Data transmission method, apparatus and computer readable storage medium

Abstract

The application discloses a data transmission method and device and a computer readable storage medium, wherein the method comprises: obtaining target data to be sent; determining service entity data in the target data, and determining a dynamic salt value according to the service entity data; and performing confusion on the target data based on the dynamic salt value to obtain signature information, and sending the signature information and the target data to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information. The application aims to improve the security of data transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of secure transmission, in particular to a data transmission method, device and computer readable storage medium. BACKGROUND

[0002] In cross-border financial transactions, in order to protect the integrity of the data transmission process between the front-end device and the back-end device, it is mainly divided into front-end device reinforcement and back-end device reinforcement. The front-end device sends signature information to the back-end device, and the back-end device receives the signature information, verifies the signature information, and determines whether the protected data is tampered with. If it is tampered with, the operation of the protected data is stopped, thereby protecting the security of data transmission. In related technologies, a fixed static salt value is generally carried in the signature information, and the verification result of the signature information is determined by comparing the pre-stored salt value with the static salt value to determine the security of the protected data. However, the static salt value is easy to be leaked or cracked, resulting in low security of data transmission.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide a data transmission method, device and computer readable storage medium, which aims to improve the security of data transmission.

[0005] To achieve the above purpose, the present application provides a data transmission method, which comprises:

[0006] Obtaining target data to be sent;

[0007] Determining the business entity data in the target data, and determining the dynamic salt value according to the business entity data;

[0008] Based on the dynamic salt value, the target data is confused to obtain signature information, and the signature information and the target data are sent to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information.

[0009] Optionally, before the step of determining the business entity data in the target data, it further comprises:

[0010] Determining whether the target data meets the dynamic salt value enabling condition;

[0011] When the dynamic salt value enabling condition is met, the step of determining the business entity data in the target data is executed;

[0012] When the dynamic salt value enabling condition is not met, a preset salt value is obtained;

[0013] obtaining static signature information based on the preset salt value, and sending the static signature information and the target data to a data receiving end, so that the data receiving end determines the integrity of the target data according to the static signature information.

[0014] Optionally, the step of determining whether the target data satisfies the dynamic salt value enabling condition comprises:

[0015] obtaining a target data type corresponding to the dynamic salt value;

[0016] determining whether a data type in the target data includes the target data type;

[0017] when the target data type is included, determining that the target data satisfies the dynamic salt value enabling condition.

[0018] Optionally, the step of obtaining the target data type corresponding to the dynamic salt value comprises:

[0019] determining a service type of the target data;

[0020] determining the target data type according to the service type.

[0021] Optionally, the step of obtaining signature information based on the dynamic salt value and the target data comprises:

[0022] obtaining an address of the data receiving end;

[0023] determining a relative composition position of the target data and the dynamic salt value according to the address;

[0024] combining the dynamic salt value and the target data according to the relative composition position, and obtaining the signature information by obfuscating a combination result.

[0025] Optionally, the step of determining the relative composition position of the target data and the dynamic salt value according to the address comprises:

[0026] performing parity judgment on the address;

[0027] determining that the relative composition position is in front of or behind the dynamic salt value according to a result of the parity judgment.

[0028] Optionally, the method further comprises:

[0029] receiving to-be-verified signature information and to-be-verified data sent by a data sending end;

[0030] determine a verification salt value based on service entity data in the to-be-verified data;

[0031] obfuscate the to-be-verified data based on the verification salt value to obtain verification signature information;

[0032] when the verification signature information matches the to-be-verified signature information, perform a corresponding operation of the to-be-verified data.

[0033] Optionally, the step of determining the verification salt value based on the service entity data in the to-be-verified data comprises:

[0034] when a dynamic salt value enabling condition is met, determine a service type of the to-be-verified data, determine a target data type according to the service type, and generate the verification salt value according to service entity data corresponding to the target data type in the to-be-verified data;

[0035] when the dynamic salt value enabling condition is not met, use a preset salt value as the verification salt value.

[0036] In addition, to achieve the above object, the present application also provides a data transmission device, which comprises a memory, a processor, and a data transmission program stored in the memory and executable on the processor, and the data transmission program implements the steps of the data transmission method when executed by the processor.

[0037] In addition, to achieve the above object, the present application also provides a computer readable storage medium, which stores a data transmission program, and the data transmission program implements the steps of the data transmission method when executed by a processor.

