Message processing method and device, electronic equipment and storage medium

Abstract

The invention is suitable for the technical field of communication, and provides a message processing method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the decryption of a received request message through employing a preset decryption algorithm; under the condition that the decryption processing is abnormal, a first abnormal frequency is updated, the latest first abnormal frequency is obtained, the first abnormal frequency is used for indicating the abnormal frequency when the security gateway carries out decryption processing on the request message sent by the target client, and the first abnormal frequency is used for indicating the latest first abnormal frequency when decryption processing is carried out on the request message sent by the target client. The target client is a client which sends the request message; and under the condition that the latest first abnormal frequency is smaller than or equal to a first threshold value, indicating a server to carry out service processing corresponding to the request message. The fault tolerance of service interaction can be improved.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular, relates to a message processing method, device, electronic device and computer-readable storage medium. Background Art

[0002] A security gateway is a device or system that is set between the internal network and the external network, and is mainly used to protect the internal network from external threats. In the process of interaction between the client of the external network and the server in the internal network, encryption algorithms are usually used to encrypt the transmitted messages. The security gateway is responsible for decrypting and routing the request messages from the client, and then forwarding the request messages to the server in the internal network.

[0003] To protect the server from malicious attacks, when the security gateway decrypts the request message from the client, if there is an exception in the decryption, it will usually directly intercept the request message with the decryption exception. Client encryption leakage and data packet loss may cause decryption exceptions. Intercepting these request messages with decryption exceptions will cause the client's normal requests to be unable to be responded to, reducing the reliability of the business system. Summary of the invention

[0004] The embodiments of the present application provide a message processing method, device, electronic device and storage medium, which can improve the fault tolerance of business interaction.

[0005] In a first aspect, an embodiment of the present application provides a message processing method, including:

[0006] Decrypt the received request message using a preset decryption algorithm;

[0007] In the case where an exception occurs in the decryption process, updating the first exception number to obtain the latest first exception number, wherein the first exception number is used to indicate the number of exceptions that occur when the security gateway decrypts the request message sent by the target client, and the target client is the client that sends the request message;

[0008] When the latest first abnormal number is less than or equal to the first threshold, instruct the server to perform the service processing corresponding to the request message

[0009] In a second aspect, an embodiment of the present application provides a message processing device, including:

[0010] A decryption module, used to decrypt the received request message using a preset decryption algorithm;

[0011] An updating module, configured to update the first exception number in the case where an exception occurs in the decryption process, and obtain the latest first exception number, wherein the first exception number is used to indicate the number of exceptions that occur when the security gateway decrypts the request message sent by the target client, and the target client is the client that sends the request message;

[0012] A processing module is used to instruct the server to perform business processing corresponding to the request message when the latest number of the first abnormalities is less than or equal to a first threshold.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the message processing method described in the first aspect when executing the computer program.

[0014] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the message processing method described in the first aspect are implemented.

[0015] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the message processing method described in the first aspect above.

[0016] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0017] In an embodiment of the present application, a preset decryption algorithm is used to decrypt the currently received request message. When an exception occurs in the decryption process, the first exception number is updated to obtain the latest first exception number. Since the first exception number is the number of times the decryption process of each request message sent by the target client is abnormal, and the target client is the client that sends the request message, that is, the first exception number is the total number of times the decryption exception occurs in each request message sent by the client, therefore, it is determined whether to instruct the server to perform the business processing corresponding to the current request message according to the latest first exception number. If the latest first exception number is less than or equal to the first threshold, the request message with the abnormal decryption process will not be intercepted, but the server is instructed to perform the business processing corresponding to the request message, which can increase the probability of the client's normal request being responded to, which is conducive to improving the fault tolerance and reliability of the business system in the business interaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0019] Figure 1 It is a flowchart of a message processing method provided by an embodiment of the present application;

[0020] Figure 2 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0023] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0024] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0025] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways.

[0027] Embodiment 1:

[0028] Figure 1A flow chart of a message processing method provided in an embodiment of the present application is shown, and the message processing method is applied to a security gateway, and is described in detail as follows:

[0029] Step S101: Decrypt the received request message using a preset decryption algorithm.

[0030] The above-mentioned preset decryption algorithm refers to the decryption algorithm agreed upon by the security gateway and the client. The preset decryption algorithm can be a symmetric encryption algorithm, an asymmetric encryption algorithm or a hybrid encryption algorithm, etc. The embodiment of the present application does not specifically limit the specific encryption algorithm and decryption algorithm used.

[0031] To ensure the security of the transmitted request message, the client will pre-negotiate the encryption and decryption algorithms of the message with the security gateway. During the message transmission process, the client will use the preset encryption algorithm to encrypt the request message it sends, and the security gateway will use the preset decryption algorithm to decrypt the request message it obtains, so as to protect the integrity and authenticity of the request message through encrypted transmission, and at the same time help prevent man-in-the-middle attacks and fake servers.

