Interface transmission protection method, device and equipment and storage medium thereof

Abstract

The embodiment of the invention belongs to the technical field of secure transmission, is applied to a scene that data is transmitted between terminals through an interface, and relates to an interface transmission protection method, device and equipment and a storage medium thereof.The interface transmission protection method comprises the steps that when an interface transmission instruction sent by a sending terminal is monitored, the total number of times that the sending terminal sends a message field to a receiving terminal is identified; splicing the message fields and the total number of times to obtain a splicing result; carrying out encryption operation on the splicing result; identifying the total number of times of receiving the message field by the receiving end; splicing the message fields and the total number of times to obtain a splicing result; carrying out encryption operation on the splicing result; and comparing the results of the two encryption operations, and sending an interface feedback message to the sending end according to the comparison result. By adopting the processing mode, a more effective interface transmission security protection mode is provided, and the request sent by the malicious client is effectively identified, so that the activity welfare issued through the interface transmission mode is issued to a real client as far as possible, and the service experience of the real client is improved.

Description

Technical Field

[0001] The present application relates to the field of secure transmission technology, and is applied to scenarios where data is transmitted between terminals through interfaces, and in particular to an interface transmission protection method, device, equipment, and storage medium thereof. Background Art

[0002] With the rapid development of the Internet industry, more and more businesses use Internet platforms to carry out various marketing and promotion activities at important time points, and distribute various benefits to activate and give back to customers. For example, at 10:00 on the Mid-Autumn Festival, Ping An Good Car owners can receive a 10-yuan gas coupon. However, criminals are also quite active. They can use some technical means to directly call the program interface of Ping An Good Car Owners' marketing activities, and instantly obtain a large number of activity coupons by replaying the activity coupon program, causing the activity coupons to be unable to reach the real customers, giving real customers a bad activity experience.

[0003] At present, the common practice of criminals is to first register a Ping An Good Car Owner APP account, use the APP to initiate a coupon application, and use a packet capture tool to intercept and capture the request packet sent by the client to the server program interface, and then use a replay tool to quickly and frequently replay the request packet to the server. The server program interface responds to the request and returns the activity coupon data packet. As a result, the activity coupons are issued in batches to the virtual account, and the criminals then resell the activity coupons through the virtual account. The existing interface transmission security protection method is to protect the transmission link with https, and access the program interface based on the SSL protocol https, but the replay attack does not need to decrypt the https data packet, nor does it need to modify the request packet content, which makes the interface transmission security protection method invalid. Therefore, there is currently a lack of a more effective security protection method in service interface transmission, which can easily cause the service to fail to reach the real customers and cause a bad service experience for real customers. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose an interface transmission protection method, device, equipment and storage medium thereof, so as to solve the problem that the prior art lacks a more effective security protection method in service interface transmission, which easily causes the service to fail to reach the real customers and causes a bad service experience for the real customers.

[0005] In order to solve the above technical problems, the embodiment of the present application provides an interface transmission protection method, which adopts the following technical solution:

[0006] A method for protecting interface transmission comprises the following steps:

[0007] When an interface transmission instruction sent by the target sending end is detected, the preset first identification field and the second identification field are called to obtain the corresponding attribute value;

[0008] Encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain a first encrypted value;

[0009] Sending the currently sent message field and the first encrypted value to a target parsing end;

[0010] The target parsing end encrypts the currently sent message field and the attribute value obtained through the second identification field together to obtain a second encrypted value;

[0011] The first encryption value and the second encryption value are compared, and based on the comparison result, an interface feedback message is sent to the target sending end.

[0012] Furthermore, the step of encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain the first encrypted value specifically includes:

[0013] Identify the total number of times the target sending end sends a message field to the target receiving end through the first identification field, wherein the total number of times the message field is sent is the number of times the message field is sent historically and the number and value of the message field being sent currently;

[0014] Splicing the currently sent message field and the total number of times the message field is sent to obtain a first splicing result;

[0015] A preset encryption algorithm is used to perform an encryption operation on the first splicing result to generate a first encrypted value.

[0016] Furthermore, the step of encrypting the currently sent message field and the attribute value obtained through the second identification field by the target parsing end to obtain the second encrypted value specifically includes:

[0017] Identifying, by the second identification field, the total number of times the target receiving end receives the message field currently sent by the target sending end through the target receiving end when the target receiving end receives the message field currently sent by the target sending end, wherein the total number of times the message field is received is the number of times the message field is received historically and the number and value of the message field is received currently;

[0018] Obtaining the currently sent message field and the first encrypted value through the target parsing end;

[0019] The target parsing end splices the currently sent message field and the total number of received message fields to obtain a second splicing result;

[0020] The encryption algorithm is used to perform an encryption operation on the second splicing result to generate a second encrypted value.