[0038] The method first acquires target data to be sent, determines service entity data in the target data, and determines a dynamic salt value according to the service entity data; obfuscates the target data based on the dynamic salt value to obtain signature information, and sends the signature information and the target data to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information. In this way, the dynamic salt value is determined based on the service entity data in the target data to be sent, and the target data is obfuscated based on the dynamic salt value to obtain the signature information, so that the signature information has dynamicity and business relevance. The dynamic salt value determined based on the service entity data is more difficult to be cracked than a static salt value, and is difficult to be forged. The signature information and the target data are sent as transmission contents to the data receiving end, so that the data receiving end can determine the integrity of the target data according to the signature information, determine whether the target data is tampered in the transmission process, and thus improve the security of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1is a terminal structure schematic diagram of a hardware running environment related to an embodiment of the present application;

[0040] Figure 2 is a flowchart of an embodiment of the data transmission method of the present application;

[0041] Figure 3 is a flowchart of another embodiment of the data transmission method of the present application;

[0042] Figure 4 is a schematic diagram of an application scenario related to an embodiment of the present application.

[0043] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0044] It should be understood that the specific embodiments described herein are merely intended to explain the present application and not to limit the present application.

[0045] In the related art, a fixed static salt value is generally carried in the signature information, and the verification result of the signature information is determined by comparing the pre-stored salt value with the static salt value to determine the security of the protected data. However, the static salt value is easily leaked or cracked, resulting in low security of data transmission.

[0046] In order to improve the security of data transmission, an embodiment of the present application proposes a data transmission method, device and computer readable storage medium, wherein the main steps of the method include:

[0047] Obtaining target data to be sent;

[0048] Determining service entity data in the target data, and determining a dynamic salt value according to the service entity data;

[0049] Based on the dynamic salt value, the target data is obfuscated to obtain signature information, and the signature information and the target data are sent to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information.

[0050] In this way, the dynamic salt value is determined based on the service entity data in the target data to be sent, and the target data is obfuscated based on the dynamic salt value to obtain the signature information, so that the signature information has dynamic and business relevance. The dynamic salt value determined based on the service entity data is more difficult to crack than the static salt value and is difficult to be forged. The signature information and the target data are sent as transmission content to the data receiving end, so that the data receiving end can determine the integrity of the target data according to the signature information, determine whether the target data is tampered with in the transmission process, and thus improve the security of data transmission.

[0051] The application will be described in detail below with reference to the accompanying drawings.

[0052] As shown in Figure 1 , Figure 1 is a terminal structure diagram of a hardware running environment involved in an embodiment of the application.

[0053] The terminal of the embodiment of the application can be a data transmission device.

[0054] As shown in Figure 1 , the terminal can include a processor 1001, such as a CPU, a memory 1003, and a communication bus 1002. The communication bus 1002 is used to realize the connection and communication between the components. The memory 1003 can be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1003 can also be a storage device independent of the aforementioned processor 1001.

[0055] Those skilled in the art can understand that Figure 1 the terminal structure shown in the above does not constitute a limitation on the terminal, and can include more or fewer components than the diagram, or combine certain components, or different component arrangements.

[0056] As shown in Figure 1 , the memory 1003, as a computer storage medium, can include an operating system and a data transmission program.

[0057] In the terminal shown in Figure 1 , the processor 1001 can be used to call the data transmission program stored in the memory 1003 and perform the following operations:

[0058] obtain target data to be sent;

[0059] determine service entity data in the target data, and determine a dynamic salt value according to the service entity data;

[0060] obfuscate the target data based on the dynamic salt value, obtain signature information, and send the signature information and the target data to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information.

[0061] Further, the processor 1001 can call the data transmission program stored in the memory 1003 and further perform the following operations:

[0062] determine whether the target data satisfies a dynamic salt value enabling condition;

[0063] When the dynamic salt value enabling condition is met, the step of determining the business entity data in the target data is performed;

[0064] When the dynamic salt value enabling condition is not met, a preset salt value is obtained;

[0065] The target data is obfuscated based on the preset salt value, static signature information is obtained, and the static signature information and the target data are sent to a data receiving end, so that the data receiving end determines the integrity of the target data according to the static signature information.

