Application security interaction method and system between client and server

Abstract

The embodiment of the invention discloses an application security interaction method and system between a client side and a server side. The method comprises the steps of determining an environment detection result corresponding to a target application through a first security interaction subsystem based on current operation environment information corresponding to the target application and preset security environment information, based on the environment detection result, performing encryption processing on current service request information corresponding to the target application to determine encrypted service request information corresponding to the target application, and sending the encrypted service request information to the server side; receiving the encrypted service request information through the second security interaction subsystem, and verifying the encrypted service request information to determine a request verification result; the request processing subsystem effectively controls the execution of the current service request information based on the received request verification result, so that multi-level security protection is realized, the risks of illegal invasion and service request tampering are effectively reduced, and the security and privacy of user application data are more comprehensively guaranteed.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a method and system for secure application interaction between a client and a server. Background Art

[0002] With the development of technology, users pay more and more attention to the security of applications, such as secure application interaction.

[0003] At present, in the current application system, there are cases where the application is illegally called by simulating Android system requests. Usually, the internal functions of the application can be tampered with or called by illegal means to achieve the purpose of cheating, which damages the accuracy of the business system and the fairness of the application, and also introduces security vulnerabilities and threatens the data security of users. It can be seen that there is an urgent need for technical means to prevent illegal calls to ensure the security of applications and user data. Summary of the invention

[0004] The embodiments of the present invention provide a method and system for secure application interaction between a client and a server to achieve multi-level security protection, effectively reduce the risk of illegal intrusion and tampering of business requests, and more comprehensively ensure the security and privacy of user application data.

[0005] In a first aspect, an embodiment of the present invention provides a method for secure application interaction between a client and a server, comprising:

[0006] Determine, by the first security interaction subsystem, an environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server end;

[0007] Receiving the encrypted service request information through the second security interaction subsystem, and verifying the encrypted service request information to determine a request verification result;

[0008] The request processing subsystem effectively controls the execution of the current business request information based on the received request verification result.

[0009] Optionally, the method further includes: the first secure interaction subsystem is located at the client; the target application is located at the client; the second secure interaction subsystem is located at the server; and the request processing subsystem is located at the server.

[0010] Optionally, the method further includes: obtaining current operating environment information of a client where the target application is located; and determining an environment detection result corresponding to the target application based on the current operating environment information and preset security environment information.

[0011] Optionally, the method also includes: if it is detected that the request verification result is a decryption failure, generating a first prompt message about the decryption failure, and sending the first prompt message to the client; if it is detected that the request verification result is a signature verification failure, generating a second prompt message about the signature verification failure, and sending the second prompt message to the client; if it is detected that the request verification result is a signature verification success, executing the current business request information to determine the current business execution result, and sending the current business execution result to the client.

[0012] Optionally, the method further includes: the first security interaction subsystem includes: an environmental security detection module, an encryption module and a signature generation module; the second security interaction subsystem includes: a decryption module and a signature verification module.

[0013] Optionally, the method also includes: determining the environment detection result corresponding to the target application through the environment security detection module based on the current running environment information corresponding to the target application and the preset security environment information; performing signature processing on the current business request information corresponding to the target application based on the environment detection result and the preset signature generation method through the signature generation module to determine the business request information to be selected corresponding to the target application; the business request information to be selected includes: the current business request information and the generated current signature information; performing encryption processing on the business request information to be selected based on the preset encryption method through the encryption module to determine the encrypted business request information corresponding to the target application.

[0014] Optionally, the method also includes: decrypting the encrypted business request information based on a preset decryption method through a decryption module to determine a decryption result; the preset decryption method corresponds to a preset encryption method; and verifying the encrypted business request information based on the decryption result and a preset signature generation method through a signature verification module to determine a request verification result.

[0015] Optionally, the method also includes: if the decryption result is successful, signing the decrypted business request information to be verified based on a preset signature generation method, determining the signature information to be verified, and verifying based on the current signature information in the business request information to be verified and the signature information to be verified to determine the request verification result.

[0016] Optionally, the method also includes: the functions of the first safety interaction subsystem and the functions of the second safety interaction subsystem are both implemented through C language programming.

