Front and rear end secure transmission method, device and equipment of fee control system

Abstract

The invention provides a front-end and back-end secure transmission method, device and equipment of a fee control system, and relates to the technical field of front-end and back-end interaction, and the method comprises the steps: receiving an HTTPS request sent by a front end of the fee control system; the HTTPS request comprises a parameter digital signature, a key ciphertext and a parameter ciphertext; the key ciphertext is obtained by performing asymmetric encryption on a pre-generated random key by using an asymmetric public key; the parameter ciphertext is obtained by encrypting target transmission data by using a random key; decrypting the key ciphertext by using a pre-stored asymmetric private key to obtain a random key; verifying the parameter digital signature, and after the parameter digital signature passes, decrypting the parameter ciphertext by using the random key to obtain target transmission data; processing the target transmission data to obtain a processing result; and returning a processing result to the front end of the cost control system. According to the invention, efficient and secure encryption of front and rear end parameters is realized, and the security of data in a transmission process is ensured.

Description

Technical Field

[0001] The present application relates to the technical field of front-end and back-end interaction, and in particular to a front-end and back-end secure transmission method, device and equipment for a fee control system. Background Art

[0002] With the rapid development of Internet technology, front-end and back-end interaction has become an indispensable part of many applications. However, the front-end and back-end parameters are vulnerable to security risks such as illegal interception, tampering and forgery during transmission, which seriously threatens the security of user data and the stability of applications. Therefore, how to provide an efficient and secure encryption solution to ensure the security of front-end and back-end interface parameter transmission has become an urgent problem to be solved.

[0003] In the existing fee control system, the front-end and back-end interface parameter transmission mostly adopts the methods of plain text, Base64 encoding, single encryption, single verification, etc., which makes the parameters vulnerable to illegal interception, tampering and forgery during the front-end and back-end transmission process. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a front-end and back-end secure transmission method, device and equipment for a fee control system, which is used to solve the problems of low security of front-end and back-end interface parameter transmission in the prior art, and susceptibility to illegal interception, tampering and forgery. By combining and applying a variety of national secret encryption algorithms, efficient and secure encryption of front-end and back-end parameters can be achieved, thereby ensuring the security of data during transmission.

[0005] In a first aspect, a front-end and back-end secure transmission method of a fee control system is provided, and the method may include:

[0006] Receive an HTTPS request sent by the front end of the fee control system; wherein the HTTPS request includes a parameter digital signature, a key ciphertext, and a parameter ciphertext; the key ciphertext is obtained by asymmetrically encrypting a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key;

[0007] Decrypting the key ciphertext using a pre-stored asymmetric private key to obtain the random key;

[0008] After verifying the parameter digital signature and the parameter digital signature passes, decrypting the parameter ciphertext using the random key to obtain the target transmission data;

[0009] Processing the target transmission data to obtain a processing result;

[0010] The processing result is returned to the front end of the fee control system.

[0011] In an optional implementation, before receiving the HTTPS request sent by the fee control system front end, the method further includes:

[0012] An asymmetric key pair is generated, and the asymmetric public key in the asymmetric key pair is sent to the front end of the fee control system, and the asymmetric private key in the asymmetric key pair is sent to the back end of the fee control system.

[0013] In an optional implementation, the parameter digital signature is obtained by encrypting a pre-generated parameter summary using an asymmetric public key; the parameter summary is generated by performing a hash operation on the parameter ciphertext and the random key using a hash function;

[0014] Verifying the parameter digital signature includes:

[0015] Decrypting the key ciphertext using the asymmetric private key to obtain a random key;

[0016] Decrypting the parameter digital signature using an asymmetric private key to obtain the parameter summary;

[0017] Using a hash function to calculate the parameter ciphertext and the random key to obtain a decryption parameter summary;

[0018] If the decryption parameter digest is the same as the parameter digest, the parameter digital signature passes the verification.

[0019] In an optional implementation, any HTTPS request corresponds to a request sending time;

[0020] The HTTPS request includes: a request type and a fee control system account number for sending the HTTPS request;

[0021] The HTTPS request types include fee control system login requests and fee control system operation requests;

[0022] When the HTTPS request is a fee control system login request, the target transmission data includes: the login password of the fee control system account that sends the HTTPS request;

[0023] When the HTTPS request is a fee control system operation request, the target transmission data includes: operation type.

[0024] In an optional implementation, the method further includes:

[0025] Based on the request type, operation type and corresponding request sending time of the HTTPS request, and the fee control system account that sends the HTTPS request, a fee control system security operation log is generated.