[0066] Further, the processor 1001 can call the data transmission program stored in the memory 1003, and further perform the following operations:

[0067] The target data type corresponding to the dynamic salt value is obtained;

[0068] It is determined whether the data type in the target data includes the target data type;

[0069] When the target data type is included, it is determined that the target data meets the dynamic salt value enabling condition.

[0070] Further, the processor 1001 can call the data transmission program stored in the memory 1003, and further perform the following operations:

[0071] The business type of the target data is determined;

[0072] The target data type is determined according to the business type.

[0073] Further, the processor 1001 can call the data transmission program stored in the memory 1003, and further perform the following operations:

[0074] The address of the data receiving end is obtained;

[0075] The relative composition position of the target data and the dynamic salt value is determined according to the address;

[0076] The dynamic salt value and the target data are combined according to the relative composition position, and the combination result is obfuscated to obtain the signature information.

[0077] Further, the processor 1001 can call the data transmission program stored in the memory 1003, and further perform the following operations:

[0078] The address is determined to be even or odd;

[0079] According to the result of the parity judgment, it is determined that the relative composition position is in front of or behind the target data in the dynamic salt value.

[0080] Further, the processor 1001 can invoke the data transmission program stored in the memory 1003, and further perform the following operations:

[0081] receive the to-be-verified signature information and the to-be-verified data sent by the data sending end;

[0082] determine a verification salt value based on the service entity data in the to-be-verified data;

[0083] obfuscate the to-be-verified data based on the verification salt value to obtain verification signature information;

[0084] when the verification signature information matches the to-be-verified signature information, perform the operation corresponding to the to-be-verified data.

[0085] Further, the processor 1001 can invoke the data transmission program stored in the memory 1003, and further perform the following operations:

[0086] when the dynamic salt value enabling condition is met, determine the business type of the to-be-verified data, determine the target data type according to the business type, and generate the verification salt value according to the service entity data corresponding to the target data type in the to-be-verified data;

[0087] when the dynamic salt value enabling condition is not met, use a preset salt value as the verification salt value.

[0088] The following will explain the content claimed in the claims of the present application by specific exemplary schemes, so that those skilled in the art can better understand the protection scope of the claims of the present application. It can be understood that the following exemplary schemes do not limit the protection scope of the present application, but only serve to explain the present application.

[0089] Exemplarily, with reference to Figure 2 In an embodiment of the data transmission method of the present application, the data transmission method comprises the following steps:

[0090] Step S10, obtaining target data to be sent;

[0091] In this embodiment, in the cross-border financial service scenario, the front-end device sends a user's financial service request to the back-end device, and the back-end device completes the financial service corresponding to the request, and then sends the response after processing the financial service to the front-end device, and the front-end device outputs the response and displays it to the user.

[0092] The data transmission method provided in this embodiment can be applied to a data transmission device, and the data transmission device is arranged in the cross-border financial service scenario front-end device and / or back-end device, and is used to process data communication between the front-end device and the back-end device.

[0093] The front-end device is a user-oriented interface device, the front-end device sends a triggered service request to the back-end device, the back-end device is a device based on the service request, and the original data in the service request is processed according to the service request. The back-end device can also send response information to the front-end device after the service processing is completed. The front-end device and the back-end device can send data to each other, and in the process of sending data, the data security needs to be ensured. For example, when the front-end device and the back-end device belong to a financial scenario, the user sends a payment request to the back-end device through the front-end device, and the back-end device can complete the payment service based on the payment request after verifying the integrity of the payment account, the payment account, the payment amount, the order number and other data in the payment request.

[0094] If the data transmission device is arranged in the front-end device, the target data to be sent can be a request sent by the front-end device to the back-end device, and if the data transmission device is arranged in the back-end device, the target data to be sent can be a response sent by the back-end device to the front-end device.

[0095] Optionally, since the front-end device and the back-end device can send data to each other, the data transmission device is arranged on the front-end device and the back-end device, and the data transmission method provided in the embodiment is used to encrypt the data to be sent by the front-end device and the back-end device to each other, and the security of the front-end device, the back-end device and the transmission process is emphasized, so as to protect the security of the whole service system in all directions. Taking this application scenario as an example: the data transmission device is uniformly installed in the front-end device and the back-end device, the front-end device first intercepts all request information to be sent to the back-end device through the interceptor of the front-end device after constructing the request information, and constructs the signature based on the data transmission device of the back-end device to obtain the signature information and send it to the back-end device. Similarly, the back-end device first intercepts all response information to be sent to the front-end device through the interceptor of the back-end device after constructing the response information, and constructs the signature based on the data transmission device of the back-end device to obtain the signature information and send it to the front-end device.

