Data processing method and device, equipment and medium

Abstract

The invention relates to a data processing method and device, equipment and a medium, and relates to the technical field of data processing. The method comprises the following steps: receiving a target request message sent by a client; wherein the target request message is sent under the condition that the input value passes the validity verification by performing page rendering according to link configuration of the target process link, displaying a form page, and performing validity verification on the input value of a page element in the form page in response to a trigger operation on a specified page element in the form page; querying parameter constraint configuration of the target process link and immutable parameters of the target interface; based on the parameter constraint configuration and the immutable parameter, performing legality constraint verification on the request parameter in the target request message; and in response to the request parameter passing the legality constraint verification, storing the request parameter to a database. Therefore, by adopting a synchronous verification mechanism of the client and the server, the probability that an attacker bypasses front-end logic verification can be reduced, and the security of the system is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a data processing method, apparatus, device and medium. Background Art

[0002] In order to ensure the security of the business systems of financial institutions, almost every business system has various verification functions. Common verification functions include user input verification, operation logic verification, JavaScript (a lightweight, interpreted or just-in-time compiled programming language with function priority) data verification, and other front-end (i.e. client) logic verification. In the front-end development of the Web (Global Wide Area Network, also known as the World Wide Web), front-end logic verification is a common verification method, which uses the front-end language to restrict users' illegal input and operations. However, when developers develop verification methods, there may be defects or omissions, resulting in the verification logic being bypassed. In the face of such verification methods, verification can be bypassed by modifying the front-end language or tampering with parameters during transmission. Some users may try to bypass these front-end verifications and bypass some restrictions through some technical means to achieve the purpose of deceiving the system.

[0003] In the related art, the following method can be used to avoid bypassing the critical logic front-end check: disable the browser's F12 developer tool to prevent attackers from attacking the system by analyzing the front-end HTML (Hyper Text Markup Language) elements and JavaScript code.

[0004] However, this method only performs security reinforcement from the front-end perspective, such as disabling the F12 developer tool, which only treats the symptoms but not the root cause. Attackers can also bypass the verification logic through other means. Summary of the invention

[0005] The present disclosure provides a data processing method, device, equipment and medium to solve one of the technical problems in the related art at least to a certain extent. The technical solution of the present disclosure is as follows:

[0006] According to a first aspect of an embodiment of the present disclosure, there is provided a data processing method, which is applied to a server, and includes:

[0007] Receive a target request message sent by a client; wherein the target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and performing page rendering according to the link configuration, and in response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page, and sending the message when the input value passes the validity check;

[0008] Query the parameter constraint configuration of the target process link and the immutable parameters of the target interface; wherein the target interface is an interface for transmitting the target request message;

[0009] Based on the parameter constraint configuration and the immutable parameters, performing a legality constraint check on the request parameters in the target request message;

[0010] In response to the request parameters passing the legality constraint check, the request parameters are saved in a database.

[0011] According to a second aspect of an embodiment of the present disclosure, another data processing method is provided, which is applied to a client and includes:

[0012] Querying the link configuration of the target process link associated with the client from the server, and rendering the page according to the link configuration to obtain and display the form page of the target process link;

[0013] In response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page;

[0014] In response to the input value passing the legality check, sending a target request message to the server;

[0015] Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, perform a legality constraint check on the request parameters in the target request message, and in response to the request parameters passing the legality constraint check, save the request parameters to the database; wherein, the target interface is an interface for transmitting the target request message.

[0016] According to a third aspect of an embodiment of the present disclosure, there is provided a data processing device, which is applied to a server, and includes:

[0017] A receiving module, configured to receive a target request message sent by a client; wherein the target request message is obtained by querying the link configuration of the target process link associated with the client, and performing page rendering according to the link configuration, obtaining and displaying a form page of the target process link, and in response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page, and sending the request if the input value passes the validity check;

[0018] A query module, used to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface; wherein the target interface is an interface for transmitting the target request message;

[0019] A verification module, configured to perform a legality constraint check on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters;

[0020] The saving module is used to save the request parameters to a database in response to the request parameters passing the legality constraint check.

[0021] According to a fourth aspect of an embodiment of the present disclosure, another data processing device is provided, which is applied to a client and includes:

[0022] A query module, used to query the link configuration of the target process link associated with the client from the server;

[0023] A display module is used to render the page according to the link configuration, obtain and display the form page of the target process link;

[0024] A verification module, configured to verify the legitimacy of an input value of a page element in the form page in response to a trigger operation on a specified page element in the form page;

[0025] A sending module, configured to send a target request message to a server in response to the input value passing the legality check;

[0026] Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, perform a legality constraint check on the request parameters in the target request message, and in response to the request parameters passing the legality constraint check, save the request parameters to the database; wherein, the target interface is an interface for transmitting the target request message.

[0027] According to the fifth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the data processing method proposed in the first aspect of the present disclosure, or to implement the data processing method proposed in the second aspect of the present disclosure.

[0028] According to the sixth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data processing method proposed in the first aspect of the present disclosure, or to execute the data processing method proposed in the second aspect of the present disclosure.

[0029] According to the seventh aspect of the embodiments of the present disclosure, a computer program product is provided, including: a computer program, which, when executed by a processor, implements the data processing method as described in the above embodiments of the present disclosure, or implements the data processing method proposed in the above second aspect of the present disclosure.

[0030] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0031] The use of a synchronous verification mechanism between the client and the server can reduce the probability of attackers bypassing the front-end logic verification and increase the security of the system. In addition, the server adopts a parameterized and configured verification strategy to verify the request parameters, which can flexibly adapt to the ever-changing business scenarios and business processes, and minimize the workload of developers. In addition, using two pairs of asymmetric keys to encrypt and sign the transmitted request messages, verify and decrypt the signatures, which can not only prevent attackers from bypassing the front-end (ie, client) logic to tamper with the fields in the request message, but also ensure that the back-end (ie, server) can accurately obtain the request parameters in the request message, thereby improving the effectiveness of the back-end parameter verification.

[0032] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0034] Figure 1 It is a flowchart of the data processing method shown in the first embodiment of the present disclosure.

[0035] Figure 2 It is a flowchart of a data processing method shown in the second embodiment of the present disclosure.

[0036] Figure 3 It is a flowchart of a data processing method shown in the third embodiment of the present disclosure.

[0037] Figure 4 It is a flowchart of a data processing method shown in the fourth embodiment of the present disclosure.

[0038] Figure 5 It is a schematic diagram of the process link configuration interface shown in the embodiment of the present disclosure.

[0039] Figure 6 This is a schematic diagram of an authorization document management form shown in the embodiment of the present disclosure. Figure 1 .

[0040] Figure 7 This is a schematic diagram of an authorization document management form shown in the embodiment of the present disclosure. Figure 2 .

[0041] Figure 8 It is a flowchart of the data processing method shown in the fifth embodiment of the present disclosure.

[0042] Fig. 9 It is a flowchart of a data processing method shown in the sixth embodiment of the present disclosure.

[0043] Fig.10 It is a schematic diagram of a data verification principle shown in an embodiment of the present disclosure.

[0044] Fig.11 It is a structural diagram of a data processing device shown in the seventh embodiment of the present disclosure.

[0045] Fig.12 It is a schematic diagram of the structure of a data processing device shown in the eighth embodiment of the present disclosure.

[0046] Fig.13 It is a schematic structural diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0049] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0050] It should also be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0051] It should also be noted that in the embodiments of the present disclosure, certain software, components, models and other existing solutions in the industry may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present disclosure, but it does not mean that the applicant has or will necessarily use the solution.

