Data processing method and device and electronic equipment
By encrypting and processing of identity authentication information in the interactive operation of the prompt page and information filtering, combined with server-side rendering to generate the prompt page, the problem of low security of the prompt page is solved, and more efficient information security and interactive operation security is achieved.
Patent Information
- Application Number
- CN202411495594.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2024-12-31
AI Technical Summary
In the prior art, the interaction of prompt pages has the risk of information leakage and attack, resulting in low security. Especially when plain text interaction is operated, the attacker can use relevant information to attack.
In the interactive operation of the prompt page, the identity authentication information sent from the server side is encrypted, and the encrypted information and the information entered by the user are sent to the server side. The results of the interaction are determined through the decryption results to avoid information leakage and attacks. Specific measures include using encryption algorithms to encrypt and store identity authentication information, filtering the information entered by users, and generating prompt pages through server-side rendering to avoid interface exposure.
Improve the interactive operation and overall security of prompt pages, prevent information leakage and attacks, enhance the defense capabilities of prompt pages, and ensure the accuracy and efficiency of interactive operations.
Smart Images
Figure CN119232478A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of web page security, and in particular to a data processing method, device and electronic device. Background Art
[0002] With the increasing popularity of Internet applications, the Internet has penetrated into every aspect of life. However, while the Internet has brought great convenience to the public, the fraudulent activities of dangerous websites such as fake websites have also brought many security risks.
[0003] In order to avoid the security risks caused by fraudulent activities of dangerous websites such as fake websites, when the website visited by the user is determined to be a dangerous website, the browser will automatically jump to a prompt page to remind the user that the website currently visited is a dangerous website.
[0004] However, if the interactive operation of the prompt page is not handled properly, criminals may use the prompt page to attack, resulting in low security of the prompt page.
[0005] For example, if the interactive operation of the prompt page is performed in plain text, an attacker may use the relevant information in the plain text to attack the prompt page, thereby causing low security of the prompt page. Summary of the invention
[0006] The present application provides a data processing method, device and electronic device to achieve the effect of improving the security of the prompt page. The specific implementation scheme is as follows:
[0007] In a first aspect, the present application provides a data processing method, the method comprising:
[0008] In the interactive operation of the first prompt page, the identity authentication information sent by the server is encrypted to obtain encrypted information; wherein the first prompt page is a page that prompts the user that the website currently visited is a dangerous website;
[0009] The encrypted information and the user's input information in the interactive operation are sent to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
[0010] Through the above-mentioned application embodiment, in the interactive operation of the first prompt page, the identity authentication information sent by the server is first encrypted, and then the encrypted information and the user's input information are sent to the server, so that the server decrypts the encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information, thereby avoiding information leakage during the interactive operation, thereby avoiding attacks by attackers in the interactive operation, and improving the security of the interactive operation of the first prompt page, thereby improving the security of the first prompt page.
[0011] In a possible implementation manner, the identity authentication information includes a first public key and a first private key sent by the server, the encrypted information includes a second public key and a second private key, the second public key and the second private key are respectively a public key and a private key encrypted by the first public key and the first private key, and the identity authentication information sent by the server is encrypted to obtain the encrypted information, including:
[0012] Receiving the first public key and the first private key;
[0013] Based on a first encryption algorithm, the first public key and the first private key are encrypted respectively to obtain the second public key and the second private key.
[0014] Through the above-mentioned application embodiment, the first public key and the first private key in the identity authentication information are encrypted based on the first encryption algorithm, so that the security of the identity authentication information used for identity authentication is further improved, and the leakage of the identity authentication information is avoided, thereby preventing the attacker from stealing the first public key and the first private key in the identity authentication information to carry out malicious attacks on the server side, further improving the security of the interactive operation of the first prompt page, and further improving the security of the first prompt page.
[0015] In a possible implementation manner, after obtaining the second public key and the second private key, the method further includes:
[0016] The second public key and the second private key are stored in a script file corresponding to the first prompt page.
[0017] Through the above-mentioned application embodiment, the encrypted storage of the identity authentication information used for identity authentication is realized, which prevents attackers from stealing the identity authentication information, further improves the security of the interactive operation of the first prompt page, and thus further improves the security of the first prompt page. In addition, through the encrypted storage of the identity authentication information used for identity authentication, when the identity authentication information of the first prompt page is needed later, it can be directly obtained from the script file, so that it is not necessary to encrypt the identity authentication information every time the identity authentication information of the first prompt page is used, thereby reducing the number of encryption times of the identity authentication information, so that the use efficiency of the identity authentication information can be improved.