[0096] Step S20, determining the service entity data in the target data, and determining the dynamic salt value according to the service entity data;

[0097] In the embodiment, the target data to be sent can be data sent by the front-end device to the back-end device, or data sent by the back-end device to the front-end device. Regardless of which data, it can involve business entity data, which refers to data that will actually be used for business processing, for example, in a payment request, the business entity data involved can be order number, payment amount, etc. Business entity data is the core data for completing business processing, and is also a variable between different businesses. According to the dynamic salt value obtained from the business entity data, the business entity data can be obfuscated to obtain a dynamic salt value, or the business entity data can be used as a dynamic salt value.

[0098] In step S30, the target data is obfuscated based on the dynamic salt value to obtain signature information, and the signature information and the target data are sent to a data receiving end, so that the data receiving end determines the integrity of the target data according to the signature information.

[0099] In the embodiment, the target data is obfuscated based on the dynamic salt value determined according to the business entity data to obtain signature information. The obfuscation algorithm combines data packets of multiple algorithms, including B64, Crypt, DigestUtils, HmacAlgorithms, HmacUtils, Md5Crypt, MessageDigestAlgorithms, PureJavaCrc32, PureJavaCrc32C, Sha2Crypt, UnixCrypt, XXHash32, etc. Through the combination of multiple algorithms in these tools, the algorithm can be quickly switched and configured. The obfuscation algorithm can be used to encrypt and package the code at the core signature position of the front-end device as a whole, and at the same time, the code can be inserted with an obfuscated value to prevent direct code leakage. The above can be understood as using business core data to reinforce the signature information. The obtained signature information mainly verifies whether the business core data has been tampered with. Taking the business entity data as the important protection range of the entire security scheme can avoid the situation of protecting useless data and wasting system resources, and achieves the balance between performance and security.

[0100] The data packet, consisting of signature information determined based on business entity data and target data, is sent to the data receiving end. If the data packet is sent by a front-end device, then the data receiving end is the back-end device; conversely, if the data packet is sent by a back-end device, then the data receiving end is the front-end device. Upon receiving the data packet, both the front-end and back-end devices must verify the signature information within it. Similar to the method used to generate the signature information, the data receiving end obtains a verification salt value from the business entity data in the received data. Using the same obfuscation algorithm as described above, the target data is obfuscated using the verification salt value to obtain the verification signature information. This verification signature information is then compared with the received signature information to determine if they are identical. If they are identical, it can be determined that the target data has not been tampered with, that the integrity of the target data meets the requirements, and that the corresponding business processing can be executed based on the target data. Conversely, if they are different, it can be determined that the target data has been tampered with, that the integrity of the target data does not meet the requirements, and that the target data can be ignored or discarded, without executing the corresponding business processing.

[0101] In the technical solution disclosed in this embodiment, target data to be sent is obtained; business entity data in the target data is determined, and a dynamic salt value is determined based on the business entity data; the target data is obfuscated based on the dynamic salt value to obtain signature information, and the signature information and the target data are sent to a data receiving end so that the data receiving end can determine the integrity of the target data based on the signature information. By determining the dynamic salt value using the business entity data in the target data to be sent, and obfuscating the target data with the dynamic salt value to obtain the signature information, the signature information becomes dynamic and business-related. The dynamic salt value determined using the business entity data is more difficult to crack and forge than a static salt value. Sending the signature information and the target data as transmission content to the data receiving end allows the data receiving end to determine the integrity of the target data based on the signature information and whether the target data has been tampered with during transmission, thereby improving the security of data transmission. In addition, the dynamic salt value used in this embodiment is not a simple time-based or random type, nor is it easy to find a pattern to crack it. The dynamic salt value incorporates core business data to ensure dynamism and business relevance, achieving a balance between performance and security. By setting core data such as business entity data as the protection scope of the entire security solution, the situation of protecting useless data and thus wasting system resources is prevented, thereby improving the security and efficiency of data transmission.

[0102] Furthermore, prior to the step of determining the business entity data in the target data, the method further includes:

[0103] Determine whether the target data meets the conditions for enabling dynamic salt value;

[0104] When the conditions for enabling dynamic salt values ​​are met, the step of determining the business entity data in the target data is executed;

[0105] When the conditions for enabling dynamic salt value are not met, obtain the preset salt value;

[0106] The target data is obfuscated based on the preset salt value to obtain static signature information, and the static signature information and the target data are sent to the data receiving end so that the data receiving end can determine the integrity of the target data based on the static signature information.

