Data request processing method and device and storage medium

Abstract

The invention discloses a data request processing method and device and a storage medium, and relates to the field of information security. The method comprises the following steps: after a data request submitted by a target user through a client is received, obtaining a target user identifier and a target session identifier of the target user through a server; an authority group corresponding to the target user is determined according to the target user identifier, and the authority group is used for recording identifiers of function modules, having data processing authority, of the target user; according to the permission group corresponding to the target user and / or the target session identifier of the target user, whether the data request has an unauthorized behavior feature is detected, processing operation on the data request is determined according to a detection result, and the unauthorized behavior feature represents that the target user requests to access or operate unauthorized data. The technical problems that in the prior art, an unauthorized detection process is lacked, so that the system information security is poor, the risk of information leakage is easily caused, and the data security is influenced are solved.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method, device and storage medium for processing data requests. Background Art

[0002] In current software applications and network systems, permission management is a critical security measure that ensures that users can only access and operate the resources they are assigned. However, in some system designs, especially those that were developed early or security considerations were insufficient, the unauthorized detection process may be omitted or insufficiently implemented. The lack of unauthorized detection directly leads to the risk of information leakage. In enterprise-level applications such as banking systems, this risk is particularly serious because the system contains a large amount of sensitive information, such as personal identity information, account details, transaction records, etc. Once unauthorized behavior occurs, attackers may obtain this information, which will not only lead to the leakage of personal privacy, but also enable attackers to conduct unauthorized transactions, data tampering or system abuse, thereby causing serious economic losses and legal consequences to users and institutions.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method, device and storage medium for processing data requests, so as to at least solve the technical problem that the prior art lacks an unauthorized detection process, resulting in poor system information security, which easily causes the risk of information leakage and affects data security.

[0005] According to one aspect of an embodiment of the present application, a method for processing a data request is provided, comprising: after receiving a data request submitted by a target user through a client, obtaining a target user identifier and a target session identifier of the target user through a server, wherein the target session identifier is used to represent a unique identifier of the target user when logging into a target system, and the target session identifier is retained in the session information generated by negotiation between the server and the client; determining a permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record identifiers of functional modules for which the target user has data processing authority; detecting whether the data request has unauthorized behavior characteristics according to the permission group corresponding to the target user and / or the target session identifier of the target user, and determining a processing operation for the data request according to the detection result, wherein the unauthorized behavior characteristics represent that the target user requests to access or operate unauthorized data.

[0006] Optionally, based on the permission group corresponding to the target user, detect whether the data request has any unauthorized behavior characteristics, and determine the processing operation for the data request based on the detection result, including: detecting the target function module identifier corresponding to the data request, wherein the target function module identifier is the unique identifier of the target function module that the target user expects to execute through the data request; based on the permission group and the target function module identifier corresponding to the target user, detect whether the data request has any horizontal unauthorized behavior characteristics, wherein the horizontal unauthorized behavior characteristics characterize that the target user requests to access or operate the data of a first type of user, the first type of user is a user with the same permission level as the target user, and there is data isolation between the first type of user and the target user; when it is detected that the data request has any horizontal unauthorized behavior characteristics, prohibit the data request from being passed.

[0007] Optionally, based on the permission group and target function module identifier corresponding to the target user, detecting whether the data request has horizontal unauthorized behavior characteristics includes: detecting whether the target function module identifier is included in the permission group corresponding to the target user; determining that the data request has horizontal unauthorized behavior characteristics when it is detected that the target function module identifier is not included in the permission group corresponding to the target user; determining that the data request does not have horizontal unauthorized behavior characteristics when it is detected that the target function module identifier is included in the permission group corresponding to the target user.

[0008] Optionally, based on the target session identifier of the target user, detecting whether the data request has unauthorized behavior characteristics, and determining the processing operation of the data request based on the detection result, including: receiving an encrypted string sent by the client through the server, wherein the encrypted string is a string obtained by encrypting a first string through a preset encryption protocol, and the first string includes a session identifier, a timestamp and a request parameter used when the client sends the data request, and the request parameter is used to describe the request content of the data request; encrypting a second string into a target string through the server according to a preset encryption protocol, wherein the second string includes the target session identifier, the timestamp used when the client sends the data request, and the request parameter; based on the encrypted string and the target string, detecting whether the data request has vertical unauthorized behavior characteristics, wherein the vertical unauthorized behavior characteristics indicate that the target user requests to access or operate the data of a second type of user, and the data processing authority of the second type of user is higher than the data processing authority of the target user; when it is detected that the data request has vertical unauthorized behavior characteristics, prohibiting the data request from being passed.