[0018] In a possible implementation manner, the identity authentication information also includes parameters transmitted by the interface of the server side, and the encrypted information includes an identity field, and the identity authentication information sent by the server side is encrypted to obtain the encrypted information, including: encrypting the parameters transmitted by the interface of the server side based on a second encryption algorithm to obtain encrypted parameters;
[0019] Based on the encrypted parameters, signature processing is performed in combination with the third public key and the third private key, and the signature result is encrypted based on the third encryption algorithm to obtain the identity field.
[0020] Through the above-mentioned application embodiment, the leakage of parameters transmitted in the server-side interface in the identity authentication information is avoided, and the security of the identity authentication information is further improved, so that the security in the interactive operation of the first prompt page is further improved, thereby further enhancing the security of the first prompt page.
[0021] In a possible implementation manner, the interactive operation includes a complaint operation, and the input information includes a complaint reason and contact information input by the user. Before sending the encrypted information and the user input information in the interactive operation to the server, the method further includes:
[0022] When the interactive operation is the false alarm complaint, malicious information in the complaint reason is filtered out based on the first filtering method, and erroneous contact information in the contact information that does not conform to the standard format of the contact information is filtered out based on the second filtering method.
[0023] Through the above application embodiment, based on the first filtering method, the malicious information in the complaint reason input by the user in the false alarm complaint is filtered, so as to avoid the attacker from attacking through the user's input information, further improving the security of the interactive operation, and further improving the security of the first prompt page. And, based on the second filtering method, the wrong contact information that does not conform to the standard format of the contact information in the contact information input by the user in the false alarm complaint is filtered, so as to avoid the user's contact information error, so as to avoid the user being unable to be contacted later, further improving the security in the interactive operation, and further improving the security of the first prompt page.
[0024] In a possible implementation manner, sending the encrypted information and the user's input information in the interactive operation to the server side includes:
[0025] Filter out information that does not meet preset conditions in the input information of the user in the interactive operation to obtain information to be sent;
[0026] Using the identity field in the encrypted information as a request header, and using the information to be sent as a request body;
[0027] Combining the request header with the request body to generate a message;
[0028] The message is sent to the server.
[0029] Through the above application embodiment, the information that does not meet the preset conditions in the user's input information in the interactive operation is first filtered, so as to avoid attackers from using the information in the input information that does not meet the preset conditions to attack, thereby further improving the security of the interactive operation of the first prompt page, and further improving the security of the first prompt page. Then, the identity field in the encrypted information is used as the request header, and the information after the user's input information is filtered (i.e., the information to be sent) is used as the request body, and then sent to the server in the form of a message obtained by combining the request header and the request body, so that the server can more accurately and efficiently clarify the received information to ensure the accuracy and efficiency of the interactive results of the interactive operation, thereby improving the accuracy and efficiency of the interactive operation.
[0030] In a possible implementation, the method further includes:
[0031] In response to the website visited by the user being a dangerous website, prompt information is written into the first prompt page through server-side rendering to generate a second prompt page containing the prompt information; wherein the prompt information is used to describe the security threat information of the dangerous website.
[0032] Through the above-mentioned application embodiment, the prompt page is implemented by server-side rendering, thereby avoiding the interface for obtaining prompt information from being exposed on the browser side, thereby avoiding attacks using the interface to attack, and further improving the security of the first prompt page.
[0033] In a possible implementation, the method further includes:
[0034] Compiling a script file corresponding to a prompt page by using a compilation tool; wherein the prompt page at least includes the first prompt page;
[0035] Import the compiled script file into the prompt page for use.
[0036] Through the above application embodiment, the script file corresponding to the prompt page is first compiled, and then the compiled script file is introduced into the prompt page for use, so that the attacker cannot see the source code of the prompt page on the browser side, further improving the security of the prompt page.
[0037] In a second aspect, the present application further provides a data processing device, the device comprising:
[0038] An encryption module, used to encrypt the identity authentication information sent by the server in the interactive operation of the first prompt page to obtain encrypted information; wherein the first prompt page is a page that prompts the user that the website currently visited is a dangerous website;
[0039] A processing module is used to send the encrypted information and the user's input information in the interactive operation to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
[0040] In a possible implementation, the identity authentication information includes a first public key and a first private key sent by the server, and the encrypted information includes a second public key and a second private key, and the second public key and the second private key are respectively the public key and the private key encrypted by the first public key and the first private key. Then, the encryption module is specifically used to receive the first public key and the first private key; based on a first encryption algorithm, the first public key and the first private key are respectively encrypted to obtain the second public key and the second private key.
[0041] In a possible implementation, the encryption module is specifically configured to store the second public key and the second private key in a script file corresponding to the first prompt page.
[0042] In a possible implementation, the identity authentication information also includes the parameters of the server-side interface, and the encrypted information includes an identity field. The encryption module is specifically used to encrypt the parameters of the server-side interface based on the second encryption algorithm to obtain the encrypted parameters; based on the encrypted parameters, a signature is performed in combination with a third public key and a third private key, and the signature result is encrypted based on the third encryption algorithm to obtain the identity field.