[0107] In this embodiment, the target data to be sent may not necessarily meet the conditions for enabling dynamic salt values. If the conditions are not met, a dynamic salt value may not be successfully obtained, or the obtained dynamic salt value may not meet the user's requirements. The conditions for enabling dynamic salt values ​​include at least one of the following: the target data includes business entity data that meets the requirements; the dynamic salt value generation period has begun; dynamic salt value mode has been activated, for example, the front-end device has enabled the request signature switch, and the back-end device has enabled the response signature switch; the target data or the data receiving end belongs to the preset whitelist for generating dynamic salt values. This configuration includes the switch for enabling signatures and the whitelist settings, and can be further differentiated into front-end device request signature switch and request signature whitelist; and back-end device response signature switch and response signature whitelist. These configurations allow for more flexible handling of various problems. When the conditions for enabling dynamic salt values ​​are met, step S20 is executed. When the conditions for enabling dynamic salt values ​​are not met, a static salt value can be used by default as a backup to ensure that the signed data is obfuscated by the salt value.

[0108] Such a static salt value can be preset. In cross-border financial scenarios, preset salt values ​​are less affected by changing factors, such as time, and are more suitable for signature verification. After obtaining the preset salt value, the target data is obfuscated based on the preset salt value to obtain static signature information. The static signature information and the target data are then sent to the data receiving end, so that the data receiving end can determine the integrity of the target data based on the static signature information, thereby improving the security of data transmission.

[0109] Furthermore, the step of determining whether the target data meets the conditions for enabling dynamic salt values ​​includes:

[0110] Obtain the target data type corresponding to the dynamic salt value;

[0111] Determine whether the data type in the target data includes the target data type;

[0112] When the target data type is included, it is determined that the target data meets the conditions for enabling dynamic salt values.

[0113] In this embodiment, the target data may include different data types. The dynamic salting condition requires the target data to include the target data type from which the dynamic salt is obtained. The target data type can be a preset data type required to obtain the dynamic salt. For example, if the target data includes multiple data types belonging to business entity data, then business entity data matching the target data type can be selected. Alternatively, it can be determined based on the business type of the target data. The system determines whether the data type in the target data includes the target data type. If it includes the target data type and meets other set dynamic generation conditions, the target data is deemed to meet the dynamic generation conditions. The data corresponding to the target data type in the target data is then used as business entity data, thereby ensuring that the dynamic salt value can be determined based on the business entity data, thus improving the security of data transmission.

[0114] Furthermore, the step of obtaining the target data type corresponding to the dynamic salt value includes:

[0115] Determine the business type of the target data;

[0116] The target data type is determined based on the business type.

[0117] The data content corresponding to the target data type is used as the business entity data;

[0118] The business entity data is processed using an obfuscation algorithm to determine the dynamic salt value.

[0119] In this embodiment, the target data can also be determined based on its business type. In scenarios where the front-end device sends a request to the back-end device, the business type of the request is determined. This embodiment will process RESTful style requests separately. For POST requests, the request body is used as the target data type, and the data in the request body is used as the business entity data. For GET requests, the data appended to the request URL is used as the target data type, and the actual data is used as the business entity data. In scenarios where the back-end device sends a response to the front-end device, the response data is directly used as the business entity data.

[0120] By treating RESTful requests and other business types differently, we can enhance security and further improve the security of data transmission.

[0121] Furthermore, the step of obfuscating the target data based on the dynamic salt value to obtain signature information includes:

[0122] Obtain the address of the data receiving end;

[0123] The relative compositional position of the target data and the dynamic salt value is determined based on the address;

[0124] The dynamic salt value and the target data are combined according to the relative composition positions, and the combination result is obfuscated to obtain the signature information.

[0125] In this embodiment, the address of the data receiving end is obtained, and the relative composition positions of the target data and the dynamic salt value are determined based on the address of the data receiving end. The target data is then combined based on the relative composition positions, and the combined data is then obfuscated to obtain signature information.