[0009] Optionally, based on the encrypted string and the target string, detecting whether the data request has vertical unauthorized behavior characteristics includes: detecting whether the encrypted string and the target string are the same; when it is detected that the encrypted string and the target string are the same, determining that the data request does not have vertical unauthorized behavior characteristics; when it is detected that the encrypted string and the target string are not the same, determining that the data request has vertical unauthorized behavior characteristics.

[0010] Optionally, based on the permission group corresponding to the target user and the target session identifier of the target user, it is detected whether the data request has any unauthorized behavior characteristics, and the processing operation on the data request is determined based on the detection result, including: based on the permission group corresponding to the target user and the target function module identifier corresponding to the data request, it is detected whether the data request has any horizontal unauthorized behavior characteristics; based on the target session identifier of the target user, the session identifier used when the client sends the data request, the timestamp, and the request parameters, it is detected whether the data request has any vertical unauthorized behavior characteristics; if the data request has any horizontal unauthorized behavior characteristics and / or any vertical unauthorized behavior characteristics, it is determined that the data request has any unauthorized behavior characteristics, and the data request is prohibited from being passed; if the data request does not have any horizontal unauthorized behavior characteristics and any vertical unauthorized behavior characteristics, it is determined that the data request does not have any unauthorized behavior characteristics, and the data request is allowed to be passed.

[0011] Optionally, after receiving the data request submitted by the target user through the client, obtaining the target user identifier and the target session identifier of the target user through the server, including: after receiving the data request submitted by the target user through the client, reading the session information corresponding to the target user from the client according to the name of the target user and the network address of the client through the server, wherein the session information is the login information stored by the target user negotiated by the server and the client when the target user previously logged into the target system; and obtaining the target user identifier and the target session identifier by parsing the session information through the server.

[0012] According to another aspect of the present application, a data request processing device is also provided, which includes: an acquisition unit, which is used to obtain a target user identifier and a target session identifier of the target user through a server after receiving a data request submitted by a target user through a client, wherein the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by negotiation between the server and the client; a first determination unit, which is used to determine a permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record the identifiers of functional modules for which the target user has data processing authority; a second determination unit, which is used to detect whether the data request has an unauthorized behavior feature according to the permission group corresponding to the target user and / or the target session identifier of the target user, and determine the processing operation of the data request according to the detection result, wherein the unauthorized behavior feature represents that the target user requests to access or operate unauthorized data.

[0013] According to another aspect of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored executable program, wherein when the executable program runs, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned data request processing method.

[0014] According to another aspect of the present application, an electronic device is provided, which includes: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned method for processing data requests is executed when the program is running.

[0015] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein the computer instructions implement the steps of the above-mentioned data request processing method when executed by a processor.

[0016] In the present application, after receiving the data request submitted by the target user through the client, the target user identifier and target session identifier of the target user are obtained through the server, wherein the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by the negotiation between the server and the client before, and then, the permission group corresponding to the target user is determined according to the target user identifier, wherein the permission group is used to record the identifier of the functional module for which the target user has data processing authority. Finally, according to the permission group corresponding to the target user and / or the target session identifier of the target user, it is detected whether the data request has unauthorized behavior characteristics, and the processing operation of the data request is determined according to the detection result, wherein the unauthorized behavior characteristics represent that the target user requests to access or operate unauthorized data.

