A signature method, apparatus, device and medium

Abstract

The application relates to the technical field of network security, and in particular to a signature method and device, equipment and a medium. In the embodiment of the application, on the basis of obtaining a first string corresponding to request data, the first string is first divided into a first preset number of first substrings, then a shift operation is performed on each first string according to the offset corresponding to each first substring, and finally each string obtained after the shift is spliced to obtain a signature string. The complexity of the corresponding signature algorithm is higher, even if a rule-violating person with reverse experience tampers with the request data, it is impossible to think how to sign the tampered request data based on the signature algorithm of the application, therefore, the server can accurately verify whether the request data is tampered with based on whether the received signature string and the signature string calculated by the server based on the request data are consistent, and the security is higher.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a signature method and device, equipment and a medium. BACKGROUND

[0002] In order to complete a transaction, a client sends request data to a server in the process of initiating a network request to the server. If the request data is not signed and is sent directly to the server, the request data may be tampered with.

[0003] In related technologies, in order to sign the request data, a standard message digest algorithm is generally used to calculate the signature string of the request data, and then the signature string is added to the request data and forwarded to the server. The standard message digest algorithm can be MD5 (Message-digest Algorithm 5), SHA256 (Secure Hash Algorithm 256), etc. After the server receives the request data with the added signature string, it uses the same message digest algorithm to calculate another signature string of the request data excluding the signature string, and then compares the calculated signature string with the signature string sent by the client. If they are the same, it means that the request data has not been tampered with, and the transaction can proceed normally. Otherwise, it means that the request data has been tampered with, and the transaction ends.

[0004] However, when using the message digest algorithm to sign the request data, a rule-breaking person with reverse experience can guess what algorithm is used to sign the request data, and then use the same message digest algorithm to re-sign the tampered request data and generate a new signature string. At this time, the server cannot verify whether the request data has been tampered with, and thus cannot achieve the purpose of data tamper-proofing. SUMMARY

[0005] The embodiments of the present application provide a signature method, device, equipment and medium to solve the problem that the request data is signed based on the standard message digest algorithm in the prior art, and the purpose of data tamper-proofing cannot be achieved.

[0006] The embodiments of the present application provide a signature method, which comprises:

[0007] concatenating the request data into a first string, determining a second string corresponding to the request data based on a preset algorithm and the first string;

[0008] dividing the second string into a first preset number of first substrings;

[0009] According to the offset corresponding to each first substring and a preset shift rule, the first substrings are subjected to a shift operation, the substrings obtained after the shift are spliced, and a third string is obtained; the third string is added to the request data as a signature string and sent to the server.

[0010] Further, the request data is key-value form data.

[0011] The request data is spliced into a first string, including:

[0012] The characters containing all keys in the request data are converted according to a preset rule.

[0013] Each key in the converted request data is sorted according to a preset order; and for each converted key, the converted key and the value corresponding to the key are spliced to determine a substring containing the converted key.

[0014] According to the sorting result of each key, the substrings containing each converted key are spliced in turn to obtain the first string.

[0015] Further, before the request data is spliced into a first string, the method further includes:

[0016] The non-signature data contained in the request header and request body in the request data is deleted.

[0017] Further, the shift operation on each first substring according to the offset corresponding to each first substring and a preset shift rule includes:

[0018] According to the position of each first substring in the second string, the following operations are performed in order from front to back according to the position:

[0019] The current first substring is divided into a second preset number of second substrings, the sorting position of each second substring in the current first substring is determined, and the second substring corresponding to the sorting position is subjected to position exchange according to the exchange rule contained in the preset shift rule.

[0020] According to the offset corresponding to the current first substring pre-stored in the shift rule, the first substring after position exchange is shifted by the offset in a preset first direction to obtain a fourth string.

[0021] The pre-stored string is XORed with the fourth string to realize the shift operation on the current first substring.

[0022] Further, after obtaining the fourth string by shifting the first sub-string with the exchanged positions in the preset first direction by the offset corresponding to the current first sub-string preserved in advance, the method further comprises:

[0023] determining a difference offset between the preset target offset and the offset corresponding to the current first sub-string preserved in advance, and shifting the current first sub-string with the exchanged positions in the preset second direction by the difference offset to obtain a fifth string;

[0024] performing XOR operation on the fourth string and the fifth string, and updating the string obtained after the XOR operation as the fourth string.

[0025] Further, after performing the XOR operation on the string preserved in advance and the fourth string, the method further comprises:

[0026] performing XOR operation on the string preserved in advance and the fourth string to obtain a sixth string;

[0027] taking the value corresponding to the last third preset number of bits in the sixth string as the offset of the next first sub-string.

[0028] Further, before adding the third string as the signature string to the request data and sending the request data to the server, the method further comprises:

[0029] encrypting the data other than the data to be exempted from encryption in the request data based on the public key preserved in advance.

[0030] Embodiments of the present application also provide a signature device, and the device comprises:

[0031] a processing module configured to concatenate request data into a first string, and determine a second string corresponding to the request data based on a preset algorithm and the first string;

[0032] a division module configured to divide the second string into a first preset number of first sub-strings;

[0033] the processing module is further configured to perform a shifting operation on each first sub-string according to the offset corresponding to each first sub-string preserved in advance and a preset shifting rule, concatenate the sub-strings obtained after the shifting operation to obtain a third string, and add the third string as a signature string to the request data and send the request data to a server.