[0026] In an optional implementation, any fee control system account corresponds to an operation permission; the operation permission is used to characterize the operation type of the fee control system account;

[0027] Before processing the target transmission data to obtain a processing result, the method further includes:

[0028] If the request sending time exceeds the preset time threshold, a configured timeout prompt is directly returned to the fee control system front end;

[0029] If the operation permission does not include the operation type in the target transmission data, a prompt indicating that the configured permission is exceeded is directly returned to the fee control system front end.

[0030] In an optional implementation, returning the processing result to the fee control system front end includes:

[0031] After the processing result is encrypted using the random key, the encrypted processing result is returned to the fee control system front end.

[0032] In a second aspect, a front-end and back-end secure transmission device of a fee control system is provided, and the device may include:

[0033] A receiving unit, configured to receive an HTTPS request sent by a front end of a fee control system; wherein the HTTPS request includes a parameter digital signature, a key ciphertext, and a parameter ciphertext; the key ciphertext is obtained by asymmetrically encrypting a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key;

[0034] A decryption unit, configured to decrypt the key ciphertext using a pre-stored asymmetric private key to obtain the random key; after verifying the parameter digital signature and the parameter digital signature passes, decrypt the parameter ciphertext using the random key to obtain the target transmission data;

[0035] A processing unit, used for processing the target transmission data to obtain a processing result;

[0036] The returning unit is used to return the processing result to the front end of the fee control system.

[0037] In a third aspect, an electronic device is provided, the electronic device comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0038] Memory, used to store computer programs;

[0039] The processor is used to implement any method step described in the first aspect when executing the program stored in the memory.

[0040] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any method step described in the first aspect is implemented.

[0041] This application adopts a strategy that combines hash function algorithms, symmetric encryption algorithms and asymmetric encryption algorithms, flexibly selects encryption algorithms according to actual needs, realizes efficient data encryption and decryption processing, and improves security and performance; this application introduces key management services (KMS) to realize the full life cycle management of SM2 key generation, storage, distribution, update and destruction, and ensures the security of key storage process through strict permission control and access audit.

[0042] The front end of this application is responsible for random key generation, parameter encryption, random key encryption and signature processing; the back end is responsible for signature verification, random key decryption, and parameter decryption processing, realizing a set of simple and easy-to-use encryption and decryption, which is convenient for front-end and back-end developers to quickly integrate and use. This application uses the HTTPS protocol for data transmission to ensure the security of data during transmission. At the same time, through technical means such as digital signatures and certificate verification, the integrity and tamper resistance of the data are further enhanced.

[0043] This application records the key operations in the front-end and back-end parameter encryption process in real time and supports log auditing. Once a security problem occurs, the cause of the problem can be quickly located through the log and appropriate treatment measures can be taken. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of a front-end and back-end secure transmission method for a fee control system provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of a front-end and back-end secure transmission method for a fee control system provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of front-end and back-end secure transmission data flow of a fee control system provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the structure of a front-end and back-end secure transmission device of a fee control system provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] The front-end and back-end secure transmission method of the fee control system provided in the embodiment of the present application can be applied in a server or in a terminal with strong computing power. The server can be a physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal can be a user equipment (User Equipment, UE) such as a mobile phone, a smart phone, a laptop, a digital broadcast receiver, a personal digital assistant (PDA), a tablet computer (PAD), a handheld device, a vehicle-mounted device, a wearable device, a computing device or other processing equipment connected to a wireless modem, a mobile station (Mobile Station, MS), a mobile terminal (Mobile Terminal), etc. The terminal and the server can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0052] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0053] Figure 1 A schematic diagram of a flow chart of a front-end and back-end secure transmission method of a fee control system provided in an embodiment of the present application. Figure 1 As shown, the method may include:

[0054] Step S110: Receive the HTTPS request sent by the fee control system front end; use the pre-stored asymmetric private key to decrypt the key ciphertext to obtain a random key.

[0055] In an embodiment of the present application, a pair of asymmetric key pairs are generated in advance using a key management service (KMS), which includes an asymmetric public key and an asymmetric private key; wherein the asymmetric public key pubKey is distributed to the front end of the fee control system; and the asymmetric private key priKey is distributed to the back end of the fee control system.

[0056] In an embodiment of the present application, a key management service (KMS) is used to uniformly implement the full life cycle management of SM2 keys, including generation, storage, distribution, update, and destruction; only authorized users can access and use the keys to ensure the security of the keys.