[0017] In a second aspect, an embodiment of the present invention further provides an application security interaction system between a client and a server, the system comprising: a first security interaction subsystem, a second case interaction subsystem and a request processing subsystem;

[0018] Among them, the first security interaction subsystem is used to determine the environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server end;

[0019] A second security interaction subsystem is used to receive the encrypted service request information and verify the encrypted service request information to determine a request verification result;

[0020] The request processing subsystem is used to effectively control the execution of the current business request information based on the received request verification result.

[0021] The technical solution of the embodiment of the present invention is to determine the environment detection result corresponding to the target application based on the current running environment information and preset security environment information corresponding to the target application by the first security interaction subsystem, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server; receive the encrypted business request information by the second security interaction subsystem, and verify the encrypted business request information to determine the request verification result; and effectively control the execution of the current business request information based on the received request verification result by the request processing subsystem, thereby realizing multi-level security protection, effectively reducing the risk of illegal intrusion and business request tampering, and more comprehensively ensuring the security and privacy of user application data.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flow chart of a method for secure application interaction between a client and a server provided in Embodiment 1 of the present invention;

[0025] Figure 2 is a flow chart of a method for secure application interaction between a client and a server provided in Embodiment 2 of the present invention;

[0026] Figure 3 It is a structural diagram of an application security interaction system between a client and a server provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 A flowchart of a method for secure application interaction between a client and a server is provided for the first embodiment of the present invention. This embodiment is applicable to the case of secure application interaction. The method can be executed by a secure application interaction system between the client and the server. The secure application interaction system between the client and the server can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0031] S110. Determine the environment detection result corresponding to the target application through the first security interaction subsystem based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server.

[0032] Among them, the first security interaction subsystem can be used to detect the application running environment and perform tamper-proof transmission on the service request issued by the application. The target application may refer to the application that has just been started. The current running environment information may refer to the information of the environment in which the target application is located when it is started. For example, the current running environment information may include but is not limited to hardware carrier information, software system information and transmission protocol information. The preset security environment information may refer to the preset environment information in which the application can run safely. For example, the preset security environment information may include but is not limited to the preset real and effective Android system. Different from the preset security environment information is the preset non-security environment information. The preset non-security environment information may refer to virtual or invalid environment information. For example, the preset security environment information may be but is not limited to the running environment information created by the Android virtual machine. The environment detection result may refer to the validity or authenticity detection result of the current running environment of the target application. The current service request information may refer to the service request information issued by the target application at that time. For example, the service request information may be in the form of a message. The current service request information may include but is not limited to a timestamp, a service request message, user identification information of logging into the target application, and client identification information. The encrypted service request information may refer to the service request information obtained after tamper-proof processing. For example, the anti-tampering process may include, but is not limited to, encryption processing, such as the SM3 cryptographic hash algorithm and / or the SM5 symmetric encryption algorithm.

[0033] Specifically, the first security interaction subsystem can compare the current operating environment information corresponding to the target application with the preset security environment information to determine the environmental detection result corresponding to the target application. If the current operating environment information is fully contained in the preset security environment information, the environmental detection result is determined as the current operating environment of the target application is a safe operating environment, and the target application can continue to run based on the environmental detection result. If the current operating environment information is not fully contained in the preset security environment information, the environmental detection result is determined as the current operating environment of the target application is an invalid operating environment, and the target application can be stopped based on the environmental detection result, and the information prompt subsystem generates and displays the corresponding stop operation information of the target application (which may include a stop prompt and a reason for the stop). When it is determined that the target application can run safely based on the environmental information, the current business request information sent by the target application can be obtained, and the current business request information corresponding to the target application is encrypted based on the pre-encryption algorithm and key to determine the encrypted business request information corresponding to the target application, and the encrypted business request information is sent to the server.

[0034] On the basis of the above technical solution, the functions of the first safety interaction subsystem and the functions of the second safety interaction subsystem are both implemented through C language programming.

