Encryption signature verification system

Abstract

The encryption signature verification system comprises an SRM management center, an API management center, a desensitization center, an encryption center, an order E center, a financial center and a persistent storage module. The SRM management center is used for performing desensitization processing and encryption processing on parameters through the desensitization center and the encryption center when initiating a service request to the financial center and the order E center, and carrying specific key information returned by the API management center; when the financial center and the order E center initiate a service request to the SRM management center, desensitization processing and encryption processing are carried out on parameters through the desensitization center and the encryption center, and specific key information returned by the API management center is carried at the same time; the API management center is responsible for carrying out authentication verification on the request so as to ensure the safety and reliability of output transmission; and after authentication and release of the API management center, the data are transmitted to a network security intranet.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method that can be applied to an encryption signature verification system. Background Art

[0002] Electric power and energy are important areas related to national security. With the development of technology, more and more data and information are retained and transmitted through electronic technology to improve work efficiency. The applicant's company has adopted a digital procurement platform (SRM) to complete the integration with multiple upstream and downstream systems, covering financial, banking, ERP and other systems. There are many types of interfaces between these systems, which leads to the lack or inconsistency of authentication, insecure transmission of sensitive information, or easy to break encryption strategies after these systems are involved in the SRM platform. Summary of the invention

[0003] In order to improve the security of the SRM system in the order finance scenario, this application provides an encrypted signature verification system.

[0004] In order to achieve the above objectives, the present application embodiment proposes an encrypted signature verification system, including:

[0005] SRM Management Center 001 is a lightweight microservice management center based on service discovery and dynamic configuration. It includes a public gateway and dynamic multi-data sources to quickly respond to changes in business needs and select the most suitable technology for each task. The SRM Management Center 001 can independently expand a single service as needed without affecting the entire system.

[0006] API management center 002, used to manage and organize application programming interfaces (APIs); it is used to centrally store and manage information about APIs, including but not limited to: API descriptions, endpoint URLs, version information, ThrAuth authentication information, ThrSys Id blacklists and whitelists;

[0007] Desensitization center 003 is used to perform desensitization processing on sensitive data; the desensitization center 003 is used to identify and classify sensitive data stored in different systems, classify the data according to its sensitivity and purpose, define desensitization rules and strategies for different types of data, and build a desensitization engine;

[0008] Encryption Center 004, used to manage and perform data encryption, decryption and key management to ensure the security of sensitive data during storage and transmission and prevent unauthorized access;

[0009] Order E-Center 005 is used to manage the entire life cycle of orders; from order formation, production and delivery, warehousing acceptance to settlement and payment collection, the information flow is fully mastered;

[0010] Financial Center 006 is used to centralize the financial functions of different business units to achieve standardization, process and automation;

[0011] The persistent storage module 007 saves data to non-volatile media, including cache persistence and relationship data persistence.

[0012] Among them, Figure 1 As shown, the system of the embodiment of the present disclosure is used to perform the following steps:

[0013] 1) API authentication registration step 0102 is used to perform registration authentication to uniformly authenticate the interfaces for interaction between systems such as SRM, Order E, and Finance.

[0014] For example, if the SRM system needs to access the financial center's interface xxAPi001, it needs to register the interface URL, authentication method, encryption and desensitization special processing method, and other information to the API management center 002, and receive the special key information returned by the API management center 002 that can be used to call the financial center interface xxAPi001;

[0015] 2) Desensitization processing step 0103, which is used to desensitize data during the process of interface interaction between systems and persistent data storage; developers can configure the required desensitization rules according to their own needs, and then use the data desensitization tool provided by the desensitization center 003 to remove sensitive information while retaining the data structure and characteristics, so that the data can be used for testing without leaking privacy.

[0016] 3) Encryption processing step 0304, which is used to provide encryption for interface interaction between systems and persistent data storage; developers can configure the required encryption rules according to their own needs, and then use the data encryption tools provided by the encryption center 004 to encrypt the data multiple times while retaining the data structure and characteristics, so that the data can be securely transmitted and stored.