[0032] Step S102, when an exception occurs in the above decryption processing, the first exception number is updated to obtain the latest first exception number. The first exception number is used to indicate the number of exceptions that occur when the security gateway decrypts the request message sent by the target client. The target client is the client that sends the request message.

[0033] Abnormal decryption processing includes, but is not limited to, key errors, mismatched decryption algorithms, data corruption (such as packet loss), improper decryption logic processing, and excessive decryption time. For example, the encryption strength of the request message is too high, resulting in the security gateway being unable to complete the decryption process within a reasonable time (such as 3 minutes) due to insufficient computing resources. That is, if the security gateway does not complete the decryption process within the set time threshold (such as 5 minutes), the security gateway will also determine that the decryption process of the request message is abnormal.

[0034] In some embodiments, the first number of exceptions may be the number of exceptions that occur when the target client decrypts a request message sent by the target client within a preset time period. The preset time period may be determined based on the sending time or receiving time of the current request message and a preset duration (24 hours).

[0035] For example, assuming that the preset time period is within 12 hours before the current request message is received, and assuming that the request message B sent by the target client A is received at 15:30, the first abnormal number is the number of abnormal decryption processing of the request message sent by the target client A received by the security gateway in the time period from 3:30 to 15:30. Assuming that before receiving the request message B, the first abnormal number is 3, if the decryption processing of the request message B is abnormal, the first abnormal number will be updated, and after the update, the latest first abnormal number is 4.

[0036] In some embodiments, since the attacker usually sends multiple request messages continuously when sending a request message to the server, at this time, the security gateway usually receives multiple request messages sent by the same client in a short period of time. Therefore, in order to improve the accuracy of message processing, when an exception occurs in the decryption processing of the current request message, if the exception is continuous, that is, the decryption processing of one or more request messages previously sent by the target client that are continuous with the request message all have exceptions, at this time, when updating the first exception coefficient, the first exception number can be weighted according to the continuous number of exceptions to increase the probability of the request message sent by the target client that continuously sends abnormal request messages being isolated.

[0037] In some embodiments, if an exception occurs when the security gateway decrypts a received request message, an exception notification may be sent to the target terminal corresponding to the user to inform the user that the decryption process of the request message is abnormal.

[0038] In an embodiment of the present application, if an exception occurs in the decryption processing of the request message, the first exception number is updated in a timely manner to obtain the latest first exception number, so that when subsequently judging the size relationship between the first exception number and the first threshold, the judgment can be made based on the latest first exception number, thereby ensuring the accuracy of the judgment result and thus ensuring the accuracy of the message processing.

[0039] Step S103: When the latest first abnormal number is less than or equal to the first threshold, instruct the server to perform the service processing corresponding to the request message.

[0040] Optionally, the first threshold may be determined according to a history of misjudgment of abnormalities in the decryption process or by manual setting.

[0041] If it is determined that the latest number of first exceptions is less than or equal to the set first threshold (such as 3 times), it can be considered that the exception in the decryption processing may be caused by a misjudgment. At this time, the request message can be responded to normally, that is, the server can be instructed to perform the business processing corresponding to the request message, thereby increasing the probability of the client's normal request being responded to, which is conducive to improving the fault tolerance in the business interaction process.

[0042] Optionally, if the latest first abnormal number is greater than the first threshold, the request message can be isolated; or, a retransmission request can be sent to the target client, and the target client is instructed to resend the corresponding request message through the retransmission request. If the decryption processing of the retransmitted request message (the first retransmitted message) is still abnormal, the first retransmitted message can be isolated, and the request messages subsequently sent by the target client can also be isolated.

[0043] In the embodiment of the present application, after receiving the request message, the security gateway will use a preset decryption algorithm to decrypt the current request message. When the decryption process is abnormal, the first abnormal number will be updated to obtain the latest first abnormal number. Since the first abnormal number is the number of abnormal decryption processes of each request message sent by the target client, and the target client is the client that sends the current request message, that is, the first abnormal number is the number of abnormal decryption processes of each request message sent by the client, therefore, according to the latest first abnormal number, it is determined whether to instruct the server to perform the business processing corresponding to the current request message. If the latest first abnormal number is less than or equal to the first threshold, it can be considered that the security risk of the target client is low. At this time, the request message with abnormal decryption processing will not be intercepted, but the server will be instructed to perform the business processing corresponding to the request message, thereby increasing the probability of the client's normal request being responded to, which is conducive to improving the fault tolerance and reliability of the business system in the business interaction process.