[0021] Further, the step of comparing the first encrypted value and the second encrypted value and sending an interface feedback message to the target sending end according to the comparison result specifically includes:

[0022] Determining whether the first encrypted value and the second encrypted value are the same;

[0023] If the first encrypted value is the same as the second encrypted value, sending a service program response packet to the target sending end, and sending a message indicating that the service request has been successfully identified to the target sending end;

[0024] If the first encryption value is different from the second encryption value, a message indicating that the service request identification failed is sent to the target sending end, and an alarm message is sent to a preset security interception terminal.

[0025] Further, the target sending end includes a server, the target parsing end includes a preset third-party parsing end, the target receiving end includes a client, the message field includes a service program response packet, the first identification field is used to record the total number of service responses sent by the server to the client, and the second identification field is used to record the total number of service responses received by the client through the server.

[0026] The step of calling the preset first identification field and the second identification field to obtain the corresponding attribute value when the interface transmission instruction sent by the target sending end is detected specifically includes:

[0027] When the interface transmission instruction sent by the server is detected, the first identification field and the second identification field are called;

[0028] The step of encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain the first encrypted value specifically includes:

[0029] Identify the total number of times the server sends service program response packets to the client through the first identification field;

[0030] splicing the service program response packet and the total number of times the server sends the service program response packet to the client to obtain the first splicing result;

[0031] Using a preset encryption algorithm to perform an encryption operation on the first splicing result to generate a first encrypted value;

[0032] The step of sending the currently sent message field and the first encrypted value to the target parsing end includes:

[0033] Sending the service program response packet and the first encrypted value to the third-party parsing terminal, wherein the third-party parsing terminal is any security terminal other than the client;

[0034] The step of encrypting the currently sent message field and the attribute value obtained through the second identification field by the target parsing end to obtain the second encrypted value specifically includes:

[0035] Identify, by using the second identification field, the total number of service program response packets received by the client through the server when the client receives the service program response packet sent by the server this time;

[0036] Parsing the service program response packet and the first encrypted value through the third-party parsing terminal;

[0037] The third-party parsing end splices the service program response packet and the total number of service program response packets received by the client through the server to obtain the second splicing result;

[0038] The encryption algorithm is used to perform an encryption operation on the second splicing result to generate a second encrypted value.

[0039] Further, the step of comparing the first encrypted value and the second encrypted value and sending an interface feedback message to the target sending end according to the comparison result specifically includes:

[0040] Determining whether the first encrypted value and the second encrypted value are the same;

[0041] If the first encrypted value is the same as the second encrypted value, sending a service program response packet to the client through the third-party parsing end, and sending a message to the client indicating that the service request has been successfully identified;

[0042] If the first encryption value is different from the second encryption value, a message indicating that the service request identification failed is sent to the client, and an alarm message is sent to a preset security interception terminal.

[0043] Furthermore, the preset encryption algorithm includes an HMAC encryption algorithm, and the step of using the preset encryption algorithm to perform encryption operation on the first splicing result to generate a first encrypted value specifically includes:

[0044] Using the HMAC encryption algorithm to perform encryption operation on the first splicing result, and generating an HMAC value as the first encryption value;

[0045] The step of using the encryption algorithm to perform encryption operation on the second splicing result to generate a second encrypted value specifically includes:

[0046] The HMAC encryption algorithm is used to perform an encryption operation on the second concatenation result to generate an HMAC value as the second encryption value.

[0047] In order to solve the above technical problems, the embodiment of the present application also provides an interface transmission protection device, which adopts the following technical solution:

[0048] An interface transmission protection device, comprising:

[0049] The identification field calling module is used to call the preset first identification field and the second identification field to obtain the corresponding attribute value when monitoring the interface transmission instruction sent by the target sending end;

[0050] A first encryption module, used to encrypt the currently sent message field and the attribute value obtained through the first identification field together to obtain a first encrypted value;

[0051] A data sending module, used for sending the currently sent message field and the first encrypted value to a target parsing end;

[0052] A second encryption module, configured to encrypt the currently sent message field and the attribute value obtained through the second identification field through the target parsing end to obtain a second encrypted value;

[0053] A comparison feedback module is used to compare the first encryption value and the second encryption value, and send an interface feedback message to the target sending end according to the comparison result.

[0054] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0055] A computer device comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the above-mentioned interface transmission protection method when executing the computer-readable instructions.

[0056] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0057] A computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the interface transmission protection method described above are implemented.

[0058] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0059] The interface transmission protection method described in the embodiment of the present application, when monitoring the interface transmission instruction sent by the sending end, identifies the total number of times the sending end sends the message field to the receiving end; splices the message field and the total number of times to obtain a first splicing result; performs an encryption operation on the first splicing result; identifies the total number of times the receiving end receives the message field through the sending end; splices the message field and the total number of times to obtain a second splicing result; performs an encryption operation on the second splicing result; compares the results of the two encryption operations, and sends an interface feedback message to the sending end based on the comparison result. The present application adopts the above processing method to provide a more effective interface transmission security protection method, effectively identifies malicious requests sent by malicious clients, avoids malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and makes the activity benefit discounts issued through the interface transmission method as much as possible distributed to real customers, thereby improving the service experience of real customers. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0062] Figure 2 is a flow chart of an embodiment of the interface transmission protection method according to the present application;

[0063] Figure 3 yes Figure 2 A flowchart of a specific embodiment of step 202 is shown;

[0064] Figure 4 yes Figure 2 A flowchart of a specific embodiment of step 204 is shown;

[0065] Figure 5 is a structural schematic diagram of an embodiment of an interface transmission protection device according to the present application;

[0066] Figure 6 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0067] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0068] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0069] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0070] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0071] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0072] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0073] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0074] It should be noted that the interface transmission protection method provided in the embodiment of the present application is generally executed by a server, and accordingly, the interface transmission protection device is generally arranged in the server.