[0017] 4) SRM management center 001 requests step 0405 / 0406 to financial center 006 and order E center 005, which is used for the SRM system to initiate a service request to financial center 006 and order E center 005. When initiating a service request, the parameters are desensitized in step 0103 and encrypted in step 0304, and the key information generated in API authentication registration step 0102 is carried; financial center 006 and order E center 005 are responsible for authenticating and verifying the request to ensure the security and reliability of output transmission.

[0018] 5) The financial center 006 and the order E center 005 request step 0502 / 0602 to the SRM management center 001, which is used for the financial center 006 and the order E center 005 to initiate a service request to the SRM management center 001. When initiating a service request, the parameters are desensitized in step 0103 and encrypted in step 0304, and the key information generated in the API authentication registration step 0102 is carried. The API management center 002 is responsible for authenticating and verifying the request to ensure the security and reliability of the output transmission.

[0019] 6) Synchronous step 0201, after the API management center 002 authenticates and releases, the data is transmitted to this step through the network security intranet, and the security authentication within the intranet area is passed to ensure the security of data transmission within the intranet. After the API management center 002 verifies the reliable data, the SRM is automatically trusted.

[0020] 7) SRM persistence step 0107 is used to identify and analyze the core configuration data and business data processed by the SRM system, and store them in the form of cached key-value or relationship data in the persistent storage module 007.

[0021] The beneficial effects of the above-mentioned technical solution of the present application are as follows: The technical solution proposed in the present application introduces encryption, signature verification, desensitization and other technologies. Through unified interface authentication, standards are set for interface mutual access, access specifications between systems are unified, and a standardized system integration platform is built. By desensitizing data during data transmission and storage, personal privacy can be effectively protected, data security can be guaranteed, development and testing can be supported, data analysis and sharing can be promoted, and user trust can be enhanced. At the same time, challenges such as data leakage risks, compliance issues, and internal data access control are well solved. Through the authentication mechanism, it can be ensured that only verified users or systems can access sensitive data and functions, thereby preventing unauthorized access. The authentication mechanism can limit access to APIs, reduce potential attack points, and improve the overall security of the system. By encrypting data during transmission and storage, it can be ensured that the data is not tampered with during transmission, ensuring the integrity of the data, while meeting regulatory requirements and preventing data leakage and other security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the structure of the encryption signature verification system of an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the technical problems, technical solutions and advantages to be solved by the present application clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0024] In order to achieve system integration in a standardized and rapid manner, the applicant expects to adopt a modular design approach to make system development, testing and maintenance easier; standardization helps reduce integration complexity and improve system scalability and flexibility; ensure that different hardware and software are compatible with each other; ensure that data in different systems remain consistent to avoid data silos; security is an important measure to protect the system from unauthorized access and attacks.

[0025] The disclosed embodiment proposes an encryption signature verification system for order finance scenarios, including data desensitization, data encryption, bank-enterprise interaction, financial interaction and order E (order lifecycle management). Data desensitization creates a data copy that looks similar to the original data but does not contain real sensitive details by strategically modifying or replacing the original data. Data encryption converts plaintext (original data) into ciphertext, and implements symmetric encryption (AES) through customized byte substitution, row shift, column mixing, and round key addition techniques to prevent unauthorized third parties from obtaining sensitive information during data transmission or storage. Bank-enterprise interaction performs point-to-point compression and transmission interaction of data in accordance with the agreed XML or JSON data structure to ensure the security of data and prevent illegal blasting. Financial interaction is based on the security mechanism of internal and external interactions, and performs point-to-point compression and transmission of agreed data to ensure the security of data interaction. Order lifecycle management targets the "self-compensation" of upstream transactions and ensures that the first repayment source of order financing and transaction repayment form a benign drive.