[0044] In some embodiments, after the first abnormal number is updated to obtain the latest first abnormal number, the method further includes:

[0045] When the latest first abnormal number is greater than the first threshold, a lock time period corresponding to the target client is determined according to the first abnormal number.

[0046] During the above-mentioned locking time period, the above-mentioned request message sent by the above-mentioned target client is isolated.

[0047] The above-mentioned isolation processing refers to isolating data. In the embodiment of the present application, the request message is isolated to prevent its propagation from affecting the security of the security gateway and the server.

[0048] To ensure data security of the security gateway and server, after the security gateway decrypts the request message, if the latest first exception number is greater than the first threshold, it can be considered that the security risk of the target client is high. At this time, the request message sent by the target client can be isolated to reduce the impact of the request message sent by the target client with a higher security risk on the security gateway and server.

[0049] Among them, in order to reduce the impact of misjudgment, when it is determined that the latest first abnormal number is greater than the first threshold, the corresponding lock time period can be set according to the latest first abnormal number, and the request message sent by the target client is isolated and processed within the lock time period.

[0050] In an embodiment of the present application, the greater the number of first abnormality times, the longer the corresponding lock time period, that is, when the value of the first abnormality times is different, the length of the lock time period is usually different, and increases with the increase of the first abnormality times, so as to reduce the impact of abnormal message brute force attacks by increasing the lock time.

[0051] As an example, the length of the lockout time period can be determined based on a preset exponential function and the latest first abnormal number, and then the lockout time period is determined in combination with the abnormal time (such as the time when the current abnormal request message is received or the time when the decryption processing of the request message is abnormal, etc.) and the calculated length. In other embodiments, the length of the lockout time period can also be determined based on other increasing functions such as a linear increasing function or a polynomial increasing function and the first abnormal number, which can be specifically set according to the actual application scenario.

[0052] As an example, the duration of the lock period can be expressed as follows:

[0053] t=n*2 m-1

[0054] Among them, t is the length of the locking period (ie, the locking duration), n is the initial locking duration, whose value is greater than 0, and m is the first abnormal number.

[0055] In some embodiments, during the locked time period, when isolating the request message sent by the target client, the request message sent by the target client can be directly rejected, or the request message sent by the target client can be redirected to a preset isolation area after being received. No specific restrictions are imposed on the specific implementation method of the isolation processing.

[0056] Optionally, within the lock time period, if the security gateway normally receives the request message sent by the target client, it can decrypt the received request message after receiving the request message or after the lock time period ends. For the request message (target request message) for which no abnormality occurs in the decryption processing, after the lock time period ends, the server is instructed to perform the business processing corresponding to the target request message to increase the probability that the normal request of the target client is responded to. For the request message for which an abnormality occurs in the decryption processing, no business processing is required, wherein the first abnormality number can be updated according to the number of abnormalities in the decryption processing of the request message within the lock time period.

[0057] It should be noted that, in the embodiment of the present application, when an exception occurs in the decryption processing of a request message sent by a target client received within a lock time period, a new lock time period will not be determined based on the abnormal request message.

[0058] For example, assuming that the latest first exception count of client M is 3, a request message A sent by client M is received at 6:00. An exception occurs when decrypting the request message A, and the first exception count needs to be updated. At this time, the latest first exception count is 4 (calculated by 3+1).

[0059] Assume that the first threshold is 3, and the latest first abnormal number is 4, which is greater than the first threshold. Then, according to the first abnormal number and the preset function (assuming that t=1*2 m-1 ) The calculated lock duration is 8 hours (by 1*2 (4-1) Calculated), combined with the time when the request message A is received, it can be determined that the lock time period is 6:00 to 14:00. Among them, the request message A can be directly intercepted or discarded, and the server will not be instructed to perform the business processing corresponding to the request message A.

[0060] Assume that within the lock time period of 6:00 to 14:00, request messages B, C, and D are received from client M. After redirecting the received request messages to the isolation area, these request messages can be decrypted in the isolation area. Assuming that there is no abnormality in the decryption processing of request messages B and C, and there is an abnormality in the decryption processing of request message D, then after the lock time period ends, that is, after 14:00, the server can be instructed to perform the business processing corresponding to request messages B and C, and corresponding to the abnormal request message B, the request message D can be discarded, and the first abnormal number of times is updated. At this time, the latest first abnormal number of times is 5 (calculated by 4+1).

[0061] Assume that at 15:00, a request message E is received from client M. The decryption process of the request message E is abnormal. At this time, the first abnormal number needs to be updated. After the update, the latest value of the first abnormal number is 6 (calculated by 5+1). According to the first abnormal number and the preset function, the lockout duration is calculated to be 32 hours (calculated by 1*2 (6-1) Calculated), then according to the locking duration, it can be determined that the locking time period is from 15:00 to 23:00 the next day.