[0034] Further, the request data is data in the form of key-value.

[0035] The processing module is specifically configured to convert characters of all keys contained in the request data according to a preset rule; sort each key in the converted request data according to a preset order; and for each converted key, splice the converted key and a value corresponding to the key to determine a substring containing the converted key; and according to the sorting result of each key, splice the substrings containing each converted key in sequence to obtain the first string.

[0036] Further, the processing module is further configured to delete the signature-free data contained in the request header and the request body in the request data.

[0037] Further, the processing module is specifically configured to, according to positions of each first substring in the second string, perform the following operations in sequence according to an order from front to back of the positions: divide a current first substring into a second preset number of second substrings, determine an ordering position of each second substring in the current first substring, perform position exchange on the second substring corresponding to the ordering position according to an exchange rule contained in a preset shift rule, shift the first substring after the position exchange by a preset offset amount corresponding to the current first substring according to the offset amount pre-stored in the shift rule in a preset first direction to obtain a fourth string, and perform XOR operation on the pre-stored string and the fourth string to implement a shift operation on the current first substring.

[0038] Further, the processing module is further configured to determine a difference offset amount between a preset target offset amount and the offset amount pre-stored for the current first substring, shift the current first substring after the position exchange by the difference offset amount in a preset second direction to obtain a fifth string, perform XOR operation on the fourth string and the fifth string, and update the string obtained after the XOR operation as the fourth string.

[0039] Further, the processing module is further configured to perform XOR operation on the pre-stored string and the fourth string to obtain a sixth string, and take a value corresponding to a last third preset number of bits in the sixth string as an offset amount of a next first substring.

[0040] Further, the processing module is further configured to encrypt other data in the request data except the signature-free data based on a pre-stored public key.

[0041] Embodiments of the present application also provide an electronic device, which comprises a processor configured to implement the steps of the signature method according to any of the above embodiments when executing a computer program stored in a memory.

[0042] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the signature method in any one of the above.

[0043] The embodiment of the present application further provides a computer program product, which comprises computer program code, and the computer program code enables a computer to execute the steps of the signature method in any one of the above when the computer program code is run on the computer.

[0044] In the present application, according to the request data and a preset algorithm, a first string corresponding to the request data is determined, the first string is divided into a first preset number of first substrings, each first substring is subjected to a shift operation according to a preset shift rule and a preset offset corresponding to each first substring, and a second string is obtained by splicing the substrings obtained after the shift, and the second string is added to the request data as a signature string and sent to a server. In the embodiment of the present application, on the basis of the first string corresponding to the request data, the first string is first divided into a first preset number of first substrings, then each first substring is subjected to a shift operation according to the offset corresponding to each first substring, and finally each string obtained after the shift is spliced to obtain a signature string, and the complexity of the corresponding signature algorithm is higher. Even if a rule-breaking person with reverse experience tampers with the request data, it is also impossible to think how to sign the tampered request data based on the signature algorithm of the present application, and therefore the server can accurately verify whether the request data is tampered with based on whether the received signature string and the signature string calculated by the server based on the request data are consistent, and the security is also higher. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0046] Figure 1 A signature process schematic diagram provided by the embodiments of the present application;

[0047] Figure 2 A process schematic diagram of the shift operation on the current first substring provided by some embodiments of the present application;

[0048] Figure 3 A process schematic diagram of generating a signature string provided by some embodiments of the present application;

[0049] Figure 4 A schematic diagram of a signature device structure is provided for some embodiments of the present application.

[0050] Figure 5 A schematic diagram of an electronic device structure is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art belong to the scope of protection of the present application.

[0052] In order to ensure that the server can accurately determine whether the request data is tampered based on the received signature string and the signature string calculated by itself, and also improve the security of data transmission, the present application provides a signature method, device, equipment and medium.

[0053] In the present application, according to the request data and the preset algorithm, a first string corresponding to the request data is determined, the first string is divided into a first preset number of first substrings, each first substring is subjected to a shift operation according to a pre-stored offset of each first substring and a preset shift rule, and the substrings obtained after the shift are spliced to obtain a second string. The second string is added to the request data as a signature string and sent to the server.

[0054] Embodiment 1:

[0055] Figure 1 A signature process schematic diagram is provided for the embodiments of the present application, and the process includes the following steps:

[0056] S101: The request data is spliced into a first string, and a second string corresponding to the request data is determined based on a preset algorithm and the first string.

[0057] The signature method provided by the embodiments of the present application is applied to a client. The request data can be at least one of account, password, identity information and the like.

[0058] In the embodiment of the present application, in order to generate the signature string, the request data can be spliced into a first string, and then a second string corresponding to the request data can be determined based on a preset algorithm and the first string, where the preset algorithm can be a CC_MD5 algorithm, and the CC_MD5 is a function for generating an MD5 value. The second string is a fixed-length string, for example, the second string can be a 16-byte string, that is, the second string is a 128-bit string, where 1 byte = 8 bits. The second string is a 16-bit or other base string.

