Data security protection method and device and electronic equipment

Abstract

The invention relates to the field of network security, and provides a data security protection method and device and electronic equipment, and the data security protection method comprises the steps: obtaining data submitted by a front-end page; executing a preset first data security protection measure based on the data submitted by the front-end page; judging whether the first data security protection measure is successfully executed or not and whether a preset first abnormal condition associated with the first data security protection measure occurs or not when the first data security protection measure is executed or not; if yes, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established corresponding relation between the security level and the security operation; and if not, an HTTP request for transmitting the data submitted by the front-end page is sent to the server. According to the method, by dynamically adjusting the security level and executing corresponding security measures, the security of data transmission is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a data security protection method, device and electronic equipment. Background Art

[0002] In modern network applications, data interaction between the front-end and the back-end is frequent, and data security has become a critical issue. Although existing technologies provide some security measures, such as data encryption and simple integrity verification, they often lack systematicity and dynamism, making it difficult to cope with complex and changing network attacks. Summary of the invention

[0003] The present invention provides a data security protection method, device and electronic device to solve the defects of lack of systematicity and dynamism in data security protection in the prior art, and improves the security of data transmission by dynamically adjusting the security level and executing corresponding security measures.

[0004] Obtain data submitted by a front-end page; execute a pre-set first data security protection measure based on the data submitted by the front-end page; determine whether the first data security protection measure is successfully executed, and whether a pre-set first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; if it is determined that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, adjust the security level, and execute the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; if it is determined that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed, send an HTTP request to the server for transmitting the data submitted by the front-end page.

[0005] According to the data security protection method provided by the present invention, the first data security protection measure includes: encrypting the data submitted by the front-end page using a preset encryption method and storing it in a first preset location; before sending the HTTP request, obtaining the first encrypted data of the data required for the HTTP request from the first preset location; performing data verification on the first encrypted data; and the first abnormal situation includes failure of data verification.

[0006] According to the data security protection method provided by the present invention, the data verification of the first encrypted data includes: encrypting the data associated with the first encrypted data in the HTTP request using the preset encryption method to obtain the data to be verified; and comparing whether the data to be verified is the same as the first encrypted data.

[0007] According to the data security protection method provided by the present invention, the security level includes low risk, medium risk and high risk. If it is determined that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established correspondence between the security level and the security operation, including: if it is determined that the first data security protection measure is not successfully executed within a preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset first number threshold, the security level is adjusted to low risk, and the security operation corresponding to the low risk is executed. The security operation corresponding to the low risk includes strengthening the monitoring of the front-end page, determining whether the front-end page performs sensitive operations and / or the front-end whether the debugging tool of the page browser is opened for illegal display; if it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset second number threshold, the security level is adjusted to medium risk, and the security operation corresponding to the medium risk is performed, and the security operation corresponding to the medium risk includes sending risk warning information to the user; if it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset third number threshold, the security level is adjusted to high risk, and the security operation corresponding to the high risk is performed, and the security operation corresponding to the high risk includes sending an instruction message to the server to delete the current user's unique user identifier.

[0008] According to the data security protection method provided by the present invention, the first data security protection measure includes determining whether the count of HTTP requests within a preset time period exceeds a preset threshold; and the first abnormal situation includes the statistical count exceeding the preset threshold.

[0009] According to the data security protection method provided by the present invention, the method also includes: accepting an HTTP response returned by the server; decrypting the HTTP response message; executing a pre-set second data security protection measure based on the data obtained by decrypting the message; judging whether the second data security protection measure is successfully executed, and whether a pre-set second abnormal situation associated with the second data security protection measure occurs when the second data security protection measure is executed; if it is judged that the second data security protection measure is not successfully executed or the second abnormal situation occurs when the second data security protection measure is executed, adjusting the security level, and executing the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; if it is judged that the second data security protection measure is successfully executed and the second abnormal situation does not occur when the second data security protection measure is executed, executing the predefined data usage logic for using the message data of the HTTP response.