[0043] In a possible implementation, the interactive operation includes a complaint operation, and the input information includes the complaint reason and contact information input by the user. Before sending the encrypted information and the user input information in the interactive operation to the server, the processing module is specifically used to filter out malicious information in the complaint reason based on the first filtering method when the interactive operation is the false alarm complaint, and to filter out erroneous contact information in the contact information that does not conform to the standard format of the contact information based on the second filtering method.
[0044] In a possible implementation, the processing module is specifically used to filter out information that does not meet preset conditions in the input information of the user in the interactive operation to obtain information to be sent; use the identity field in the encrypted information as a request header, and use the information to be sent as a request body; combine the request header and the request body to generate a message; and send the message to the server.
[0045] In a possible implementation, the device further includes a rendering module, which is used to write prompt information in the first prompt page through server-side rendering in response to the website visited by the user being a dangerous website, and generate a second prompt page containing the prompt information; wherein the prompt information is used to describe the security threat information of the dangerous website.
[0046] In a possible implementation, the device further includes a compilation module, which is specifically used to compile a script file corresponding to the prompt page through a compilation tool; wherein the prompt page includes at least the first prompt page; and the compiled script file is introduced into the prompt page for use.
[0047] In a third aspect, the present application provides an electronic device, including:
[0048] Memory, used to store computer programs;
[0049] The processor is used to implement the above-mentioned data processing method steps when executing the computer program stored in the memory.
[0050] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned data processing method steps are implemented.
[0051] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;
[0053] Figure 2a Schematic diagram of the prompt page provided for the embodiment of the present application Figure 1 ;
[0054] Figure 2b Schematic diagram 2 of the prompt page provided for the embodiment of the present application;
[0055] Figure 3 A schematic diagram of a complaint page provided for an embodiment of the present application;
[0056] Figure 4 A schematic diagram of the processing process of the data processing method provided in the embodiment of the present application;
[0057] Figure 5 A schematic diagram of a data processing device provided in an embodiment of the present application;
[0058] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0059] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.
[0060] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.
[0061] When the website that the user is currently visiting is a dangerous website, a prompt page can be redirected to remind the user that the website is a dangerous website, thereby preventing the user from visiting websites containing malware, phishing websites or fraudulent activities. Among them, the prompt page has interactive operations, such as warning the user of risks, so as to fully protect the user's network security through the interactive operation.
[0062] However, when the interactive operation of the prompt page is performed in plain text, an attacker can use the relevant information of the plain text to attack it, resulting in low security of the prompt page.
[0063] In view that improper handling of interactive operations of the prompt page of a dangerous website may also lead to security problems, it is necessary to provide an effective method to improve the security of the interactive operations of the prompt page, thereby improving the security of the prompt page.
[0064] Therefore, the present application proposes a data processing method that can be applied to the browser side. In the operation of the first prompt page, the identity authentication information sent by the server side for identity authentication is encrypted, and then the encrypted information and the user's input information in the interactive operation are sent to the server side, so that the server side decrypts the encrypted information and determines the interaction result of the interactive operation based on the decryption result and the input information, thereby avoiding the leakage of authentication information and input information in the interactive operation, thereby improving the security of the interactive operation of the first prompt page, and further enhancing the security of the prompt page.
[0065] Reference Figure 1 The figure is a flow chart of a data processing method provided by an embodiment of the present application, the method comprising:
[0066] S101, in the interactive operation of the first prompt page, encrypt the identity authentication information sent by the server to obtain encrypted information.
[0067] Among them, the first prompt page is a page that prompts the user that the website currently visited is a dangerous website.
[0068] S102, sending the encrypted information and the user's input information in the interactive operation to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
[0069] In the embodiment of the present application, the interactive operation of the first prompt page may include a complaint operation, but is not limited thereto. Figure 2a As shown. Figure 2aIn the example, "Should not be blocked? I want to appeal" indicates an appeal button for the appeal operation, so that the interactive operation between the user / browser side and the server side can be realized based on the appeal button. In addition, Figure 2a The “Service Hotline” can be adjusted according to the specific application scenario.
[0070] In the interactive operation of the first prompt page (such as the appeal operation), the identity authentication information may include the identity information sent by the server (the identity information may be the first public key and the first private key), and may also include the parameters transmitted by the server interface (i.e., the parameters transmitted by the server interface), but is not limited to this.
[0071] Therefore, in the interactive operation of the first prompt page, encrypting the identity authentication information may include encrypting the first public key and the first private key, and encrypting the parameters transmitted by the server-side interface.