[0035] Among them, the advantage of such a setting is that after the program written in C language is compiled into machine code, it is low-level and direct, and cannot be decompiled back to the original C code, so it has a high resistance to decompilation. Therefore, the difficulty of decompilation of C language and the resistance of C language to compilation can be used to improve the normal operation of the environment detection function and the anti-tampering function, and further improve the security of application interaction. At the same time, this embodiment can also use other compilation methods that are difficult to decompile to realize the functions of the first security interaction subsystem and the second security interaction subsystem.

[0036] On the basis of the above technical solution, the first secure interaction subsystem is located at the client; the target application is located at the client; the second secure interaction subsystem is located at the server; and the request processing subsystem is located at the server.

[0037] Among them, the target application can be located in the client of the Android system. If the first security interaction subsystem and the target application are both located in the same client, the current operating environment information corresponding to the target application can be understood as the current operating environment information of the client where the target application is located. The key used by the first security interaction subsystem in the encryption process is pre-agreed with the second security interaction subsystem.

[0038] Based on the above technical solution, "determining the environment detection result corresponding to the target application based on the current operating environment information and preset security environment information corresponding to the target application" may include: obtaining the current operating environment information of the client where the target application is located; determining the environment detection result corresponding to the target application based on the current operating environment information and the preset security environment information.

[0039] Specifically, the first security interaction subsystem is automatically activated when it detects that the target application exists on the client, obtains the current operating environment information of the client where the target application is located, and determines the environment detection result corresponding to the target application based on the current operating environment information and the preset security environment information. Only when the environment detection passes, the application is allowed to continue to perform subsequent operations, such as business requests.

[0040] S120. Receive encrypted service request information through the second security interaction subsystem, and verify the encrypted service request information to determine a request verification result.

[0041] The request verification result may refer to a verification result of verifying the validity of the encrypted service request information and / or the information included in the encrypted service request information.

[0042] Specifically, the second secure interaction subsystem receives the encrypted service request information and performs decryption processing on the received encrypted service request information. If the decryption fails, the request verification result is determined as a decryption failure. If the decryption succeeds, the request verification result is determined as a decryption success.

[0043] S130. Effectively control the execution of the current business request information based on the received request verification result through the request processing subsystem.

[0044] The request processing subsystem may be used to process valid business requests and send the processing results to the target application to complete the business request.

[0045] Specifically, if the request verification result is detected as a decryption failure, a first prompt message about the decryption failure is generated based on the request verification result of the decryption failure, and the first prompt message is sent to the client for display. If the request verification result is detected as a decryption success, the business request is executed based on the decryption result obtained by the decryption process to determine the business request execution result, and the business request execution result is sent to the target application to complete the current business request.

[0046] On the basis of the above technical solution, the first secure interaction subsystem can add signature information before encryption processing to further improve information tamper resistance and interaction security. The signature adding method in the first secure interaction subsystem is pre-agreed with the second secure interaction subsystem.

[0047] Among them, "effectively controlling the execution of the current business request information based on the received request verification result" may include: if it is detected that the request verification result is a decryption failure, generating a first prompt message about the decryption failure, and sending the first prompt message to the client; if it is detected that the request verification result is a signature verification failure, generating a second prompt message about the signature verification failure, and sending the second prompt message to the client; if it is detected that the request verification result is a signature verification success, executing the current business request information to determine the current business execution result, and sending the current business execution result to the client.

[0048] The first prompt message may be, but is not limited to, decryption failure, please confirm whether the key is correct. The second prompt message may be, but is not limited to, signature verification failure, and the service request information may be tampered with.

[0049] Specifically, if the second security interaction subsystem detects that the request verification result is a decryption failure, a first prompt message about the decryption failure is generated based on the request verification result of the decryption failure, and the first prompt message is sent to the client, thereby avoiding the execution of the current business request information when the decryption fails. If the second security interaction subsystem detects that the request verification result is a signature verification failure, a second prompt message about the signature verification failure is generated based on the request verification result of the signature verification failure, and the second prompt message is sent to the client, thereby avoiding the execution of the current business request information that has been tampered with. If the second security interaction subsystem detects that the request verification result is a signature verification success, the current business request information is executed based on the request verification result of the signature verification success to determine the current business execution result, and the current business execution result is sent to the client, thereby ensuring that the current business request information is executed when the decryption is successful and the signature verification is successful, further improving the security of application interaction and user application information.