[0052] In order to ensure the security of the business systems of financial institutions, almost every business system has various verification functions. Common verification functions include user input verification, operation logic verification, JavaScript data verification, and other front-end logic verifications, as well as some server-side logic verifications. In Web front-end development, front-end logic verification is a common verification method used to ensure that the user's input data meets specific requirements, that is, to verify the user's input data on the client side, send the verification results as parameters to the server side, or use the front-end language to restrict the user's illegal input and operations. However, when developers develop verification methods, there may be defects or omissions, resulting in the verification logic being bypassed. In the face of such verification methods, verification can be bypassed by modifying the front-end language or tampering with the parameters during transmission. Some users may try to bypass these front-end verifications and bypass some restrictions through some technical means to achieve the purpose of deceiving the system.

[0053] In the legal system of financial institutions, there are a large number of business scenarios that use workflows. The dynamic form function is realized through the configuration of form-process-link. The process binds the form and link. One process generally corresponds to one form and multiple process links. The visible range of the form of the approvers in different process links is controlled through link configuration, such as visible buttons, visible fields, editable fields, required fields, optional processing person range, etc. After the system front-end code obtains the link configuration, it controls the attributes of the page elements to achieve the dynamic display, hiding, and editability of page elements such as buttons and text boxes in the form. In addition, the legal system also has the use scenario of page element linkage, which is controlled by non-process link configuration, such as a radio button, which can determine the display method of other page elements according to the selected options.

[0054] The implementation of these feature usage scenarios of the legal system is controlled in the front-end code languages ​​such as jQuery (a lightweight, multi-browser compatible JavaScript library) and Vue (a progressive framework for building user interfaces). If only the verification control is performed on the front-end without synchronous verification on the server or the server verification is incomplete, there is often a security vulnerability of bypassing the key logic front-end, leaving attackers with an entry point for the system to be attacked. A typical bypass of the key logic front-end verification is as follows: After the attacker logs in to the system, the browser F12 developer tool can be used to analyze the system's front-end HTML elements and JavaScript code, and then find the input box element for verification, and modify its attributes or values ​​(by modifying the disable attribute of the input box to change the non-editable input box to an editable state), or debug the JavaScript code, or tamper with the request parameters to achieve the purpose of attacking the system.

[0055] In related technologies, the following methods are mainly used to avoid bypassing the key logic front-end verification:

[0056] The first method is to disable the browser's F12 developer tools to prevent attackers from attacking the system by analyzing front-end HTML elements and JavaScript code.

[0057] Second, the front end is controlled using specific components or elements.

[0058] The third type is that the code logic is hard-coded. When the front-end and back-end (i.e., the server) are developed, the verification logic is hard-coded into each interface code according to the specific interface logic verification requirements, and no unified solution is formed.

[0059] The fourth method is to add redundant parameters in the request message sent from the front end to the back end to identify the verification rules, such as identifying which fields are required or not. After the back end obtains the request message, it performs verification according to the verification rules indicated by the redundant parameters in the request message.

[0060] However, the first method only performs security reinforcement from the front-end perspective, such as disabling the F12 developer tool, which only treats the symptoms but not the root cause. Attackers can also bypass the verification logic in other ways.

[0061] The second method uses specific development components or element control methods, which is inflexible, generally cannot meet business needs, and is difficult to develop.

[0062] The third method is to hard-code the verification logic into the interface code according to the specific interface requirements during front-end and back-end development. The solutions are not unified, each works independently, and is not flexible. If the workflow changes, the interface code needs to be modified.

[0063] The fourth method is to add redundant parameters in the request message, which is redundant in design and increases the length of the request message.

[0064] In response to at least one of the above problems, the present disclosure proposes a data processing method, apparatus, device and medium.

[0065] The following describes the data processing method, device, equipment and medium of the embodiments of the present disclosure with reference to the accompanying drawings. Before describing the embodiments of the present disclosure in detail, for ease of understanding, common technical terms are first introduced:

[0066] Database: refers to a warehouse that organizes, stores and manages data according to data structure. A database is a collection of large amounts of data that is stored in a computer for a long time, organized, shareable and uniformly managed.

[0067] Annotations: can be understood as special tags in the code, which can be read during compilation, class loading, and runtime, and the corresponding processing logic can be executed. Developers can embed supplementary information in the source code through annotations without changing the original code and logic.

[0068] F12 Developer Tools: It is a powerful debugging tool built into the browser. It provides rich functions to help developers debug and analyze web pages. Users can modify HTML and CSS (Cascading Style Sheets, a computer language used to express file styles such as HTML or XML (a subset of Standard Generalized Markup Language)) through the element inspection function to change the appearance and behavior of the web page.

[0069] Figure 1 It is a flowchart of the data processing method shown in the first embodiment of the present disclosure.

[0070] The data processing method of the embodiment of the present disclosure can be applied to the server.

[0071] like Figure 1 As shown, the data processing method may include the following steps S11 to S14.

[0072] In step S11, a target request message sent by the client is received; wherein, the target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and rendering the page according to the link configuration, and responding to the trigger operation of the specified page element in the form page, the input value of the page element in the form page is verified for validity, and sent when the input value passes the validity verification.

[0073] The client refers to a software program that runs on an electronic device and provides services to users. The electronic device can be any device with computing capabilities, such as a personal computer, a mobile terminal, etc. The mobile terminal can be a mobile phone, a tablet computer, a personal digital assistant, a wearable device, and other hardware devices with various operating systems, touch screens, and / or display screens.

[0074] The target process link may be a current process link for which the logged-in user of the client has processing or approval authority.

[0075] Among them, the link configuration is used to control the visible scope of the form for processors or approvers in different process links, such as visible buttons, visible fields, editable fields, required fields, optional processor range, etc.

[0076] In the disclosed embodiment, the client can query the link configuration of the target process link from the server, and automatically assemble and dynamically render the form page according to the link configuration, obtain and display the form page of the target process link, so that the logged-in user of the client can fill in the page elements in the form page.

[0077] When the client monitors that the user has triggered a trigger operation on a specified page element in a form page (such as a save button or a submit button), the client can perform a validity check on the input values ​​of each page element in the form page, and when the input values ​​pass the validity check, send a target request message to the server, wherein the target request message includes the input values ​​that pass the validity check, and these input values ​​correspond to the page elements in the form page displayed by the client. Accordingly, the server can receive the target request message sent by the client.

[0078] In step S12, the parameter constraint configuration of the target process link and the immutable parameters of the target interface are queried; wherein the target interface is an interface for transmitting the target request message.

[0079] The parameter constraint configuration is obtained by configuring the target process link and is used to constrain at least one page element in the target process link.

[0080] Among them, the immutable parameters are obtained by configuring the target interface and are used to indicate the non-editable items of the target interface, or the non-editable items of the interface parameters of the target interface, such as serial number, mobile phone number, serial number, approval opinion, etc.

[0081] In the disclosed embodiment, the server may query the parameter constraint configuration of the target process link associated with the client, and the immutable parameters of the target interface for transmitting the target request message.

[0082] In step S13, based on the parameter constraint configuration and the immutable parameters, a legality constraint check is performed on the request parameters in the target request message.

[0083] In the disclosed embodiment, the server may perform a legality constraint check on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters.

[0084] In step S14, in response to the request parameters passing the legality constraint check, the request parameters are saved in the database.

[0085] In the disclosed embodiment, when the request parameters pass the legality check, the server can save the request parameters to the database. When the request parameters fail the legality check, in order to improve the security of the system, the server does not need to save the request parameters to the database.

[0086] The data processing method of the disclosed embodiment adopts a synchronous verification mechanism between the client and the server, which can reduce the probability of attackers bypassing the front-end logic verification and increase the security of the system. In addition, the server adopts a parameterized and configured verification strategy to verify the request parameters, which can flexibly adapt to the ever-changing business scenarios and business processes, and minimize the workload of developers.