[0059] S102: The second string is divided into a first preset number of first substrings.

[0060] In the embodiment of the present application, in order to further avoid tampering with the signature string, after obtaining the second string, the second string is divided into a first preset number of first substrings, where the first preset number can be 2, 3, 4, etc., and the length of each first substring can be the same or different. Specifically, the first preset number and the length of each first substring can be set according to requirements.

[0061] In the embodiment of the present application, taking the second string as a 16-bit string as an example, in order to facilitate division, the 16-bit second string can be converted into a 2-bit second string, and then the 2-bit second string is divided into a first preset number of 2-bit first substrings.

[0062] Preferably, the second string is divided into four first substrings of the same length, and each first substring is a 4-byte string.

[0063] S103: According to the pre-stored offset corresponding to each first substring and the preset shift rule, each first substring is subjected to a shift operation, the substrings obtained after the shift are spliced to obtain a third string, and the third string is added to the request data as a signature string and sent to the server.

[0064] In the embodiment of the present application, in order to generate the signature string, each first substring can be subjected to a shift operation according to the pre-stored offset corresponding to each first substring and the preset shift rule, where the offset corresponding to each first substring can be the same or different. Then the substrings obtained after the shift are spliced to obtain a third string. The third string is the signature string. Finally, the signature string is added to the request data and sent to the server.

[0065] On the basis of the above examples, if the first substring is a binary string, the third string is also a binary string. In the embodiment of the present application, since the general signature string is a hexadecimal string, the binary third string can be converted into a hexadecimal third string before being added to the request data.

[0066] For ease of description, the data obtained by adding the signature string to the request data is referred to as target data. After receiving the target data sent by the client, the server calculates another signature string based on the same signature method for the data in the target data other than the signature string, that is, the request data, and then compares the calculated signature string with the signature string in the target data to determine whether the request data is tampered with.

[0067] In the embodiment of the present application, the first string corresponding to the request data is divided into a first preset number of first substrings, each first substring is shifted according to the offset corresponding to the first substring, and each string obtained after shifting is spliced to obtain the signature string. The complexity of the corresponding signature algorithm is higher. Even if a rule-breaking person with reverse experience tampers with the request data, it is impossible to think how to sign the tampered request data based on the signature algorithm of the present application. Therefore, the server can accurately verify whether the request data is tampered with based on whether the received signature string and the signature string calculated based on the request data are consistent, and the security is higher.

[0068] Embodiment 2:

[0069] In order to obtain the first string, on the basis of the above embodiment, in the embodiment of the present application, the request data is key-value form data.

[0070] The request data is spliced into a first string, including:

[0071] Converting the characters containing all keys in the request data according to a preset rule;

[0072] Sorting each key in the converted request data according to a preset order; and for each converted key, splicing the converted key and the value corresponding to the key to determine a substring containing the converted key;

[0073] According to the sorting result of each key, the substrings containing each converted key are spliced in turn to obtain the first string.

[0074] In the embodiment of the present application, the request data is in the form of key-value data, for example, when the key in the request data is user, the corresponding value can be zhangsan, and when the key in the request data is password, the corresponding value can be 1234567, and the like.

[0075] In order to splice the request data into the first substring, in the embodiment of the present application, the characters containing all keys in the request data can be converted according to a preset rule, and the preset rule can be converting the upper case characters into lower case characters, or converting the lower case characters into upper case characters, or converting the letters into numbers, and the like.

[0076] After the characters containing all keys in the request data are converted according to the preset rule, each key in the converted request data is sorted according to a preset order. Specifically, the ASCII codes corresponding to each key in the request data can be determined first, and then each key is sorted according to the order from small to large of the ASCII codes, wherein the process of determining the ASCII codes corresponding to each key is a prior art and will not be described here.

[0077] For each converted key, the converted key and the value corresponding to the key are spliced to determine a substring containing the converted key, and specifically, the converted key and the value corresponding to the key can be spliced by a certain character.

[0078] It should be noted that the converted key and the value exist in the form of key:value in the request data, and therefore, when the substring containing the converted key is determined, the converted key and the value corresponding to the key can be spliced by the character “:”, or the converted key and the value corresponding to the key can be spliced by other characters, wherein the other characters can be “=”, and the like. For example, when the key is user and the corresponding value is zhangsan, the substring containing the converted key can be user=zhangsan.

[0079] For each converted key, after determining the substring containing the converted key, the substring containing each converted key can be spliced in turn according to the sorting result of each key to obtain the first string. Specifically, for the substrings of two adjacent converted keys in the sorting result, the two adjacent converted key substrings are spliced by a certain character, where the character can be "&" and the like. For example, for the request data with the key user and the value zhangsan, and the request data with the key password and the value 1234567, if the sorting result of user is before that of password, the first string can be user=zhangsan&password=1234567.

[0080] Embodiment 3

[0081] To improve security, on the basis of the above embodiments, in the embodiment of the present application, before the request data is spliced into the first string, the method further comprises:

[0082] The signature-free data contained in the request header and the request body in the request data is deleted.