[0010] According to the data security protection method provided by the present invention, the second data security protection measure includes: adding an integrity check to the data obtained by decrypting the message; encrypting and storing the data that passes the integrity check in a second preset location; before executing the data usage logic, obtaining the second encrypted data of the data required by the data usage logic from the second preset location; decrypting the second encrypted data to obtain the data required by the data usage logic; performing a secondary check on the data required by the data usage logic; the second abnormal situation includes failure of the integrity check and failure of the secondary check.

[0011] According to the data security protection method provided by the present invention, the first data security protection measure or the second data security protection measure is selected by a user from a pre-built set of security protection measures, and the set of security protection measures includes security protection measures for HTML5 pages, and the security protection measures for HTML5 pages are run on HTML5 pages in native applications through pre-defined dependencies.

[0012] According to the data security protection method provided by the present invention, if it is determined that the second data security protection measure is not successfully executed or the second abnormal situation occurs when the second data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established correspondence between the security level and the security operation, including: if it is determined that the first data security protection measure and the second data security protection measure are not successfully executed within a preset time period or the number of the first abnormal situation and the second abnormal situation occurring when the first data security protection measure and the second data security protection measure are executed reaches a preset fourth number threshold, the security level is adjusted to low risk, and the security operation corresponding to the low risk is executed, and the security operation corresponding to the low risk includes strengthening the monitoring of the front-end page to determine whether the front-end page performs sensitive operations and / or whether the debugging tool of the front-end page browser is opened for illegal display; ... If the first data security protection measure and the second data security protection measure are not successfully executed within the time period or the number of the first abnormal situation and the second abnormal situation that occur during the execution of the first data security protection measure and the second data security protection measure reaches the preset fifth number threshold, the security level is adjusted to medium risk, and the security operation corresponding to the medium risk is executed, and the security operation corresponding to the medium risk includes sending risk warning information to the user; if it is determined that the first data security protection measure and the second data security protection measure are not successfully executed within the preset time period or the number of the first abnormal situation and the second abnormal situation that occur during the execution of the first data security protection measure and the second data security protection measure reaches the preset sixth number threshold, the security level is adjusted to high risk, and the security operation corresponding to the high risk is executed, and the security operation corresponding to the high risk includes sending an instruction message to the server to delete the user unique identifier of the current user. By executing security protection measures before sending data to the server and before receiving data sent by the server to execute data use logic, more comprehensive protection is achieved, and the security of the system is further improved.

[0013] The present invention also provides a data security protection device, comprising: an acquisition module, configured to acquire data submitted by a front-end page; an execution module, configured to execute a pre-set first data security protection measure based on the data submitted by the front-end page; a judgment module, configured to judge whether the first data security protection measure is successfully executed, and whether a pre-set first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; an adjustment module, configured to adjust the security level when the judgment module determines that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, and to execute the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; a sending module, configured to send an HTTP request for transmitting the data submitted by the front-end page to the server when the judgment module determines that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed.

[0014] The data security protection method, device and electronic device provided by the present invention improve the security of data transmission by dynamically adjusting the security level and executing corresponding security measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flow chart of the data security protection method provided by the present invention.

[0017] Figure 2 It is a schematic diagram of the data security protection process provided by the present invention.

[0018] Figure 3 It is a structural schematic diagram of the data security protection device provided by the present invention.

[0019] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one", "one" or "the" do not indicate a quantitative limitation, but indicate the existence of at least one. Words such as "include" or "comprise" mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Words such as "connect" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0022] The following is a brief explanation of the terms involved in the present invention.

[0023] Combine the following Figure 1-Figure 4 The data security protection method, device and electronic device of the present invention are described.

[0024] Figure 1 It is a flow chart of the data security protection method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Get the data submitted by the front-end page.

[0025] In this embodiment, the data submitted by the front-end page may come from form input, URL parameters or other user interactions.

[0026] Step 102: Execute a pre-set first data security protection measure based on the data submitted by the front-end page.