[0087] The present disclosure provides another data processing method. Figure 2 It is a flowchart of a data processing method shown in the second embodiment of the present disclosure.

[0088] It should be noted that the data processing method can be executed alone, or it can be executed in combination with any embodiment of the present disclosure or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology, and the embodiments of the present disclosure are not limited to this.

[0089] like Figure 2 As shown, the data processing method may include the following steps S21 to S25.

[0090] In step S21, a target request message sent by the client is received; wherein the target request message is obtained by encrypting and signing the initial request message using the client's encryption public key and signature private key.

[0091] Among them, the initial request message is generated and displayed by querying the link configuration of the target process link associated with the client, and rendering the page according to the link configuration, in response to the trigger operation of the specified page element in the form page, performing a validity check on the input value of the page element in the form page, and generating a request when the input value passes the validity check.

[0092] It should be noted that the explanations of the target process links and link configurations in the above embodiment are also applicable to this embodiment and will not be repeated here.

[0093] In the disclosed embodiment, the client can query the link configuration of the target process link from the server, and automatically assemble and dynamically render the form page according to the link configuration, obtain and display the form page of the target process link, so that the logged-in user of the client can fill in the page elements in the form page.

[0094] When the client monitors that the user has triggered a trigger operation on a specified page element in a form page (such as a save button or a submit button), the client can perform a validity check on the input values ​​of each page element in the form page, and if the input value passes the validity check, generate an initial request message based on the input value that passes the validity check, and use the client's encryption public key and signature private key to encrypt and sign the initial request message to obtain a target request message. After that, the client can send the target request message to the server.

[0095] As a possible implementation, the client can use the following steps A to E to encrypt and sign the initial request message to obtain the target request message:

[0096] Step A: Encrypt the initial request message using the random key generated by the client to obtain an encrypted message.

[0097] As an example, the random key can be a random symmetric key. For example, the client can generate a 16-bit random symmetric key and use the random symmetric key to encrypt at least part of the key sensitive fields in the initial request message, or use the random symmetric key to encrypt the entire message of the initial request message to obtain an encrypted message to ensure the security of the request message during transmission.

[0098] Step B: Use the encryption public key to encrypt the random key to obtain the encryption key, so that the server can safely obtain the random key required to decrypt the request message without exposing the plaintext key during the transmission process, further improving the security of data transmission.

[0099] Step C: Use the client's signature private key to sign the information to be signed to obtain a digital signature; wherein the information to be signed is generated based on the encrypted message.

[0100] As an example, the client can splice the encrypted message, request time, user ID (Identity) and other key information according to the set rules to obtain the information to be signed. After that, the client can use the signature private key to sign the information to be signed to obtain a digital signature, where the digital signature can be used to verify the integrity of the data and the reliability of the source.

[0101] Step D: Generate the message header of the target request message based on the digital signature and encryption key.

[0102] As an example, the client can generate a message header of the target request message based on the fields required for signature verification, such as the digital signature, encryption key, request time, and user ID.

[0103] Step E: Generate the message body of the target request message according to the encrypted message.

[0104] Therefore, by encrypting and signing the request message, the security of the request message during transmission can be guaranteed, preventing attackers from bypassing the front-end logic to tamper with the fields in the request message.

[0105] In step S22, the parameter constraint configuration of the target process link and the immutable parameters of the target interface are queried; wherein the target interface is an interface for transmitting the target request message.

[0106] For the explanation of step S22, please refer to the relevant description in any embodiment of the present disclosure, which will not be repeated here.

[0107] In step S23, based on the signature public key and decryption private key of the server, the target request message is verified and decrypted to obtain an initial request message.

[0108] In the disclosed embodiment, the signature public key and decryption private key of the server may be used to verify the signature and decrypt the target request message to obtain an initial request message.

[0109] In any embodiment of the present disclosure, the server may adopt the following steps A' to C' to perform signature verification and decryption processing on the target request message to obtain an initial request message:

[0110] Step A': Use the server's signature public key to verify the validity of the digital signature in the message header of the target request message according to the signature rules. If the digital signature is valid, step B' and subsequent steps can be executed. If the digital signature is invalid, step B' and subsequent steps do not need to be executed.

[0111] Step B': In response to the digital signature being valid, the encryption key in the message header is decrypted using the server's decryption private key to obtain a random key.

[0112] Step C': Decrypt the message body of the target request message using a random key to obtain an initial request message.

[0113] In summary, two pairs of asymmetric keys are cross-stored on the client and server, one pair is used to encrypt and decrypt the encryption key, and the other pair is used to sign and verify the signature. This can not only prevent attackers from bypassing the front-end (ie, client) logic to tamper with the fields in the request message, but also ensure that the back-end (ie, server) can accurately obtain the request parameters in the request message, thereby improving the effectiveness of the back-end parameter verification.

[0114] In step S24, based on the parameter constraint configuration and the immutable parameters, a legality constraint check is performed on the request parameters in the initial request message.

[0115] In the disclosed embodiment, the server may perform a legality constraint check on the request parameters in the initial request message based on the parameter constraint configuration and the immutable parameters.

[0116] In step S25, in response to the request parameters passing the legality constraint check, the request parameters are saved in the database.

[0117] For the explanation of step S25, please refer to the relevant description in any embodiment of the present disclosure, and will not be repeated here.

[0118] The data processing method of the disclosed embodiment uses two pairs of asymmetric keys to encrypt and sign the transmitted request messages and verify and decrypt the signatures. This can not only prevent attackers from bypassing the front-end (i.e., client) logic to tamper with the fields in the request message, but also ensure that the back-end (i.e., server) can accurately obtain the request parameters in the request message, thereby improving the effectiveness of the back-end parameter verification.

[0119] The present disclosure provides another data processing method. Figure 3 It is a flowchart of a data processing method shown in the third embodiment of the present disclosure.

[0120] It should be noted that the data processing method can be executed alone, or it can be executed in combination with any embodiment of the present disclosure or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology, and the embodiments of the present disclosure are not limited to this.

[0121] like Figure 3 As shown, the data processing method may include the following steps S31 to S37.

[0122] In step S31, a target request message sent by a client is received.

[0123] Among them, the target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and rendering the page according to the link configuration, responding to the trigger operation of the specified page element in the form page, and performing a validity check on the input value of the page element in the form page, and sending it when the input value passes the validity check.

[0124] In step S32, the parameter constraint configuration of the target process link and the immutable parameters of the target interface are queried.

[0125] The target interface is an interface used to transmit the target request message.

[0126] For explanations of steps S31 to S32, reference may be made to the relevant descriptions in any embodiment of the present disclosure and will not be repeated here.

[0127] In step S33, the request parameters in the target request message are converted into a request object.

[0128] In the disclosed embodiment, the server may convert the request parameters in the target request message or the initial request message into a request object (or a request data object). Exemplarily, the request object may be InVo (Input View Object), where Vo (View Object) is used for the presentation layer to encapsulate all data of a specified page (or component).

[0129] In step S34, the request object is filtered and verified based on the parameter constraint configuration and the immutable parameters.

[0130] As an example, the server can summarize the constraints in the parameter constraint configuration and immutable parameters, and filter and verify the request object (InVo object) based on the summarized constraints to determine whether there is an attacker bypassing the front-end verification to modify the parameters that are not allowed to be edited. If the request object (InVo object) passes the verification, it means that there is no attacker bypassing the front-end verification to modify the parameters that are not allowed to be edited. At this time, the server can further execute subsequent steps. If the request object (InVo object) fails to pass the verification, it means that there is an attacker bypassing the front-end verification to modify the parameters that are not allowed to be edited. At this time, in order to improve the security of the system, the server does not need to execute subsequent steps.

