Temporary attachment link processing method and device and electronic equipment

Abstract

The invention relates to a temporary attachment link processing method and device and electronic equipment, and the method is realized based on an asymmetric encryption algorithm, and comprises the following steps: obtaining a public key and private key pair from a key realization interface; environment variables of key and attachment link failure time are configured in background environment variables; the link request data is subjected to asymmetric encryption according to the public key, the link request data comprises a parameter of attachment link generation time, and then the link request data is put into a temporary parameter, subjected to base64 coding and then used as a link parameter to be packaged and transmitted; generating and requesting an attachment link, and performing decryption verification on link request data when the attachment link is accessed; judging whether the attachment link is an effective link within the time limit or not according to a decoding verification result, and if yes, downloading or previewing the attachment according to the attachment link; otherwise, returning corresponding link failure prompt information. Compared with the prior art, the method has the advantages that the temporary attachment link based on the attachment link generation time is realized, and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of attachment link processing, and in particular to a temporary attachment link processing method, device and electronic equipment. Background Art

[0002] In today's big data era, data security is an issue that no enterprise can avoid. Data security is vital to individuals, organizations and enterprises, and its role involves privacy protection, data integrity, commercial interests, compliance requirements and other aspects. By taking appropriate data security measures, data risks can be effectively prevented and data security can be guaranteed.

[0003] Data security is an important aspect of information security and has the following functions:

[0004] Protecting privacy: Data security can protect the private information of individuals, organizations or enterprises from being accessed, modified or disclosed by unauthorized persons.

[0005] Preventing data leakage: Data security measures can effectively prevent data leakage and prevent sensitive information from falling into the hands of criminals, thereby avoiding losses to individuals, organizations or enterprises.

[0006] Safeguarding business interests: Safeguarding important data such as business secrets and customer information can protect the business interests and competitive advantages of the company.

[0007] Comply with laws and regulations: Many countries and regions have relevant laws and regulations to protect personal data and privacy. Data security measures can ensure that data processing complies with laws and regulations.

[0008] Ensure data integrity: Data security can ensure that data is not tampered with during transmission or storage, ensuring the integrity and credibility of the data.

[0009] Ensure business continuity: When faced with data loss, damage, malicious attacks, etc., taking data security measures can ensure continuous business operations.

[0010] Build trust: Securing user and customer data builds trust, increases user satisfaction and credibility.

[0011] Common attachment encryption methods are symmetric encryption and asymmetric encryption, each with its own advantages and disadvantages.

[0012] The advantages and disadvantages of symmetric encryption are fast encryption and decryption speed, simple algorithm implementation, and simple key management. The disadvantage is poor security. If the key is intercepted or leaked during transmission, the security of encrypted communication will be threatened, and the key update process is cumbersome. In a public network environment, the security of symmetric encryption may be affected due to risks such as man-in-the-middle attacks and key leaks.

[0013] The advantage of asymmetric encryption is key separation. Asymmetric encryption algorithms use different keys for encryption and decryption. The public key is used for encryption, and the private key is used for decryption. There is a clear separation between the keys, which improves security. In addition, the public key can be publicly disseminated, and key updates are relatively convenient, without the need to renegotiate and distribute keys like symmetric encryption.

[0014] Common attachment download links are permanent. Traditional non-permanent expiration logic is based on the creation or update time of the file pointed to by the attachment link, but cannot be associated with the time when the attachment link was generated.

[0015] Based on the above two attachment encryption schemes and the scenario requirements of changing the permanent attachment download link to a temporary attachment link, this design scheme was designed and invented to resolve the existing contradictions, meet the security needs of customers, and ensure the stability and speed of attachment downloads.

[0016] How to achieve a highly secure temporary attachment link has become a technical problem that needs to be solved. Summary of the invention

[0017] The purpose of the present invention is to provide a temporary attachment link processing method, device and electronic device in order to overcome the defects of the above-mentioned prior art.