[0083] If the signature is performed on part of the data in the request data, the violator cannot know which part of the data in the request data is signed based on the target data after receiving the target data, so the security can be further improved. In the embodiment of the present application, some signature-free data can be pre-stored in the client, and the signature-free data contained in the request data is deleted before the request data is spliced into the first string. Specifically, the signature-free data contained in the request header and the request body in the request data is deleted.

[0084] The signature-free data can be sent by the server to the client, or pre-configured in the server and the client. Which data is signature-free data is pre-set and known.

[0085] In the embodiment of the present application, the signature-free data contained in the request data is deleted before the request data after deletion is signed, so the violator cannot guess which part of the data in the request data is signed, the security is higher, and after the server receives the target data, the request data cannot be signed by the violator based on the signature method of the present application, so the request data can be more accurately determined whether it is tampered.

[0086] Embodiment 4

[0087] In order to perform the shifting operation on each first substring, based on the above embodiments, in the embodiments of the present application, the shifting operation on each first substring according to the pre-stored offset corresponding to each first substring and the preset shifting rule includes:

[0088] According to the position of each first substring in the second string, in the order from front to back, the following operations are performed in sequence:

[0089] The current first substring is divided into a second preset number of second substrings, the sorting position of each second substring in the current first substring is determined, and the third string corresponding to the sorting position is positionally exchanged according to the exchange rule included in the preset shifting rule;

[0090] According to the offset corresponding to the current first substring saved in the shifting rule, the first substring after position exchange is shifted by the offset in a preset first direction, and a fourth string is obtained;

[0091] The pre-stored string is XORed with the fourth string to implement the shifting operation on the current first substring.

[0092] In the embodiments of the present application, in order to generate the third string, that is, the signature string, when performing the shifting operation on each first substring according to the pre-stored offset corresponding to each first substring and the preset shifting rule, the operation shown in Figure 2 may be performed in sequence for each second string according to the position of each first substring in the second string in the order from front to back, wherein Figure 2 is a process diagram provided by some embodiments of the present application for performing the shifting operation on the current first substring.

[0093] S201: The current first substring is divided into a second preset number of second substrings.

[0094] The second preset number can be 2, 3, etc., and the length of each second substring can be the same or different. Specifically, the second preset number and the length of each second substring can be set according to requirements.

[0095] For example, if the current first substring is A1A2A3A4A5A6, the second preset number is 2, and the second preset number of second substrings can be A1A2A3 and A4A5A6 respectively. If the second preset number is 3, the second preset number of second substrings can be A1A2, A3A4 and A5A6 respectively.

[0096] Preferably, the second preset number is 4, each second substring has the same length, and adjacent second substrings do not overlap.

[0097] S202: Determine the order position of each second substring in the current first substring, and perform position exchange on the second substring corresponding to the order position according to the exchange rule contained in the preset shift rule.

[0098] In the embodiment of the present application, the positions of each second substring in the current first substring are different, in order to facilitate position exchange, the order position of each second substring in the current first substring can be determined according to the positional relationship of each second substring in the current first substring, wherein the order positions of different second substrings are different.

[0099] For example, the current first substring is A1A2A3A4A5A6, if the current first substring is divided into two second substrings A1A2A3 and A4A5A6, and the position of the second substring A1A2A3 is before the position of the second substring A4A5A6, then the order position of the second substring A1A2A3 can be determined as the first position, and the order position of the second substring A4A5A6 can be determined as the second position.

[0100] After determining the order position of each second substring in the current first substring, the third substring corresponding to the order position can be exchanged in position according to the preset exchange rule, wherein the preset exchange rule can be to exchange the second substrings at two set positions, for example, to exchange the second substring at the first position with the second substring at the third position, the preset exchange rule can also be to exchange the second substring at the position behind the order position to the position of the second substring at the position in front of the order position for any two positionally adjacent second substrings, and the like, and specifically, the preset exchange rule can be set according to requirements.

[0101] S203: According to the offset corresponding to the current first substring pre-stored in the shift rule, shift the first substring after position exchange in a preset first direction by the offset to obtain a fourth substring.

[0102] In the embodiments of the present application, the second substring corresponding to the sorting position is subjected to position interchanging according to a preset interchanging rule, and a first interchanged substring is obtained. Then, the first interchanged substring is offset. Specifically, the client pre-stores an offset corresponding to the current first substring. When the first interchanged substring is offset based on the offset corresponding to the current first substring, the first interchanged substring is shifted by the offset in a preset first direction, and a fourth string is obtained. The offset can be 2 characters, 3 characters, etc. Specifically, the offset can be set according to requirements, and the offsets corresponding to different first substrings can be the same or different. The preset first direction can be a left direction or a right direction.

[0103] It should be noted that for different clients, the offsets corresponding to the respective first substrings pre-stored in the client are generated by the server and sent to the client. In order to further improve security, the offsets corresponding to the respective first substrings sent by the server to the client can be different from the offsets corresponding to the respective first substrings sent to other clients.