[0131] In step S35, when the request object passes the verification, the request object is converted into a persistent object; wherein the persistent object corresponds to the table structure in the database.

[0132] In the embodiment of the present disclosure, when the request object (InVo object) passes the verification, the server may convert the request object (InVo object) into a Po object (Persistent Object).

[0133] In step S36, based on the annotations configured on the attribute fields of the class to which the persistent object belongs, the legality of the persistent object is checked.

[0134] Among them, the class to which the persistent object belongs can be called the Po class.

[0135] In any embodiment of the present disclosure, the annotation configured for the attribute field of the Po class, that is, the annotation introduced by the Po class, can be used to indicate at least one of the following:

[0136] The first term is a constraint on at least one parameter.

[0137] For example, the annotation introduced for the Po class may define constraints not limited to the following parameters:

[0138] Parameter description String description(), default is "";

[0139] Is it required? booleanisNotNull(), the default value is false (not required);

[0140] Maximum length constraint int maxLength(), default is 200;

[0141] Minimum length constraint minLength(), default is 0;

[0142] Is it an integer? isInt(), the default value is false (non-integer);

[0143] Is it a date type isDate(), the default value is false (not a date type);

[0144] …

[0145] The second item is the validation rule for at least one parameter, such as parameter non-null check, permission check, etc.

[0146] Therefore, it is possible to embed Po class annotations in the source code without changing the original code and logic to limit the validation rules and constraints of the parameters, which can improve the effectiveness of the legitimacy verification performed by the server.

[0147] In the disclosed embodiment, the server may perform a validity check on the persistent object based on the annotations introduced for the Po class.

[0148] In step S37, in response to the persistent object passing the validity check, the request parameters in the persistent object are written into the database.

[0149] In the embodiment of the present disclosure, the request parameters in the Po object can be written into the database if the Po object passes the legality check.

[0150] Therefore, by performing a validity check on the Po object, the verification logic can be centrally managed to avoid repeated writing of verification code in multiple places, thereby improving the maintainability and readability of the code. When the Po object passes the validity check, the request parameters in the Po object are written to the database. This not only ensures that the data written to the database complies with business rules and the expected format, thereby avoiding data inconsistency problems caused by data errors or invalid input, but also supports complex business logic (the Po object acts as a bridge for database operations and can perform complex business logic processing before writing to the database). This flexibility enables the system to better meet business needs.

[0151] The data processing method of the disclosed embodiment can more easily support complex business logic processing after converting request parameters into objects. The conversion and verification process between objects can be used as part of the business logic processing, making the business logic more coherent and complete. Encapsulating request parameters in the request object (InVo object) helps to separate the data transmitted over the network from the data structure used inside the application, increasing the decoupling of the system. The Po object focuses on the mapping with the table structure in the database, making database operations clearer and more direct.

[0152] The present disclosure provides another data processing method. Figure 4 It is a flowchart of a data processing method shown in the fourth embodiment of the present disclosure.

[0153] It should be noted that the data processing method can be executed alone, or it can be executed in combination with any embodiment of the present disclosure or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology, and the embodiments of the present disclosure are not limited to this.

[0154] like Figure 4 As shown, the data processing method may include the following steps S41 to S47.

[0155] In step S41, a target request message sent by the client is received.

[0156] The target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and rendering the page according to the link configuration, and responding to the trigger operation of the specified page element in the form page, performing the legality check on the input value of the page element in the form page, and sending it when the input value passes the legality check;

[0157] In step S42, the parameter constraint configuration of the target process link and the immutable parameters of the target interface are queried.

[0158] The target interface is an interface used to transmit the target request message.

[0159] In step S43, based on the parameter constraint configuration and the immutable parameters, a legality constraint check is performed on the request parameters in the target request message.

[0160] For explanations of steps S41 to S43, reference may be made to the relevant descriptions in any embodiment of the present disclosure and will not be repeated here.

[0161] In any embodiment of the present disclosure, the immutable parameters are generated in response to monitoring the interface configuration operation triggered on the target interface, and are used to indicate the non-editable items of the target interface, or to indicate the non-editable items of the interface parameters of the target interface, such as numbers, mobile phone numbers, serial numbers, approval opinions, etc.

[0162] In any embodiment of the present disclosure, the parameter constraint configuration is generated in response to monitoring a link configuration operation triggered on a target process link, and is used to indicate at least one of the following:

[0163] The first item is the parameter configuration of at least one page element in the form page of the target process link; wherein the parameter configuration at least includes display parameter configuration and edit parameter configuration.

[0164] The display parameter configuration is used to indicate whether page elements (such as buttons, fields, etc.) are visible.

[0165] The editing parameter configuration is used to indicate whether a page element is required, editable, etc.

[0166] The second item is the constraint configuration of at least one page element in the form page of the target process link.

[0167] The constraint configuration is used to indicate whether a page element has constraints and the specific condition parameters of the constraints.

[0168] As an example, taking the business scenario of the legal system as an example, users can use Figure 5The configuration interface shown defines and configures the process links in the workflow. For example, users can dynamically configure page elements such as visible buttons, visible buttons with constraints, visible fields, visible fields with constraints, editable fields, editable fields with conditional constraints, and required fields of the target process link.

[0169] The third item is at least one subsequent process link after the target process link.

[0170] Still Figure 5 For example, the subsequent process links may include the comprehensive processing link of the drafting department, the drafting link, the comprehensive processing link of the legal department, and the review link of the department leader.

[0171] The fourth item is the cascading display configuration of at least one page element in the form page of the target process link.

[0172] The target process link is the agent processing link in the authorization document management process in the legal system. According to the link configuration of the agent processing link, the client dynamically displays the page elements (such as buttons and fields) in the authorization document management form (such as Figure 6 or Figure 7 As shown in the figure, the dynamically displayed authorization document management form includes a scenario of cascading display of page elements. For example, for the radio button "Whether to batch process" in the authorization document management form, if the user selects "Yes", the authorization document management form can be displayed as follows Figure 6 If the user selects "No", the authorization document management form can be as shown in Figure 7 As shown, Figure 6 and Figure 7 The area above the form (i.e. Figure 6 Middle area 61 and Figure 7 The number of buttons visible in the area 71) is different, and the "Authorized Organization / Person" field ( Figure 6 As shown in area 62, Figure 7 Whether the field is required or not (as shown in area 72 in FIG. 1 ) is also different.

[0173] Among them, the target process link can be as follows Figure 6 As shown in area 63, Figure 7 As shown in area 73 in FIG.

[0174] In summary, parameterized and configurable design can flexibly adapt to ever-changing business scenarios and business processes, minimizing the workload of developers.

[0175] In step S44, it is determined whether all request parameters have passed the legality constraint check. If so, step S45 is executed; if not, steps S46 to S47 are executed.

[0176] It should be noted that step S45 and steps S46 to S47 are two parallel implementation methods. In actual application, only one needs to be executed.

[0177] In step S45, the request parameters are saved in the database.

[0178] For the explanation of step S45, please refer to the relevant description in any embodiment of the present disclosure, which will not be repeated here.

[0179] In step S46, prompt information is generated, wherein the prompt information is used to indicate the reason for failing the legality constraint check.

[0180] In an embodiment of the present disclosure, when there is at least one request parameter that fails to pass the legality constraint check, the server may generate a prompt message, wherein the prompt message is used to indicate the reason why the at least one request parameter fails to pass the legality constraint check.