[0075] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0076] Continue to refer Figure 2 , shows a flow chart of an embodiment of an interface transmission protection method according to the present application. The interface transmission protection method comprises the following steps:

[0077] Step 201: When an interface transmission instruction sent by a target sending end is detected, a preset first identification field and a second identification field are called to obtain corresponding attribute values.

[0078] In this embodiment, the target sending end may be a client or a server.

[0079] If the target sending end is a client, the first identification field is used to record the total number of service requests sent by the client to the server. For example, the first identification field may be client_send, and its corresponding value is a positive integer, indicating the total number of service requests sent by the client to the server, and each time the client sends a service request to the server, the positive integer value corresponding to the first identification field client_send is accumulated by 1. The second identification field is used to record the total number of service requests received by the server through the client. For example, the second identification field may be server_recv, and its corresponding value is a positive integer, indicating the total number of service requests received by the server through the client, and each time the server receives a service request sent by the client, the positive integer value corresponding to the second identification field server_recv is accumulated by 1.

[0080] When the target sending end is a client, the step of calling the preset first identification field and the second identification field to obtain the corresponding attribute value when the interface transmission instruction sent by the target sending end is monitored specifically includes: calling the first identification field and the second identification field when the interface transmission instruction sent by the client is monitored;

[0081] Specifically, the first identification field client_send is called to obtain the total number of service requests sent by the client to the server, and the second identification field server_recv is called to obtain the total number of service requests received by the server through the client. Theoretically, if the client sends a service request directly to the server, the total number of times corresponding to the first identification field client_send is the same as the total number of times corresponding to the second identification field server_recv.

[0082] If the target sending end is the server, the first identification field is used to record the total number of service responses sent by the server to the client. For example, the first identification field may be server_send, and its corresponding value is a positive integer, indicating the total number of service responses sent by the server to the client, and each time the server sends a service response to the client, the positive integer value corresponding to the first identification field server_send is accumulated by 1. The second identification field is used to record the total number of service responses received by the client through the server. The second identification field may be client_recv, and its corresponding value is a positive integer, indicating the total number of service responses received by the client through the server, and each time the client receives a service response sent by the server, the positive integer value corresponding to the second identification field client_recv is accumulated by 1.

[0083] When the target sending end is a server, the step of calling a preset first identification field and a preset second identification field to obtain a corresponding attribute value when the interface transmission instruction sent by the target sending end is monitored specifically includes: calling the first identification field and the second identification field when the interface transmission instruction sent by the server is monitored;

[0084] Specifically, the first identification field server_send is called to obtain the total number of service responses sent by the server to the client, and the second identification field client_recv is called to obtain the total number of service responses received by the client through the server. Theoretically, if the server sends a service response directly to the client, the total number of times corresponding to the first identification field server_send is the same as the total number of times corresponding to the second identification field client_recv.

[0085] When the interface transmission instruction sent by the target sending end is monitored, the preset first identification field and the second identification field are called to obtain the corresponding attribute value. During the interface transmission process, the data can be securely processed to avoid being cracked by malicious third parties, thereby improving the security of the interface transmission.

[0086] Step 202: encrypt the message field currently being sent and the attribute value obtained through the first identification field together to obtain a first encrypted value.

[0087] Continue to refer Figure 3 , Figure 3 yes Figure 2 The flowchart of a specific embodiment of step 202 shown includes:

[0088] Step 301, identifying the total number of times the target sending end sends a message field to the target receiving end through the first identification field, wherein the total number of times the message field is sent is the number of times the message field is sent historically and the number and value of the message field being sent currently.

[0089] When the target sending end is a client and the target receiving end is a server, the step of identifying the total number of times the target sending end sends a message field to the target receiving end through the first identification field specifically includes: identifying the total number of times the client sends a service program request packet to the server through the first identification field;

[0090] Specifically, by calling the first identification field client_send to obtain the total number of times the client sends service program request packets to the server, client_send can be set as an attribute field in advance, and the client can be taken as an object. The total number of times the client sends service program request packets to the server can be obtained by obtaining the attribute field of the object, for example, using A.get(client_send), where A represents the object corresponding to the client.

[0091] When the target sending end is a server and the target receiving end is a client, the step of identifying the total number of times the target sending end sends a message field to the target receiving end through the first identification field specifically includes: identifying the total number of times the server sends a service program response packet to the client through the first identification field;

[0092] Specifically, by calling the first identification field server_send, the total number of times the server sends a service program response packet to the client is obtained. The server_send can be set as an attribute field in advance, and the server is taken as an object. The total number of times the server sends a service program response packet to the client is obtained by obtaining the attribute field of the object, for example, using B.get(server_send), where B represents the object corresponding to the server.