[0027] In this embodiment, the first data security protection measure is used for security protection, and can be selected and set according to actual security protection needs. As an example, it can include one or more of the following measures: data encryption, data verification, and anti-duplicate submission, etc.

[0028] Step 103: Determine whether the first data security protection measure is successfully executed, and whether a pre-set first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed.

[0029] In this embodiment, by judging whether the first data security protection measure is successfully executed, and whether a preset first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed, the possibility that the system is attacked or abnormal can be determined. The first abnormal situation is associated with the first data security protection measure. For example, if the first data security protection measure is data verification, the first abnormal situation is usually set to data verification failure.

[0030] Step 104: Adjust the security level.

[0031] In this embodiment, after step 103 determines that the first data security protection measure has not been successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level can be adjusted. The security level can be used to indicate the security risk level faced by the system, data or assets, and can be dynamically determined according to the user's current environment. For example, the initial security level can be dynamically determined based on environmental information such as the current network, access longitude and latitude, mobile phone location, and mobile phone and computer model configuration, and then the security level can be adjusted based on information such as the execution status of the data security protection measures, such as the number of times the security protection measures have not been successfully executed or abnormal situations have occurred during execution. In addition, the security level can also be adjusted comprehensively based on changes in the above types of information. The security level can be divided according to actual needs. As an example, the security level can be divided into three levels: low, medium, and high. The risk level can be determined in the user operating system to perform different pre-risk processing.

[0032] Step 105: Execute the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation.

[0033] In this embodiment, security operations can be used to reduce system risks, and a correspondence between security levels and security operations can be established according to the actual needs of the system. As an example, security operations can include several of the following operations: basic identity authentication, network monitoring, data backup, multi-factor authentication, enhanced access control, security auditing, intrusion detection, strict access control and permission review, high-intensity data encryption and secure transmission, and stopping access or transactions.

[0034] Step 106: Send an HTTP request to the server for transmitting the data submitted by the front-end page.

[0035] In this embodiment, if it is determined in step 103 that the first data security protection measure is successfully executed and no first abnormal situation occurs during the execution of the first data security protection measure, an HTTP request for transmitting the data submitted by the front-end page can be sent to the server. The data submitted by the front-end page in the HTTP request can be encrypted and / or verified, thereby further improving the security of the system.

[0036] The data security protection method provided by the present invention can protect against network attacks including cross-site scripting (XSS) attacks. Since the security level in the present invention is dynamically adjusted, even if the attacker cracks the session credential, secondary authentication cannot be performed.

[0037] In some optional implementations, the first data security protection measure includes: encrypting the data submitted by the front-end page in a preset encryption method and storing it in a first preset location; obtaining the first encrypted data of the data required for the HTTP request from the first preset location before sending the HTTP request; performing data verification on the first encrypted data; and the first abnormal situation includes failure of the data verification. Data verification may include integrity verification and / or security verification. Integrity verification is mainly used to ensure that the data has not been accidentally or maliciously modified during transmission or processing. For file stream type data, a fixed format fixed size interval can be set to perform file stream integrity verification. Security verification is mainly used to ensure the security of data and prevent unauthorized access and data leakage.

[0038] In some optional implementations, performing data verification on the first encrypted data includes: encrypting the data associated with the first encrypted data in the HTTP request using a preset encryption method to obtain the data to be verified; and comparing whether the data to be verified is the same as the first encrypted data. If they are not the same, it means that the data has been tampered with, and the verification fails.

[0039] At present, the server often receives a large amount of data, but these data may have various problems, such as format errors, missing data, unreasonable data, etc. This may cause errors or abnormalities in the subsequent data processing process, affecting the normal operation of the system and the accurate development of the business. This implementation method improves the quality of data received by the server by performing data verification before sending HTTP requests, and further improves the operating efficiency of the system.

[0040] In some optional implementations, the first data security protection measure includes determining whether a count of HTTP requests within a preset time period exceeds a preset threshold; and the first abnormal situation includes a counted count exceeding the preset threshold.

