Front-end and back-end interaction data protection device suitable for system security upgrade and reconstruction in use

Abstract

The invention discloses a front-end and rear-end interaction data protection device suitable for system security upgrade and reconstruction in use, which comprises a front end and a rear end, the server is configured to request a public key to perform login data encryption, send a login request, perform global request interface secondary packaging to realize automatic encryption of request data, automatically load user key information by a request header and automatically decrypt response data; and the back end is configured to receive the login data, decrypt the login data by using a private key and execute login verification, the self-defined interceptor realizes automatic decryption of the received data and automatic encryption of the response data, and the back end self-defined verification AOP interface performs secondary verification on the key data and / or the key interface. Therefore, the method can be widely applied to front-end and back-end interaction data protection of security upgrade and reconstruction of an online use system.

Description

Technical Field

[0001] The present invention relates to a front-end and back-end interactive data protection device suitable for the security upgrade and transformation of a system in use, and relates to the technical field of system data interactive security verification. Background Art

[0002] With the development of network technology, especially the continuous advancement of Web technology, whether it is an enterprise office system, a government system or a life software system, its transaction logic processing and user interaction are often not on the same hardware device. Therefore, it is inevitable to use the network to transmit data and realize system interaction. Whether it is data interaction between the front and back ends of the PC system, or data interaction between the mobile terminal and the business processing background, it involves the guarantee requirements of data security and data accuracy.

[0003] At present, the common implementation methods are divided into the following types according to the scope of application of the system, security level requirements, etc.: The first type: dedicated network operation. This method is common in enterprise office systems and government systems. Enterprise office software runs in the enterprise intranet, and government software runs in the government dedicated network, which is physically isolated from the Internet. This method effectively protects data security and accuracy. As long as the transmission network is not invaded, the system will not be cracked by the outside. The second type: using the HTTPS protocol. This method is currently the most popular form of security. HTTPS is a secure SSL encryption transmission protocol. All request and response data must be encrypted before being sent to the network, thereby improving the security of data during transmission and solving most security problems. The third type: using encryption algorithms, encrypting data before transmission, and decrypting it after receiving the data at the receiving end, thereby ensuring the security of the data transmission process, and coordinating data verification with signature technology to ensure data integrity and accuracy.

[0004] Although the existing data security and accuracy protection technologies are relatively mature, they still have some shortcomings. For example, the private network method requires enterprises to independently build intranets, which has high technical requirements. Some small and micro enterprises do not have the corresponding technical capabilities and hardware resources; the use of the HTTPS protocol requires enterprises to purchase certificates, and the system needs to have a domain name or a public IP, which increases enterprise costs; the use of encryption algorithms effectively solves the security and accuracy of data transmission, but there is a risk of algorithm leakage and possible disguised data. Especially for systems that have been put into use, the workload of upgrading security protection technology is large, and the invasiveness to the original system is high. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, in view of the above problems, the purpose of the present invention is to provide a front-end and back-end interactive data protection device suitable for the security upgrade and transformation of the system in use, based on the data interaction method of the national secret SM2 encryption, while ensuring the security of data transmission, the key data and / or key interface are secondary verified, thereby ensuring the accuracy of data operation.

[0006] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is:

[0007] The present invention provides a front-end and back-end interactive data protection device suitable for security upgrade and transformation of a system in use, comprising: a front-end, configured to request a public key to encrypt login data and send a login request, perform secondary encapsulation of a global request interface to realize automatic encryption of request data, automatic loading of user key information in a request header, and automatic decryption of response data; a back-end, configured to receive login data, use a private key to decrypt and perform login verification, use a custom interceptor to realize automatic decryption of received data and automatic encryption of response data, and use a back-end custom verification AOP interface to perform secondary verification on key data and / or key interfaces.

[0008] In one possible implementation, the front end includes a login unit, which is used to request a public key to encrypt login data and send a login request, specifically: applying for a public key of the SM2 encryption algorithm, encrypting the login data through the public key, and sending a login request.