[0093] By using the attribute field method, the total number of transmissions during each interface transmission between the client and the server is applied to the encryption process, so that the encryption is always in dynamic change, which increases the difficulty of cracking by malicious third parties and makes the interface transmission process more secure.

[0094] Step 302: Concatenate the currently sent message field and the total number of times the message field is sent to obtain a first concatenation result.

[0095] When the target sending end is a client and the target receiving end is a server, the step of splicing the currently sent message field and the total number of times the message field is sent to obtain a first splicing result specifically includes: splicing the service program request packet and the total number of times the client sends the service program request packet to the server to obtain the first splicing result.

[0096] When the target sending end is a server and the target receiving end is a client, the step of splicing the currently sent message field and the total number of times the message field is sent to obtain a first splicing result specifically includes: splicing the service program response packet and the total number of times the server sends a service program response packet to the client to obtain the first splicing result.

[0097] The service package (request package or response package) is spliced ​​with the total number of transmissions during each interface transmission between the client and the server, and applied to the encryption process. Since the total number of transmissions changes with the transmission, the encryption is always in dynamic change, which increases the difficulty of cracking by malicious third parties and makes the interface transmission process more secure. At the same time, the introduction of the service package has a more complex encryption field than a simply changing numerical value, which further increases the difficulty of cracking and ensures the security of interface transmission.

[0098] Step 303: Use a preset encryption algorithm to perform encryption operation on the first splicing result to generate a first encrypted value.

[0099] In this embodiment, the preset encryption algorithm includes an HMAC (Hash-based Message Authentication Code, HMAC) encryption algorithm, and the step of using the preset encryption algorithm to perform an encryption operation on the first splicing result to generate a first encryption value specifically includes: using the HMAC encryption algorithm to perform an encryption operation on the first splicing result to generate an HMAC value as the first encryption value.

[0100] Specifically, when the target sending end is a client and the target receiving end is a server, the HMAC encryption algorithm is used to perform an encryption operation on the first splicing result to generate an HMAC value as the first encryption value, that is, the splicing result of the service program request packet and the total number of times the client sends the service program request packet to the server is encrypted.

[0101] Correspondingly, when the target sending end is the server and the target receiving end is the client, the HMAC encryption algorithm is used to perform an encryption operation on the first splicing result to generate an HMAC value as the first encryption value, that is, the splicing result of the service program response packet and the total number of times the server sends the service program response packet to the client is encrypted.

[0102] The HMAC encryption algorithm is a message authentication code algorithm based on a hash function and a key, which is used to ensure the integrity and authentication of data. When the HMAC encryption method is adopted in this embodiment, the total number of transmissions during each interface transmission between the client and the server is cleverly applied to the encryption process, so that the encryption is always in dynamic change, which increases the difficulty of cracking by malicious third parties and makes the interface transmission process more secure.

[0103] Step 203: Send the currently sent message field and the first encrypted value to the target parsing end.

[0104] When the target sending end is a client and the target receiving end is a server, the step of sending the currently sent message field and the first encrypted value together with the target parsing end specifically includes: sending the service program request packet and the first encrypted value together with the server;

[0105] At this time, since it is the client that sends the service request to the server, the target parsing end can be the target receiving end, that is, the target parsing end can be the server. If the target parsing end is the server, it is possible to directly use the server to parse the service request sent by the client, thereby avoiding the introduction of an external parsing end. Of course, the target parsing end can also be a third-party parsing end. Introducing a third-party parsing end to parse the service request avoids the situation where, when service requests are received from multiple clients at one time, the server's own computing resources alone will cause delays in service request parsing and make it impossible to send service feedback to the client in a timely manner.

[0106] When the target sending end is a server and the target receiving end is a client, the step of sending the currently sent message field and the first encrypted value together with the target parsing end specifically includes: sending the service program response packet and the first encrypted value together with the third-party parsing end;

[0107] In this embodiment, the preset third-party parsing end is any secure terminal other than the client, and may also be the server.

[0108] In essence, when the service response is sent to the client through the server, a third-party parser is introduced to parse the service program response package and the first encrypted value, thereby avoiding the client from directly parsing the service program response package and increasing the security of the service response.

[0109] Step 204: The target parsing end encrypts the currently sent message field and the attribute value obtained through the second identification field together to obtain a second encrypted value.

[0110] Continue to refer Figure 4 , Figure 4 yes Figure 2 The flowchart of a specific embodiment of step 204 shown includes:

[0111] Step 401, identifying through the second identification field the total number of times the target receiving end receives the message field currently sent by the target sending end when the target receiving end receives the message field, wherein the total number of times the message field is received is the number of historical receptions of the message field and the number and value of the current reception of the message field.