[0041] During the transaction process, some abnormal situations may occur, such as repeated transactions with extremely short intervals (for example, less than 200 milliseconds). This situation may be caused by malicious behavior or system failure. If it is not handled, it will have a serious impact on the normal order and security of the transaction. This implementation method can further improve the security and stability of the system by judging whether the count of HTTP requests within a preset time period exceeds the preset threshold. In addition, counting HTTP requests can prevent high and heavy concurrency, and record this transaction. In addition, in addition to counting, when accessing the server, the sending time record, security level record, and current environment record can also be performed. When the transaction is repeatedly accessed, the data can be compared to see if it is consistent, the time interval and the environment are consistent, so as to perform relatively safe processing. Since the counter value of the HTTP request changes dynamically, even if the attacker cracks the session credentials, secondary authentication cannot be performed; therefore, the technical solution provided in the embodiment of the present application can improve the security of single sign-on and better protect user data and interests.

[0042] In some optional implementations, the security level includes low risk, medium risk and high risk. If it is determined that the first data security protection measure is not successfully executed or a first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established correspondence between the security level and the security operation, including: if it is determined that the first data security protection measure is not successfully executed within a preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset first number threshold, the security level is adjusted to low risk, and the security operation corresponding to the low risk is executed. The security operation corresponding to the low risk includes strengthening the monitoring of the front-end page, determining whether the front-end page performs sensitive operations and / or the front-end page is browsed whether the browser's debugging tool is opened for illegal display; if it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches the preset second number threshold, the security level is adjusted to medium risk, and the security operation corresponding to the medium risk is performed, and the security operation corresponding to the medium risk includes sending risk warning information to the user; if it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches the preset third number threshold, the security level is adjusted to high risk, and the security operation corresponding to the high risk is performed, and the security operation corresponding to the high risk includes sending an instruction message to the server to delete the user's unique identifier of the current user.

[0043] In this implementation, the first number threshold, the second number threshold, and the third number threshold can be set according to actual needs, for example, the first number threshold, the second number threshold, and the third number threshold can be set to one, two, and three times, respectively. Sending risk warning information to users can be used to remind them of current risks and suggest that users exit the current browsing page, log out, or change their passwords. In addition, sending an instruction message to the server to delete the current user's unique user identifier can force the user to log out of this login, thereby terminating this operation.

[0044] In some optional implementations, the method also includes: accepting an HTTP response returned by the server; decrypting the HTTP response message; executing a pre-set second data security protection measure based on the data obtained from the decrypted message; determining whether the second data security protection measure is successfully executed, and whether a pre-set second abnormal situation associated with the second data security protection measure occurs when the second data security protection measure is executed; if it is determined that the second data security protection measure is not successfully executed or a second abnormal situation occurs when the second data security protection measure is executed, adjusting the security level, and executing the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; if it is determined that the second data security protection measure is successfully executed and no second abnormal situation occurs when the second data security protection measure is executed, executing the predefined data usage logic for using the message data of the HTTP response.

[0045] In this implementation, the second data security protection measure can be selected and set according to the needs of the actual system. As an example, it can include steps such as data encryption and / or verification. The data usage logic is pre-written to process the data included in the HTTP response. Figure 2 , Figure 2 It is a schematic diagram of the data security protection process provided by the present invention. This implementation method is used to process the HTTP response returned by the server, which can effectively protect the transmission of data from the server to the client, further improving the security of the system. It is particularly suitable for application scenarios with high requirements for data security, such as online payment, sensitive information processing and enterprise data management.

[0046] In some optional implementations, the second data security protection measure includes: adding integrity check to the data obtained by decrypting the message; encrypting and storing the data that passes the integrity check in a second preset location; obtaining the second encrypted data of the data required by the data use logic from the second preset location before executing the data use logic; decrypting the second encrypted data to obtain the data required by the data use logic; performing a secondary check on the data required by the data use logic; and the second abnormal situation includes failure of the integrity check and failure of the secondary check. The encryption algorithm for encryption can be selected or set according to actual needs. As an example, Advanced Encryption Standard (AES), MD5 (Message Digest Algorithm 5), etc. can be selected.