[0104] Since in the embodiments of the present application, the offsets corresponding to the respective first substrings corresponding to different clients are different, the signature strings generated by different clients for the same request data can be different, the security is higher, and the irregular personnel cannot know the offsets corresponding to the respective first substrings corresponding to the respective clients. Therefore, it is more difficult to restore the signature string obtained by signing the request data. After the server receives the target data, it can more accurately determine whether the request data is tampered with.

[0105] S204: XORing the pre-stored string with the fourth string to implement the shifting operation on the current first substring.

[0106] In the embodiments of the present application, after the first interchanged substring is offset to obtain the fourth string, in order to improve the complexity of the signature and improve the security, the pre-stored string can be XORed with the fourth string to implement the shifting operation on the current first substring. The length of the pre-stored string is the same as that of the fourth string, and the pre-stored string can be set according to requirements.

[0107] In order to further improve the complexity of the signature, on the basis of the above embodiments, in the embodiments of the present application, after the first interchanged substring is shifted by the offset corresponding to the pre-stored current first substring in the preset first direction to obtain the fourth string, the method further comprises:

[0108] determining a difference offset between the preset target offset and the offset corresponding to the current first substring, and shifting the position-interchanged current first substring in a preset second direction by the difference offset to obtain a fifth substring;

[0109] performing XOR operation on the fourth substring and the fifth substring, and updating the obtained substring after the XOR operation as the fourth substring.

[0110] In the embodiments of the present application, in order to further improve the complexity of the signature and improve the security, after the position-interchanged first substring is shifted in the preset first direction by the offset corresponding to the current first substring, the fourth substring is obtained, the difference offset between the preset target offset and the offset corresponding to the current first substring is determined, for example, the preset target offset is 32 characters, the offset corresponding to the current first substring is 5, and the difference offset is 27. Then, the position-interchanged current first substring is shifted in a preset second direction by the difference offset to obtain a fifth substring, wherein the preset second direction can be a left direction or a right direction.

[0111] After the fifth substring is obtained, the fourth substring and the fifth substring are subjected to XOR operation, and the obtained substring after the XOR operation is updated as the fourth substring.

[0112] In order to further improve the complexity of the signature, on the basis of the above-mentioned embodiments, in the embodiments of the present application, after the pre-stored string and the fourth substring are subjected to XOR operation, the method further comprises:

[0113] performing XOR operation on the pre-stored string and the fourth substring to obtain a sixth substring;

[0114] taking the value corresponding to the last third preset number of bits of the sixth substring as the offset of the next first substring.

[0115] In the embodiments of the present application, in order to further improve the complexity of the signature, the pre-stored string and the fourth string are first subjected to the XOR operation, then the value corresponding to the last third preset number of bits in the sixth string obtained after the XOR operation is determined, and finally the value is taken as the offset of the next first substring, that is, the current pre-stored string and the fourth string determined by the shifting operation on the current substring are subjected to the XOR operation to obtain the sixth string, and then the value corresponding to the last third preset number of bits in the sixth string is updated as the offset corresponding to the next first substring. The third preset number can be 3, 4, etc. Specifically, the third preset number can be set according to requirements.

[0116] In the shifting operation on the next first substring, the next first string is first updated as the current first substring, then the updated current first string is divided into a second preset number of second substrings, the sorting position of each second substring in the current first substring is determined, the second substrings corresponding to the sorting positions are subjected to position exchange according to the exchange rule contained in the preset shifting rule, then the first substrings subjected to the position exchange are shifted in the preset first direction by the updated offset corresponding to the current first substring, to obtain a fourth string, and finally the pre-stored string and the fourth string are subjected to the XOR operation to implement the shifting operation on the current first substring.

[0117] Since in the embodiments of the present application, for each other second substring except the first substring with the highest sorting position, the offset corresponding to the other first substring is related to the sixth string corresponding to the first substring in the previous position, and generally the offset corresponding to each other first substring is different, the complexity of the signature is improved, and after the server receives the target data, it can more accurately determine whether the request data is tampered with. In the case where the server determines that the request data is leaked, the offsets corresponding to the first substrings can also be dynamically changed to ensure the security of the subsequent network request process.

[0118] Figure 3 A process diagram for generating a signature string is provided for some embodiments of the present application, which will now be described with respect to Figure 3

[0119] ​The client first obtains the signature-free data sent by the server and the offset corresponding to each first substring, then initiates a network request, and formats the request data into a standard string to be signed, that is, converts the uppercase characters in the characters containing all keys in the request data into lowercase characters, determines the ASCII corresponding to each key for the converted request data, sorts each key in ascending order of the ASCII corresponding to each key, and splices the converted key and the value corresponding to the key for each converted key to determine a substring containing the converted key, splices the substrings containing each converted key in turn according to the sorting result of each key, obtains a first string, determines a second string corresponding to the request data based on the CC_MD5 algorithm and the first string, and the second string is the standard string.

[0120] Then, based on the signature algorithm defined in the embodiments of the present application and the generated standard string, a signature string is generated. Specifically, the second string is divided into a first preset number of first substrings, then each first substring is subjected to a shift operation according to the pre-stored offset corresponding to each first substring and a preset shift rule, the substrings obtained after the shift are spliced to obtain a third string, and the third string is also the signature string.