[0072] The encryption process of encrypting a public key and a first private key may be as follows:
[0073] Specifically, first, a first public key and a first private key sent by the server are received. Then, the first public key and the first private key are encrypted by a first encryption algorithm to obtain encrypted information including the encrypted second public key and the second private key, thereby making the identity authentication information more secure, preventing attackers from stealing the first public key and the first private key in the identity authentication information to conduct malicious attacks on the server, and further improving the security of the interactive operation of the first prompt page, thereby further improving the security of the first prompt page.
[0074] In the embodiment of the present application, the first encryption algorithm may be an Advanced Encryption Standard (AES) encryption algorithm, but is not limited thereto. The AES encryption algorithm may adopt the AES encryption algorithm in the CryptoJS encryption library, and the encryption of the first public key and the first private key may be implemented by calling the AES encryption algorithm in the CryptoJS encryption library.
[0075] The process of encrypting the first public key and the first private key is implemented by calling the AES encryption algorithm in the CryptoJS encryption library, as shown in the following code:
[0076]
[0077] Here, encode represents an encryption function.
[0078] text indicates the first public key or the first private key. For example, if the first public key is "rqSw7tb64412", then text is "rqSw7tb64412"; if the first private key is "rg5cjVTk7ZRKi9UWPpFqLOabdXwrwqs", then text is "rg5cjVTk7ZRKi9UWPpFqLOabdXwrwqs".
[0079] encrypt indicates the encrypted second public key or second private key. When text is the first public key, encrypt indicates the encrypted second public key; when text is the first private key, encrypt indicates the encrypted second private key.
[0080] Random can be fixed as a string, such as "GKhsoij8UI7698jkk=dhf=hjhf==", but is not limited to this and can be adjusted according to specific application scenarios.
[0081] Exemplarily, assuming that the first public key is "rqSw7tb64412", the AES encryption algorithm in the CryptoJS encryption library is called through the above-mentioned encode encryption function to encrypt the first public key, and the encrypted second public key is "c4j97IuoBqf71GBGbUCZxA==".
[0082] Assuming that the first private key is "rg5cjVTk7ZRKi9UWPpFqLOabdXwrwqs", the AES encryption algorithm in the CryptoJS encryption library is called through the above-mentioned encode encryption function to encrypt the first private key, and the encrypted second private key is "vsA8A89hWRWYuW+HhPNGzor6szmEpl8ldoDSbil4fMU=".
[0083] By calling the above-mentioned encode encryption function, the AES encryption algorithm in the CryptoJS encryption library can be called to encrypt the first public key and the first private key, thereby making the first public key and the first private key more secure.
[0084] The decryption algorithm corresponding to the AES encryption algorithm in the above CryptoJS encryption library can be shown in the following code:
[0085]
[0086] Among them, decode represents the decryption function.
[0087] decrypt indicates the result of decrypting encrypt. For example, if encrypt is the second public key, decrypt is the first public key after decryption of the second public key; if encrypt is the second private key, decrypt is the first private key after decryption.
[0088] In the decryption algorithm, random can also be fixed as a string, such as "GKhsoij8UI7698jkk=dhf=hjhf==", but it is not limited to this and can be adjusted according to specific application scenarios.
[0089] By calling the above-mentioned decode decryption function, the AES decryption algorithm in the CryptoJS encryption library can be called to realize the decryption of the second public key and the second private key, thereby restoring the second public key and the second private key back to the original public key and private key, and ensuring the accuracy of the restoration process (i.e., the decryption process), so as to facilitate the subsequent use of the decrypted public key and private key.
[0090] Optionally, after encrypting the first public key and the first private key to obtain the encrypted second public key and the second private key, the second public key and the second private key can be stored in the script file corresponding to the first prompt page, thereby realizing the encrypted storage of identity information in the first prompt page, preventing attackers from stealing identity information, and further improving the security of interactive operations of the first prompt page, thereby further improving the security of the first prompt page.
[0091] When encrypting the parameters of the server-side interface, the encryption can be performed based on the second encryption algorithm to obtain the encrypted parameters, so as to avoid the leakage of the parameters of the server-side interface, which helps to further improve the security of the interactive operation, and further improve the security of the first prompt page. The second encryption algorithm can be a message digest algorithm (English: MD5, abbreviated as MD5) encryption algorithm, but is not limited to this. The MD5 encryption algorithm can be the MD5 encryption algorithm in the CryptoJS encryption library, so that the encryption of the parameters of the server-side interface can be achieved by calling the MD5 encryption algorithm in the CryptoJS encryption library.