[0018] The purpose of the present invention can be achieved by the following technical solutions:

[0019] According to one aspect of the present invention, a temporary attachment link processing method is provided, which is implemented based on an asymmetric encryption algorithm and includes the following steps:

[0020] Step S1, obtaining a public key and a private key pair from a key implementation interface;

[0021] Step S2, configuring the environment variables of the key and attachment link expiration time in the background environment variables;

[0022] Step S3, asymmetrically encrypting the link request data according to the public key, wherein the link request data includes the parameter of the time when the attachment link is generated, and then putting the link request data into a temporary parameter token and performing base64 encoding, and then packaging and transmitting it as a link parameter;

[0023] In step S4, an attachment link is generated and requested, and when the attachment link is accessed, the link request data is decrypted and verified;

[0024] In step S5, the decoding verification result of step S4 is judged to determine whether the attachment link is a valid link within the time limit. If yes, step S6 is executed; otherwise, step S7 is executed;

[0025] In step S6, the verification is passed, and the attachment can be downloaded or previewed normally according to the attachment link, and the process ends;

[0026] In step S7, if the verification fails, the corresponding link failure prompt information is returned and the process ends.

[0027] Preferably, the environment variable also includes a parameter of "whether to enable attachment link encryption".

[0028] More preferably, when the parameter of "whether to enable attachment link encryption" is set to "temporary", the attachment link is a temporary attachment link, otherwise the attachment link is a permanent attachment link.

[0029] More preferably, when the parameter of "whether to enable attachment link encryption" is set to "temporary" and attachment link encryption is enabled for the first time, all permanent links generated previously cannot be accessed any more.

[0030] Preferably, the determining whether the attachment link is a valid link within the time limit specifically comprises: calculating the time difference between the attachment link generation time and the current time, and determining whether the time difference is within the attachment link expiration time in the environment variable.

[0031] More preferably, the asymmetric encryption algorithm includes an SM2 encryption algorithm.

[0032] According to one aspect of the present invention, there is provided a temporary attachment link processing device, the device comprising a key acquisition module, an encryption encoding module and a decoding verification module connected in sequence, and a configuration module connected to the key acquisition module and the decoding verification module respectively;

[0033] The key acquisition module is used to obtain a public key and a private key pair from a key implementation interface;

[0034] The configuration module is used to configure the environment variables of the key and attachment link expiration time in the background environment variables;

[0035] The encryption and coding module performs asymmetrical encryption on the link request data according to the public key, then puts the link request data into a temporary parameter token and performs base64 encoding on the data before packaging and transmitting it as a link parameter;

[0036] The decoding and verification module is used to decrypt and verify the link request data when the attachment link is accessed, and determine whether the attachment link is a valid link within the time limit based on the decoding and verification result. If so, the verification passes and the attachment can be downloaded or previewed normally according to the attachment link; otherwise, the verification fails and the corresponding link invalidation prompt information is returned.

[0037] Preferably, the link request data includes a parameter of the attachment link generation time.

[0038] Preferably, the environment variable also includes a parameter of "whether to enable attachment link encryption". When the parameter is set to "temporary", the attachment link is a temporary attachment link, otherwise the attachment link is a permanent attachment link.

[0039] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1) The present invention uses the attachment link generation time as a part of the link request data, thus realizing a truly temporary link. The link request data is encrypted so that the link request data cannot be modified manually. The attachment link generation time is decrypted and verified during the link request, and only attachments with valid links within the time limit are downloaded or previewed normally. This realizes temporary attachment link processing based on the attachment link generation time, and the encrypted link request data improves the security of customer data.

[0042] 2) The present invention uses base64 encoding and SM2 asymmetric encryption algorithm to process link request data, thereby ensuring transmission rate and improving data security.

[0043] 3) The present invention adopts background environment variable configuration management encryption and time-related configuration. When the expiration time of the attachment link changes, the existing generated attachment link uses the link generation time parameter and is placed inside the encrypted attachment link. Therefore, it can be judged in real time according to the latest configuration without abolishing the existing generated attachment link. It perfectly adapts to the situation where the attachment link time is modified, making subsequent updates and maintenance flexible and convenient.