[0062] In some embodiments, the lockout time period, the first abnormal number, the remaining lockout time, etc. of each client may be displayed visually so that the user can be aware of the abnormal situation intuitively.

[0063] In the embodiment of the present application, when it is determined that the security risk of the target client is high, a lock time period is determined according to the first abnormal number, and the request message sent by the client is isolated and processed during the lock time period to reduce the impact of the client with high security risk on the security gateway and server. In addition, the length of the lock time period will increase with the increase of the first abnormal number. The higher the security risk of the client, the longer it will be locked. By increasing the lock time, the impact of abnormal message brute force attacks and other situations is reduced, and the security of the security gateway and server is guaranteed.

[0064] In some embodiments, after determining the lock time period corresponding to the target client according to the first abnormal number, the method further includes:

[0065] Counting the number of abnormalities in the decryption processing of the request message sent by the target client within a grace period to obtain a second number of abnormalities, wherein the grace period is a period within the lock period;

[0066] When the second abnormal number is less than or equal to the second threshold, the first abnormal number is reset.

[0067] In the embodiment of the present application, the second threshold is less than the first threshold. It should be noted that in the embodiment of the present application, when the request message sent by the target client is isolated during the lock time period, the security gateway will normally receive the request message sent by the target client, and then decrypt the received request message in the isolation environment (such as a sandbox).

[0068] To reduce the impact of misjudgment, after determining the lock time period corresponding to the target client, a grace period within the lock time period can be determined based on the lock time period. Optionally, the grace period can be an earlier period within the lock time period. For example, assuming that the lock time period is from 12:30 on February 20 to 12:30 on February 22, the grace period can be from 12:30 on February 20 to 00:30 on February 21.

[0069] During the grace period, the number of times the decryption processing of each request message sent by the target client is abnormal (that is, the number of times the decryption processing of the request message sent by the target client received during the grace period is abnormal) is counted to obtain the second abnormal number, and then it is determined whether the second abnormal number is less than or equal to the second threshold (such as 1 time). If the second abnormal number is less than or equal to the second threshold, it can be considered that the probability of the abnormality in the decryption processing being a misjudgment is relatively high. At this time, the first abnormal number can be reset. If the second abnormal number is greater than the second threshold, there is no need to reset the first abnormal number. As an example, the value of the second threshold can be 0, that is, when there is no abnormality in the decryption processing of the request message sent by the target client received during the grace period, the first abnormal number is reset. Optionally, when resetting the first abnormal number, the isolation processing of the request message sent by the target client can be synchronously released.

[0070] It should be noted that when resetting the first abnormal number, the first abnormal number can be set to 0, or the first abnormal number can be set to a preset reset value (such as 2 times, less than the first threshold), which can be set specifically according to the actual application scenario.

[0071] In other embodiments, if the second number of abnormal times is greater than or equal to the third threshold (such as 10 times), it indicates that the target client has frequently sent a large number of abnormal request messages in a short period of time, and it can be considered that the security risk of the target client is high. At this time, the target client can be permanently rejected, that is, the request message sent by the target client will no longer be received.

[0072] If the second number of abnormalities is greater than the second threshold and less than the third threshold, the first threshold corresponding to the target client can be reduced, so that when the subsequent judgment is made based on the first number of abnormalities of the target client, a stricter judgment can be made based on the smaller first threshold corresponding to it, so as to reduce the probability of the security gateway and the server being attacked. Wherein, the third threshold is greater than the second threshold, and the size relationship between the third threshold and the first threshold is not limited here.

[0073] As an example, while reducing the first threshold corresponding to the target client, the lock time period of the target client can be increased, for example, the length of the lock time period of the target client increases exponentially with the number of first anomalies. Through the above processing, the length of time for isolating the request message sent by the target client is multiplied to prevent brute force attacks and reduce security risks. It should be noted that in the embodiment of the present application, the first thresholds corresponding to different clients can be different thresholds.

[0074] It should be noted that if the first exception count is not reset after the grace period ends, after the lock period ends, the first exception count will be updated with the number of exceptions in the request messages sent by the target client during the lock period (including the grace period).

[0075] In an embodiment of the present application, a grace period is set within the lock time period. If the number of exceptions in the decryption processing of the request message sent by the target client received within the grace period is less than the second threshold, it can be considered that the probability that the previous decryption processing exception was a misjudgment is relatively high, that is, the security risk of the target client is low, and its corresponding first exception number can be reset to increase the probability of a response to the normal request sent by it, thereby further improving the fault tolerance in the business interaction process.

[0076] In some embodiments, when the latest first abnormal number is less than or equal to the first threshold, instructing the server to perform the service processing corresponding to the request message includes:

[0077] In the case where the latest first abnormal number is less than or equal to the first threshold, a legitimacy check is performed on the request message to obtain a test result, wherein the legitimacy check is used to detect whether the data in the request message is legal.