[0092] After encrypting the parameters transmitted by the server-side interface and obtaining the encrypted parameters, signature processing can be performed based on the encrypted parameters, the third public key and the third private key, and the signature result can be encrypted based on the third encryption algorithm to obtain the identity field (the identity field belongs to the encrypted information, that is, the encrypted information includes the identity field) to further improve the security of the identity authentication information and avoid subsequent information leakage during the transmission process, thereby defending against attacks by attackers during the transmission process, so as to further improve the security of the interactive operation, and further improve the security of the first prompt page.
[0093] The third public key and the third private key can be obtained based on the second public key and the second private key stored in the script file corresponding to the first prompt page. Specifically, first obtain the stored second public key and the second private key from the script file corresponding to the first prompt page, and then decrypt the second public key and the second private key based on the decryption algorithm corresponding to the second public key and the second private key to obtain the decrypted third public key and the third private key. If there is no security problem in the decryption process, the third public key is the first public key, and the third private key is the first private key.
[0094] The above-mentioned signature processing can adopt a hash function to perform signature processing, such as HmacSHA256. The HmacSHA256 can be the HmacSHA256 in the CryptoJS encryption library, so that the signature processing can be implemented by calling the HmacSHA256 in the CryptoJS encryption library.
[0095] The third encryption algorithm may be a Base64-based encryption algorithm, but is not limited thereto. The Base64-based encryption algorithm may be implemented based on CryptoJS.enc.Base64.stringify in the CryptoJS encryption library. In addition, the third encryption algorithm, the second encryption algorithm, and the first encryption algorithm may be consistent or inconsistent, and may be adjusted according to specific application scenarios.
[0096] Exemplarily, the process of obtaining encrypted information by calling HmacSHA256 in the CryptoJS encryption library and CryptoJS.enc.Base64.stringify in the CryptoJS encryption library can be shown in the following code:
[0097]
[0098]
[0099] Among them, hashInBase64 represents the identity field.
[0100] url indicates the server-side interface address, for example, the url is " / question / domainSubmit".
[0101] Body represents the parameters transmitted by the server-side interface.
[0102] accessKeyEncrypt represents the encrypted second public key, and accessKey represents the decrypted third public key (i.e., the first public key)
[0103] secretKeyEncrypt represents the encrypted second private key, and secretKey represents the decrypted third private key (ie, the first private key).
[0104] Hash represents the signature result.
[0105] Furthermore, after the identity authentication information is encrypted and the encrypted information is obtained, the encrypted information and the user's input information in the interactive operation are sent to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
[0106] Among them, the user's input information in the interactive operation can be received after obtaining the encrypted information, or before obtaining the encrypted information, or at the same time as obtaining the encrypted information, and can be adjusted according to the specific application scenario.
[0107] In order to more conveniently send the encrypted information and the input information, and to facilitate the server to better receive the encrypted information and the input information, the encrypted information and the input information may be sent to the server in the form of a message.
[0108] Specifically, the information that does not meet the preset conditions in the user's input information during the interactive operation is filtered out to obtain the information to be sent, so as to filter out the error information that does not meet the preset conditions in the input information, thereby avoiding sending the error information to the server. The information to be sent is then used as the request body, and the identity field in the encrypted information is used as the request header. Then, the request header and the request body are combined to form a message. The message is then sent to the server, thereby achieving the use of the message to send the encrypted information and the input information to the server.
[0109] In the embodiment of the present application, the above preset conditions can be adjusted according to the specific interactive operation.
[0110] For example, when the interactive operation is a complaint operation, the user's input information may include the reason for the complaint and the user's contact information. Figure 2a or Figure 2b In the prompt page shown in FIG. 1 , the interactive operation on the prompt page is a complaint operation. When the user clicks the interactive operation indicating the complaint operation on the prompt page, the user can jump to the complaint page. The complaint page is as follows: Figure 3 As shown. Figure 3 In the appeal page shown (ie, in the appeal operation), the user's input information may include the reason for the appeal and the user's contact information.
[0111] At this time, filtering out the user's input information in the interactive operation means filtering out the complaint reason and contact information input by the user. Then, filtering out the information that does not meet the preset conditions in the user's input information in the interactive operation, and obtaining the information to be sent, can be as follows:
[0112] Based on the first filtering method, malicious information in the reason for the appeal is filtered out, and based on the second filtering method, erroneous contact information that does not conform to the standard format of the contact information is filtered out, thereby achieving restrictions on the reason for the appeal and contact information entered by the user, so as to avoid information that does not meet the preset conditions from attacking the server side, which helps to further improve the security of interactive operations in the prompt page, thereby further improving the security of the prompt page.
[0113] Therefore, when the interactive operation is a complaint operation, the above-mentioned preset conditions may be non-malicious information and a standard format of contact information, but are not limited thereto.
[0114] The first filtering method and the second filtering method may be the same or different, and may be adjusted according to specific application scenarios. For example, the first filtering method and the second filtering method are both regular expressions, but are not limited thereto.