[0057] In an embodiment of the present application, the key management service (KMS) will periodically update the asymmetric key pair and re-issue it to the back-end and front-end of the fee control system.

[0058] In the embodiment of the present application, the HTTPS request includes: parameter ciphertext enData, key ciphertext enKey and parameter digital signature sign.

[0059] In the embodiment of the present application, the key ciphertext enKey is obtained by asymmetrically encrypting the pre-generated random key key using the asymmetric public key pubKey pre-stored in the front end of the fee control system;

[0060] In the embodiment of the present application, the parameter ciphertext enData is obtained by encrypting the target transmission data using a random key; the encryption may adopt a symmetric encryption algorithm.

[0061] In the embodiment of the present application, the parameter digital signature is obtained by encrypting a pre-generated parameter summary using an asymmetric public key; the parameter summary is generated by performing a hash operation on the parameter ciphertext and a random key using a hash function.

[0062] In the embodiment of the present application, the front-end and back-end use the HTTPS protocol for data transmission to ensure the security of data during transmission.

[0063] In an embodiment of the present application, the key ciphertext is decrypted using a pre-stored asymmetric private key to obtain a random key.

[0064] In one embodiment of the present application, the random key can be generated using the SM4 symmetric encryption algorithm; the asymmetric encryption algorithm can be the SM2 encryption algorithm; and the hash algorithm can be the SM3 algorithm.

[0065] Step S120: After the parameter digital signature is verified and passed, the parameter ciphertext is decrypted using a random key to obtain the target transmission data; the target transmission data is processed to obtain a processing result; and the processing result is returned to the front end of the fee control system.

[0066] In the embodiment of the present application, after receiving the HTTPS request sent by the fee control system front end, the parameter digital signature needs to be verified, including:

[0067] The key ciphertext is decrypted using the asymmetric private key to obtain the random key; the parameter digital signature is decrypted using the asymmetric private key to obtain the parameter summary; the parameter ciphertext and the random key are calculated using the hash function to obtain the decrypted parameter summary; if the decrypted parameter summary is the same as the parameter summary, the parameter digital signature is verified.

[0068] In the embodiment of the present application, the back-end server processes the target transmission data obtained after decryption and returns the processing result to the front-end. If sensitive data needs to be returned, the back-end server can reversely encrypt and sign the data to ensure the security of the data during the return process.

[0069] In the embodiment of the present application, any HTTPS request corresponds to a request sending time; the HTTPS request includes: the request type and the fee control system account that sends the HTTPS request; the HTTPS request type includes a fee control system login request and a fee control system operation request.

[0070] In an embodiment of the present application, when the HTTPS request is a fee control system login request, the target transmission data includes: the login password of the fee control system account that sends the HTTPS request; the front-end and back-end secure transmission method of the present application can be applied not only to the daily data interaction process between the front-end and the back-end, but also to the login verification process between the front-end and the back-end. When the user enters the fee control system account and the corresponding login password at the front-end, the front-end encrypts based on the fee control system account, the corresponding login password, the random key and the private key to obtain an HTTPS request; the back-end receives the HTTPS request and performs signature verification and decryption to obtain the login password of the corresponding fee control system account, and compares it with the login password of the account pre-stored in the database. When it passes, a prompt indicating successful login is returned. The above method solves the problem that the prior art focuses on process data transmission while ignoring the transmission security of the login verification process. By securely encrypting and verifying the login input data, the security and reliability of the system are improved, and the possibility of account and password being invaded and stolen during login is avoided.

[0071] In an embodiment of the present application, when the HTTPS request is a fee control system operation request, the target transmission data includes: operation type.

[0072] In the embodiment of the present application, any fee control system account corresponds to an operation permission; the operation permission is used to characterize the operation type of the fee control system account; that is, the operational permission of the fee control system account.

[0073] In an embodiment of the present application, after the back-end decrypts and obtains the target transmission data, it will obtain the operating authority of the fee control system account that sent the target transmission data, and compare whether the operating authority can operate the operation type contained in the target transmission data. If it is not authorized to process, it will directly return the configured authority exceeded prompt to the fee control system front end; thereby avoiding unauthorized processing, using different permissions to perform different operations, and further improving the security of the system.

[0074] In an embodiment of the present application, after the back-end decrypts and obtains the target transmission data, the request sending time is also verified. If the request sending time exceeds the preset time threshold, the configured timeout prompt is directly returned to the fee control system front end; thereby avoiding the risk of the request being intercepted and resent with other data, and further improving the security of the transmission.