[0050] The technical solution of the embodiment of the present invention is to determine the environment detection result corresponding to the target application based on the current running environment information and preset security environment information corresponding to the target application through the first security interaction subsystem, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server; receive the encrypted business request information through the second security interaction subsystem, and verify the encrypted business request information to determine the request verification result; and effectively control the execution of the current business request information based on the received request verification result through the request processing subsystem, thereby realizing multi-level security protection, effectively reducing the risk of illegal intrusion and business request tampering, and more comprehensively ensuring the security and privacy of user application data.

[0051] Embodiment 2

[0052] Figure 2 This is a flowchart of a method for secure application interaction between a client and a server provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment describes in detail the process of determining the encrypted service request information and the request verification result. The explanations of the terms that are the same or corresponding to the above embodiments are not repeated here. Figure 2 As shown, the method includes:

[0053] S210. Determine, through an environmental security detection module, an environmental detection result corresponding to the target application based on current operating environment information corresponding to the target application and preset security environment information.

[0054] Among them, the first security interaction subsystem includes: an environmental security detection module, an encryption module and a signature generation module. The second security interaction subsystem includes: a decryption module and a signature verification module. The environmental security detection module can be used to effectively prevent the application from running in an infected or tampered environment, making it difficult for malware and simulators to disguise themselves as normal devices and bypass security detection. Based on the strictness of the environmental security detection module, the application will only continue to perform subsequent operations if the detection passes, thereby greatly reducing the possibility of malicious attackers using simulators or modifying the device environment to attack.

[0055] For example, an experienced cheater can modify the simulator's configuration file to make its features close to those of a real device, or even use advanced simulator tools to hide simulator features, thereby bypassing detection. Alternatively, Android applications often rely on hardware information such as device ID, MAC address, IMEI, etc. for unique identification and verification. This information can be modified at the operating system level. Through root permissions or special APIs, cheaters can forge or tamper with this information, making it impossible for applications to accurately identify the true identity of the device. In an embodiment of the present invention, an environmental security detection module can be used to avoid the above risks.

[0056] S220: The signature generation module performs signature processing on the current service request information corresponding to the target application based on the environment detection result and the preset signature generation method, and determines the service request information to be selected corresponding to the target application.

[0057] The selected service request information includes: current service request information and generated current signature information. The signature generation module can be used to generate current signature information based on current service request information when the target application initiates the current service request information and add the current signature information to the current service request information.

[0058] Specifically, if the result of the environmental detection is that the current operating environment of the target application is an invalid operating environment, the environmental security detection module stops running the target application. If the result of the environmental detection is that the current operating environment of the target application is a safe operating environment, the signature generation module can perform signature processing on the current business request information corresponding to the target application based on the environmental detection result and the preset signature generation method, and determine the selected business request information corresponding to the target application. When generating a signature based on the current business request information, the timestamp, business request message, user identification information of the target application logged in, and client identification information contained in the current business request information can be used to generate the current signature information in conjunction with the preset signature generation method, and the current signature information is added to the current business request information to determine the selected business request information corresponding to the target application, thereby improving the immutability and high confidentiality of the business request information, and further ensuring the security of application interaction and user application information.

[0059] S230: Encrypt the selected service request information using an encryption module based on a preset encryption method to determine the encrypted service request information corresponding to the target application.

[0060] Among them, the signature generation module and the encryption module perform multiple encrypted signatures on the current business request information of the target application after the target application passes the environmental detection. This process combines timestamps, keys and high-security encryption algorithms to effectively ensure the immutability and high confidentiality of the request. In addition, the encrypted and signed encrypted business request information is not only difficult to be illegally intercepted and tampered with, but also ensures the integrity and confidentiality of the data during transmission. After receiving the encrypted business request information, the server will decrypt and verify the signature to ensure the credibility and integrity of the data source.

[0061] S240: Decrypt the encrypted service request information based on a preset decryption method through a decryption module to determine a decryption result.