[0181] In step S47, prompt information is sent to the client, so that the client updates the input value based on the prompt information.

[0182] In an embodiment of the present disclosure, the server may send prompt information to the client, so that the client displays the prompt information and updates the input value based on the prompt information.

[0183] The data processing method of the disclosed embodiment saves the request parameters that have passed the legality constraint check to the database, which can ensure that only data that complies with business rules and expected formats is stored in the database, thereby improving the accuracy and consistency of the data and helping to reduce subsequent data processing errors and unnecessary correction work. As for the request parameters that have not passed the legality constraint check, since they may cause database errors, system or application crashes or abnormal behaviors, intercepting them before they enter the database can reduce the occurrence of system errors and anomalies, and sending prompt information to the client in a timely manner can help users quickly discover and correct errors. This instant feedback mechanism can reduce user confusion and dissatisfaction and improve user experience.

[0184] The above is a data processing method executed by the server. The present disclosure also proposes a data processing method executed by the client.

[0185] Figure 8 It is a flowchart of the data processing method shown in the fifth embodiment of the present disclosure.

[0186] like Figure 8 As shown, the data processing method may include the following steps S81 to S83.

[0187] In step S81, the link configuration of the target process link associated with the client is queried from the server, and the page is rendered according to the link configuration to obtain and display the form page of the target process link.

[0188] In step S82, in response to the triggering operation on the designated page element in the form page, the legality of the input value of the page element in the form page is checked.

[0189] In step S83, in response to the input value passing the legality check, a target request message is sent to the server.

[0190] Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, the request parameters in the target request message are checked for legality constraints. In response to the request parameters passing the legality constraint check, the request parameters are saved to the database; wherein, the target interface is an interface for transmitting the target request message.

[0191] It should be noted that the explanation of the method executed by the server in any of the above embodiments is also applicable to the method executed by the client in this embodiment. The implementation principles are similar and will not be repeated here.

[0192] The data processing method of the disclosed embodiment adopts a synchronous verification mechanism between the client and the server, which can reduce the probability of attackers bypassing the front-end logic verification and increase the security of the system. In addition, the server adopts a parameterized and configured verification strategy to verify the request parameters, which can flexibly adapt to the ever-changing business scenarios and business processes, and minimize the workload of developers.

[0193] The present disclosure provides another data processing method. Fig. 9 It is a flowchart of a data processing method shown in the sixth embodiment of the present disclosure.

[0194] It should be noted that the data processing method can be executed alone, or it can be executed in combination with any embodiment of the present disclosure or a possible implementation method in the embodiment, or it can be executed in combination with any technical solution in the related technology, and the embodiments of the present disclosure are not limited to this.

[0195] like Fig. 9 As shown, the data processing method may include the following steps S91 to S95.

[0196] In step S91, the link configuration of the target process link associated with the client is queried from the server, and the page is rendered according to the link configuration to obtain and display the form page of the target process link.

[0197] In step S92, in response to the triggering operation on the designated page element in the form page, the legality of the input value of the page element in the form page is checked.

[0198] In step S93, in response to the input value passing the legality check, an initial request message is generated according to the input value that passes the legality check.

[0199] In step S94, the client's encryption public key and signature private key are used to encrypt and sign the initial request message to obtain a target request message.

[0200] In any one of the embodiments of the present disclosure, the initial request message can be encrypted using a random key generated by the client to obtain an encrypted message; the random key can be encrypted using an encryption public key to obtain an encryption key; the signature information to be signed is signed using the client's signature private key to obtain a digital signature; wherein the information to be signed is generated based on the encrypted message; based on the digital signature and the encryption key, a message header of the target request message is generated, and based on the encrypted message, a message body of the target request message is generated.

[0201] In step S95, a target request message is sent to the server.

[0202] Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, the request parameters in the target request message are checked for legality constraints. In response to the request parameters passing the legality constraint check, the request parameters are saved to the database; wherein, the target interface is an interface for transmitting the target request message.

[0203] As a possible implementation method, the target request message is specifically used for: the server queries the parameter constraint configuration of the target process link and the immutable parameters of the target interface; based on the signature public key and decryption private key of the server, the target request message is signed and decrypted to obtain an initial request message; based on the parameter constraint configuration and the immutable parameters, the request parameters in the initial request message are checked for legality constraints; in response to the request parameters passing the legality constraint check, the request parameters are saved to the database.

[0204] It should be noted that the explanation of the method executed by the server in any of the above embodiments is also applicable to the method executed by the client in this embodiment. The implementation principles are similar and will not be repeated here.

[0205] In any one of the embodiments of the present disclosure, when the input value of a page element in a form page fails to pass the validity check, the client may also generate and display a first prompt message; wherein the first prompt message is used to indicate the reason why the input value fails to pass the validity check.

[0206] Therefore, by performing a validity check on the user's input values ​​through the client, some obvious malicious input or illegal data can be prevented from entering the system, which helps to reduce potential security risks. In addition, if the validity check fails, the client will display prompt information in a timely manner to help users quickly correct errors. This instant feedback mechanism can help users quickly discover and correct errors, avoiding users from discovering problems after submitting the form and waiting for the server to respond, thereby improving the user experience.

[0207] In any embodiment of the present disclosure, the client may also receive and display a second prompt message sent by the server; wherein the second prompt message is generated by the server in response to the request parameter failing to pass the legality constraint check, and is used to indicate the reason why the request parameter fails to pass the legality constraint check.

[0208] Therefore, for request parameters that fail to pass the legality constraint check, since they may cause database errors, system or application crashes or abnormal behaviors, intercepting them before they enter the database can reduce the occurrence of system errors and exceptions. In addition, the server sends prompt information to the client in a timely manner, which can help users quickly discover and correct errors. This instant feedback mechanism can reduce user confusion and dissatisfaction and improve user experience.

[0209] It should be noted that an attacker can analyze the system's front-end HTML elements and JavaScript code to find the input box element for verification and modify its attributes or values ​​(by modifying the disable attribute of the input box to change the non-editable input box to an editable state), or debug the JavaScript code, or tamper with the request parameters to attack the system.

[0210] In view of the above problems, in any embodiment of the present disclosure, code obfuscation can be used to prevent attackers from tampering with request messages. As an example, when a client receives a code query instruction for a form page, it can respond to the code query instruction, perform code obfuscation on the page logic code, obtain the obfuscated code, and display and / or send the obfuscated code to the user.

[0211] The code query instruction is used to query the page logic code of the form page, and the page logic code is used to perform logic verification on the page elements.

[0212] Therefore, code obfuscation can prevent attackers from analyzing code logic and tampering with request messages based on the code logic.

[0213] The data processing method of the embodiment of the present disclosure encrypts and signs the transmitted request message, which can prevent attackers from bypassing the front-end logic to tamper with the fields in the request message.

[0214] In any embodiment of the present disclosure, the data processing method provided by the present disclosure is applied to the legal system of a financial institution for exemplary description. The present disclosure proposes a system-level security reinforcement method for bypassing the security vulnerability problem of the front-end verification of the key logic of the legal system. The design ideas mainly include the following points:

[0215] 1. Encrypt and sign the request message, and use code obfuscation to prevent tampering of the request message;

[0216] 2. The front-end and back-end synchronization verification mechanism does not leave any front-end logic verification that can be bypassed by attackers;

[0217] 3. The back-end verification adopts a parameterized and configured unified verification strategy to minimize the workload of developers.

[0218] That is, in this disclosure, a complete and comprehensive security reinforcement method is designed for the vulnerabilities of the key logic front-end verification, using encryption algorithms, cross-storage of secret keys at the front and back ends, message encryption and signing, front-end and back-end synchronization verification mechanisms, and dynamic and static verification methods to prevent bypassing the front-end verification logic to modify non-editable fields or tampering with request messages. Among them, for the business use scenarios of dynamic form display in the legal system, a unified interception and verification strategy with parameterized, configured, automatically assembled, dynamic and flexible constraints is adopted.