[0075] In an embodiment of the present application, when the HTTPS request is a fee control system operation request, the target transmission data includes: hidden data and non-hidden data; wherein, the hidden data is obtained by processing the sensitive data of the operation object, and the non-hidden data is the data necessary to perform the operation; for example, when the fee control system operation request is a reimbursement request, the employee to be reimbursed is the operation object, and the bank card data of the reimbursed employee is the sensitive data of the operation object.

[0076] In the embodiment of the present application, the generation of hidden data includes:

[0077] Acquire sensitive data of the operation object, add noise (Laplace noise and / or Gaussian noise) to the sensitive data of the operation object; perform privacy budget processing on the sensitive data of the operation object after adding noise according to the configured privacy budget; divide the sensitive data of the operation object after privacy budget processing into several groups, each group has at least k identical identifiers (i.e., k-anonymity processing); generalize the identifiers; on the basis of k-anonymity, ensure that the sensitive attributes in each group of similar records have sufficient diversity to prevent individual information from being inferred through background knowledge; ensure that the difference between the sensitive attribute values ​​in each group of similar records does not exceed a certain threshold t, and obtain hidden data.

[0078] The above operations protect individual privacy by adding noise to the data, provide an additional security layer in the data transmission and processing process at the front and back ends, and further improve the security of data transmission.

[0079] In another embodiment of the present application, the HTTPS request also includes: the login device, operation frequency, IP address and current network environment of the fee control system account sending the HTTPS request.

[0080] During the process of secure transmission between the front-end and back-end of the fee control system, a comprehensive risk score is performed on the front-end and back-end secure transmission based on the login device, operation frequency, IP address and current network environment contained in the HTTPS request. When the comprehensive risk score is lower than the warning threshold, a timely warning is issued and corresponding security measures are adopted.

[0081] In an embodiment of the present application, the front-end and back-end secure transmission method of the fee control system also includes: generating a fee control system security operation log based on the request type, operation type and corresponding request sending time of the HTTPS request, and the fee control system account that sends the HTTPS request.

[0082] In an embodiment of the present application, for any fee control system account, the historical operation log of the fee control system account is extracted from the historical security operation log of the fee control system; feature analysis is performed on the extracted historical operation log to obtain the historical operation log features of the fee control system account; using a pre-built behavior analysis model, the historical operation log features of the fee control system account are learned to obtain a trained behavior analysis model; based on the trained behavior model, real-time operations of the fee control system account are monitored to identify abnormal behaviors and risk levels; and from the configured risk level and security measure comparison table, target security measures are matched and executed, thereby improving system security.

[0083] Specifically, the operation log of the fee control system account not only includes data such as the request type, operation type and corresponding request sending time of the fee control system account, but also includes the login device, login time, IP geology, as well as abnormal event records such as login failure and abnormal access mode of the fee control system account.

[0084] In the embodiment of the present application, risk levels include low risk, medium risk and high risk; low-risk security measures may include: sending warning notifications to remind users to pay attention to account security; medium-risk security measures may include: requiring secondary verification, such as SMS verification code, fingerprint recognition; high-risk security measures may include: immediately locking the account and conducting manual review; specifically, the manual review must be performed in accordance with a pre-established detailed review process, including contacting the user, verifying identity, checking operation records, etc.; and all review processes must be recorded to ensure traceability and compliance.

[0085] In one embodiment of the present application, Figure 2-Figure 3 As shown, the front-end and back-end secure transmission method of the fee control system includes:

[0086] Key Management Service (KMS) generates key pairs: KMS uniformly implements the full life cycle management of SM2 key generation, storage, distribution, update, and destruction. Only authorized users can access and use keys to ensure the security of keys. KMS generates SM2 key pairs (public key pubKey, private key priKey), and the front end regularly updates and stores SM2 public key pubKey.

[0087] Front-end encryption and signature processing: hash function algorithm (SM3), symmetric encryption algorithm (SM4) and asymmetric encryption algorithm (SM2); when the front-end initiates a data transmission request, it generates an SM4 random key key each time, and uses the public key to perform SM2 encryption on the key to generate the key ciphertext enKey, enKey = SM2.encrypt(key,pubKey). Use the random key key to perform SM4 encryption on the request parameter data to generate the encrypted parameter enData, enData = SM4.encrypt(data,key). Use SM3 to generate the parameter digest digest for enData and key, digest = SM3.hash(enData,key). Use the public key to perform SM2 encryption on the parameter digest digest to generate the parameter digital signature sign, sign = SM2.encrypt(digest,pubKey);

[0088] The front end sends a request: The front end packages the encrypted parameter ciphertext enData, the encrypted key ciphertext enKey, and the parameter digital signature sign into an HTTPS request and sends it to the backend server.