[0026] like Figure 1 As shown, the present application proposes an encrypted signature verification system, which includes:

[0027] SRM Management Center 001 is a lightweight microservice management center based on service discovery and dynamic configuration. It includes a public gateway and dynamic multi-data sources to quickly respond to changes in business needs and select the most suitable technology for each task. The SRM Management Center 001 can independently expand a single service as needed without affecting the entire system.

[0028] API management center 002, used to manage and organize application programming interfaces (APIs); it is used to centrally store and manage information about APIs, including but not limited to: API descriptions, endpoint URLs, version information, ThrAuth authentication information, ThrSys Id blacklists and whitelists;

[0029] Desensitization center 003 is used to perform desensitization processing on sensitive data; the desensitization center 003 is used to identify and classify sensitive data stored in different systems, classify the data according to its sensitivity and purpose, define desensitization rules and strategies for different types of data, and build a desensitization engine;

[0030] Encryption Center 004, used to manage and perform data encryption, decryption and key management to ensure the security of sensitive data during storage and transmission and prevent unauthorized access;

[0031] Order E-Center 005 is used to manage the entire life cycle of orders; from order formation, production and delivery, warehousing acceptance to settlement and payment collection, the information flow is fully mastered;

[0032] Financial Center 006 is used to centralize the financial functions of different business units to achieve standardization, process and automation;

[0033] The persistent storage module 007 saves data to non-volatile media, including cache persistence and relationship data persistence.

[0034] The system also includes: a dynamic authentication module, which is used to dynamically generate interactive authentication information between systems and ensure dual-factor verification of location and time.

[0035] Among them, Figure 1 As shown, the system of the embodiment of the present disclosure is used to perform the following steps:

[0036] 1) API authentication registration step 0102 is used to perform registration authentication to uniformly authenticate the interfaces for interaction between systems such as SRM, Order E, and Finance.

[0037] For example, if the SRM system needs to access the financial center's interface xxAPi001, it needs to register the interface URL, authentication method, encryption and desensitization special processing method and other information to the API center, and receive the special key information returned by the API management center 002 that can be used to call the financial center interface xxAPi001;

[0038] 2) Desensitization processing step 0103, which is used to desensitize data during the process of interface interaction between systems and persistent data storage; developers can configure the required desensitization rules according to their own needs, and then use the data desensitization tool provided by the desensitization center 003 to remove sensitive information while retaining the data structure and characteristics, so that the data can be used for testing without leaking privacy.

[0039] 3) Encryption processing step 0304, which is used to provide encryption for interface interaction between systems and persistent data storage; developers can configure the required encryption rules according to their own needs, and then use the data encryption tools provided by the encryption center 004 to encrypt the data multiple times while retaining the data structure and characteristics, so that the data can be securely transmitted and stored.

[0040] 4) SRM management center 001 requests step 0405 / 0406 to financial center 006 and order E center 005, which is used for the SRM system to initiate a service request to financial center 006 and order E center 005. When initiating a service request, the parameters are desensitized in step 0103 and encrypted in step 0304, and the key information generated in API authentication registration step 0102 is carried; financial center 006 and order E center 005 are responsible for authenticating and verifying the request to ensure the security and reliability of output transmission.

[0041] 5) The financial center 006 and the order E center 005 request step 0502 / 0602 to the SRM management center 001, which is used for the financial center 006 and the order E center 005 to initiate a service request to the SRM management center 001. When initiating a service request, the parameters are desensitized in step 0103 and encrypted in step 0304, and the key information generated in the API authentication registration step 0102 is carried. The API management center 002 is responsible for authenticating and verifying the request to ensure the security and reliability of the output transmission.

[0042] 6) Synchronous step 0201, after the API management center 002 authenticates and releases, the data is transmitted to this step through the network security intranet, and the security authentication within the intranet area is passed to ensure the security of data transmission within the intranet. After the API management center 002 verifies the reliable data, the SRM is automatically credible.