[0219] As an example, the legal system is implemented using a B / S (Browser / Server) architecture with front-end and back-end separation. Front-end and back-end requests are transmitted via HTTP protocol. The data verification principle can be as follows: Fig.10 As shown, it mainly includes the following steps:

[0220] Step 1: Implementation of specific business scenario display: The client's display control component obtains the link configuration of the current target process link through the server-side process configuration engine, and automatically assembles and dynamically renders the form page according to the link configuration.

[0221] Step 2: Implementation of client logic verification: perform legitimacy verification on user input and click events, and intercept and prompt illegal user operations.

[0222] Step 3: Encryption and signing service implementation: Use two pairs of asymmetric keys to store cross-keys in the front-end and back-end, one pair for encryption and decryption of encryption keys, and one pair for signing and verification. Encryption and signing prevent attackers from bypassing the front-end logic to tamper with the fields in the request message.

[0223] Client encryption and signing process: Each time the client requests a transaction interface (HTTP request initiated by the front end to perform a certain transaction or operation), it first generates a 16-bit random key (symmetric key, used to encrypt the request message), encrypts the entire request message or part of the key sensitive fields with the random key, obtains the encrypted message, uses the signature private key to generate a signature (signs the encrypted message after concatenating #request time#user ID), and uses the encryption public key to encrypt the random key to obtain the encryption key. The encryption key, signature, request time, user ID and other fields required for signature verification are transmitted to the server through the HTTP request message header, and the encrypted message is transmitted to the server through the HTTP request message body.

[0224] The server-side signature verification and decryption process: Use the signature public key to verify the validity of the signature according to the signature rules, use the decryption private key to decrypt the random key, and use the random key to decrypt the encrypted message.

[0225] Step 4: Implement server-side logic verification.

[0226] The parameter constraint configuration consists of three parts. One part is constrained when configuring the process engine, one part configures the non-editable items of each interface parameter in the configuration center, and the other part mainly verifies the legality of the request parameters. Some code-level verification and constraints are implemented through custom annotations. By adding annotations to the Po class, some verification rules can be defined for the Po class, such as parameter non-null checks, permission checks, etc. At the compiler or runtime, the code can be statically or dynamically verified according to the annotations. Public constraint rule conditions and public verification logic methods are encapsulated for different types of parameters. An annotation named SelfLimit is defined in the legal system, in which constraints are defined that are not limited to the following parameters:

[0227] Parameter description String description(), default is "";

[0228] Is it required? booleanisNotNull(), the default value is false (not required);

[0229] Maximum length constraint int maxLength(), default is 200;

[0230] Minimum length constraint minLength(), default is 0;

[0231] Is it an integer? isInt(), the default value is false (non-integer);

[0232] Is it a date type isDate(), the default value is false (not a date type);

[0233] …

[0234] By referencing annotations, the constraints are injected into the attribute fields of the Po class. The non-intrusive mode is ready to use. Each interface can be used as needed without writing validation logic code separately. You only need to configure the SelfLimit annotation to each attribute field (field field) on the Po class and configure it. For example, adding @SelfLimit(description="Organization Code", isNotNull=true, maxLength=10) above the organization code attribute indicates that the organization code field parameter is a required item and the maximum length does not exceed 10. For another example, adding @SelfLimit(description="Creation Date", isDate=true) above the creation date attribute indicates that the field is a date field.

[0235] As an application scenario, a complete front-end and back-end verification logic process is as follows: the user modifies and fills in the form page of the current target process link and initiates a save request. After the client's logic component verification is passed, the request message is encrypted and signed. After receiving the request message, the server verifies and decrypts the request message. After decryption, the request parameters in the message request are converted into InVo objects. The unified interception verifier queries the parameter constraint configuration of the target process link through the process configuration engine, and queries the immutable parameters of the target interface through the parameter policy of the configuration center. After summarizing the two constraints, the InVo object is filtered and verified to determine whether there is a situation in which the parameters that are not allowed to be edited are modified by bypassing the front-end verification. If not, the InVo object is converted into a Po object, and the request parameters in the Po object are checked for legality constraints according to the annotations introduced by the Po class.

[0236] Step 5: After all request parameters have passed verification, submit this modification to the database to complete the saving.

[0237] In summary, it can support the dynamic and flexible form usage scenarios of the legal system, parameterize and configure the verification logic, form a unified logic verification strategy, and a verification method that combines dynamic and static, to solve the problems of repeated code development, lack of support for dynamic expansion, and lack of flexibility in the traditional development model. The solution provided by the present disclosure can quickly adapt to business changes and has certain scalability and flexibility. After the form is automatically assembled and adjusted, the configuration constraints of the logic verification will also take effect. It will automatically judge and logically process according to the latest constraints to decide whether to execute specific code logic, and dynamically configure the behavior of the application according to the actual situation, effectively reducing the development complexity brought about by changes in business processes, and can quickly adapt to business changes. It has certain scalability and flexibility, improves the readability and maintainability of the code, eliminates the cumbersome configuration process, and simplifies the development process.

[0238] With the above Figures 1 to 4 Corresponding to the data processing method provided in the embodiment, the present disclosure also provides a data processing device. Figures 1 to 4 The data processing method provided in the embodiment corresponds to the data processing method, so the implementation of the data processing method is also applicable to the data processing device provided in the embodiment of the present disclosure, and will not be described in detail in the embodiment of the present disclosure.

[0239] Fig.11 It is a structural diagram of a data processing device shown in the seventh embodiment of the present disclosure.

[0240] Reference Fig.11 The data processing device 1100 may include: a receiving module 1110, a query module 1120, a verification module 1130 and a storage module 1140.

[0241] The receiving module 1110 is used to receive a target request message sent by a client; wherein the target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and rendering the page according to the link configuration, and responding to the trigger operation of the specified page element in the form page, the input value of the page element in the form page is verified for legitimacy, and sent when the input value passes the legitimacy verification;

[0242] A query module 1120 is used to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface; wherein the target interface is an interface for transmitting the target request message;

[0243] A verification module 1130, configured to perform a legality constraint verification on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters;

[0244] The saving module 1140 is used to save the request parameters to the database in response to the request parameters passing the legality constraint check.

[0245] In a possible implementation of the embodiment of the present disclosure, the target request message is obtained by encrypting and signing the initial request message using the client's encryption public key and signature private key; wherein the encryption and signing processing includes: generating the initial request message based on the input value that passes the legality check, and encrypting the initial request message using the random key generated by the client to obtain an encrypted message; encrypting the random key using the encryption public key to obtain an encryption key; signing the information to be signed using the client's signature private key to obtain a digital signature; wherein the information to be signed is generated based on the encrypted message; generating a message header of the target request message based on the digital signature and the encryption key, and generating a message body of the target request message based on the encrypted message.

[0246] In a possible implementation of the embodiment of the present disclosure, the verification module 1130 is specifically used to: based on the signature public key and decryption private key of the server, verify the signature and decrypt the target request message to obtain an initial request message; based on the parameter constraint configuration and immutable parameters, perform a legality constraint check on the request parameters in the initial request message.

[0247] In a possible implementation of the embodiment of the present disclosure, the verification module 1130 is specifically used to: use the signature public key of the server to verify the validity of the digital signature in the message header of the target request message according to the signature rule; in response to the digital signature being valid, use the decryption private key of the server to decrypt the encryption key in the message header to obtain a random key; use the random key to decrypt the message body of the target request message to obtain an initial request message.