[0078] When the detection result indicates that the data in the request message is legal, the server is instructed to perform the business processing corresponding to the request message.

[0079] The above-mentioned legitimacy detection includes but is not limited to malicious attack detection, certificate detection, checksum detection and message authentication code (MAC) detection.

[0080] To further ensure the data security of the server, before instructing the server to perform the business processing corresponding to the request message, the request message can be first checked for legitimacy. The legitimacy check can be used to determine whether the data in the request message is legal, so as to filter out request messages containing illegal data and reduce the risk of security gateways and servers being attacked.

[0081] In other embodiments, the request message may be checked for legitimacy when the latest number of first exceptions is less than or equal to the first threshold and greater than 0. If the latest number of first exceptions is 0, it can be considered that the security risk of the target client is low. At this time, the server can be directly instructed to perform the business processing corresponding to its request message.

[0082] Optionally, if the detection result indicates that there is illegal data in the request message, at this time, the request message can be isolated. Alternatively, the target client can be instructed to resend the request message. If the decryption processing of the request message resent by the target client (the second resent message) is abnormal or contains illegal data, at this time, the target client can be permanently rejected, that is, the request message sent by the target client will no longer be received.

[0083] In some embodiments, the above-mentioned legitimacy detection includes malicious attack detection and business field verification. Among them, malicious attack detection is mainly used to detect whether there is malicious intent in the request message, such as detecting whether there is SQL injection (Structured Query Language Injection), XSS injection (Cross-Site Scripting) and replay attack in the request message. Business field verification is mainly used to detect whether each business field in the request message meets the requirements (such as business logic requirements and format requirements, etc.) to ensure the legitimacy and validity of the data. For example, check whether the format such as data type and length meets expectations; check whether the values ​​of data such as age and price are within the legal range; check whether the data is complete, such as whether the required fields are empty, whether the related data is consistent, etc.

[0084] In an embodiment of the present application, when it is determined that the server can be instructed to perform business processing corresponding to the request message, the request message is first checked for legitimacy. If the test result indicates that the data in the request message is legal, the server is then instructed to perform corresponding business processing to reduce the risk of the server being attacked and improve data security.

[0085] In some embodiments, after the instructing server to perform the service processing corresponding to the request message, the method further includes:

[0086] When the response data corresponding to the request message is obtained, the response data is encrypted using a preset encryption algorithm to obtain a response message.

[0087] The above response message is sent to the above target client.

[0088] The above preset encryption algorithm is the encryption algorithm agreed upon by the security gateway and the client.

[0089] It can be understood that after the server performs the business processing corresponding to the request message and obtains the response data, it will send the response data to the security gateway, which will encapsulate it into a message and send it to the target client.

[0090] To ensure data security, after obtaining the response data corresponding to the request message, the security gateway will first use a preset encryption algorithm to encrypt the response call. The security gateway will encapsulate the encrypted data in a specific format to obtain a response message, and then send the response message to the target client to complete a business interaction between the target client and the server.

[0091] In some embodiments, after obtaining the response data corresponding to the request message, the security gateway can first desensitize the sensitive data in the response data to protect user privacy and improve data security. For example, after obtaining the response data, the security gateway can first identify sensitive data such as ID card number, mobile phone number, bank card number, email address, etc. in the response data. After determining the sensitive data in the response data, each sensitive data can be desensitized accordingly, such as data hiding and conversion processing. For example, data such as ID card number, mobile phone number, etc. are subjected to data hiding processing, that is, part of the data is hidden; data such as name and personal address are converted, such as converting the real name to an alias, converting the detailed address to a region, etc. During the desensitization process, the security gateway can record detailed information (such as desensitization field, desensitization time and desensitization result, etc.) during the desensitization process to obtain a desensitization log so that it can be used as a basis for security review when needed.

[0092] In an embodiment of the present application, the security gateway encrypts the response data before sending it to the target client to reduce the risk of being attacked and tampered with during data transmission, which is beneficial to improving data security.

[0093] In some embodiments, the first number of exceptions is used to indicate the total number of exceptions in the decryption processing of the request message sent by the target client and the corresponding response message. After sending the response message to the target client, the process further includes:

[0094] In the case of obtaining the exception notification sent by the target client, the first exception number is updated to obtain the latest first exception number, and the exception notification is used to indicate that an exception occurs in the decryption process of the response message.

[0095] To further improve the security of message processing, after the target client obtains the response message sent by the security gateway, it will use the corresponding preset decryption algorithm to decrypt the response message. If the decryption processing of the response message is abnormal, it indicates that the response message may have been tampered with by an attacker. At this time, the target client can send an abnormal notification to the security gateway, indicating that the decryption processing of the response message is abnormal.