[0126] To prevent attackers from directly obtaining device code and finding the core algorithm of the signature location through retrieval, the entire solution employs methods such as variable name obfuscation, variable name splitting, and the use of meaningless variable names to prevent direct keyword-based cracking, thereby further improving the security of data transmission.

[0127] Further, the step of determining the relative compositional position of the target data and the dynamic salt value based on the address includes:

[0128] A parity check is performed on the determined address;

[0129] Based on the result of the parity determination, the relative composition position is determined to be the position of the target data in front of or behind the dynamic salt value.

[0130] In this embodiment, when combining the dynamic salt value and the target data, a parity check is performed on the determined address to determine the combination method of the dynamic salt value and the target data. The combination method can be front-to-back, which is relatively simple and can ensure the obfuscation effect while improving the obfuscation efficiency. Specifically, when the result of the parity check is odd, the relative composition position is determined to be that the target data is placed before the dynamic salt value; when the result of the parity check is even, the relative composition position is determined to be that the target data is placed after the dynamic salt value.

[0131] By using the parity result of the address to swap the relative positions, the efficiency and effectiveness of obfuscation can be improved, further enhancing the security of data transmission.

[0132] Optionally, refer to Figure 3 Based on any of the above embodiments, in another embodiment of the data transmission method of the present invention, the data transmission method further includes:

[0133] Step S100: Receive the signature information to be verified and the data to be verified sent by the data sender;

[0134] Step S200: Determine the verification salt value based on the business entity data in the data to be verified;

[0135] Step S300: Obfuscate the data to be verified based on the verification salt value to obtain verification signature information;

[0136] Step S400: When the verification signature information matches the signature information to be verified, perform the corresponding operation of the data to be verified.

[0137] In this embodiment, the device can function as both a data sender and a data receiver. For example, a front-end device can act as a data sender, sending requests to a back-end device, or as a data receiver, receiving responses from the back-end device. Similarly, a back-end device can act as a data sender, sending responses to a front-end device, or as a data receiver, receiving requests from the front-end device. In this embodiment, the device acquires the target data to be sent, determines the business entity data within the target data, determines a dynamic salt value based on the business entity data, obfuscates the target data based on the dynamic salt value to obtain signature information, and sends the signature information and the target data to the data receiver so that the data receiver can determine the integrity of the target data based on the signature information. Alternatively, it can receive unverified signature information and unverified data sent by the data sender. Based on the business entity data in the unverified data, a verification salt value is determined. The data type of the business entity data in the unverified data is the same as the data type of the business entity data obtained by the data sender when generating the signature information. Then, the unverified data is obfuscated based on the verification salt value. The obfuscation algorithm used is the same as the obfuscation algorithm used by the data sender to generate the signature information, resulting in verified signature information. When the verified signature information matches the unverified signature information, the corresponding operation for the unverified data is executed. It should be noted that the data sender and data receiver can be the same device.

[0138] Furthermore, the step of determining the verification salt value based on the business entity data in the data to be verified includes:

[0139] When the conditions for enabling dynamic salt value are met, the business type of the data to be verified is determined, the target data type is determined according to the business type, and the verification salt value is generated according to the business entity data corresponding to the target data type in the data to be verified.

[0140] When the conditions for enabling dynamic salt value are not met, the preset salt value will be used as the verification salt value.

[0141] In this embodiment, the data sending end can obfuscate the target data using either dynamic or static salt values, depending on whether the dynamic salt value activation conditions are met, to obtain signature information. Therefore, the device can also obfuscate the data to be verified using either dynamic or static salt values, depending on whether the dynamic salt value activation conditions are met, to obtain verification signature information. Meeting the dynamic salt value activation conditions includes at least one of the following: the data to be verified includes compliant business entity data; the dynamic salt value generation period has begun; dynamic salt value mode has been activated, for example, the data sending end has enabled the signature switch, and the data receiving end also has the signature switch enabled; the target data or the data receiving end belongs to a preset whitelist for generating dynamic salt values, etc. When the dynamic salt value activation conditions are met, the business type of the data to be verified is determined, the target data type of the verification data is determined based on the business type of the data to be verified, and the verification salt value is generated based on the business entity data corresponding to the target data type in the data to be verified; when the dynamic salt value activation conditions are not met, a preset salt value is used as the verification salt value.

[0142] This method, which corresponds to the way the data sender determines the verification salt value, can obtain accurate verification signature information, thereby improving the accuracy of signature verification and enhancing the security of data transmission.