[0089] Backend receiving request: After receiving the HTTPS request, the backend server first verifies the validity of the parameter digital signature.

[0090] Back-end signature verification and decryption processing: Use the private key to perform SM2 decryption on the key ciphertext enKey into the original random key key, key = SM2.decrypt (enKey, priKey).

[0091] Use the private key to perform SM2 decryption on the parameter digital signature sign to generate the original parameter digest digest. oriDigest = SM2.decrypt(sign,pubKey).

[0092] Use SM3 to calculate the actual parameter digest digestVal from the parameter ciphertext enData and the original random key key, digestVal = SM3.hash (enData, key).

[0093] The backend performs parameter digital signature verification, comparing the original parameter digest and the actual parameter digest value digestVal to see if they are equal. If the values ​​are equal, the signature verification passes.

[0094] After the signature verification is passed, the encrypted parameter enData is decrypted by SM4 using the original random key key to obtain the original request parameter data, data = SM4.decrypt (enData, key).

[0095] Backend business processing and return of processing results: The backend server processes the decrypted data and returns the processing results to the frontend. If sensitive data needs to be returned, the backend server can reverse encrypt and sign the data to ensure the security of the data during the return process.

[0096] Audit log processing: During the entire business processing process, key operations in the front-end and back-end parameter encryption process are recorded in real time, and the log audit function is supported. Once a security problem occurs, the cause of the problem can be quickly located through the log and corresponding treatment measures can be taken.

[0097] Corresponding to the above method, the embodiment of the present application also provides a front-end and back-end secure transmission device of a fee control system, such as Figure 4 As shown, the front-end and back-end security transmission devices of the fee control system include:

[0098] The receiving unit 410 is used to receive an HTTPS request sent by the front end of the fee control system; wherein the HTTPS request includes a parameter digital signature, a key ciphertext and a parameter ciphertext; the key ciphertext is obtained by asymmetrically encrypting a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key;

[0099] The decryption unit 420 is used to decrypt the key ciphertext using the pre-stored asymmetric private key to obtain the random key; after verifying the parameter digital signature and the parameter digital signature passes, the parameter ciphertext is decrypted using the random key to obtain the target transmission data;

[0100] The processing unit 430 is used to process the target transmission data to obtain a processing result;

[0101] The return unit 440 is used to return the processing result to the front end of the fee control system.

[0102] The functions of each functional unit of the front-end and back-end secure transmission device of the fee control system provided in the above-mentioned embodiments of the present application can be realized through the above-mentioned method steps. Therefore, the specific working process and beneficial effects of each unit in the front-end and back-end secure transmission device of the fee control system provided in the embodiments of the present application will not be repeated here.

[0103] The present application also provides an electronic device, such as Figure 5 As shown, it includes a processor 510 , a communication interface 520 , a memory 530 and a communication bus 540 , wherein the processor 510 , the communication interface 520 , and the memory 530 communicate with each other via the communication bus 540 .

[0104] Memory 530, for storing computer programs;

[0105] The processor 510 is used to execute the program stored in the memory 530 to implement the following steps:

[0106] Receive the HTTPS request sent by the front end of the fee control system; the HTTPS request contains a parameter digital signature, key ciphertext and parameter ciphertext; the key ciphertext is obtained by asymmetric encryption of a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key;

[0107] The key ciphertext is decrypted using the pre-stored asymmetric private key to obtain a random key; after the parameter digital signature is verified and the parameter digital signature passes, the parameter ciphertext is decrypted using the random key to obtain the target transmission data;

[0108] Process the target transmission data to obtain the processing result;

[0109] The processing results will be returned to the front end of the fee control system.

[0110] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0111] The communication interface is used for communication between the above electronic device and other devices.

[0112] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0113] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0114] The implementation methods and beneficial effects of the components of the electronic device in the above embodiments to solve the problems can be seen in Figure 1 The various steps in the illustrated embodiment are implemented, therefore, the specific working process and beneficial effects of the electronic device provided by the embodiment of the present application are not repeated here.