[0017] As can be seen from the above content, in this application, by introducing the target session identifier (such as session ID) and the target user identifier (such as user ID), the system can accurately identify the initiator of each data request and judge whether the request is unauthorized according to the user's permission group (the identification set of the functional module). This means that even users of the same level cannot access unauthorized data by modifying the request parameters, which greatly limits the possibility of unauthorized attacks. Secondly, in this application, the target session identifier is stored in the session information between the server and the client as the unique identifier for each login, which ensures that each user's session is independent and traceable. Combining the session ID and the permission group for unauthorized detection can effectively prevent session hijacking and identity impersonation, which is especially important for vertical unauthorized detection. By verifying the validity of the session ID in the request, the system can determine whether the request comes from a legitimate user, and reject the request when the session times out or is tampered with, thereby improving the security of session management. By detecting the unauthorized behavior characteristics in the data request, the technical solution of the present application can timely intercept those requests that attempt to access or operate unauthorized data. This detection mechanism blocks the risk of information leakage at the source, ensuring that sensitive information such as personal identity information, account details, transaction records, etc. will not be obtained by unauthorized users. In addition, it can prevent users from performing operations beyond their authority, such as modifying other people's account information, conducting unauthorized transactions, etc., further protecting the integrity of data and the robustness of the system.

[0018] In summary, this application solves the problem of the lack of unauthorized detection process in the prior art by introducing the concepts of target session identifier and permission group, and performing unauthorized detection in data request processing, significantly enhancing the information security of the system, effectively preventing information leakage and unauthorized operations, and improving the data protection level and corporate compliance capabilities. This technical solution has important application value and security significance for any system that needs to process sensitive data and multi-user operations, especially financial transaction systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional method for processing a data request according to an embodiment of the present application;

[0021] Figure 2 It is an optional flow chart of detecting unauthorized behavior characteristics according to a target session identifier according to an embodiment of the present application;

[0022] Figure 3is a schematic diagram of a data request processing device according to an embodiment of the present application;

[0023] Figure 4 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should also be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0027] According to an embodiment of the present application, an embodiment of a method for processing a data request is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 is a flowchart of an optional method for processing a data request according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0029] Step S101, after receiving a data request submitted by a target user through a client, a target user identifier and a target session identifier of the target user are obtained through a server.

[0030] In step S101, the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by negotiation between the server and the client.

[0031] Optionally, the target user refers to a user who initiates a request to the system. In this application, "target user" specifically refers to logged-in users who are performing operations or attempting to access system resources. The target user can be any legitimate user of the system, including but not limited to ordinary users, administrators, or any individuals with specific permissions. The client refers to the device or software through which the user interacts with the system. In web applications, the client usually refers to the user's web browser, but in a broader IT environment, the client can be any application that can communicate with the server, such as a mobile application, a desktop application, or any other type of user interface. The client is responsible for sending requests to the server and receiving responses returned by the server. The server refers to the back-end system or server that processes client requests and provides responses. The server is responsible for performing operations such as business logic, data processing, and permission verification, and returns the results to the client. In this application, the server is the core of unauthorized access detection, which uses the target user identifier and the target session identifier to determine the legitimacy of the request.

[0032] Optionally, the target user identifier is information used to uniquely identify each user in the system. In most applications, the target user identifier can be a user name, user ID, or any other information that can uniquely identify the user. The target user identifier is the basis for permission management and authentication, ensuring that the system can accurately identify the user who initiated the request.

[0033] Optionally, the target session identifier, also known as a session ID, is a unique identifier used to represent a session in which the target user interacts with the system during a specific period of time. When a user logs into the system, the server generates a session ID, which is stored in a cookie (corresponding to the above-mentioned session information) on the client (such as the user's browser) and is sent to the server along with the request via the cookie each time the user sends a request to the server. The session ID is temporary and exists only during the validity period of the session. The validity period of the session can be controlled by setting an expiration time. When the session ID expires or is deemed invalid by the server, the user needs to log in to the system again to obtain a new session ID before continuing to interact with the system. The use of session IDs helps protect user sessions from being stolen or forged by external attackers, and enhances the security of user authentication.

[0034] Step S102: determining the permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record the identifiers of the function modules for which the target user has data processing authority.