[0009] In one possible implementation, the front end includes a secondary encapsulation unit, which is used to perform secondary encapsulation of the global request interface to achieve automatic encryption of request data. Specifically, global modification is achieved by rewriting through the ajax method without having to modify each front-end request in the existing system. Before sending the network request, the request parameters are encrypted using the national secret SM2 algorithm.

[0010] In a possible implementation, when the front-end JQuery directly transforms AJAX, $.extend is used to rewrite the ajax method, and before the send method of the XMLHttpRequest object is called, the param parameter is encrypted using the national encryption SM2 algorithm.

[0011] In one possible implementation, the front end includes an information loading and decryption unit, which is used to automatically load user key information in the request header and automatically decrypt response data. Specifically, the encrypted user key information returned by the back end is added to the request header, and a data decryption method is added after receiving the request. The front-end JQuery directly transforms AJAX, rewrites the ajax method, and adds decryption logic to the return method error and success method, that is, calling the requested public key to decrypt the returned data and then returning it to the front end.

[0012] In one possible implementation, the back end includes a login verification unit, which is used to receive login data and use a private key to decrypt and perform login verification. After successful verification, the encrypted user key information is returned, specifically: the user information in the request header is compared with the current login person information in the permission verification to see if they are consistent. If they are inconsistent, an error message is directly returned without further verification. If they are consistent, it is determined that the request is sent by the current login person, and the user information is verified before further verification; the role permission level of the user in the request header is verified to determine whether the interface request permission is possessed. Different roles correspond to different menu URL permissions. The URL permission List is obtained by querying, and the current request interface is compared with the URL permission List owned by the role. If the URL permission List contains the current request method, the verification fails and the encrypted user key information is returned; if the URL permission List does not contain the current request method, the verification fails and an error message is directly returned to the front end.

[0013] In one possible implementation, the backend includes a first custom unit, which is configured as a custom interceptor to realize automatic decryption of received data and automatic encryption of response data. The specific process is: by creating a global interceptor, a custom filter class can be created in spring to realize global interface request interception processing. Before responding, the response content is encrypted using the national secret SM2 algorithm.

[0014] In one possible implementation, a custom interceptor is used. When using the Spring framework, a filter class is created and registered in the interceptor of shiro or spring security. Automatic decryption of data in the front-end request is realized based on the national secret SM2 algorithm, and automatic encryption of data in the response is realized. Specifically, after the logic in the Filter interceptor intercepts the request data, it first calls the national secret SM2 algorithm to decrypt the data and then executes subsequent requests. Because the interceptor can intercept all requests to realize automatic decryption, there is no need to write decryption logic in each request interface.

[0015] In one possible implementation, the backend includes a second customization unit, which is used to customize the verification AOP interface and to perform secondary verification on key data and / or key interfaces. Specifically, according to the actual situation of the system, confirm that the key data and / or key interface add a customized AOP interface through annotation, and use it in the form of annotation on the required interface, thereby achieving secondary verification without code intrusion.

[0016] The present invention adopts the above technical solution, and has the following characteristics:

[0017] 1. The present invention uses SM2 encryption and decryption to protect the data during transmission, which improves the security of the data without the need for HTTPS transformation, and has certain advantages in terms of cost and efficiency.

[0018] 2. The present invention enhances interface security through secondary verification of user key information, thereby preventing illegal users from forging requests by intercepting and cracking information through requests, thereby causing leakage of user key information and damaging data stored in the database.

[0019] 3. The present invention mainly adopts encryption technology to provide a data security and accuracy verification method for system front-end and back-end data transmission, communication and data interaction between APP and application services.