[0047] In some optional implementations, if it is determined that the second data security protection measure is not successfully executed or a second abnormal situation occurs when the second data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established correspondence between the security level and the security operation, including: if it is determined that the first data security protection measure and the second data security protection measure are not successfully executed within a preset time period or the number of first abnormal situations and second abnormal situations that occur when the first data security protection measure and the second data security protection measure are executed reaches a preset fourth number threshold, the security level is adjusted to low risk, and the security operation corresponding to the low risk is executed. The security operation corresponding to the low risk includes strengthening the monitoring of the front-end page to determine whether the front-end page performs sensitive operations and / or whether the debugging tool of the front-end page browser is opened for illegal display; if it is determined that the If the first data security protection measure and the second data security protection measure are not successfully executed within the time period, or the number of first abnormal situations and second abnormal situations that occur when the first data security protection measure and the second data security protection measure are executed reaches the preset fifth number threshold, the security level is adjusted to medium risk, and the security operation corresponding to the medium risk is executed. The security operation corresponding to the medium risk includes sending risk warning information to the user; if it is determined that the first data security protection measure and the second data security protection measure are not successfully executed within the preset time period, or the number of first abnormal situations and second abnormal situations that occur when the first data security protection measure and the second data security protection measure are executed reaches the preset sixth number threshold, the security level is adjusted to high risk, and the security operation corresponding to the high risk is executed. The security operation corresponding to the high risk includes sending an instruction message to the server to delete the current user's unique user identifier.

[0048] In this implementation, the fourth number threshold, the fifth number threshold and the sixth number threshold can be set according to actual needs. For example, the fourth number threshold, the fifth number threshold and the sixth number threshold can be set to once, twice and three times respectively.

[0049] At present, data on the server may be missing, damaged or tampered with during transmission, storage and processing, which will seriously affect the accuracy and reliability of the data, and further affect the normal operation of the application system based on this data and the correct development of the business. This implementation method improves the quality of data processed by the client by performing data verification before executing the data usage logic, and further improves the security and operation efficiency of the system.

[0050] In some optional implementations, the first data security protection measure or the second data security protection measure is selected by the user from a pre-built security protection measure set, and the security protection measure set includes security protection measures for HTML5 pages, and the security protection measures for HTML5 pages are run on HTML5 pages in native applications through pre-defined dependencies. A security protection system and corresponding front-end pages can be established to facilitate user selection. In addition, the security protection measures and related auxiliary parts in the security protection measure set can be processed by system encryption and obfuscation to further enhance overall security.

[0051] The data security protection device provided by the present invention is described below. The data security protection device described below and the data security protection method described above can be referenced to each other.

[0052] Figure 3 A schematic diagram of the structure of the data security protection device provided in the embodiment of the present application is shown in FIG. Figure 3 As shown, it specifically includes: an acquisition module 301, configured to acquire data submitted by a front-end page; an execution module 302, configured to execute a preset first data security protection measure based on the data submitted by the front-end page; a judgment module 303, configured to judge whether the first data security protection measure is successfully executed, and whether a preset first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; an adjustment module 304, configured to adjust the security level when the judgment module determines that the first data security protection measure is not successfully executed or a first abnormal situation occurs when the first data security protection measure is executed, and execute the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; a sending module 305, configured to send an HTTP request for transmitting the data submitted by the front-end page to the server when the judgment module determines that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed.

[0053] In some optional implementations, the first data security protection measure includes: encrypting and storing the data submitted by the front-end page in a first preset location; obtaining the first encrypted data required for the HTTP request from the first preset location before sending the HTTP request; performing data verification on the first encrypted data; and the first abnormal situation includes failure of the data verification.

[0054] In some optional implementations, the first data security protection measure includes determining whether a count of HTTP requests within a preset time period exceeds a preset threshold; and the first abnormal situation includes a counted count exceeding the preset threshold.