[0248] In a possible implementation of the embodiment of the present disclosure, the verification module 1130 is specifically used to: convert the request parameters in the target request message into a request object; filter and verify the request object based on the parameter constraint configuration and immutable parameters; if the request object passes the verification, convert the request object into a persistent object; wherein the persistent object corresponds to the table structure in the database; and verify the legitimacy of the persistent object based on the annotations configured on the attribute fields of the class to which the persistent object belongs.

[0249] In a possible implementation of the embodiment of the present disclosure, the saving module 1140 is specifically configured to: in response to the persistent object passing the legality check, write the request parameters in the persistent object into the database.

[0250] In a possible implementation manner of the embodiment of the present disclosure, the annotation is used to indicate at least one of the following: a constraint condition of at least one parameter; a validation rule of at least one parameter.

[0251] In a possible implementation of the embodiment of the present disclosure, the immutable parameter is generated in response to monitoring an interface configuration operation triggered on a target interface, and is used to indicate an uneditable item of an interface parameter of the target interface;

[0252] The parameter constraint configuration is generated in response to monitoring a link configuration operation triggered on a target process link, and is used to indicate at least one of the following: parameter configuration of at least one page element in the form page of the target process link; wherein the parameter configuration includes at least display parameter configuration and edit parameter configuration; constraint condition configuration of at least one page element in the form page of the target process link; at least one subsequent process link located after the target process link; and cascade display configuration of at least one page element in the form page of the target process link.

[0253] In a possible implementation of the embodiment of the present disclosure, the data processing device 1100 further includes:

[0254] A generating module, configured to generate prompt information in response to the request parameter failing to pass the legality constraint check, wherein the prompt information is used to indicate the reason for failing to pass the legality constraint check;

[0255] The sending module is used to send prompt information to the client, so that the client updates the input value based on the prompt information.

[0256] The data processing device of the disclosed embodiment adopts a synchronous verification mechanism between the client and the server, which can reduce the probability of attackers bypassing the front-end logic verification and increase the security of the system. In addition, the server adopts a parameterized and configured verification strategy to verify the request parameters, which can flexibly adapt to the ever-changing business scenarios and business processes, and minimize the workload of developers.

[0257] With the above Figures 8 to 10 Corresponding to the data processing method provided in the embodiment, the present disclosure also provides a data processing device. Figures 8 to 10 The data processing method provided in the embodiment corresponds to the data processing method, so the implementation of the data processing method is also applicable to the data processing device provided in the embodiment of the present disclosure, and will not be described in detail in the embodiment of the present disclosure.

[0258] Fig.12 It is a schematic diagram of the structure of a data processing device shown in the eighth embodiment of the present disclosure.

[0259] Reference Fig.12 The data processing device 1200 may include: a query module 1210, a display module 1220, a verification module 1230 and a sending module 1240.

[0260] The query module 1210 is used to query the link configuration of the target process link associated with the client from the server;

[0261] The display module 1220 is used to render the page according to the link configuration, obtain and display the form page of the target process link;

[0262] The verification module 1230 is used to verify the legality of the input value of the page element in the form page in response to the trigger operation of the specified page element in the form page;

[0263] The sending module 1240 is used to send a target request message to the server in response to the input value passing the legality check;

[0264] Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, the request parameters in the target request message are checked for legality constraints. In response to the request parameters passing the legality constraint check, the request parameters are saved to the database; wherein, the target interface is an interface for transmitting the target request message.

[0265] In a possible implementation of the embodiment of the present disclosure, the sending module 1240 is specifically used to: in response to the input value passing the legality check, generate an initial request message according to the input value that passed the legality check; use the client's encryption public key and signature private key to encrypt and sign the initial request message to obtain a target request message; and send the target request message to the server.

[0266] In a possible implementation of the embodiment of the present disclosure, the sending module 1240 is specifically used to: encrypt the initial request message using a random key generated by the client to obtain an encrypted message; encrypt the random key using an encryption public key to obtain an encryption key; sign the information to be signed using the client's signature private key to obtain a digital signature; wherein the information to be signed is generated based on the encrypted message; generate a message header of the target request message based on the digital signature and the encryption key, and generate a message body of the target request message based on the encrypted message.

[0267] In a possible implementation of the embodiment of the present disclosure, the data processing device 1200 further includes:

[0268] The first display module is used to generate and display first prompt information in response to the input value failing to pass the legality check; wherein the first prompt information is used to indicate the reason for failing to pass the legality check.

[0269] In a possible implementation of the embodiment of the present disclosure, the data processing device 1200 further includes:

[0270] The second display module is used to receive and display the second prompt information sent by the server; wherein the second prompt information is generated by the server in response to the request parameter failing to pass the legality constraint check, and is used to indicate the reason for failing to pass the legality constraint check.

[0271] In a possible implementation of the embodiment of the present disclosure, the data processing device 1200 further includes:

[0272] A receiving module, used for receiving a code query instruction for a form page, wherein the code query instruction is used for querying a page logic code of the form page, and the page logic code is used for performing a logic check on page elements;

[0273] A processing module, used for performing code obfuscation processing on the page logic code in response to the code query instruction to obtain an obfuscated code;

[0274] The display and sending module is used to display and / or send the obfuscated code.

[0275] The data processing device of the disclosed embodiment adopts a synchronous verification mechanism between the client and the server, which can reduce the probability of attackers bypassing the front-end logic verification and increase the security of the system. In addition, the server adopts a parameterized and configured verification strategy to verify the request parameters, which can flexibly adapt to the ever-changing business scenarios and business processes, and minimize the workload of developers.

[0276] In an exemplary embodiment, the present disclosure also provides an electronic device.

[0277] Among them, electronic equipment includes:

[0278] processor;

[0279] a memory for storing processor-executable instructions;

[0280] The processor is configured to execute instructions to implement the data processing method proposed in any of the aforementioned embodiments.

[0281] As an example, Fig.13 is a schematic diagram of the structure of an electronic device 1300 shown in an exemplary embodiment of the present disclosure, such as Fig.13 As shown, the electronic device 1300 may further include:

[0282] The memory 1310 and the processor 1320, a bus 1330 connecting different components (including the memory 1310 and the processor 1320), the memory 1310 stores a computer program, and when the processor 1320 executes the program, the data processing method described in the embodiment of the present disclosure is implemented.

[0283] Bus 1330 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0284] The electronic device 1300 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 1300, including volatile and non-volatile media, removable and non-removable media.

[0285] The memory 1310 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1340 and / or cache memory 1350. The server 1300 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1360 may be used to read and write non-removable, non-volatile magnetic media ( Fig.13 not shown, usually called a "hard drive"). Although Fig.13 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 1330 via one or more data medium interfaces. The memory 1310 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0286] A program / utility 1380 having a set (at least one) of program modules 1370 may be stored, for example, in the memory 1310, such program modules 1370 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 1370 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0287] The electronic device 1300 may also communicate with one or more external devices 1390 (e.g., keyboard, pointing device, display 1391, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1300, and / or communicate with any device that enables the electronic device 1300 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 1392. In addition, the electronic device 1300 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through a network adapter 1393. As shown, the network adapter 1393 communicates with other modules of the electronic device 1300 through a bus 1330. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0288] The processor 1320 executes various functional applications and data processing by running the programs stored in the memory 1310 .

[0289] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the data processing method of the embodiment of the present disclosure, and will not be repeated here.

[0290] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory including instructions, and the above instructions can be executed by a processor of an electronic device to complete the method proposed in any of the above embodiments. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0291] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, wherein the computer program / instruction implements the method proposed in any of the above embodiments when executed by a processor.