[0112] When the target sending end is a client and the target receiving end is a server, the step of identifying, through the second identification field, the total number of times that the target receiving end passes through the message field received by the target sending end when the target receiving end receives the message field currently sent by the target sending end, specifically includes: identifying, through the second identification field, the total number of times that the server passes through the service program request packet received by the client when the server receives the service program request packet sent by the client this time;

[0113] Specifically, the total number of service requests received by the server through the client is obtained by calling the second identification field server_recv. Similarly, server_recv can be set as an attribute field in advance, and the server can be taken as an object. The total number of service requests received by the server through the client can be obtained by obtaining the attribute field of the object, for example, using B.get(server_recv), where B represents the object corresponding to the server.

[0114] When the target sending end is a server and the target receiving end is a client, the step of identifying, by using the second identification field, the total number of times that the target receiving end passes through the message field received by the target sending end when the target receiving end receives the message field currently sent by the target sending end, specifically includes: identifying, by using the second identification field, the total number of times that the client passes through the service program response packet received by the server when the client receives the service program response packet sent by the server this time;

[0115] Specifically, the total number of service responses received by the client through the sending of the server is obtained by calling the second identification field client_recv. Similarly, client_recv can be set as an attribute field in advance, and the client can be taken as an object. The total number of service responses received by the client through the sending of the server is obtained by obtaining the attribute field of the object, for example, using A.get(client_recv), where A represents the object corresponding to the client.

[0116] The attribute field is obtained to obtain the total number of transmissions each time the interface is transmitted between the client and the server. In terms of data acquisition, it is directly obtained through the get method, which is simpler. The obtained attribute value is subsequently applied to the encryption process, so that the encryption is always in dynamic change, which increases the difficulty of cracking by malicious third parties and makes the interface transmission process more secure.

[0117] Step 402: obtaining the currently sent message field and the first encrypted value through the target parsing end.

[0118] When the target sending end is a client and the target receiving end is a server, the step of obtaining the currently sent message field and the first encrypted value through the target parsing end specifically includes: parsing the service program request package and the first encrypted value through the server.

[0119] When the target sending end is a server and the target receiving end is a client, the step of obtaining the currently sent message field and the first encrypted value by parsing through the target parsing end specifically includes: parsing the service program response package and the first encrypted value through the third-party parsing end.

[0120] Step 403: The target parsing end splices the currently sent message field and the total number of received message fields to obtain a second splicing result.

[0121] When the target sending end is a client, the target parsing end is the target receiving end, and the target receiving end is a server, the step of obtaining a second splicing result by splicing the currently sent message field with the total number of received message fields through the target parsing end specifically includes: obtaining the second splicing result by splicing the service program request packet through the server and the total number of service program request packets received by the server through the client.

[0122] When the target sending end is a server and the target receiving end is a client, the step of obtaining a second splicing result by splicing the currently sent message field and the total number of received message fields through the target parsing end specifically includes: obtaining the second splicing result by splicing the service program response packet and the total number of service program response packets received by the client through the server through the third-party parsing end.

[0123] Step 404: Use the encryption algorithm to perform encryption operation on the second splicing result to generate a second encrypted value.

[0124] In this embodiment, the step of using the encryption algorithm to perform an encryption operation on the second splicing result to generate a second encrypted value specifically includes: using the HMAC encryption algorithm to perform an encryption operation on the second splicing result to generate an HMAC value as the second encrypted value.

[0125] Specifically, when the target sending end is a client and the target receiving end is a server, the HMAC encryption algorithm is used to perform an encryption operation on the second splicing result, that is, the HMAC encryption algorithm is used to encrypt the splicing result of the service program request packet and the total number of service program request packets received by the server through the client.

[0126] Correspondingly, when the target sending end is the server and the target receiving end is the client, the HMAC encryption algorithm is used to perform an encryption operation on the second splicing result, that is, the HMAC encryption algorithm is used to encrypt the splicing result of the service program response packet and the total number of service program response packets received by the client through the server.

[0127] Step 205: compare the first encryption value and the second encryption value, and send an interface feedback message to the target sending end according to the comparison result.

[0128] When the target sending end is a client and the target receiving end is a server, the step of comparing the first encryption value and the second encryption value and sending an interface feedback message to the target sending end based on the comparison result specifically includes: comparing the first encryption value and the second encryption value; judging whether the first encryption value and the second encryption value are the same based on the comparison result; if the first encryption value is the same as the second encryption value, sending a service program response packet to the client through the server, and sending a message of successful service request identification to the client; if the first encryption value is different from the second encryption value, sending a message of failed service request identification to the client through the server, and sending an alarm message to a preset security interception terminal.

[0129] When the target sending end is a server and the target receiving end is a client, the step of comparing the first encryption value and the second encryption value and sending an interface feedback message to the target sending end based on the comparison result specifically includes: comparing the first encryption value and the second encryption value; judging whether the first encryption value and the second encryption value are the same based on the comparison result; if the first encryption value is the same as the second encryption value, sending a service program response packet to the client through the third-party parsing end, and sending a message of successful service request identification to the client; if the first encryption value is different from the second encryption value, sending a message of failed service request identification to the client, and sending an alarm message to a preset security interception terminal.