[0115] In another embodiment provided in the present application, a computer-readable storage medium is also provided, which stores instructions. When the computer-readable storage medium is executed on a computer, the computer executes the front-end and back-end secure transmission method of the fee control system in any of the above embodiments.

[0116] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the front-end and back-end secure transmission method of the fee control system in any of the above embodiments.

[0117] Those skilled in the art will appreciate that the embodiments in the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt a complete hardware embodiment, a complete software embodiment, or a form of an embodiment combining software and hardware. Moreover, the present application may adopt a form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0118] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0121] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0122] Obviously, those skilled in the art can make various changes and modifications to the embodiments in the present application without departing from the spirit and scope of the embodiments in the present application. Thus, if these modifications and variations of the embodiments in the present application fall within the scope of the claims and their equivalents in the embodiments of the present application, the embodiments of the present application are also intended to include these modifications and variations.

Claims

1. A front-end and back-end secure transmission method for a fee control system, characterized in that: The method comprises: Receive an HTTPS request sent by the front end of the fee control system; wherein the HTTPS request includes a parameter digital signature, a key ciphertext, and a parameter ciphertext; the key ciphertext is obtained by asymmetrically encrypting a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key; Decrypting the key ciphertext using a pre-stored asymmetric private key to obtain the random key; After verifying the parameter digital signature and the parameter digital signature passes, decrypting the parameter ciphertext using the random key to obtain the target transmission data; Processing the target transmission data to obtain a processing result; The processing result is returned to the front end of the fee control system.

2. The method according to claim 1, characterized in that Before receiving the HTTPS request sent by the fee control system front end, the method further includes: An asymmetric key pair is generated, and the asymmetric public key in the asymmetric key pair is sent to the front end of the fee control system, and the asymmetric private key in the asymmetric key pair is sent to the back end of the fee control system.

3. The method according to claim 2, characterized in that The parameter digital signature is obtained by encrypting the pre-generated parameter summary using an asymmetric public key; The parameter summary is generated by performing a hash operation on the parameter ciphertext and the random key using a hash function; Verifying the parameter digital signature includes: Decrypting the key ciphertext using the asymmetric private key to obtain a random key; Decrypting the parameter digital signature using an asymmetric private key to obtain the parameter summary; Using a hash function to calculate the parameter ciphertext and the random key to obtain a decryption parameter summary; If the decryption parameter digest is the same as the parameter digest, the parameter digital signature passes the verification.

4. The method according to claim 2, characterized in that Any HTTPS request corresponds to a request sending time; The HTTPS request includes: a request type and a fee control system account number for sending the HTTPS request; The HTTPS request types include fee control system login request and fee control system operation request; When the HTTPS request is a fee control system login request, the target transmission data includes: the login password of the fee control system account that sends the HTTPS request; When the HTTPS request is a fee control system operation request, the target transmission data includes: operation type.

5. The method according to claim 4, characterized in that The method further comprises: Based on the request type, operation type and corresponding request sending time of the HTTPS request, and the fee control system account that sends the HTTPS request, a fee control system security operation log is generated.

6. The method according to claim 4, characterized in that Any fee control system account corresponds to an operation permission; the operation permission is used to characterize the operation type of the fee control system account; Before processing the target transmission data to obtain a processing result, the method further includes: If the request sending time exceeds the preset time threshold, a configured timeout prompt is directly returned to the fee control system front end; If the operation permission does not include the operation type in the target transmission data, a prompt indicating that the configured permission is exceeded is directly returned to the fee control system front end.

7. The method according to claim 1, characterized in that The processing result is returned to the fee control system front end, including: After the processing result is encrypted using the random key, the encrypted processing result is returned to the fee control system front end.

8. A front-end and back-end secure transmission device for a fee control system, characterized in that: The device comprises: A receiving unit, configured to receive an HTTPS request sent by a front end of a fee control system; wherein the HTTPS request includes a parameter digital signature, a key ciphertext, and a parameter ciphertext; the key ciphertext is obtained by asymmetrically encrypting a pre-generated random key using an asymmetric public key pre-stored in the front end of the fee control system; the parameter ciphertext is obtained by encrypting the target transmission data using the random key; A decryption unit, configured to decrypt the key ciphertext using a pre-stored asymmetric private key to obtain the random key; after verifying the parameter digital signature and the parameter digital signature passes, decrypt the parameter ciphertext using the random key to obtain the target transmission data; A processing unit, used for processing the target transmission data to obtain a processing result; The returning unit is used to return the processing result to the front end of the fee control system.

9. An electronic device, characterized in that: The electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images