[0020] In summary, the front-end and back-end interactive data protection device of the present invention is not only suitable for the research and development of new systems, but also suitable for the front-end and back-end interactive data protection of the security upgrade and transformation of the system that has been put into use. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Throughout the accompanying drawings, the same reference numerals are used to represent the same components. In the accompanying drawings:

[0022] Figure 1 This is a block diagram of a front-end and back-end interactive data protection device suitable for system transformation according to an embodiment of the present invention.

[0023] Figure 2 This is a schematic diagram of a front-end and back-end interactive data protection device suitable for system transformation according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0025] Although the terms first, second, third, etc. can be used in the text to describe multiple elements, components, regions, layers and / or sections, these elements, components, regions, layers and / or sections should not be limited by these terms. These terms can only be used to distinguish an element, component, region, layer or section from another region, layer or section. Unless the context clearly indicates, terms such as "first", "second" and other numerical terms do not imply order or sequence when used in the text. Therefore, the first element, component, region, layer or section discussed below can be referred to as the second element, component, region, layer or section without departing from the teaching of the example embodiments.

[0026] For ease of description, spatially relative terms may be used herein to describe the relationship of one element or feature relative to another element or feature as shown in the figures, such as "inside", "outside", "inner side", "outer side", "below", "above", etc. Such spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation depicted in the figures.

[0027] Since the transformation workload for the system that has been put into use is large when the security protection technology is upgraded, the invasiveness to the original system is high. The front-end and back-end interactive data protection device suitable for the security upgrade and transformation of the system in use provided by the present invention includes: the front end is configured to request the public key to encrypt the login data and send the login request, perform the secondary encapsulation of the global request interface to realize the automatic encryption of the request data, the request header automatically loads the user's key information and the response data is automatically decrypted; the back end is configured to receive the data and use the private key to decrypt and perform login verification, the custom interceptor realizes the automatic decryption of the received data and the automatic encryption of the response data, and the back end custom verification AOP interface performs secondary verification on the key data and / or key interface. Therefore, the present invention enhances the interface security through the secondary verification of the user's key information, and avoids the illegal user from forging the request by requesting to intercept the cracked information, resulting in the leakage of the user's key information and the destruction of the database storage data.

[0028] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0029] The front-end and back-end interactive data protection device suitable for system transformation provided in this embodiment can be implemented by software, hardware, or a combination of software and hardware. For the convenience of description, the present embodiment is described separately by dividing the functions into various units. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware during implementation. The embodiment of the front-end and back-end interactive data protection device suitable for system transformation provided by the present invention is merely illustrative.

[0030] like Figure 1 , Figure 2 As shown, the front-end and back-end interactive data protection device suitable for security upgrade and transformation of the system in use provided by this embodiment includes:

[0031] The front end is configured to request the public key to encrypt the login data and send the login request, perform secondary encapsulation of the global request interface to achieve automatic encryption of the request data, automatic loading of the user's key information in the request header, and automatic decryption of the response data;

[0032] The backend is configured to receive data and use the private key to decrypt it to perform login verification, customize the interceptor to implement automatic decryption of received data and automatic encryption of response data, and customize the backend verification AOP interface to perform secondary verification on key data and / or key interfaces.

[0033] In a preferred embodiment of the present invention, the front end includes a login unit, a secondary packaging unit and an information loading and decryption unit.

[0034] Furthermore, the login unit is used to request the public key to encrypt the login data and send a login request. Specifically, the front end applies to the back end for the public key of the SM2 encryption algorithm, encrypts the login information through the public key, and sends a login request, wherein the login information includes a password, verification code, etc.

[0035] Furthermore, the secondary encapsulation unit is used to perform secondary encapsulation of the global request interface to achieve automatic encryption of the request data, specifically: after the user logs in successfully, the user's key information is encrypted and stored in the front-end cookie. The secondary encapsulation unit rewrites the ajax method through the secondary encapsulation of the global interface to achieve global modification without having to modify each front-end request in the existing system. Before sending the network request, the request parameters are encrypted using the national secret SM2 algorithm. Taking JQuery as an example, the front-end directly transforms AJAX, and taking VUE as an example, directly transforms AXIOS, etc. Use $.extend to rewrite the ajax method. Before calling the send method of the XMLHttpRequest object, encrypt the param parameter using the national secret SM2 algorithm.