[0044] 4) The background environment variable configuration of the present invention includes the function of permanent attachment link, taking into account the links generated before the attachment link encryption function is turned on, thereby ensuring the security of customer data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flowchart of the temporary attachment link processing method in the present invention. Figure 2 It is a structural schematic diagram of the temporary attachment link processing device in the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0047] The present embodiment relates to a temporary attachment link processing method, which adopts base64 encoding combined with an asymmetric encryption algorithm. First, the time record generated by the attachment link is encrypted using an asymmetric encryption algorithm (such as the SM2 encryption algorithm, but not limited to SM2), and then base64 encoding is used to ensure the transmission rate. According to the attachment link expiration time agreed in the customer's background configuration file, the parameters are decrypted and verified when the attachment link is accessed.

[0048] like Figure 1 , the method comprises the following steps;

[0049] a. Implement asymmetric encryption algorithm and call the corresponding implementation interface to obtain a set of corresponding public and private keys;

[0050] b. Configure the key of the asymmetric encryption algorithm and the expiration time of the attachment link in the background environment variables to facilitate subsequent flexible updates and modifications;

[0051] c. Implementing a public key encryption interface to encrypt the link request data according to the public key, wherein the link request data includes a link generation time parameter.

[0052] d. Put the encrypted link request data into the token, then encode it with base64 and package it as link parameters for transmission;

[0053] e. When requesting a link, the link request data (including the link generation time parameter) is decrypted and verified when the attachment link is accessed according to the attachment link expiration time agreed in the customer background environment variable;

[0054] f. Determine the decoding verification result to determine whether it is a valid link within the time limit. If so, execute g; if not, execute h;

[0055] g. Attachments can be downloaded or previewed normally;

[0056] h. The attachment link has expired and a corresponding prompt message will pop up.

[0057] When attachment link encryption is enabled for the first time, all previously generated permanent links will no longer be accessible, but will still be retained. Whether to enable temporary attachment link encryption is controlled by the environment variables in the background environment variables.

[0058] When the attachment link expiration time changes, the existing attachment link that has been generated can be judged in real time according to the latest configuration because the link generation time parameter is placed inside the encrypted attachment link, without the need to abolish the existing attachment link that has been generated.

[0059] like Figure 1 As shown, the flowchart of the temporary attachment link processing method, from configuration to specific implementation, will be combined with specific examples below Figure 1 Describe in detail:

[0060] Step S1, obtain the public key and private key pair from the key implementation interface http: / / localhost:8081 / encrypt / getSM2EncryptKeyMap;

[0061] Step S2, configure the environment variables of the key and attachment link expiration time in the background environment variables:

[0062] download:

[0063] config: / / Environment configuration for key and attachment link expiration time

[0064] effectiveTime / / Attachment link expiration time (hours)

[0065] downloadType / / PERMANENT / TEMPORARY, this parameter is used to determine whether to enable attachment link encryption. When set to TEMPORARY, it is used as a temporary attachment link, otherwise it is used as a permanent attachment link.

[0066] publicKeyHex / / hexadecimal public key

[0067] privateKeyHex / / hexadecimal private key

[0068] Step S3, SM2 encrypting the link request data through the interface according to the public key, wherein the link request data includes the attachment link generation time parameter timeString, and then puts it into the temporary parameter token for base64 encoding;

[0069] Step S4, generating and requesting an attachment link, and decrypting and verifying the link request data when the attachment link is accessed;

[0070] Step S5, judging the decoding verification result, judging whether the time difference between the attachment link generation time and the current time is within the attachment link expiration time configured in the background environment variable, if yes, executing step S6; otherwise, executing step S7;

[0071] Step S6: If the verification is successful, the attachment can be downloaded or previewed normally according to the attachment link, and the process ends;

[0072] Step S7: if the verification fails, the corresponding link failure prompt information is returned and the process ends.

[0073] This embodiment also relates to a temporary attachment link processing device, such as Figure 2 The device includes a key acquisition module, an encryption encoding module and a decoding verification module which are connected in sequence, and a configuration module which is respectively connected to the key acquisition module and the decoding verification module.

[0074] The key acquisition module is used to obtain the public key and private key pair from the key implementation interface;

[0075] The configuration module is used to configure the environment variables of the key and attachment link expiration time in the background environment variables; the environment variables also include the parameter of "whether to enable attachment link encryption". When the parameter is set to "temporary", the attachment link is a temporary attachment link, otherwise the attachment link is a permanent attachment link.