[0096] If the security gateway receives an exception notification sent by the target client, that is, an exception occurs in the decryption processing of the response message corresponding to the request message, the security gateway will also update the first exception number to obtain the latest first exception number.

[0097] In an embodiment of the present application, the first number of exceptions is the total number of exceptions in the decryption processing of the request message and response message sent by the target client, that is, not only the abnormal situation of the request message sent by the target client, but also the abnormal situation of the response message returned by the security gateway to the target client is considered. It can consider the security risks of the target client more comprehensively, and ensure the security of business interaction while improving the fault tolerance of business interaction.

[0098] In some embodiments, the decryption algorithm includes a hash function, a symmetric encryption algorithm, and a public key encryption algorithm in sequence. The decryption process of the obtained request message using the preset decryption algorithm includes:

[0099] The request message is decrypted in sequence using the hash function, the symmetric encryption algorithm and the public key encryption algorithm.

[0100] To improve data security, multiple encryption algorithms may be used to perform multiple encryption processing on the request message. Correspondingly, when the security gateway decrypts the request message, it will use a preset decryption algorithm to decrypt the multiple encrypted request messages in sequence.

[0101] In the embodiment of the present application, the encryption algorithm of the request message includes a public key encryption algorithm, a symmetric encryption algorithm and a hash function in sequence. Correspondingly, the decryption algorithm preset in the security gateway includes a hash function, a symmetric encryption algorithm and a public key encryption algorithm in sequence.

[0102] Among them, the public key encryption algorithm is an algorithm in which a public key is used for encryption and a private key is used for decryption. The public key can be made public, but the private key needs to be kept confidential. The public key encryption algorithm is used for encryption processing, and the private key does not need to be transmitted between the target client and the security gateway, which can reduce the risk of key leakage. Optionally, the public key encryption algorithm can be an elliptic curve public key cryptography algorithm (State Commercial Cryptography Algorithm No. 2 Elliptic Curve Cryptography, SM2 algorithm).

[0103] A symmetric encryption algorithm is an algorithm that uses the same key for encryption and decryption. Since only one key is used, the encryption and decryption processing speed of the symmetric encryption algorithm is accelerated, and a large amount of data can be encrypted and decrypted, which is beneficial to improving the message processing efficiency and business interaction efficiency. Optionally, the above-mentioned symmetric encryption algorithm can be a lightweight symmetric encryption algorithm such as a symmetric block cipher algorithm (Commercial Cryptography Algorithm No.3Secure Hash Algorithm, SM4 algorithm), a stream cipher (Stream Ciphers) or PRESENT (Present Block Cipher).

[0104] Hash function, also known as hash function. Hash function transforms input of any length into output of fixed length through hash algorithm. Using hash function to encrypt data can simplify data, thereby reducing the cost and duration of message transmission. Optionally, the above hash function can be a cryptographic hash function standard (Commercial Cryptography Algorithm No. 4 Block Cipher Algorithm, SM3 algorithm), or a hash function such as MD5 (Message-Digest Algorithm 5), SHA-3 (Secure Hash Algorithm 3) or BLAKE2.

[0105] In some embodiments, when the target client uses a public key encryption algorithm, a symmetric encryption algorithm, and a hash function to encrypt the request data, the public key encryption algorithm can be used to first encrypt the Internet Protocol Address (IP address) of the target client to obtain a signature data (first signature data), and the first signature data is attached to the end of the request data to obtain a first message with the IP signature information of the target client; then, the public key encryption algorithm can be continued to be used to process the first message to obtain a second signature data, and the second signature data is attached to the end of the first message to obtain a second message with the overall signature information of the first message.

[0106] After obtaining the second message, the second message is encrypted using a symmetric function to obtain an encrypted third message; finally, the third message is processed using a hash function to obtain a hash value (first hash value) of a fixed size (such as 32 bytes), and the first hash value is appended to the end of the third message to obtain a multi-encrypted request message.

[0107] In the embodiment of the present application, the size of the first signature data is set to 64 bytes, the size of the second signature data is set to 64 bytes, and the size of the third signature data is set to 32 bytes. In other embodiments, the sizes of the first signature data, the second signature data, and the third signature data may also be other values.

[0108] Correspondingly, when the security gateway uses the hash function, symmetric encryption algorithm and public key encryption algorithm to decrypt the request message in sequence, it can take 32 bytes of data from the back to the front in the data field of the request message, use it as the first data, use the hash function to calculate the first data, and obtain a 32-byte hash value (second hash value), and compare the second hash value with the last 32 bytes of data in the request message; if the second hash value is the same as the last 32 bytes of data in the request message (ie, the first hash value), it indicates that the decryption is correct and the request message passes the integrity check based on the hash function.