[0143] To better understand, two application scenarios are provided below:

[0144] I. For example Figure 4As shown, the data transmission method is applied to the front-end device. When constructing a request, the front-end device first intercepts all requests to be sent to the back-end device through its unified interceptor and begins signature construction. All request-related data enters the front-end device's signature toolkit (data transmission device). The data transmission method of the signature toolkit processes the data: First, it determines whether signature information needs to be generated: whether the system has the request signature switch enabled, and whether the current request is in the request signature whitelist. If these conditions are met, signature information needs to be generated. Then, it analyzes the business type of the request to be processed. RESTful style requests are processed separately. For POST requests, the data in the request body is used as the business entity data; for GET requests, the data appended to the request URL is used as the business entity data. After obtaining the business entity data, it performs a parity check based on the request address (data receiving address) to determine where the business entity data is constructed in the signature information. If the result is odd, the business entity data is placed before the salt value; if the result is even, the business entity data is placed after the salt value. The salt value design is implemented using a combination of dynamic enhancement and static support. When the conditions for enabling dynamic salt value are met, the dynamic salt value is used to obfuscate the original text. A dynamic salt value is generated by combining specific business entity data with an obfuscation algorithm. This ensures that the pattern of the dynamic salt value cannot be forged even if it is known. When the conditions for enabling the dynamic salt value are not met, a static preset salt value is used as a fallback to ensure that the business entity data is obfuscated by the salt value. The business entity data and dynamic salt value obtained from the above three steps are concatenated to obtain the final signature text. The final signature information is then obtained by using the obfuscation algorithm toolkit mentioned above and stored in the request header, which is sent out along with the request.

[0145] When the backend device receives a request from the frontend device, it begins signature verification. First, the backend device constructs a verification signature for the received request using the method described above. Then, it compares the verification signature constructed by the backend device with the signature to be verified transmitted by the frontend device. If any step in this process fails, the request will be immediately blocked.

[0146] II. Figure 4As shown, the data transmission method is applied to the backend device. When constructing a response, the backend device first intercepts all responses to be sent to the backend device through a unified interceptor and begins signature construction. Response-related data enters the backend device's signature toolkit (data transmission device), which processes the data transmission method: First, it determines whether signature information needs to be generated: whether the system has the response signature switch enabled, and whether the current response is in the response signature whitelist. If these conditions are met, signature information needs to be generated. Then, it analyzes the business type of the response to be processed, and separates RESTful responses. For POST responses, the data in the response body is used as the business entity data, while for GET responses, the data appended to the response URL is used as the business entity data. After obtaining the business entity data, it performs a parity check based on the response address (data receiving address) to determine where the business entity data is constructed in the signature information. If the result is odd, the business entity data is placed before the salt value; if the result is even, the business entity data is placed after the salt value. The salt value design is implemented using a combination of dynamic enhancement and static support. When the conditions for enabling dynamic salt value are met, the dynamic salt value is used to obfuscate the original text. Dynamic salt values ​​are generated by combining specific business entity data with obfuscation algorithms. This ensures that the pattern of the dynamic salt value cannot be forged even if it is known. When the conditions for enabling dynamic salt values ​​are not met, a static preset salt value is used as a fallback to ensure that the business entity data is obfuscated by the salt value. The business entity data and dynamic salt values ​​obtained from the above three steps are concatenated to obtain the final signature text. The final signature information is then obtained by using the obfuscation algorithm toolkit mentioned above and stored in the response header, which is sent out along with the response.

[0147] When the front-end device receives a response from the back-end device, it begins signature verification. First, the front-end device constructs a verification signature for the received response using the method described above. Then, it compares the verification signature constructed by the front-end device with the signature to be verified transmitted by the back-end device. If any step in this process fails, a message will immediately indicate a problem with the response; please be aware of operational security.

[0148] In the technical solution disclosed in this embodiment, the system receives unverified signature information and unverified data sent by the data sending end. A verification salt value is determined based on the business entity data in the unverified data. The unverified data is then obfuscated based on the verification salt value to obtain verification signature information. When the verification signature information matches the unverified signature information, the corresponding operation for the unverified data is executed. Thus, the data sending end also generates signature information using the above method. After receiving the unverified signature information and unverified data from the data sending end, it generates a verification salt value in the same way to obtain verification signature information, completing the verification of the unverified signature information and unverified data. This ensures business security and, overall, guarantees the security of data transmission when the device acts as both a data sending end and a data receiving end.