[0121] Embodiment 5

[0122] To improve the security of the request data, on the basis of each of the above embodiments, in the embodiments of the present application, before the third string is added to the request data as a signature string and sent to the server, the method further includes:

[0123] Encrypting other data in the request data except the encryption-free data based on a pre-stored public key.

[0124] In the embodiments of the present application, to improve the security of the request data, in one possible implementation, the request data can be encrypted based on a pre-stored public key, and the server subsequently decrypts the request data in the target data based on a private key corresponding to the public key to obtain the request data after receiving the target data. Specifically, the request data can be encrypted using a public key based on RSA or Advanced Encryption Standard (AES) algorithm.

[0125] However, due to the problem of public key leakage, after the public key is leaked, the request data after tampering can be re-encrypted using the public key, so as to cheat the server and tamper with the request data. Secondly, if the whole message is encrypted, that is, all data in the request data is encrypted, there is a performance problem, which will slow down the request response speed, and also affect the monitoring of sensitive words by the monitoring system.

[0126] Therefore, in another possible implementation, the other data in the request data except the exempted encryption data can also be encrypted based on the pre-stored public key according to the pre-stored exempted encryption data. Specifically, the request header and the other data in the request body except the exempted encryption data in the request data are encrypted according to the pre-stored public key.

[0127] Embodiment 6

[0128] Figure 4 A signature device structure schematic diagram provided for some embodiments of the application, the device comprises:

[0129] The processing module 401 is configured to splice the request data into a first string, determine a second string corresponding to the request data based on a preset algorithm and the first string.

[0130] The division module 402 is configured to divide the second string into a first preset number of first substrings.

[0131] The processing module 401 is further configured to perform a shift operation on each first substring according to a pre-stored offset of each first substring and a preset shift rule, splice the substrings obtained after the shift operation to obtain a third string, and add the third string as a signature string to the request data and send it to the server.

[0132] In a possible implementation, the request data is key-value form data.

[0133] The processing module 401 is specifically configured to convert characters containing all keys in the request data according to a preset rule, sort each key in the converted request data according to a preset order, splice the converted key and the value corresponding to the key for each converted key to determine a substring containing the converted key, and splice the substrings containing each converted key in turn according to the sorting result of each key to obtain the first string.

[0134] In a possible implementation, the processing module 401 is further configured to delete exempted signature data contained in the request header and the request body in the request data.

[0135] In one possible implementation, the processing module 401 is specifically configured to perform the following operations sequentially according to the positions of each first substring in the second string, in order from front to back: dividing the current first substring into a second preset number of second substrings; determining the sorting position of each second substring in the current first substring; swapping the positions of the second substrings at corresponding sorting positions according to the swapping rules included in the preset shifting rules; shifting the swapped first substrings in a preset first direction by the offset amount corresponding to the current first substring in the shifting rules, to obtain a fourth string; and performing an XOR operation between the pre-saved string and the fourth string to realize the shifting operation of the current first substring.

[0136] In one possible implementation, the processing module 401 is further configured to determine the difference offset between the preset target offset and the offset corresponding to the pre-saved current first substring, shift the current first substring after position swapping by the difference offset in a preset second direction to obtain a fifth string; perform an XOR operation on the fourth string and the fifth string, and update the string obtained after the XOR operation to the fourth string.

[0137] In one possible implementation, the processing module 401 is further configured to perform an XOR operation between the pre-saved string and the fourth string to obtain a sixth string;

[0138] The value corresponding to the third preset number of positions in the sixth string is used as the offset of the next first substring.

[0139] In one possible implementation, the processing module 401 is further configured to encrypt other data in the request data, excluding the data that is not required to be encrypted, based on a pre-saved public key.

[0140] Example 7:

[0141] Based on the above embodiments, this application also provides an electronic device. Figure 5 This application provides a schematic diagram of an electronic device structure, such as... Figure 5 As shown, it includes: processor 501, communication interface 502, memory 503 and communication bus 504, wherein processor 501, communication interface 502 and memory 503 communicate with each other through communication bus 504.

[0142] The memory 503 stores a computer program. When the program is executed by the processor 501, the processor 501 performs the following steps:

[0143] concatenate the request data into a first string, determine a second string corresponding to the request data based on a preset algorithm and the first string;

[0144] divide the second string into a first preset number of first substrings;

[0145] perform a shifting operation on each first substring according to a preset shifting rule and a previously saved offset of each first substring, concatenate the substrings obtained after shifting to obtain a third string, and add the third string as a signature string to the request data and send it to a server.

[0146] In a possible implementation, the request data is key-value form data.

[0147] The processor 501 is specifically configured to convert characters containing all keys in the request data according to a preset rule, sort each key in the converted request data according to a preset order, and concatenate the converted key and the value corresponding to the key for each converted key to determine a substring containing the converted key, and sequentially concatenate substrings containing each converted key according to the sorting result of each key to obtain the first string.

[0148] In a possible implementation, the processor 501 is further configured to delete non-signature data contained in the request header and request body in the request data.