[0036] Furthermore, the information loading and decryption unit is used to automatically load user key information in the request header and automatically decrypt the response data. Specifically, the encrypted user key information returned by the background is added to the request header. When the front end sends a request to the back end, the encrypted user key information is stored in the request header to realize automatic encryption of the request data: after receiving the request, a data decryption method is added. Taking JQuery as an example, the ajax method is rewritten, and the decryption logic is added to the return method error and success method, that is, the requested public key is called to decrypt the returned data and then return it to the front end.

[0037] In a preferred embodiment of the present invention, the back end includes a login verification unit, a first customization unit and a second customization unit.

[0038] Furthermore, the login verification unit is used to receive the login data and decrypt it using the private key, perform login verification, and return the encrypted user key information after successful verification, specifically:

[0039] Compare the request header user information with the current login user information in the permission verification to see if they are consistent. If they are inconsistent, an error message is directly returned without further verification. If they are consistent, it is determined that the request is sent by the current login user, and the user information is verified before the next verification;

[0040] Verify the role permission level of the user in the request header to determine whether the request permission of the interface is available. Different roles correspond to different menu URL permissions. The URL permission list is obtained through query, and the current request interface is compared with the URL permission list owned by the role. If the URL permission list contains the current request method, the verification is successful. If the URL permission list does not contain the current request method, the verification fails and an error message is directly returned to the front end. The front-end request data is decrypted using the SM2 private key stored in the backend server to perform login verification. If the verification is successful, the user's key information is encrypted and returned to the front end. The user's key information includes information for user uniqueness verification, such as work number, mobile phone number, user name, etc.

[0041] Furthermore, the first custom unit is configured as a custom interceptor to realize automatic decryption of received data and automatic encryption of response data. The specific process is as follows: the first custom unit can create a custom filter class in spring by creating a global interceptor to realize global interface request interception processing, and perform SM2 encryption on the response content before responding. Taking the Spring framework as an example, the custom interceptor can create a filter class and register it in the interceptor of shiro or springsecurity. Based on the national secret SM2, the automatic decryption of data in the front-end request and the automatic encryption method of the response response data are realized. Specifically, the logic in the Filter interceptor, after intercepting the request data, first calls the SM2 algorithm to decrypt the data and then executes the subsequent request. Because the interceptor can intercept all requests, automatic decryption is realized without writing decryption logic in each request interface.

[0042] Furthermore, the second customization unit is used to customize the verification AOP interface, and is used to perform secondary verification on key data and / or key interfaces.

[0043] In this embodiment, the user key information verification process is that the back-end uses AOP technology to develop a user key information verification function. The key information verification is performed for other requests initiated by the user after the login is successful. The second custom unit customizes the verification AOP interface: For the spring framework project, aspects, point cuts and notifications can be defined through annotations or XML configurations, which will not be repeated here. After obtaining the user key information in the front-end request header and decrypting it, it is compared and verified with the user information saved on the server after the login verification is successful to confirm the requester information. In addition, the permission information of the requesting user is verified to confirm whether the requesting user of the interface has the right to call the interface, thereby achieving secondary verification.

[0044] In this embodiment, according to the actual situation of the system, key data and / or key interfaces are confirmed to be added in the customized AOP interface through annotation, so as to realize the secondary verification without code intrusion, that is, to use it in the form of annotation on the required interface. Among them, key data such as personal information data, especially data related to mobile phone numbers and ID numbers. User work numbers, contact information, positions, business operation data, etc. in enterprise information systems; purchase records of shopping software, etc., key interfaces are interfaces that will obtain or modify key data.