[0076] The encryption coding module performs asymmetrical encryption on the link request data according to the public key, then puts the link request data into a temporary parameter token and performs base64 encoding before packaging and transmitting it as a link parameter; wherein the link request data includes the parameter of the attachment link generation time.

[0077] The decoding and verification module is used to decrypt and verify the link request data when the attachment link is accessed, and determine whether the attachment link is a valid link within the time limit based on the decoding and verification results. If so, the verification passes and the attachment can be downloaded or previewed normally according to the attachment link; otherwise, the verification fails and the corresponding link invalidation prompt information is returned.

[0078] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0079] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0080] The processing unit performs the various methods and processes described above, such as methods S1 to S7. For example, in some embodiments, methods S1 to S7 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of methods S1 to S7 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S7 in any other appropriate manner (e.g., by means of firmware).

[0081] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0082] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0083] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0084] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A temporary attachment link processing method, characterized in that: The method is implemented based on an asymmetric encryption algorithm and includes the following steps: Step S1, obtaining a public key and a private key pair from a key implementation interface; Step S2, configuring the environment variables of the key and attachment link expiration time in the background environment variables; Step S3, asymmetrically encrypting the link request data according to the public key, wherein the link request data includes the parameter of the time when the attachment link is generated, and then putting the link request data into a temporary parameter token and performing base64 encoding, and then packaging and transmitting it as a link parameter; In step S4, an attachment link is generated and requested, and when the attachment link is accessed, the link request data is decrypted and verified; In step S5, the decoding verification result of step S4 is judged to determine whether the attachment link is a valid link within the time limit. If yes, step S6 is executed; otherwise, step S7 is executed; In step S6, the verification is passed, and the attachment can be downloaded or previewed normally according to the attachment link, and the process ends; In step S7, if the verification fails, the corresponding link failure prompt information is returned and the process ends.

2. A temporary attachment link processing method according to claim 1, characterized in that: The environment variables also include a parameter of "whether to enable attachment link encryption".

3. A temporary attachment link processing method according to claim 2, characterized in that: When the parameter of "whether to enable attachment link encryption" is set to "temporary", the attachment link is a temporary attachment link, otherwise the attachment link is a permanent attachment link.

4. A temporary attachment link processing method according to claim 2, characterized in that: When the parameter of "whether to enable attachment link encryption" is set to "temporary" and attachment link encryption is enabled for the first time, all previously generated permanent links will no longer be accessible.

5. A temporary attachment link processing method according to claim 1, characterized in that: The method of determining whether the attachment link is a valid link within the time limit specifically comprises: calculating the time difference between the attachment link generation time and the current time, and determining whether the time difference is within the attachment link expiration time in the environment variable.

6. A temporary attachment link processing method according to claim 1, characterized in that: The asymmetric encryption algorithm includes the SM2 encryption algorithm.

7. A device using the temporary attachment link processing method according to claim 1, characterized in that: The device comprises a key acquisition module, an encryption encoding module and a decoding verification module which are connected in sequence, and a configuration module which is respectively connected to the key acquisition module and the decoding verification module; The key acquisition module is used to obtain a public key and a private key pair from a key implementation interface; The configuration module is used to configure the environment variables of the key and attachment link expiration time in the background environment variables; The encryption and coding module performs asymmetrical encryption on the link request data according to the public key, then puts the link request data into a temporary parameter token and performs base64 encoding on the data before packaging and transmitting it as a link parameter; The decoding verification module is used to decrypt and verify the link request data when the attachment link is accessed, and determine whether the attachment link is a valid link within the time limit according to the decoding verification result. If yes, the verification passes, and the attachment can be downloaded or previewed normally according to the attachment link; Otherwise, the verification fails and the corresponding link invalidation prompt message is returned.

8. The device according to claim 7, characterized in that The link request data includes a parameter of the attachment link generation time.

9. The device according to claim 7, characterized in that The environment variables also include a parameter of "whether to enable attachment link encryption". When the parameter is set to "temporary", the attachment link is a temporary attachment link, otherwise the attachment link is a permanent attachment link.

10. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

Images