[0292] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0293] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A data processing method, characterized in that: Applied to the server, including: Receive a target request message sent by a client; wherein the target request message is obtained and displayed by querying the link configuration of the target process link associated with the client, and performing page rendering according to the link configuration, and in response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page, and sending the message when the input value passes the validity check; Query the parameter constraint configuration of the target process link and the immutable parameters of the target interface; wherein the target interface is an interface for transmitting the target request message; Based on the parameter constraint configuration and the immutable parameters, performing a legality constraint check on the request parameters in the target request message; In response to the request parameters passing the legality constraint check, the request parameters are saved in a database.

2. The method according to claim 1, characterized in that The target request message is obtained by encrypting and signing the initial request message using the encryption public key and signature private key of the client; The encryption and signing process includes: Generate an initial request message according to the input value that passes the legality check, and encrypt the initial request message using the random key generated by the client to obtain an encrypted message; Encrypting the random secret key using the encryption public key to obtain an encryption secret key; The client's signature private key is used to sign the information to be signed to obtain a digital signature; wherein the information to be signed is generated according to the encrypted message; A message header of the target request message is generated according to the digital signature and the encryption key, and a message body of the target request message is generated according to the encrypted message.

3. The method according to claim 2, characterized in that The performing a legality constraint check on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters includes: Based on the signature public key and decryption private key of the server, the target request message is verified and decrypted to obtain the initial request message; Based on the parameter constraint configuration and the immutable parameters, a legality constraint check is performed on the request parameters in the initial request message.

4. The method according to claim 3, characterized in that The method of performing signature verification and decryption processing on the target request message based on the signature public key and decryption private key of the server to obtain the initial request message includes: Verify the validity of the digital signature in the message header of the target request message using the signature public key of the server according to the signature rule; In response to the digital signature being valid, the encryption key in the message header is decrypted using the decryption private key of the server to obtain a random key; The random key is used to decrypt the message body of the target request message to obtain the initial request message.

5. The method according to any one of claims 1 to 4, characterized in that The performing a legality constraint check on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters includes: Convert the request parameters in the target request message into a request object; Filtering and validating the request object based on the parameter constraint configuration and the immutable parameters; If the request object passes the verification, converting the request object into a persistent object; wherein the persistent object corresponds to the table structure in the database; Based on the annotations configured on the attribute fields of the class to which the persistent object belongs, the legality of the persistent object is checked.

6. The method according to claim 5, characterized in that In response to the request parameter passing the legality constraint check, saving the request parameter to a database includes: In response to the persistent object passing the validity check, the request parameters in the persistent object are written into the database.

7. The method according to claim 5, characterized in that The annotation is used to indicate at least one of the following: A constraint on at least one parameter; Validation rule for at least one parameter.

8. The method according to any one of claims 1 to 4, characterized in that The immutable parameter is generated in response to monitoring an interface configuration operation triggered on the target interface, and is used to indicate an uneditable item of an interface parameter of the target interface; The parameter constraint configuration is generated in response to monitoring a link configuration operation triggered on the target process link, and is used to indicate at least one of the following: Parameter configuration of at least one page element in the form page of the target process link; wherein the parameter configuration at least includes display parameter configuration and edit parameter configuration; Configuration of constraints for at least one page element in the form page of the target process link; at least one subsequent process link located after the target process link; A cascading display configuration of at least one page element in the form page of the target process link.

9. The method according to any one of claims 1 to 4, characterized in that: After performing a legality constraint check on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters, the method further includes: In response to the request parameter failing to pass the legality constraint check, generating prompt information, wherein the prompt information is used to indicate the reason for failing to pass the legality constraint check; The prompt information is sent to the client, so that the client updates the input value based on the prompt information.

10. A data processing method, characterized in that: Applied to the client, including: Querying the link configuration of the target process link associated with the client from the server, and rendering the page according to the link configuration to obtain and display the form page of the target process link; In response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page; In response to the input value passing the legality check, sending a target request message to the server; Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, perform a legality constraint check on the request parameters in the target request message, and in response to the request parameters passing the legality constraint check, save the request parameters to the database; wherein, the target interface is an interface for transmitting the target request message.

11. The method according to claim 10, characterized in that The step of sending a target request message to the server in response to the input value passing the legality check comprises: In response to the input value passing the legality check, generating an initial request message according to the input value passing the legality check; Using the encryption public key and signature private key of the client, encrypt and sign the initial request message to obtain the target request message; Send the target request message to the server.

12. The method according to claim 11, characterized in that The method of using the encryption public key and signature private key of the client to encrypt and sign the initial request message to obtain the target request message includes: Encrypting the initial request message using a random key generated by the client to obtain an encrypted message; Encrypting the random secret key using the encryption public key to obtain an encryption secret key; The client's signature private key is used to sign the information to be signed to obtain a digital signature; wherein the information to be signed is generated according to the encrypted message; A message header of the target request message is generated according to the digital signature and the encryption key, and a message body of the target request message is generated according to the encrypted message.

13. The method according to claim 10, characterized in that After the legality of the input value of the page element in the form page is checked, the method further includes: In response to the input value failing the legality check, generating and displaying a first prompt message; The first prompt information is used to indicate the reason for failing the legality check.

14. The method according to claim 10, characterized in that After the target request message is sent to the server in response to the input value passing the legality check, the method further includes: Receive and display the second prompt information sent by the server; The second prompt information is generated by the server in response to the request parameter failing to pass the legality constraint check, and is used to indicate the reason for failing to pass the legality constraint check.

15. The method according to any one of claims 10 to 14, characterized in that The method further comprises: Receiving a code query instruction for the form page; wherein the code query instruction is used to query the page logic code of the form page, and the page logic code is used to perform logic verification on page elements; In response to the code query instruction, code obfuscation processing is performed on the page logic code to obtain an obfuscated code; The obfuscated code is displayed and / or sent.

16. A data processing device, characterized in that: Applied to the server, including: A receiving module, configured to receive a target request message sent by a client; wherein the target request message is obtained by querying the link configuration of the target process link associated with the client, and performing page rendering according to the link configuration, obtaining and displaying a form page of the target process link, and in response to a trigger operation on a specified page element in the form page, performing a validity check on an input value of the page element in the form page, and sending the request if the input value passes the validity check; A query module, used to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface; wherein the target interface is an interface for transmitting the target request message; A verification module, used for performing a legality constraint verification on the request parameters in the target request message based on the parameter constraint configuration and the immutable parameters; The saving module is used to save the request parameters to a database in response to the request parameters passing the legality constraint check.

17. A data processing device, characterized in that: Applied to the client, including: A query module, used to query the link configuration of the target process link associated with the client from the server; A display module is used to render the page according to the link configuration, obtain and display the form page of the target process link; A verification module, configured to verify the legitimacy of an input value of a page element in the form page in response to a trigger operation on a specified page element in the form page; A sending module, configured to send a target request message to a server in response to the input value passing the legality check; Among them, the target request message is used by the server to query the parameter constraint configuration of the target process link and the immutable parameters of the target interface, and based on the parameter constraint configuration and the immutable parameters, perform a legality constraint check on the request parameters in the target request message, and in response to the request parameters passing the legality constraint check, save the request parameters to the database; wherein, the target interface is an interface for transmitting the target request message.

18. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the data processing method according to any one of claims 1 to 9, or to implement the data processing method according to any one of claims 10 to 15.

19. A computer-readable storage medium, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the data processing method as described in any one of claims 1 to 9, or execute the data processing method as described in any one of claims 10 to 15.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the data processing method according to any one of claims 1 to 9, or implements the data processing method according to any one of claims 10 to 15.

Images