[0130] Specifically, no matter when the target sending end is the client and the target receiving end is the server, or when the target sending end is the server and the target receiving end is the client, since the total number of times corresponding to client_send is the same as the total number of times corresponding to server_recv, and the total number of times corresponding to server_send is the same as the total number of times corresponding to client_recv, the first encryption value and the second encryption value are also the same, indicating that the connection between the client and the server is normal, that is, the client is not a malicious service requester, and can normally respond to services to the client.

[0131] Especially in the scenario of financial promotion activities or the distribution of financial activity benefits, the implementation method of the above-mentioned embodiment can be used to identify malicious service requests sent by malicious clients to the financial service end, and the benefits, discounts, and discounts delivered by the financial activity promoter or the financial activity benefit distributor can be sent to the real user group as much as possible, avoiding malicious third parties from exploiting interface transmission vulnerabilities to obtain a large number of activity benefits, providing a more effective security protection method, so that service items and welfare benefits can reach real customers as much as possible, thereby improving the service experience of real customers.

[0132] When the present application monitors the interface transmission instruction sent by the sending end, it identifies the total number of times the sending end sends the message field to the receiving end; splices the message field and the total number of times to obtain a first splicing result; performs an encryption operation on the first splicing result; identifies the total number of times the receiving end receives the message field through the sending end; splices the message field and the total number of times to obtain a second splicing result; performs an encryption operation on the second splicing result; compares the results of the two encryption operations, and sends an interface feedback message to the sending end based on the comparison result. The present application adopts the above processing method to provide a more effective interface transmission security protection method, effectively identifies malicious requests sent by malicious clients, avoids malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and makes the activity benefit discounts issued through the interface transmission method as much as possible distributed to real customers, thereby improving the service experience of real customers.

[0133] The embodiments of the present application can acquire and process relevant data based on image processing technology. Among them, image processing (Artificial Intelligence, AI) is the theory, method, technology and application system of using digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0134] Image processing basic technologies generally include sensors, dedicated image processing chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. Image processing software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0135] In an embodiment of the present application, when an interface transmission instruction sent by a sending end is monitored, the total number of times the sending end sends a message field to the receiving end is identified; the message field and the total number of times are spliced ​​to obtain a first splicing result; an encryption operation is performed on the first splicing result; the total number of times the receiving end receives the message field through the sending end is identified; the message field and the total number of times are spliced ​​to obtain a second splicing result; an encryption operation is performed on the second splicing result; the results of the two encryption operations are compared, and based on the comparison result, an interface feedback message is sent to the sending end. The present application adopts the above-mentioned processing method to provide a more effective interface transmission security protection method, which effectively identifies malicious requests sent by malicious clients, avoids malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and makes the activity benefit discounts issued through the interface transmission method as much as possible distributed to real customers, thereby improving the service experience of real customers.

[0136] Further references Figure 5 , as a response to the above Figure 2The present application provides an embodiment of an interface transmission protection device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0137] like Figure 5 As shown, the interface transmission protection device 500 described in this embodiment includes: an identification field calling module 501, a first encryption module 502, a data sending module 503, a second encryption module 504 and a comparison feedback module 505. Among them:

[0138] The identification field calling module 501 is used to call the preset first identification field and the second identification field to obtain the corresponding attribute value when monitoring the interface transmission instruction sent by the target sending end;

[0139] A first encryption module 502, configured to encrypt the currently sent message field and the attribute value obtained through the first identification field together to obtain a first encrypted value;

[0140] A data sending module 503, configured to send the currently sent message field and the first encrypted value to a target parsing end;

[0141] A second encryption module 504, configured to encrypt the currently sent message field and the attribute value obtained through the second identification field through the target parsing end to obtain a second encrypted value;

[0142] The comparison feedback module 505 is used to compare the first encryption value and the second encryption value, and send an interface feedback message to the target sending end according to the comparison result.

[0143] In this embodiment, the first encryption module includes a first identification submodule, a first splicing submodule and a first encryption submodule, wherein:

[0144] A first identification submodule, configured to identify the total number of times the target sending end sends a message field to the target receiving end through the first identification field, wherein the total number of times the message field is sent is the number of times the message field is sent historically and the number and value of the message field being sent currently;

[0145] A first splicing submodule, used for splicing the currently sent message field and the total number of times the message field is sent to obtain a first splicing result;

[0146] The first encryption submodule is used to use a preset encryption algorithm to perform an encryption operation on the first splicing result to generate a first encrypted value.

[0147] In this embodiment, the second encryption module includes a second identification submodule, a data analysis submodule, a second splicing submodule and a second encryption submodule, wherein:

[0148] A second identification submodule is used to identify, through the second identification field, the total number of times the target receiving end receives the message field currently sent by the target sending end, wherein the total number of times the received message field is received is the number of times the message field is received historically and the number and value of the message field is received currently;

[0149] A data parsing submodule, configured to obtain the currently sent message field and the first encrypted value through the target parsing end;

[0150] A second splicing submodule, configured to splice the currently sent message field and the total number of received message fields through the target parsing end to obtain a second splicing result;

[0151] The second encryption submodule is used to perform encryption operation on the second splicing result by using the encryption algorithm to generate a second encrypted value.