[0045] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In the description of this specification, the description of reference terms "a preferred embodiment", "further", "specifically", "in the present embodiment", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples without contradiction.

[0046] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A front-end and back-end interactive data protection device suitable for the security upgrade and transformation of the system in use, characterized in that: The device includes: The front end is configured to request the public key to encrypt the login data and send the login request, perform secondary encapsulation of the global request interface to achieve automatic encryption of the request data, automatic loading of the user's key information in the request header, and automatic decryption of the response data; The backend is configured to receive login data and use the private key to decrypt it to perform login verification, customize the interceptor to implement automatic decryption of received data and automatic encryption of response data, and customize the backend verification AOP interface to perform secondary verification on key data and / or key interfaces.

2. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The front end includes a login unit, which is used to request a public key to encrypt login data and send a login request, specifically: apply for a public key of the SM2 encryption algorithm, encrypt the login data through the public key, and send a login request.

3. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The front end includes a secondary encapsulation unit, which is used to perform secondary encapsulation of the global request interface to realize automatic encryption of request data. Specifically, global modification is realized by rewriting through the ajax method without having to modify each front-end request in the existing system. Before sending the network request, the request parameters are encrypted using the national secret SM2 algorithm.

4. The front-end and back-end interactive data protection device according to claim 3, characterized in that: When the front-end JQuery directly transforms AJAX, use $.extend to rewrite the ajax method. Before calling the send method of the XMLHttpRequest object, the param parameter is encrypted using the national encryption SM2 algorithm.

5. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The front end includes an information loading and decryption unit, which is used to automatically load user key information in the request header and automatically decrypt response data. Specifically, the encrypted user key information returned by the back end is added to the request header, and a data decryption method is added after receiving the request. In the front end, JQuery directly transforms AJAX, rewrites the ajax method, and adds decryption logic in the return method error and success method, that is, calling the requested public key to decrypt the returned data and then returning it to the front end.

6. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The backend includes a login verification unit, which is used to receive login data and use a private key to perform login verification. After successful verification, the encrypted user key information is returned. Specifically, the user information in the request header is compared with the current login person information in the permission verification to see if they are consistent. If they are inconsistent, an error message is directly returned without further verification. If they are consistent, it is determined that the request is sent by the current login person, and the user information is verified before further verification. Verify the role permission level of the user in the request header to determine whether the request permission of the interface is available. Different roles correspond to different menu URL permissions. The URL permission List is obtained by querying, and the current request interface is compared with the URL permission List owned by the role. If the URL permission List contains the current request method, the verification passes and the encrypted user key information is returned; if the URL permission List does not contain the current request method, the verification fails and an error message is directly returned to the front end.

7. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The backend includes a first custom unit, which is configured as a custom interceptor to realize automatic decryption of received data and automatic encryption of response data. The specific process is: by creating a global interceptor, a custom filter class can be created in spring to realize global interface request interception processing. Before responding, the response content is encrypted by the national secret SM2 algorithm.

8. The front-end and back-end interactive data protection device according to claim 7, characterized in that: Custom interceptor, when using Spring framework, create filter class, register it in shiro or spring security interceptor, realize automatic decryption of data in front-end request based on national secret SM2 algorithm, and automatic encryption of data in response. Specifically: after the logic in Filter interceptor intercepts the request data, it first calls national secret SM2 algorithm to decrypt the data and then executes subsequent requests. Because the interceptor can intercept all requests to realize automatic decryption, there is no need to write decryption logic in each request interface.

9. The front-end and back-end interactive data protection device according to claim 1, characterized in that: The backend includes a second customization unit, which is used to customize the verification AOP interface and to perform secondary verification on key data and / or key interfaces. Specifically, according to the actual situation of the system, confirm that the key data and / or key interface add a customized AOP interface through annotation, and use it in the form of annotation on the required interface, thereby realizing secondary verification without code intrusion.

Images