[0149] In a possible implementation, the processor 501 is specifically configured to sequentially perform the following operations according to the position of each first substring in the second string from front to back: divide the current first substring into a second preset number of second substrings, determine the sorting position of each second substring in the current first substring, perform position exchange on the second substring corresponding to the sorting position according to an exchange rule contained in the preset shifting rule, shift the first substring after position exchange in a preset first direction by the offset corresponding to the current first substring saved in the shifting rule to obtain a fourth string, and perform XOR operation on the previously saved string and the fourth string to implement the shifting operation on the current first substring.

[0150] In a possible implementation, the processor 501 is further configured to determine a difference offset between the preset target offset and a previously stored offset corresponding to the current first substring, shift the current first substring after the position exchange by the difference offset in a preset second direction to obtain a fifth string, and perform XOR operation on the fourth string and the fifth string, and update the string obtained after the XOR operation as the fourth string.

[0151] In a possible implementation, the processor 501 is further configured to perform XOR operation on the previously stored string and the fourth string to obtain a sixth string, and take a value corresponding to a last third preset number of bits in the sixth string as an offset of a next first substring.

[0152] In a possible implementation, the processor 501 is further configured to encrypt other data in the request data except the data to be encrypted based on a previously stored public key.

[0153] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0154] The communication interface 502 is configured to perform communication between the above electronic device and other devices. The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), for example, at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0155] The processor mentioned above can be a general-purpose processor, including a central processing unit, a network processing unit (NP), etc.; can also be a Digital Signal Processing (DSP) processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0156] Embodiment 8:

[0157] On the basis of the above embodiments, the embodiment of the application further provides a computer readable storage medium, the computer readable storage medium storing a computer program executable by a processor, when the program runs on the processor, the processor executes the following steps:

[0158] concatenate the request data into a first string, determine a second string corresponding to the request data based on a preset algorithm and the first string;

[0159] divide the second string into a first preset number of first substrings;

[0160] perform a shift operation on each first substring according to a pre-stored offset of each first substring and a preset shift rule, concatenate the substrings obtained after the shift operation to obtain a third string, and add the third string as a signature string to the request data and send it to the server.

[0161] Further, the request data is key-value form data;

[0162] The request data is concatenated into a first string, which includes:

[0163] convert the characters containing all keys in the request data according to a preset rule;

[0164] sort each key in the converted request data according to a preset order, and concatenate the converted key and the value corresponding to the key for each converted key to determine the substring containing the converted key;

[0165] According to the sorting result of each key, the substrings containing each converted key are sequentially concatenated to obtain the first string.

[0166] Further, before the request data is concatenated into a first string, the method further includes:

[0167] delete the signature-free data contained in the request header and request body in the request data.

[0168] Further, the shift operation on each first substring according to the pre-stored offset of each first substring and the preset shift rule includes:

[0169] According to the position of each first substring in the second string, the following operations are sequentially performed in the order from front to back:

[0170] divide the current first substring into a second preset number of second substrings, determine the sorting position of each second substring in the current first substring, and perform position exchange on the second substring corresponding to the sorting position according to an exchange rule included in a preset shift rule;

[0171] shift the first substring after the position exchange by a preset offset amount corresponding to the current first substring according to the shift rule, to obtain a fourth substring;

[0172] perform XOR operation on the fourth substring and the previously saved string to implement the shift operation on the current first substring.

[0173] Further, after the step of shifting the first substring after the position exchange by the preset offset amount corresponding to the current first substring according to the previously saved offset amount, the method further includes:

[0174] determine a difference offset amount between a preset target offset amount and the offset amount corresponding to the current first substring, and shift the current first substring after the position exchange by the difference offset amount in a preset second direction to obtain a fifth substring;

[0175] perform XOR operation on the fourth substring and the fifth substring, and update the obtained string after the XOR operation as the fourth substring.

[0176] Further, after the step of performing XOR operation on the previously saved string and the fourth substring, the method further includes:

[0177] perform XOR operation on the previously saved string and the fourth substring to obtain a sixth substring;

[0178] take the value corresponding to the last third preset number of bits in the sixth substring as the offset amount of the next first substring.

[0179] Further, before the step of adding the third substring as the signature string to the request data and sending the request data to the server, the method further includes:

[0180] encrypt other data in the request data except the data to be exempted from encryption based on a previously saved public key.

[0181] Embodiment 9:

[0182] The application also provides a computer program product, which, when executed by a computer, implements the signature method described in any of the method embodiments applied to an electronic device.

[0183] In the embodiments described above, all or part can be implemented by software, hardware, firmware or any combination thereof, and can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions, which, when loaded and executed on a computer, generate all or part of the processes or functions described in the embodiments of the present application.

[0184] In the embodiments of the present application, on the basis of obtaining the first string corresponding to the request data, the first string is first divided into a first preset number of first substrings, then a shift operation is performed on each first string respectively according to the offset corresponding to each first substring, and finally each string obtained after the shift is spliced to obtain a signature string. The complexity of the corresponding signature algorithm is higher, even if the reverse experience of the violator is tampered with the request data, it is impossible to think how to sign the tampered request data based on the signature algorithm of the present application, therefore, the server can also accurately verify whether the request data is tampered with based on whether the received signature string and the signature string calculated by the server based on the request data are consistent, and the security is also higher.