[0152] When the present application monitors the interface transmission instruction sent by the sending end, it identifies the total number of times the sending end sends the message field to the receiving end; splices the message field and the total number of times to obtain a first splicing result; performs an encryption operation on the first splicing result; identifies the total number of times the receiving end receives the message field through the sending end; splices the message field and the total number of times to obtain a second splicing result; performs an encryption operation on the second splicing result; compares the results of the two encryption operations, and sends an interface feedback message to the sending end based on the comparison result. The present application adopts the above processing method to provide a more effective interface transmission security protection method, effectively identifies malicious requests sent by malicious clients, avoids malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and makes the activity benefit discounts issued through the interface transmission method as much as possible distributed to real customers, thereby improving the service experience of real customers.

[0153] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0154] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0155] To solve the above technical problems, the present application also provides a computer device. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0156] The computer device 6 includes a memory 6a, a processor 6b, and a network interface 6c that are interconnected through a system bus. It should be noted that the figure only shows a computer device 6 with components 6a-6c, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0157] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0158] The memory 6a includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 6a can be an internal storage unit of the computer device 6, such as a hard disk or memory of the computer device 6. In other embodiments, the memory 6a can also be an external storage device of the computer device 6, such as a plug-in hard disk equipped on the computer device 6, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 6a can also include both the internal storage unit of the computer device 6 and its external storage device. In this embodiment, the memory 6a is generally used to store the operating system and various application software installed on the computer device 6, such as a computer-readable instruction of an interface transmission protection method, etc. In addition, the memory 6a can also be used to temporarily store various types of data that have been output or are to be output.

[0159] The processor 6b may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 6b is generally used to control the overall operation of the computer device 6. In this embodiment, the processor 6b is used to run the computer-readable instructions stored in the memory 6a or process data, such as running the computer-readable instructions of the interface transmission protection method.

[0160] The network interface 6c may include a wireless network interface or a wired network interface. The network interface 6c is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0161] The computer device proposed in this embodiment belongs to the field of secure transmission technology and is applied to scenarios where data is transmitted between terminals through interfaces. When the interface transmission instruction sent by the sending end is monitored, the application identifies the total number of times the sending end sends the message field to the receiving end; splices the message field and the total number of times to obtain a first splicing result; performs an encryption operation on the first splicing result; identifies the total number of times the receiving end receives the message field through the sending end; splices the message field and the total number of times to obtain a second splicing result; performs an encryption operation on the second splicing result; compares the results of the two encryption operations, and sends an interface feedback message to the sending end based on the comparison result. The application adopts the above-mentioned processing method to provide a more effective interface transmission security protection method, effectively identify malicious requests sent by malicious clients, avoid malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and make the activity benefit discounts issued through the interface transmission method as much as possible distributed to real customers, thereby improving the service experience of real customers.

[0162] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by a processor to enable the processor to perform the steps of the interface transmission protection method as described above.

[0163] The computer-readable storage medium proposed in this embodiment belongs to the field of secure transmission technology and is applied to scenarios where data is transmitted between terminals through interfaces. When the interface transmission instruction sent by the sending end is monitored, the application identifies the total number of times the sending end sends the message field to the receiving end; splices the message field and the total number of times to obtain a first splicing result; performs an encryption operation on the first splicing result; identifies the total number of times the receiving end receives the message field through the sending end; splices the message field and the total number of times to obtain a second splicing result; performs an encryption operation on the second splicing result; compares the results of the two encryption operations, and sends an interface feedback message to the sending end based on the comparison result. The application adopts the above-mentioned processing method to provide a more effective interface transmission security protection method, effectively identify malicious requests sent by malicious clients, avoid malicious third parties from using interface transmission vulnerabilities to obtain a large number of activity benefits, and make the activity benefit discounts issued through the interface transmission method distributed to real customers as much as possible, thereby improving the service experience of real customers.

[0164] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0165] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. An interface transmission protection method, characterized in that: The steps include: When the interface transmission instruction sent by the target sending end is detected, the preset first identification field and the second identification field are called to obtain the corresponding attribute value; Encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain a first encrypted value; Sending the currently sent message field and the first encrypted value to a target parsing end; The target parsing end encrypts the currently sent message field and the attribute value obtained through the second identification field together to obtain a second encrypted value; The first encryption value and the second encryption value are compared, and based on the comparison result, an interface feedback message is sent to the target sending end.

2. The interface transmission protection method according to claim 1, characterized in that: The step of encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain the first encrypted value specifically includes: Identify the total number of times the target sending end sends a message field to the target receiving end through the first identification field, wherein the total number of times the message field is sent is the number of times the message field is sent historically and the number and value of the message field being sent currently; Splicing the currently sent message field and the total number of times the message field is sent to obtain a first splicing result; A preset encryption algorithm is used to perform an encryption operation on the first splicing result to generate a first encrypted value.