[0055] In some optional implementations, the device also includes a protection module, which is configured to: accept an HTTP response returned by the server; decrypt the HTTP response message; execute a pre-set second data security protection measure based on the data obtained by decrypting the message; determine whether the second data security protection measure is successfully executed, and whether a pre-set second abnormal situation associated with the second data security protection measure occurs when the second data security protection measure is executed; if it is determined that the second data security protection measure is not successfully executed or a second abnormal situation occurs when the second data security protection measure is executed, adjust the security level, and execute the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; if it is determined that the second data security protection measure is successfully executed and no second abnormal situation occurs when the second data security protection measure is executed, execute the predefined data usage logic for using the message data of the HTTP response.

[0056] In some optional implementations, the second data security protection measure includes: adding an integrity check to the data obtained by decrypting the message; encrypting and storing the data that passes the integrity check in a second preset location; before executing the data usage logic, obtaining the second encrypted data of the data required by the data usage logic from the second preset location; decrypting the second encrypted data to obtain the data required by the data usage logic; performing a secondary check on the data required by the data usage logic; and the second abnormal situation includes failure of the integrity check and failure of the secondary check.

[0057] In some optional implementations, the first data security protection measure or the second data security protection measure is selected by a user from a pre-built set of security protection measures, where the security protection measure set includes security protection measures for native pages and HTML5 pages, and each security protection measure in the security protection measure set has pre-defined dependencies.

[0058] The data security protection device provided by the present invention improves the security of data transmission by dynamically adjusting the security level and executing corresponding security measures.

[0059] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the data security protection method, which includes: obtaining the data submitted by the front-end page; executing the preset first data security protection measure based on the data submitted by the front-end page; judging whether the first data security protection measure is successfully executed, and whether the first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; if it is judged that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established corresponding relationship between the security level and the security operation; if it is judged that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed, an HTTP request for transmitting the data submitted by the front-end page is sent to the server.

[0060] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0061] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data security protection method provided by the above methods, which includes: obtaining data submitted by the front-end page; executing a pre-set first data security protection measure based on the data submitted by the front-end page; judging whether the first data security protection measure is successfully executed, and whether a pre-set first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; if it is judged that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and the security operation corresponding to the adjusted security level is executed according to the pre-established correspondence between the security level and the security operation; if it is judged that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed, an HTTP request for transmitting the data submitted by the front-end page is sent to the server.

[0062] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the data security protection method provided by the above-mentioned methods, the method comprising: obtaining data submitted by a front-end page; executing a pre-set first data security protection measure based on the data submitted by the front-end page; judging whether the first data security protection measure is successfully executed, and whether a pre-set first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; if it is judged that the first data security protection measure is not successfully executed or a first abnormal situation occurs when the first data security protection measure is executed, adjusting the security level, and executing the security operation corresponding to the adjusted security level according to the pre-established correspondence between the security level and the security operation; if it is judged that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed, sending an HTTP request to the server for transmitting the data submitted by the front-end page.

[0063] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0064] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data security protection method, characterized in that: include: Get the data submitted by the front-end page; Execute a preset first data security protection measure based on the data submitted by the front-end page; Determining whether the first data security protection measure is successfully executed, and whether a preset first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; If it is determined that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and according to the pre-established correspondence between the security level and the security operation, the security operation corresponding to the adjusted security level is executed; If it is determined that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed, an HTTP request for transmitting the data submitted by the front-end page is sent to the server.

2. The data security protection method according to claim 1, characterized in that: The first data security protection measure includes: Encrypting the data submitted by the front-end page in a preset encryption method and storing it in a first preset location; Before sending the HTTP request, obtaining first encrypted data of data required by the HTTP request from the first preset location; Performing data verification on the first encrypted data; And the first abnormal situation includes data verification failure.