[0035] Optionally, a permission group refers to a set of function module identifiers granted to a specific user or user group, and the permission group defines the scope of resources that the user can access or operate in the system. Permission groups are the core component of system permission management. Through the setting of permission groups, the system can implement fine-grained access control to ensure that each user can only access data and functions that match their roles and responsibilities. In this application, permission groups are used to record the function module identifiers for which the target user has data processing permissions. When a user logs in to the system and submits a data request, the server retrieves its permission group based on the target user identifier, and then checks whether the function module identifier in the request is in the permission group. If the function module identifier is not included in the permission group, the server will determine that the data request has unauthorized behavior characteristics and reject the request to prevent unauthorized data access or operation.

[0036] Optionally, the function module identification, also called menu ID, is a unique identifier for identifying each function module or menu item in the system. In system permission management, the menu ID is a specific unit of permission allocation, and each menu ID represents a specific set of data processing permissions and function access permissions.

[0037] For example, in a banking system, there may be different functional modules such as "account inquiry", "transfer operation", "loan approval", etc. Each module has its corresponding menu ID. The system administrator can control the functional modules that different users or user groups can access and operate by assigning different menu IDs to them.

[0038] During the unauthorized access detection process, the server will check whether the menu ID carried in the data request is in the target user's permission group. If it is not in the permission group, the request is considered to be unauthorized and the system will refuse to execute the request, thereby protecting the integrity and security of the data.

[0039] Step S103, based on the permission group corresponding to the target user and / or the target session identifier of the target user, detect whether the data request has unauthorized behavior characteristics, and determine the processing operation of the data request based on the detection result, wherein the unauthorized behavior characteristics indicate that the target user requests to access or operate unauthorized data.

[0040] Optionally, unauthorized behavior characteristics refer to characteristics or patterns displayed in the data request that indicate that the target user attempts to access or operate unauthorized data. In the present application, unauthorized behavior characteristics mainly include: horizontal unauthorized and vertical unauthorized. Among them, horizontal unauthorized behavior indicates that the target user modifies the parameters in the request (such as the function module identifier) ​​and attempts to access functions or data outside the authority scope of users of the same level. Vertical unauthorized behavior indicates that the target user attempts to use the session ID of other users, or modify the session information, to obtain a higher level of authority to access or operate data that he is not authorized to access.

[0041] Optionally, the processing operation of the data request refers to the action taken by the system on the data request based on the result of the unauthorized detection, including but not limited to the following operations:

[0042] Authorization: If the data request meets the target user's permission group and session ID, that is, no unauthorized behavior characteristics are detected, the system will perform the data processing operation in the request.

[0043] Deny: If unauthorized behavior characteristics are detected, the system will refuse to execute the data request to prevent the risk of unauthorized access or operation of data.

[0044] Records: The system will record all data requests and corresponding processing results, including unauthorized attempts, to facilitate subsequent security audits and problem tracking.

[0045] As can be seen from the above content, in this application, by introducing the target session identifier (such as session ID) and the target user identifier (such as user ID), the system can accurately identify the initiator of each data request and judge whether the request is unauthorized according to the user's permission group (the identification set of the functional module). This means that even users of the same level cannot access unauthorized data by modifying the request parameters, which greatly limits the possibility of unauthorized attacks. Secondly, in this application, the target session identifier is stored in the session information between the server and the client as the unique identifier for each login, which ensures that each user's session is independent and traceable. Combining the session ID and the permission group for unauthorized detection can effectively prevent session hijacking and identity impersonation, which is especially important for vertical unauthorized detection. By verifying the validity of the session ID in the request, the system can determine whether the request comes from a legitimate user, and reject the request when the session times out or is tampered with, thereby improving the security of session management. By detecting the unauthorized behavior characteristics in the data request, the technical solution of the present application can timely intercept those requests that attempt to access or operate unauthorized data. This detection mechanism blocks the risk of information leakage at the source, ensuring that sensitive information such as personal identity information, account details, transaction records, etc. will not be obtained by unauthorized users. In addition, it can prevent users from performing operations beyond their authority, such as modifying other people's account information, conducting unauthorized transactions, etc., further protecting the integrity of data and the robustness of the system.

[0046] In summary, this application solves the problem of the lack of unauthorized detection process in the prior art by introducing the concepts of target session identifier and permission group, and performing unauthorized detection in data request processing, significantly enhancing the information security of the system, effectively preventing information leakage and unauthorized operations, and improving the data protection level and corporate compliance capabilities. This technical solution has important application value and security significance for any system that needs to process sensitive data and multi-user operations, especially financial transaction systems.