[0115] The malicious information may be malicious code, Structured Query Language (English: Structured Query Language, abbreviated as SQL) injection attack and other information.
[0116] The above-mentioned standard format of contact information may be a standard format of an email address or a standard format of a telephone number, but is not limited thereto.
[0117] In addition, the architecture mode of the prompt page will also affect the security of the prompt page. If the architecture mode adopts the front-end and back-end separation mode, that is, the prompt information is generated through the front-end and back-end separation mode to generate the prompt page, the interface for obtaining the prompt information will be exposed on the browser side. At this time, the attacker can know the interface for obtaining the prompt information through the debugger (network) on the browser side and attack through this interface, resulting in low security of the prompt page.
[0118] Therefore, in order to avoid exposing the interface for obtaining prompt information on the browser side, the prompt information can be generated by server-side rendering, and then the prompt page can be generated, thereby further improving the security of the prompt page.
[0119] Specifically, when the website visited by the user is a dangerous website, prompt information can be written in the first prompt page through server-side rendering to generate a second prompt page including the prompt information to prompt the user that the website currently visited is a dangerous website, so that the user can discover the subtle differences of dangerous websites and effectively protect their own privacy and security.
[0120] The above prompt information can be used to describe the security threat information of dangerous websites.
[0121] Exemplarily, the generated second prompt page including prompt information may be as follows: Figure 2b As shown. Among them, Figure 2b "What is phishing? Phishing attacks are fraudulent emails, text messages, phone calls, or websites designed to trick users into downloading malware, sharing sensitive information, or personal data (such as Social Security and credit card numbers, bank account numbers, login credentials)." is a reminder message that describes phishing information, which is security threat information that describes dangerous websites. In addition, Figure 2a This is the first prompt page that does not include prompt information.
[0122] The above service takes the following rendering mode:
[0123] The server matches the domain name corresponding to the website visited by the user with the domain name stored in the pre-built dangerous domain name database.
[0124] If the domain name corresponding to the website visited by the user matches the domain name stored in the dangerous domain name database (such as the domain name corresponding to the website visited by the user exists in the dangerous domain name database), the website visited by the user is determined to be a dangerous website, and prompt information indicating that the website is a dangerous website is written into the first prompt page file corresponding to the first prompt page, and the first prompt page file (i.e., the second prompt page file) with the prompt information written is returned to the browser side, so that the browser side generates a second prompt page including the prompt information based on the prompt file.
[0125] Therefore, through the above-mentioned service-side rendering method, the generation of the second prompt page including the prompt information is realized. Through this method, it is possible to prevent the attacker from knowing the interface for obtaining the prompt information through the network of the browser side, thereby preventing the attacker from changing the parameters and calling the interface continuously, causing the dangerous domain name database to be blasted, so as to test the dangerous domain name database, and also preventing the attacker from avoiding the dangerous domain name database and launching attacks with domain names that are not in the dangerous domain name database, thereby further improving the security of the prompt page.
[0126] The first prompt page file corresponding to the first prompt page can be developed in advance, and the first prompt page file corresponding to the first prompt page can be stored in the server side, so as to generate the second prompt page containing prompt information in a timely manner through the server side rendering method. The second prompt page also has the interactive operation of the first prompt page.
[0127] In addition, in an embodiment of the present application, before generating a prompt page (such as the first prompt page and the second prompt page), the script file corresponding to the prompt page (such as the first prompt page and the second prompt page) can also be compiled through a compilation tool, and then the compiled script file is introduced into the prompt page (such as the first prompt page and the second prompt page) for use, so that the attacker cannot see the source code of the prompt page (such as the first prompt page and the second prompt page) on the browser side, thereby further enhancing the security of the prompt page (such as the first prompt page and the second prompt page).
[0128] In summary, the data processing method proposed in the present application encrypts and transmits the identity authentication information sent from the server during the interactive operation of the first prompt page, thereby ensuring the security of the interactive operation and thus ensuring the security of the first prompt page.
[0129] In the interactive operation, the user's input information is restricted to ensure that information that does not meet the preset conditions is filtered out (such as filtering out malicious information), so that the security of the interactive operation is further improved, thereby further improving the security of the first prompt page (or the second prompt page).
[0130] At the same time, the script files corresponding to the prompt pages (such as the first prompt page and the second prompt page) are compiled and then introduced into the prompt pages for use, avoiding exposing the source code of the prompt pages (i.e., the script source code) on the browser side, further enhancing the security of the prompt pages.