[0185] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0186] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems) and computer program products of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the computer or other programmable data processing device produce a device that implements the functions specified in the flowchart and / or block diagram. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The functions specified in one or more flows and / or blocks

[0187] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0188] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0189] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A signature method, characterized in that, The method includes: The request data is concatenated into a first string, and a second string corresponding to the request data is determined based on a preset algorithm and the first string. Divide the second string into a first preset number of first substrings; Based on the pre-saved offsets corresponding to each first substring and the preset shift rules, the first substrings are shifted, and the substrings obtained after shifting are concatenated to obtain the third string; the third string is added as a signature string to the request data and sent to the server. The step of shifting each first substring according to the pre-saved offsets and preset shift rules includes: according to the position of each first substring in the second string, performing the following operations in order from front to back: The current first substring is divided into a second preset number of second substrings. The sorting position of each second substring in the current first substring is determined. According to the swapping rules included in the preset shifting rules, the second substrings at the corresponding sorting positions are swapped. According to the offset corresponding to the current first substring that is pre-saved in the shifting rules, the first substring after the position swap is shifted by the offset in the preset first direction to obtain the fourth string. Determine the difference between the preset target offset and the pre-saved offset corresponding to the current first substring, shift the current first substring (after swapping positions) by the difference offset in the preset second direction to obtain the fifth string; perform an XOR operation on the fourth string and the fifth string, and use the string obtained after the XOR operation as the updated fourth string; Perform an XOR operation between the pre-saved string and the updated fourth string to obtain the substring obtained after the shift.

2. The method according to claim 1, characterized in that, The requested data is in key-value format; The step of concatenating the request data into the first string includes: The request data contains all the characters of the key, which are then converted according to a preset rule. Sort each key in the converted request data according to a preset order; and for each converted key, concatenate the converted key and its corresponding value to determine a substring containing the converted key. Based on the sorting results of each key, the substrings containing each converted key are concatenated sequentially to obtain the first string.

3. The method according to claim 1, characterized in that, Before concatenating the request data into the first string, the method further includes: Delete the request header and the unsigned data contained in the request body from the request data.

4. The method according to claim 1, characterized in that, After performing an XOR operation between the pre-saved string and the fourth string, the method further includes: Perform an XOR operation between the pre-saved string and the fourth string to obtain the sixth string; The value corresponding to the third preset number of positions in the sixth string is used as the offset of the next first substring.

5. The method according to claim 1, characterized in that, Before adding the third string as a signature string to the request data and sending it to the server, the method further includes: Encrypt all data in the requested data except for the data that is not required to be encrypted, based on a pre-saved public key.

6. A signature device, characterized in that, The device includes: The processing module is used to concatenate the request data into a first string, and determine the second string corresponding to the request data based on a preset algorithm and the first string; A partitioning module is used to divide the second string into a first preset number of first substrings; The processing module is further configured to perform a shift operation on each first substring according to the pre-saved offset of each first substring and the preset shift rules, concatenate the substrings obtained after shifting to obtain a third string, and add the third string as a signature string to the request data and send it to the server. The processing module is specifically configured to perform the following operations sequentially, based on the positions of each first substring within the second string and in order from front to back: Divide the current first substring into a second preset number of second substrings; determine the sorting position of each second substring within the current first substring; swap the positions of the second substrings at corresponding sorting positions according to the swapping rules included in the preset shifting rules; shift the swapped first substrings in a preset first direction by the pre-saved offset corresponding to the current first substring in the shifting rules, obtaining a fourth string; determine the difference between the preset target offset and the pre-saved offset corresponding to the current first substring, shifting the swapped current first substring in a preset second direction by the difference offset, obtaining a fifth string; perform an XOR operation on the fourth string and the fifth string, and use the resulting string as the updated fourth string; perform an XOR operation on the pre-saved string and the updated fourth string to obtain the shifted substring.

7. The apparatus according to claim 6, characterized in that, The requested data is in key-value format; The processing module is specifically used to convert all the characters of the key in the request data according to a preset rule; and to sort each key in the converted request data according to a preset order. For each converted key, the converted key and its corresponding value are concatenated to determine the substring containing the converted key. Based on the sorting results of each key, the substrings containing each converted key are concatenated sequentially to obtain the first string.

8. The apparatus according to claim 6, characterized in that, The processing module is also used to delete the request header and the unsigned data contained in the request body of the request data.

9. The apparatus according to claim 6, characterized in that, The processing module is also used to perform an XOR operation between the pre-saved string and the fourth string to obtain the sixth string; The value corresponding to the third preset number of positions in the sixth string is used as the offset of the next first substring.

10. The apparatus according to claim 6, characterized in that, The processing module is also used to encrypt other data in the request data, excluding the data that is not required to be encrypted, based on a pre-saved public key.

11. An electronic device, characterized in that, The electronic device includes a processor that executes a computer program stored in a memory to implement the steps of the signature method as described in any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the signature method as described in any one of claims 1-5.

13. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the steps of the signature method as described in any one of claims 1-5.

Images