[0043] 7) SRM persistence step 0107 is used to identify and analyze the core configuration data and business data processed by the SRM system, and store them in the form of cached key-value or relationship data in the persistent storage module 007.

[0044] The system is also used to perform the following steps:

[0045] Pre-massaging steps: The desensitization center customizes the desensitization strategy to ensure that the strategy can protect data privacy and meet business needs. The system initiates a desensitization request, and the desensitization center distributes and integrates the output of sensitive data according to different desensitization strategies configured for different businesses, and persists it to the persistence center. The desensitization steps also include: monitoring the desensitization process and recording operation logs for auditing and tracking, ensuring that all operations can be traced and meet internal and external compliance requirements.

[0046] Data encryption processing operations: the applicant requests the encryption algorithm, and the encryption engine dynamically generates a key based on the encryption algorithm and the applicant's identification. Data encryption processing flow: After the desensitization center processes, the SRM system module requests the encryption center module, which generates corresponding encrypted data based on different business requirements and the same-station key matching, and outputs the encrypted data to the SRM system module. The steps in the operation also include: security protocols protect the security of data during transmission, and automated workflows process the encryption process.

[0047] Go to the interface center to register the interface permissions, write the registration content to the authentication cache library synchronously, update the system interaction filter interceptor, and notify the bank. When the bank conducts bank-enterprise interaction and data transmission, the interaction filter interceptor verifies the access rights. If it fails to pass the verification, it will record the log and return the unified authentication code. For those who pass the verification, business operations will be performed and persisted in the business database.

[0048] Go to the interface center to register the interface permissions, write the registration content to the authentication cache, update the system interaction filter interceptor, and notify the finance department. When the finance department interacts with the SRM center to transmit data, the interaction filter interceptor verifies the access rights. If the verification fails, the log is recorded and the unified authentication code is returned. If the verification passes, the business operation is performed and persisted in the business database.

[0049] Among them, the unified authentication code is 403 No Authority.

[0050] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage medium such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0051] A person skilled in the art may understand that the various numerical numbers such as first and second involved in the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application, and also indicate the order of precedence.

[0052] At least one in the present application can also be described as one or more, and a plurality can be two, three, four or more, which is not limited in the present application. In the embodiments of the present application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", etc., and there is no order of precedence or size between the technical features described by the "first", "second", "third", "A", "B", "C" and "D".

[0053] The corresponding relationships shown in each table in the present application can be configured or predefined. The values ​​of the information in each table are only examples and can be configured as other values, which are not limited by the present application. When configuring the corresponding relationship between the information and each parameter, it is not necessarily required to configure all the corresponding relationships illustrated in each table. For example, in the table in the present application, the corresponding relationships shown in some rows may not be configured. For another example, appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc. The names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values ​​or representations of the parameters can also be other values ​​or representations that can be understood by the communication device. When implementing the above tables, other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.