[0131] In addition, the second prompt page is generated by server-side rendering. Compared with the prior art that uses front-end and back-end separation to generate prompt pages, the interface for obtaining dangerous domain name prompt information will not be exposed on the browser side, preventing attackers from knowing the interface for obtaining prompt information through the browser network, preventing attackers from changing parameters and calling the dangerous domain name database, so that the dangerous domain name database is included, thereby probing the dangerous domain name database, and preventing attackers from avoiding the dangerous domain name database and attacking with domain names that are not in the dangerous domain name database. Generating prompt pages by server-side rendering further strengthens the security of the prompt page of dangerous websites, while also enhancing the security of the server side.
[0132] The technical solution of this application is further explained below in conjunction with a specific application process.
[0133] like Figure 4 The figure shows a processing process diagram of the data processing method, firstly developing a first prompt page (dangerTip.html), and sending a first prompt page file corresponding to the first prompt page to the server, so as to store the first prompt page file of the developed first prompt page to the server.
[0134] In the page generation module of the browser side, in response to the website visited by the user being a dangerous website, prompt information for describing security threat information of the dangerous website is written into the first prompt page through server-side rendering to obtain a second prompt page.
[0135] Specifically, in the matching module on the server side, the domain name corresponding to the website visited by the user is matched with the domain name in the pre-built dangerous domain name database. If the match is successful, it is determined that the website visited by the user is a dangerous website, and then the prompt information is written into the first prompt page file to obtain the second prompt page file. Then, the second prompt page file including the prompt information is sent to the browser side, so that the browser side generates a second prompt page including the prompt information based on the second prompt page file.
[0136] In the page generation module in the browser side, after receiving the second prompt page file sent by the server side, the second prompt page file is converted into a second prompt page to prompt the user that the website he is visiting is a dangerous website.
[0137] In addition, in the interactive module on the browser side, in the interactive operation of the first prompt page, the first public key and the first private key sent by the server side are received, and the first public key and the first private key are encrypted based on the first encryption algorithm to obtain the encrypted second public key and the second private key. The second public key and the second private key are then stored in the script file corresponding to the first prompt page.
[0138] Then, based on the second encryption algorithm, the interface parameters of the server are encrypted to obtain the encrypted parameters. The second public key and the second private key stored in the script file corresponding to the first prompt page are obtained to obtain the third public key and the third private key through the decryption algorithm. Based on the encrypted parameters, the signature processing is performed in combination with the third public key and the third private key, and the signature processing result is encrypted based on the third encryption algorithm to obtain encrypted information. Then, the identity field in the encrypted information is used as the request header, and the user's input information in the interactive operation is used as the request body. Combine the request header and the request body to generate a message. The message is then transmitted to the server so that the server determines the interaction result of the interactive operation based on the message.
[0139] On the server side, after receiving the message, the request header in the message is decrypted to obtain the fourth public key and the fourth private key. It is determined whether the fourth public key and the fourth private key are consistent with the first public key and the first private key sent to the browser side. If they are consistent, it is determined that the interaction result of the interactive operation is valid, and the user is communicated with according to the user's contact information in the request body to determine the subsequent operation, or it is determined that the website should not be intercepted and the website is allowed to pass.
[0140] Based on the same inventive concept, the present application also provides a data processing device, such as Figure 5 The figure is a schematic diagram of the structure of a data processing device provided by the present application, the device comprising:
[0141] The encryption module 501 is used to encrypt the identity authentication information sent by the server in the interactive operation of the first prompt page to obtain encrypted information; wherein the first prompt page is a page that prompts the user that the website currently visited is a dangerous website;
[0142] The processing module 502 is used to send the encrypted information and the user's input information in the interactive operation to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
[0143] In a possible implementation, the identity authentication information includes a first public key and a first private key sent by the server, and the encrypted information includes a second public key and a second private key, and the second public key and the second private key are respectively the public key and the private key encrypted by the first public key and the first private key. The encryption module 501 is specifically used to receive the first public key and the first private key; based on a first encryption algorithm, the first public key and the first private key are respectively encrypted to obtain the second public key and the second private key.
[0144] In a possible implementation, the encryption module 501 is specifically configured to store the second public key and the second private key in a script file corresponding to the first prompt page.
[0145] In a possible implementation, the identity authentication information also includes the parameters of the server-side interface, and the encrypted information includes an identity field. The encryption module 501 is specifically used to encrypt the parameters of the server-side interface based on the second encryption algorithm to obtain the encrypted parameters; based on the encrypted parameters, a signature is performed in combination with a third public key and a third private key, and the signature result is encrypted based on the third encryption algorithm to obtain the identity field.
[0146] In a possible implementation, the interactive operation includes a complaint operation, and the input information includes the complaint reason and contact information input by the user. Before sending the encrypted information and the user input information in the interactive operation to the server, the processing module 502 is specifically used to filter out malicious information in the complaint reason based on the first filtering method when the interactive operation is the false alarm complaint, and to filter out erroneous contact information in the contact information that does not conform to the standard format of the contact information based on the second filtering method.