[0109] After correctly decrypting using the hash function, a symmetric encryption function can be used to decrypt the data in the data field of the request message except for the last 32 bytes (equivalent to the third message). If decrypted correctly, the second message can be obtained.

[0110] After obtaining the second message, take out the second signature data of the last 64 bytes of the second message, remove the data other than the second signature data, that is, the first message, use the public key encryption algorithm to calculate the signature data of the first message, and obtain the fourth signature data, and then compare the fourth signature data with the second signature data. If they are the same, it can be considered that the message signature verification is passed, that is, the decryption is correct. At this time, the last 64 bytes of data, that is, the first signature data, can be taken out from the first message, and the public key encryption algorithm is used to calculate the IP address of the target client to obtain the fifth signature data, which is compared with the first signature data. If the fifth signature data is the same as the first signature data, it can be considered that the target client signature verification is passed, that is, the decryption is correct. At this point, the original request data can be obtained based on the data except the last 64 bytes in the first message.

[0111] It can be understood that when the encryption algorithm preset in the security gateway is the same as the encryption algorithm preset in the target client, the processing steps of the security gateway when encrypting the response data according to the preset encryption algorithm are the same as the processing steps when the target client encrypts the request data according to the preset encryption algorithm, and will not be repeated here.

[0112] In the embodiment of the present application, three different encryption algorithms, namely, a public key encryption algorithm, a symmetric encryption algorithm and a hash function, are used to perform multiple encryption processing on the request message to achieve full message encryption of the request message, which can better ensure the security of the request message and effectively reduce the security risks caused by the request message being tampered with or the attacker forging the request message.

[0113] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0114] Embodiment 2:

[0115] Corresponding to the message processing method described in the above embodiment, Figure 2 A structural block diagram of a message processing device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0116] Reference Figure 2 The device comprises: a decryption module 21, an update module 22 and a processing module 23. Among them,

[0117] The decryption module 21 is used to decrypt the received request message using a preset decryption algorithm.

[0118] The update module 22 is used to update the first exception number when an exception occurs in the above-mentioned decryption processing, and obtain the latest first exception number. The above-mentioned first exception number is used to indicate the number of exceptions that occur when the above-mentioned security gateway decrypts the request message sent by the above-mentioned target client. The above-mentioned target client is the client that sends the above-mentioned request message.

[0119] The processing module 23 is used to instruct the server to perform the service processing corresponding to the request message when the latest first abnormal number is less than or equal to the first threshold.

[0120] In the embodiment of the present application, after receiving the request message, the security gateway will use a preset decryption algorithm to decrypt the current request message. When the decryption process is abnormal, the first abnormal number will be updated to obtain the latest first abnormal number. Since the first abnormal number is the number of abnormal decryption processes of each request message sent by the target client, and the target client is the client that sends the current request message, that is, the first abnormal number is the number of abnormal decryption processes of each request message sent by the client, therefore, according to the latest first abnormal number, it is determined whether to instruct the server to perform the business processing corresponding to the current request message. If the latest first abnormal number is less than or equal to the first threshold, it can be considered that the security risk of the target client is low. At this time, the request message with abnormal decryption processing will not be intercepted, but the server will be instructed to perform the business processing corresponding to the request message, thereby increasing the probability of the client's normal request being responded to, which is conducive to improving the fault tolerance and reliability of the business system in the business interaction process.

[0121] In some embodiments, the message processing device further includes:

[0122] The locking time period determination module is used to determine the locking time period corresponding to the target client according to the first abnormal number when the latest first abnormal number is greater than the first threshold.

[0123] The isolation module is used to isolate the request message sent by the target client within the locking time period.

[0124] In some embodiments, the message processing device further includes:

[0125] The second abnormal number counting module is used to count the number of abnormalities in the decryption processing of the above request message sent by the above target client within the grace period to obtain the second abnormal number, and the above grace period is a time period within the above lock period.

[0126] The reset module is used to reset the first abnormal number when the second abnormal number is less than or equal to the second threshold.

[0127] In some embodiments, the message processing device further includes:

[0128] The detection module is used to perform a legitimacy check on the request message to obtain a detection result when the latest first abnormal number is less than or equal to the first threshold. The legitimacy check is used to detect whether the data in the request message is legal.

[0129] The business processing module is used to instruct the server to perform the business processing corresponding to the request message when the detection result indicates that the data in the request message is legal.

[0130] In some embodiments, the message processing device further includes:

[0131] The encryption module is used to encrypt the response data corresponding to the request message using a preset encryption algorithm to obtain a response message.

[0132] The response module is used to send the above response message to the above target client.

[0133] In some embodiments, the first number of exceptions is used to indicate the number of exceptions that occur in the decryption processing of the request message sent by the target client and the corresponding response message, and the message processing device further includes:

[0134] The response update module is used to update the first abnormal number of times to obtain the latest first abnormal number of times when the abnormal notification sent by the target client is obtained. The abnormal notification is used to indicate that an abnormality occurs in the decryption processing of the response message.