[0054] The predefined in the present application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0055] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0056] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0057] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An encrypted signature verification system, comprising: SRM Management Center: This is a lightweight microservice management center based on service discovery and dynamic configuration. It includes a public gateway and dynamic multi-data sources to quickly respond to changes in business needs and select the most suitable technology for each task. API management center, used to manage and organize application programming interfaces (APIs); It is used to centrally store and manage information about APIs, including but not limited to: API descriptions, endpoint URLs, version information, ThrAuth authentication information, ThrSysId blacklists and whitelists; the API management center is also used to perform unified authentication processing on the interactive interfaces between modules and return the corresponding key information; The desensitization center is used to desensitize sensitive data to remove sensitive information; the desensitization center is used to identify and classify sensitive data stored in different systems, classify the data according to its sensitivity and purpose, define desensitization rules and policies for different types of data, and build a desensitization engine; wherein the desensitization center is used to desensitize data during the process of interface interaction between systems and persistent data storage; developers can configure the required desensitization rules according to their own needs, and then use the data desensitization tools provided by the desensitization center to remove sensitive information while retaining the data structure and characteristics, so that the data can be used for testing without leaking privacy; The encryption center is used to manage and execute data encryption, decryption, and key management to ensure the security of sensitive data during storage and transmission and prevent unauthorized access. The encryption center is also used to provide encryption for system interface interaction and data persistence storage. Developers can configure the required encryption rules according to their needs, and then use the data encryption tools provided by the encryption center to encrypt data multiple times while retaining the data structure and characteristics, so that the data can be safely transmitted and stored. The Order E Center is used to manage the entire life cycle of orders; from order formation, production and delivery, warehousing acceptance to settlement and payment collection, it fully grasps the information flow; The financial center is used to centralize the financial functions of different business units to achieve standardization, process and automation; The persistent storage module saves data to non-volatile media, including cache persistence and relational data persistence; The SRM management center is used to send business requests to the financial center and the order E center. When initiating a business request, the parameters are desensitized and encrypted by the desensitization center and the encryption center, and the specific key information returned by the API management center is carried. The financial center and the order E center are responsible for authenticating and verifying the request to ensure the security and reliability of the output transmission. Among them, the Finance Center and the Order E Center initiate business requests to the SRM Management Center. When initiating business requests, the parameters are desensitized and encrypted by the Desensitization Center and the Encryption Center, and carry the specific key information returned by the API Management Center. The API Management Center is responsible for authenticating and verifying the requests to ensure the security and reliability of output transmission. After authentication and release by the API management center, the data is transmitted to the network security intranet and passes the security authentication within the intranet to ensure the security of data transmission within the intranet; after the API management center verifies the reliable data, the SRM management center is automatically trusted.

2. The encrypted signature verification system according to claim 1, wherein the system is further configured to perform the following steps: After the SRM system identifies and analyzes the core configuration data and business data processed, it stores them in the persistent storage module in the form of cached key-value or relational data.

3. The encrypted signature verification system according to claim 1, characterized in that the system further comprises: Dynamic authentication module, which is used to dynamically generate authentication information for interaction between systems and ensure dual-factor verification of location and time.

4. The encrypted signature verification system according to claim 1, characterized in that the system is further used to perform the following steps: Pre-massaging steps: The desensitization center customizes the desensitization strategy to ensure that the strategy can both protect data privacy and meet business needs; when receiving a desensitization request, the desensitization center distributes and integrates the output of sensitive data according to different desensitization strategies configured for different businesses, and persists it to the persistent storage module.

5. The encrypted signature verification system according to claim 4, characterized in that the system is further used to perform the following steps: Monitor the desensitization process and record operation logs for easy auditing and tracking to ensure that all operations are traceable and meet internal and external compliance requirements.

6. The encrypted signature verification system according to claim 1, characterized in that: The system is also configured to perform the following steps: After receiving the request for the encryption algorithm, the encryption engine of the encryption center dynamically generates the key based on the encryption algorithm and the identifier of the requester.

7. The encrypted signature verification system according to claim 6, characterized in that: The system is also configured to perform the following steps: After the desensitization center desensitizes the data, the SRM management center requests the encryption center. The encryption center generates corresponding encrypted data based on different business requirements and key matching on the same platform, and outputs the encrypted data to the SRM management center. Security protocols protect data during transmission, and automated workflows handle the encryption process.

8. The encrypted signature verification system according to claim 1, characterized in that: The system is also configured to perform the following steps: Register interface permissions in the API management center, write the registration content to the authentication cache library, update the system interaction filter interceptor, and notify the bank; when the bank conducts bank-enterprise interaction and data transmission, the interaction filter interceptor verifies access permissions; For those that fail the inspection, logs are recorded; for those that pass the inspection, business operations are performed and persisted in the business database.

Images