[0062] The preset decryption method corresponds to the preset encryption method.

[0063] Specifically, the decryption module decrypts the encrypted service request information based on a preset decryption method. If the decryption fails, the decryption result is determined to be an empty result. If the information is decrypted, the decrypted information is used as the decryption result.

[0064] S250. The encrypted service request information is verified by the signature verification module based on the decryption result and the preset signature generation method to determine the request verification result.

[0065] Among them, the signature verification module includes the signature verification function and the signature generation function of the signature generation module.

[0066] Specifically, if the decryption result is an empty result, the request verification result can be directly determined as a decryption failure. If the decryption result is a decryption result, the signature verification module can generate signature information to be verified for the encrypted business request information based on a preset signature generation method, and perform consistency verification based on the signature information to be verified and the current signature information added by the signature generation module to determine the request verification result. If they are consistent, the request verification result is determined as a successful signature verification. If they are inconsistent, the request verification result is determined as a signature verification failure.

[0067] It should be noted that data transmitted in plain text is easily captured and tampered with. Even HTTPS, if certificate verification is not correctly implemented, may be exploited by a man-in-the-middle attack (MITM), resulting in sensitive data leakage or tampering. Advanced cheaters can also use debugging techniques or modify the underlying code of the application to bypass these reverse engineering and dynamic debugging detection. In addition, some debugging tools can be dynamically loaded and hidden to evade real-time detection of the application. Advanced cheaters can also use reverse engineering tools (such as Jadx, APKTool) to restore and analyze obfuscated code, and write specific patches or plug-ins. In an embodiment of the present invention, a signature generation module, an encryption module, a decryption module, and a signature verification module can be used to avoid the above risks.

[0068] On the basis of the above technical solution, "verifying the encrypted business request information based on the decryption result and the preset signature generation method to determine the request verification result" may include: if the decryption result is successful, the decrypted business request information to be verified is signed based on the preset signature generation method to determine the signature information to be verified, and the current signature information in the business request information to be verified and the signature information to be verified are verified to determine the request verification result.

[0069] The decryption success can be understood as the result obtained by the decryption process being a non-empty result. The signature information to be verified can refer to the signature information to be verified for consistency with the current signature information added by the signature generation module.

[0070] S260. Effectively control the execution of the current business request information based on the received request verification result through the request processing subsystem.

[0071] It should be noted that the embodiments of the present invention can be applied to the production environment of the delivery platform, by seamlessly integrating multiple security mechanisms to form a highly integrated security solution. Compared with traditional methods, this integrated security mechanism not only significantly improves the security factor of the system, but also greatly increases the cost and difficulty of cracking, reducing the risk of illegal intrusion and data tampering by several orders of magnitude. In this way, the security and privacy of user data are guaranteed, and the overall security performance and reliability of the application are also significantly improved.

[0072] For example, the embodiments of the present invention use environmental detection, encryption technology and anti-tampering mechanism to reduce the risk of illegal intrusion and data tampering by several orders of magnitude. Attackers need to pay extremely high technical and time costs to try to bypass these security measures, which greatly improves the security of the application. In addition, user data is encrypted and protected during transmission and storage, and the application environment is strictly monitored to prevent unauthorized access and tampering. This allows users to use applications more confidently and reduces the risk of data leakage and privacy infringement.

[0073] At the same time, by introducing integrated security modules and mechanisms, the overall security performance and reliability of the application have been significantly improved. The application can not only effectively resist common attack methods, but also has a stronger ability to defend against advanced attacks, ensuring the stable operation of the system and the security of data. The user experience has been significantly improved, and the market competitiveness of the application has also been improved.

[0074] The technical solution of the embodiment of the present invention is to determine the environment detection result corresponding to the target application based on the current operating environment information and preset security environment information corresponding to the target application through the environment security detection module; to perform signature processing on the current business request information corresponding to the target application based on the environment detection result and the preset signature generation method through the signature generation module, and determine the selected business request information corresponding to the target application; to perform encryption processing on the selected business request information based on the preset encryption method through the encryption module, and determine the encrypted business request information corresponding to the target application, thereby running the target application in a safe operating environment, and signing and encrypting the current business request information of the target application to obtain the encrypted business request information with the current signature information. In addition, the encrypted business request information is decrypted by the decryption module based on the preset decryption method to determine the decryption result; the encrypted business request information is verified by the signature verification module based on the decryption result and the preset signature generation method to determine the request verification result, thereby performing consistency verification on the current signature information after accurate encryption, and then further improving the security of application interaction between the client and the server through multi-level security protection of the environment, key and signature.