[0135] In some embodiments, the decryption algorithm includes a hash function, a symmetric encryption algorithm and a public key encryption algorithm in sequence, and the decryption module 23 includes:

[0136] A sequential decryption unit is used to use the above-mentioned hash function, the above-mentioned symmetric encryption algorithm and the above-mentioned public key encryption algorithm to decrypt the above-mentioned request message in sequence.

[0137] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0138] Embodiment three:

[0139] Figure 3 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 3As shown, the electronic device 3 of this embodiment includes: at least one processor 30 ( Figure 3 Only one processor is shown in the figure), a memory 31, and a computer program 32 stored in the memory 31 and executable on the at least one processor 30, wherein the processor 30 implements the steps in any of the above-mentioned method embodiments when executing the computer program 32.

[0140] The electronic device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 3 and does not constitute a limitation on the electronic device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0141] The processor 30 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0142] In some embodiments, the memory 31 may be an internal storage unit of the electronic device 3, such as a hard disk or memory of the electronic device 3. In other embodiments, the memory 31 may also be an external storage device of the electronic device 3, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 3. Further, the memory 31 may also include both an internal storage unit of the electronic device 3 and an external storage device. The memory 31 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 31 may also be used to temporarily store data that has been output or is to be output.

[0143] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0144] An embodiment of the present application also provides a network device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the above-mentioned method embodiments when executing the computer program.

[0145] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0146] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / electronic device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0148] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0149] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0150] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0151] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0152] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A message processing method, characterized in that: Applied to security gateways, including: Decrypt the received request message using a preset decryption algorithm; In the case where an exception occurs in the decryption process, updating the first exception number to obtain the latest first exception number, wherein the first exception number is used to indicate the number of exceptions that occur when the security gateway decrypts the request message sent by the target client, and the target client is the client that sends the request message; When the latest first abnormal number is less than or equal to a first threshold, instruct the server to perform business processing corresponding to the request message.

2. The message processing method according to claim 1, characterized in that: After the first abnormal number is updated to obtain the latest first abnormal number, the method further includes: When the latest number of the first exceptions is greater than the first threshold, determining a lock time period corresponding to the target client according to the first exceptions number; During the locked time period, the request message sent by the target client is isolated.

3. The message processing method according to claim 2, characterized in that: After determining the lock time period corresponding to the target client according to the first abnormal number, the method further includes: Counting the number of times that decryption processing of the request message sent by the target client within a grace period occurs abnormally, to obtain a second number of abnormalities, wherein the grace period is a period within the lock period; When the second abnormal number is less than or equal to the second threshold, the first abnormal number is reset.

4. The message processing method according to claim 1, characterized in that: When the latest first abnormal number is less than or equal to the first threshold, instructing the server to perform the service processing corresponding to the request message includes: When the latest number of the first abnormality times is less than or equal to the first threshold, performing a legitimacy check on the request message to obtain a test result, wherein the legitimacy check is used to detect whether the data in the request message is legal; When the detection result indicates that the data in the request message is legal, the server is instructed to perform the service processing corresponding to the request message.

5. The message processing method according to claim 1, characterized in that: After the instructing server to perform the service processing corresponding to the request message, the method further includes: When response data corresponding to the request message is obtained, the response data is encrypted using a preset encryption algorithm to obtain a response message; The response message is sent to the target client.

6. The message processing method according to claim 5, characterized in that: The first number of exceptions is used to indicate the number of exceptions that occur in the decryption processing of the request message sent by the target client and the corresponding response message, and after sending the response message to the target client, further comprising: In the case of obtaining an exception notification sent by the target client, the first exception number is updated to obtain the latest first exception number, and the exception notification is used to indicate that an exception occurs in the decryption process of the response message.

7. The message processing method according to any one of claims 1 to 6, characterized in that: The decryption algorithm includes a hash function, a symmetric encryption algorithm and a public key encryption algorithm in sequence. The decryption process of the obtained request message using the preset decryption algorithm includes: The request message is decrypted in sequence using the hash function, the symmetric encryption algorithm and the public key encryption algorithm.

8. A message processing device, characterized in that: include: A decryption module, used to decrypt the received request message using a preset decryption algorithm; An updating module, configured to update the first exception number in the case where an exception occurs in the decryption process, and obtain the latest first exception number, wherein the first exception number is used to indicate the number of exceptions that occur when the security gateway decrypts the request message sent by the target client, and the target client is the client that sends the request message; A processing module is used to instruct the server to perform business processing corresponding to the request message when the latest number of the first abnormalities is less than or equal to a first threshold.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images