3. The interface transmission protection method according to claim 2, characterized in that: The step of encrypting the currently sent message field and the attribute value obtained through the second identification field by the target parsing end to obtain the second encrypted value specifically includes: Identifying, by the second identification field, the total number of times the target receiving end receives the message field currently sent by the target sending end through the target receiving end when the target receiving end receives the message field currently sent by the target sending end, wherein the total number of times the message field is received is the number of times the message field is received historically and the number and value of the message field is received currently; Obtaining the currently sent message field and the first encrypted value through the target parsing end; The target parsing end splices the currently sent message field and the total number of received message fields to obtain a second splicing result; The encryption algorithm is used to perform an encryption operation on the second splicing result to generate a second encrypted value.

4. The interface transmission protection method according to claim 1, characterized in that: The step of comparing the first encrypted value and the second encrypted value, and sending an interface feedback message to the target sending end according to the comparison result, specifically includes: Determining whether the first encrypted value and the second encrypted value are the same; If the first encrypted value is the same as the second encrypted value, sending a service program response packet to the target sending end, and sending a message indicating that the service request has been successfully identified to the target sending end; If the first encryption value is different from the second encryption value, a message indicating that the service request identification failed is sent to the target sending end, and an alarm message is sent to a preset security interception terminal.

5. The interface transmission protection method according to claim 2, characterized in that: The target sending end includes a server, the target parsing end includes a preset third-party parsing end, the target receiving end includes a client, the message field includes a service program response packet, the first identification field is used to record the total number of service responses sent by the server to the client, and the second identification field is used to record the total number of service responses received by the client through the server, The step of calling the preset first identification field and the second identification field to obtain the corresponding attribute value when the interface transmission instruction sent by the target sending end is monitored specifically includes: When the interface transmission instruction sent by the server is detected, the first identification field and the second identification field are called; The step of encrypting the currently sent message field and the attribute value obtained through the first identification field together to obtain the first encrypted value specifically includes: Identify the total number of times the server sends service program response packets to the client through the first identification field; splicing the service program response packet and the total number of times the server sends the service program response packet to the client to obtain the first splicing result; Using a preset encryption algorithm to perform an encryption operation on the first splicing result to generate a first encrypted value; The step of sending the currently sent message field and the first encrypted value to the target parsing end includes: Sending the service program response packet and the first encrypted value to the third-party parsing terminal, wherein the third-party parsing terminal is any security terminal other than the client; The step of encrypting the currently sent message field and the attribute value obtained through the second identification field by the target parsing end to obtain the second encrypted value specifically includes: Identify, by using the second identification field, the total number of service program response packets received by the client through the server when the client receives the service program response packet sent by the server this time; Parsing the service program response packet and the first encrypted value through the third-party parsing terminal; The third-party parsing end splices the service program response packet and the total number of service program response packets received by the client through the server to obtain the second splicing result; The encryption algorithm is used to perform an encryption operation on the second splicing result to generate a second encrypted value.

6. The interface transmission protection method according to claim 5, characterized in that: The step of comparing the first encrypted value and the second encrypted value, and sending an interface feedback message to the target sending end according to the comparison result, specifically includes: Determining whether the first encrypted value and the second encrypted value are the same; If the first encrypted value is the same as the second encrypted value, sending a service program response packet to the client through the third-party parsing end, and sending a message to the client indicating that the service request has been successfully identified; If the first encryption value is different from the second encryption value, a message indicating that the service request identification failed is sent to the client, and an alarm message is sent to a preset security interception terminal.

7. The interface transmission protection method according to any one of claims 2 to 6, characterized in that: The preset encryption algorithm includes an HMAC encryption algorithm, and the step of using the preset encryption algorithm to perform encryption operation on the first splicing result to generate a first encrypted value specifically includes: Using the HMAC encryption algorithm to perform encryption operation on the first splicing result, and generating an HMAC value as the first encryption value; The step of using the encryption algorithm to perform encryption operation on the second splicing result to generate a second encrypted value specifically includes: The HMAC encryption algorithm is used to perform an encryption operation on the second concatenation result to generate an HMAC value as the second encryption value.

8. An interface transmission protection device, characterized in that: include: The identification field calling module is used to call the preset first identification field and the second identification field to obtain the corresponding attribute value when monitoring the interface transmission instruction sent by the target sending end; A first encryption module, used to encrypt the currently sent message field and the attribute value obtained through the first identification field together to obtain a first encrypted value; A data sending module, used for sending the currently sent message field and the first encrypted value to a target parsing end; A second encryption module, configured to encrypt the currently sent message field and the attribute value obtained through the second identification field through the target parsing end to obtain a second encrypted value; A comparison feedback module is used to compare the first encryption value and the second encryption value, and send an interface feedback message to the target sending end according to the comparison result.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the interface transmission protection method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the interface transmission protection method according to any one of claims 1 to 7 are implemented.

Images