[0075] The following is an embodiment of an application security interaction system between a client and a server provided in an embodiment of the present invention. This system and the application security interaction method between a client and a server in the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the application security interaction system between a client and a server, please refer to the embodiment of the application security interaction method between a client and a server.

[0076] Embodiment 3

[0077] Figure 3The following is a schematic diagram of a structure of an application security interaction system between a client and a server provided in Embodiment 3 of the present invention. Figure 3 As shown, the system includes: a first security interaction subsystem 310, a second case interaction subsystem 320 and a request processing subsystem 330;

[0078] Among them, the first security interaction subsystem 310 is used to determine the environment detection result corresponding to the target application based on the current operating environment information and preset security environment information corresponding to the target application, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server side; the second security interaction subsystem 320 is used to receive the encrypted business request information, and verify the encrypted business request information to determine the request verification result; the request processing subsystem 330 is used to effectively control the execution of the current business request information based on the received request verification result.

[0079] The technical solution of the embodiment of the present invention is to determine the environment detection result corresponding to the target application based on the current running environment information and preset security environment information corresponding to the target application through the first security interaction subsystem, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server; receive the encrypted business request information through the second security interaction subsystem, and verify the encrypted business request information to determine the request verification result; and effectively control the execution of the current business request information based on the received request verification result through the request processing subsystem, thereby realizing multi-level security protection, effectively reducing the risk of illegal intrusion and business request tampering, and more comprehensively ensuring the security and privacy of user application data.

[0080] On the basis of the above technical solution, the first secure interaction subsystem is located at the client; the target application is located at the client; the second secure interaction subsystem is located at the server; and the request processing subsystem is located at the server.

[0081] Based on the above technical solution, the first security interaction subsystem 310 is specifically used to: obtain the current operating environment information of the client where the target application is located; and determine the environment detection result corresponding to the target application based on the current operating environment information and preset security environment information.

[0082] Based on the above technical solution, the request processing subsystem 330 is specifically used for: if it is detected that the request verification result is a decryption failure, then generating a first prompt message about the decryption failure, and sending the first prompt message to the client; if it is detected that the request verification result is a signature verification failure, then generating a second prompt message about the signature verification failure, and sending the second prompt message to the client; if it is detected that the request verification result is a signature verification success, then executing the current business request information to determine the current business execution result, and sending the current business execution result to the client.

[0083] On the basis of the above technical solution, the first security interaction subsystem includes: an environmental security detection module, an encryption module and a signature generation module; the second security interaction subsystem includes: a decryption module and a signature verification module.

[0084] On the basis of the above technical solution, the first security interaction subsystem 310 may include: an environmental security detection module, an encryption module and a signature generation module;

[0085] Among them, the environment security detection module is used to determine the environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information;

[0086] The signature generation module is used to perform signature processing on the current business request information corresponding to the target application based on the environment detection result and the preset signature generation method, and determine the selected business request information corresponding to the target application; the selected business request information includes: the current business request information and the generated current signature information;

[0087] The encryption module is used to encrypt the selected service request information based on a preset encryption method to determine the encrypted service request information corresponding to the target application.

[0088] On the basis of the above technical solution, the second security interaction subsystem 320 may include: a decryption module and a signature verification module;

[0089] The decryption module is used to decrypt the encrypted service request information based on a preset decryption method and determine the decryption result; the preset decryption method corresponds to the preset encryption method;

[0090] The signature verification module is used to verify the encrypted business request information based on the decryption result and the preset signature generation method to determine the request verification result.