[0149] Furthermore, this embodiment of the invention also proposes a data transmission device, which includes a memory, a processor, and a data transmission program stored in the memory and executable on the processor. When the data transmission program is executed by the processor, it implements the steps of the data transmission method described in the above embodiments.

[0150] Furthermore, embodiments of the present invention also propose a computer-readable storage medium storing a data transmission program, which, when executed by a processor, implements the steps of the data transmission method described in the above embodiments.

[0151] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0152] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0153] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause the data transmission device to execute the methods described in the various embodiments of the present invention.

[0154] The above are merely preferred embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A data transmission method, characterized in that, Applied to the data sending end, the data transmission method includes: Obtain the target data to be sent; Identify the business entity data in the target data, and determine the dynamic salt value based on the business entity data; The target data is obfuscated based on the dynamic salt value to obtain signature information. The signature information and the target data are then sent to a data receiving end, allowing the data receiving end to determine the integrity of the target data based on the signature information. The data receiving end can be either a front-end device or a back-end device, and the data sending end can be either a back-end device or a front-end device. The front-end device and the back-end device exchange data. Both the front-end and back-end devices are equipped with data transmission devices, which are uniformly installed on both devices. After constructing a request message, the front-end device first intercepts all request messages destined for the back-end device using its interceptor, and then constructs a signature based on its data transmission device, obtaining signature information which is sent to the back-end device. Similarly, after constructing a response message, the back-end device first intercepts all response messages destined for the front-end device using its interceptor, and then constructs a signature based on its data transmission device, obtaining signature information which is sent to the front-end device. The step of obfuscating the target data based on the dynamic salt value to obtain signature information includes: Obtain the address of the data receiving end; The relative compositional position of the target data and the dynamic salt value is determined based on the address; The dynamic salt value and the target data are combined according to the relative composition positions, and the combination result is obfuscated to obtain the signature information.

2. The data transmission method as described in claim 1, characterized in that, Before the step of determining the business entity data in the target data, the method further includes: Determine whether the target data meets the conditions for enabling dynamic salt value; When the conditions for enabling dynamic salt values ​​are met, the step of determining the business entity data in the target data is executed; When the conditions for enabling dynamic salt value are not met, obtain the preset salt value; The target data is obfuscated based on the preset salt value to obtain static signature information, and the static signature information and the target data are sent to the data receiving end so that the data receiving end can determine the integrity of the target data based on the static signature information.

3. The data transmission method as described in claim 2, characterized in that, The step of determining whether the target data meets the conditions for enabling dynamic salt value includes: Obtain the target data type corresponding to the dynamic salt value; Determine whether the data type in the target data includes the target data type; When the target data type is included, it is determined that the target data meets the conditions for enabling dynamic salt values.

4. The data transmission method as described in claim 3, characterized in that, The step of obtaining the target data type corresponding to the dynamic salt value includes: Determine the business type of the target data; The target data type is determined based on the business type.

5. The data transmission method as described in claim 1, characterized in that, The step of determining the relative composition position of the target data and the dynamic salt value based on the address includes: Perform parity determination on the address; Based on the result of the parity determination, the relative composition position is determined to be the position of the target data in front of or behind the dynamic salt value.

6. The data transmission method as described in claim 1, characterized in that, The method further includes: Receive the signature information and data to be verified sent by the data sender; The verification salt value is determined based on the business entity data in the data to be verified. The data to be verified is obfuscated based on the verification salt value to obtain verification signature information; When the verification signature information matches the signature information to be verified, the corresponding operation for the data to be verified is executed.

7. The data transmission method as described in claim 6, characterized in that, The step of determining the verification salt value based on the business entity data in the data to be verified includes: When the conditions for enabling dynamic salt value are met, the business type of the data to be verified is determined, the target data type is determined according to the business type, and the verification salt value is generated according to the business entity data corresponding to the target data type in the data to be verified. When the conditions for enabling dynamic salt value are not met, the preset salt value will be used as the verification salt value.

8. A data transmission device, characterized in that, The data transmission device includes: a memory, a processor, and a data transmission program stored in the memory and executable on the processor, wherein the data transmission program, when executed by the processor, implements the steps of the data transmission method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a data transmission program, which, when executed by a processor, implements the steps of the data transmission method as described in any one of claims 1 to 7.

Images