3. The data security protection method according to claim 2, characterized in that: The performing data verification on the first encrypted data includes: Encrypting the data associated with the first encrypted data in the HTTP request using the preset encryption method to obtain data to be verified; Compare the data to be verified with the first encrypted data to see if they are the same.

4. The data security protection method according to claim 1, characterized in that: The first data security protection measure includes determining whether the count of HTTP requests within a preset time period exceeds a preset threshold; And the first abnormal situation includes that the counted value exceeds a preset threshold.

5. The data security protection method according to claim 1, characterized in that: The security level includes low risk, medium risk and high risk. If it is determined that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, the security level is adjusted, and according to the pre-established correspondence between the security level and the security operation, the security operation corresponding to the adjusted security level is performed, including: If it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset first number threshold, the security level is adjusted to low risk, and the security operation corresponding to the low risk is performed. The security operation corresponding to the low risk includes strengthening the monitoring of the front-end page, determining whether the front-end page performs sensitive operations and / or whether the debugging tool of the front-end page browser is opened for illegal display; If it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches a preset second number threshold, the security level is adjusted to medium risk, and the security operation corresponding to the medium risk is performed, and the security operation corresponding to the medium risk includes sending risk warning information to the user; If it is determined that the first data security protection measure is not successfully executed within the preset time period or the number of times the first abnormal situation occurs when the first data security protection measure is executed reaches the preset third number threshold, the security level is adjusted to high risk, and the security operation corresponding to the high risk is performed. The security operation corresponding to the high risk includes sending an instruction message to the server to delete the unique user identifier of the current user.

6. The data security protection method according to claim 1, characterized in that: The method further comprises: Accept the HTTP response returned by the server; Decrypting the HTTP response; Execute a preset second data security protection measure based on the data obtained by decrypting the message; Determine whether the second data security protection measure is successfully executed, and whether a preset second abnormal situation associated with the second data security protection measure occurs when the second data security protection measure is executed; If it is determined that the second data security protection measure is not successfully executed or the second abnormal situation occurs when the second data security protection measure is executed, the security level is adjusted, and according to the pre-established correspondence between the security level and the security operation, the security operation corresponding to the adjusted security level is executed; If it is determined that the second data security protection measure is successfully executed and the second abnormal situation does not occur when the second data security protection measure is executed, the predefined data usage logic for using the message data of the HTTP response is executed.

7. The data security protection method according to claim 6, characterized in that: The second data security protection measure includes: Add integrity check to the data obtained by decrypting the message; Encrypting and storing the data that passes the integrity check in a second preset location; Before executing the data usage logic, obtaining second encrypted data of data required by the data usage logic from the second preset location; decrypting the second encrypted data to obtain data required by the data usage logic; Performing a secondary check on the data required by the data usage logic; And the second abnormal situation includes failure of integrity check and failure of secondary check.

8. The data security protection method according to claim 6, characterized in that: The first data security protection measure or the second data security protection measure is selected by a user from a pre-built set of security protection measures, wherein the set of security protection measures includes security protection measures for HTML5 pages, and the security protection measures for HTML5 pages are run on HTML5 pages in native applications through pre-defined dependencies.

9. A data security protection device, characterized in that: include: The acquisition module is configured to obtain the data submitted by the front-end page; An execution module, configured to execute a preset first data security protection measure based on the data submitted by the front-end page; a judgment module configured to judge whether the first data security protection measure is successfully executed, and whether a preset first abnormal situation associated with the first data security protection measure occurs when the first data security protection measure is executed; an adjustment module, configured to adjust the security level when the judgment module determines that the first data security protection measure is not successfully executed or the first abnormal situation occurs when the first data security protection measure is executed, and perform the security operation corresponding to the adjusted security level according to the pre-established correspondence relationship between the security level and the security operation; The sending module is configured to send an HTTP request for transmitting the data submitted by the front-end page to the server when the judgment module determines that the first data security protection measure is successfully executed and the first abnormal situation does not occur when the first data security protection measure is executed.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the data security protection method as described in any one of claims 1 to 6.

Images