[0091] On the basis of the above technical solution, the signature verification module is specifically used for: if the decryption result is successful, then the decrypted business request information to be verified is signed based on a preset signature generation method, the signature information to be verified is determined, and verification is performed based on the current signature information and the signature information to be verified in the business request information to be verified to determine the request verification result.

[0092] On the basis of the above technical solution, the functions of the first safety interaction subsystem and the functions of the second safety interaction subsystem are both implemented through C language programming.

[0093] The application security interaction system between the client and the server provided in the embodiment of the present invention can execute the application security interaction method between the client and the server provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the application security interaction method between the client and the server.

[0094] It is worth noting that in the above-mentioned embodiment of application security interaction between the client and the server, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0095] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0096] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for secure application interaction between a client and a server, characterized in that: include: Determine, by the first security interaction subsystem, an environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server end; Receiving the encrypted service request information through the second security interaction subsystem, and verifying the encrypted service request information to determine a request verification result; The request processing subsystem effectively controls the execution of the current business request information based on the received request verification result.

2. The method according to claim 1, characterized in that The first security interaction subsystem is located at the client; The target application is located at the client; The second security interaction subsystem is located on the server side; The request processing subsystem is located at the server end.

3. The method according to claim 1, characterized in that The determining the environment detection result corresponding to the target application based on the current running environment information corresponding to the target application and the preset security environment information includes: Obtain the current operating environment information of the client where the target application is located; Based on the current operating environment information and the preset security environment information, an environment detection result corresponding to the target application is determined.

4. The method according to claim 1, characterized in that: The effectively controlling the execution of the current service request information based on the received request verification result includes: If it is detected that the request verification result is a decryption failure, generating first prompt information about the decryption failure, and sending the first prompt information to the client; If it is detected that the request verification result is a signature verification failure, generating second prompt information about the signature verification failure, and sending the second prompt information to the client; If it is detected that the request verification result is a successful signature verification, the current service request information is executed to determine the current service execution result, and the current service execution result is sent to the client.

5. The method according to claim 1, characterized in that The first security interaction subsystem includes: an environmental security detection module, an encryption module and a signature generation module; The second secure interaction subsystem includes: a decryption module and a signature verification module.

6. The method according to claim 5, characterized in that The first security interaction subsystem determines the environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypts the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, including: Determine the environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information through the environment security detection module; The signature generation module performs signature processing on the current business request information corresponding to the target application based on the environment detection result and the preset signature generation method to determine the selected business request information corresponding to the target application; the selected business request information includes: the current business request information and the generated current signature information; The selected service request information is encrypted by an encryption module based on a preset encryption method to determine the encrypted service request information corresponding to the target application.

7. The method according to claim 5, characterized in that The receiving the encrypted service request information through the second security interaction subsystem and verifying the encrypted service request information to determine a request verification result includes: Decrypting the encrypted service request information based on a preset decryption method by a decryption module to determine a decryption result; the preset decryption method corresponds to the preset encryption method; The encrypted service request information is verified by a signature verification module based on the decryption result and a preset signature generation method to determine a request verification result.

8. The method according to claim 7, characterized in that The verifying the encrypted service request information based on the decryption result and the preset signature generation method to determine the request verification result includes: If the decryption result is successful, the decrypted business request information to be verified is signed based on the preset signature generation method to determine the signature information to be verified, and verification is performed based on the current signature information in the business request information to be verified and the signature information to be verified to determine the request verification result.

9. The method according to claim 1, characterized in that: The functions of the first safety interaction subsystem and the functions of the second safety interaction subsystem are both implemented through C language programming.

10. An application security interaction system between a client and a server, characterized in that: The system comprises: a first security interaction subsystem, a second case interaction subsystem and a request processing subsystem; Among them, the first security interaction subsystem is used to determine the environment detection result corresponding to the target application based on the current operating environment information corresponding to the target application and the preset security environment information, and encrypt the current business request information corresponding to the target application based on the environment detection result to determine the encrypted business request information corresponding to the target application, and send the encrypted business request information to the server end; A second security interaction subsystem is used to receive the encrypted service request information and verify the encrypted service request information to determine a request verification result; The request processing subsystem is used to effectively control the execution of the current business request information based on the received request verification result.

Images