[0147] In one possible implementation, the processing module 502 is specifically used to filter out information that does not meet preset conditions in the input information of the user in the interactive operation to obtain information to be sent; use the identity field in the encrypted information as a request header, and use the information to be sent as a request body; combine the request header and the request body to generate a message; and send the message to the server.
[0148] In a possible implementation, the device further includes a rendering module, which is used to write prompt information in the first prompt page through server-side rendering in response to the website visited by the user being a dangerous website, and generate a second prompt page containing the prompt information; wherein the prompt information is used to describe the security threat information of the dangerous website.
[0149] In a possible implementation, the device further includes a compilation module, which is specifically used to compile a script file corresponding to the prompt page through a compilation tool; wherein the prompt page includes at least the first prompt page; and the compiled script file is introduced into the prompt page for use.
[0150] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned data processing device. Figure 6 , the electronic equipment includes:
[0151] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. The bus 600 is Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.
[0152] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the data processing method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.
[0153] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.
[0154] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0155] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the data processing method disclosed in the embodiments of the present application can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor.
[0156] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0157] By designing and programming the processor 601, the code corresponding to the data processing method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The steps of the data processing method of the embodiment shown are as follows: How to design and program the processor 601 is a technique well known to those skilled in the art and will not be described in detail here.
[0158] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the data processing method discussed above.
[0159] In some possible implementations, various aspects of the data processing method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the data processing method according to various exemplary implementations of the present application described above in this specification.
[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0162] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0164] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A data processing method, characterized in that: include: In the interactive operation of the first prompt page, the identity authentication information sent by the server is encrypted to obtain encrypted information; wherein the first prompt page is a page that prompts the user that the website currently visited is a dangerous website; The encrypted information and the user's input information in the interactive operation are sent to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
2. The method according to claim 1, characterized in that The identity authentication information includes a first public key and a first private key sent by the server, and the encrypted information includes a second public key and a second private key, wherein the second public key and the second private key are respectively a public key and a private key encrypted by the first public key and the first private key. The identity authentication information sent by the server is encrypted to obtain encrypted information, including: Receiving the first public key and the first private key; Based on a first encryption algorithm, the first public key and the first private key are encrypted respectively to obtain the second public key and the second private key.
3. The method according to claim 2, characterized in that After obtaining the second public key and the second private key, the method further includes: The second public key and the second private key are stored in a script file corresponding to the first prompt page.
4. The method according to claim 1, characterized in that The identity authentication information also includes the parameters transmitted by the interface of the server side, and the encrypted information includes the identity field. Then, the identity authentication information sent by the server side is encrypted to obtain the encrypted information, including: Based on the second encryption algorithm, encrypt the parameters transmitted by the interface of the server to obtain encrypted parameters; Based on the encrypted parameters, signature processing is performed in combination with the third public key and the third private key, and the signature result is encrypted based on the third encryption algorithm to obtain the identity field.
5. The method according to claim 1, characterized in that The interactive operation includes a complaint operation, and the input information includes the complaint reason and contact information input by the user. Before sending the encrypted information and the user input information in the interactive operation to the server, the method further includes: When the interactive operation is the false alarm complaint, malicious information in the complaint reason is filtered out based on the first filtering method, and erroneous contact information in the contact information that does not conform to the standard format of the contact information is filtered out based on the second filtering method.
6. The method according to any one of claims 1 to 5, characterized in that: The step of sending the encrypted information and the user's input information in the interactive operation to the server side includes: Filter out information that does not meet preset conditions in the input information of the user in the interactive operation to obtain information to be sent; Using the identity field in the encrypted information as a request header, and using the information to be sent as a request body; Combining the request header with the request body to generate a message; The message is sent to the server.
7. The method according to claim 1, characterized in that The method further comprises: In response to the website visited by the user being a dangerous website, prompt information is written into the first prompt page through server-side rendering to generate a second prompt page containing the prompt information; wherein the prompt information is used to describe the security threat information of the dangerous website.
8. The method according to claim 1, characterized in that The method further comprises: Compiling a script file corresponding to a prompt page by using a compilation tool; wherein the prompt page at least includes the first prompt page; Import the compiled script file into the prompt page for use.
9. A data processing device, characterized in that: include: An encryption module, used to encrypt the identity authentication information sent by the server in the interactive operation of the first prompt page to obtain encrypted information; wherein the first prompt page is a page that prompts the user that the website currently visited is a dangerous website; A processing module is used to send the encrypted information and the user's input information in the interactive operation to the server side, so that the server side decrypts the received encrypted information and determines the interactive result of the interactive operation based on the decryption result and the input information.
10. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 8 when executing a computer program stored in the memory.
11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 8 are implemented.