[0047] In an optional embodiment, based on the permission group corresponding to the target user, it is detected whether the data request has unauthorized behavior characteristics, and the processing operation of the data request is determined based on the detection result, including: detecting the target function module identifier corresponding to the data request through the server, wherein the target function module identifier is the unique identifier of the target function module that the target user expects to execute through the data request. Then, based on the permission group and target function module identifier corresponding to the target user, the server detects whether the data request has horizontal unauthorized behavior characteristics, wherein the horizontal unauthorized behavior characteristics indicate that the target user requests to access or operate the data of a first type of user, the first type of user belongs to a user with the same permission level as the target user, and there is data isolation between the first type of user and the target user. Finally, when it is detected that the data request has horizontal unauthorized behavior characteristics, the data request is prohibited.

[0048] Optionally, each functional module has a unique identifier in the system, which is usually expressed as a menu ID in this application. When the server receives a data request submitted by the target user through the client, it will first parse the request and extract the target functional module identifier that the target user expects to execute. For example, if the data request is submitted via a URL, the URL path or parameters may contain the target functional module identifier. After extracting the target functional module identifier, the server will further query the target user's permission group. The permission group contains a set of identifiers of the functional modules that the user is authorized to access and operate. The server will check whether the target functional module identifier exists in the target user's permission group. If not, it will preliminarily determine that the request may be unauthorized.

[0049] Optionally, for the detection of horizontal privilege escalation behavior characteristics, the server will additionally check whether the data in the request involves accessing or operating the data of other users with the same privilege level (first-class users). Horizontal privilege escalation usually occurs between users with the same privilege level, where one user attempts to access data that should be isolated from other users. For example, an ordinary employee attempts to view another employee's customer information or operate another employee's order data.

[0050] To detect horizontal privilege escalation, the server may need additional logic to verify whether the data in the request is related to the target user himself or is within his or her permission range. This may include checking other parameters in the request, such as customer ID, order number, etc., to ensure that they match the permission group of the target user. If the server identifies during the detection process that the data request has horizontal privilege escalation behavior characteristics, that is, the target user attempts to access or operate the data of other users that are not within the scope of its data isolation, the system will immediately take measures to prohibit the execution of the data request. This means that the server will not process the data operation or access instructions in the request, nor will it return any sensitive information to the client. Instead, it will return an error message or status code indicating that the request was rejected due to privilege escalation.

[0051] In this way, the system can effectively prevent horizontal unauthorized attacks, ensure the implementation of the data isolation principle, and protect each user's data from being illegally accessed by other users at the same level. The introduction of the horizontal unauthorized detection mechanism significantly enhances the system's data security and privacy protection capabilities, and solves the problem of poor system information security caused by the lack of unauthorized detection process in the existing technology.

[0052] In an optional embodiment, according to the permission group corresponding to the target user and the target function module identifier, detecting whether the data request has horizontal unauthorized behavior characteristics includes: detecting, by the server, whether the permission group corresponding to the target user includes the target function module identifier. When it is detected that the permission group corresponding to the target user does not include the target function module identifier, it is determined that the data request has horizontal unauthorized behavior characteristics; when it is detected that the permission group corresponding to the target user includes the target function module identifier, it is determined that the data request does not have horizontal unauthorized behavior characteristics.

[0053] Optionally, by comparing the target function module identifier with the set of function module identifiers in the target user's permission group, the server can determine whether the target user has the authority to execute the function in this request. If the target function module identifier exists in the target user's permission group, then this request is considered to be within the target user's permission range and there is no horizontal unauthorized behavior feature.

[0054] Optionally, if the server does not find an item in the target user's permission group that matches the target functional module identifier in the data request, this indicates that the target user is trying to access or operate a functional module outside of its permission scope. At this point, the data request will be judged to have horizontal unauthorized behavior characteristics, which means that the target user is trying to access data with the identity or permission of other users with the same permission level as itself.

[0055] Among them, horizontal privilege escalation attacks usually occur between users with the same level of authority. Attackers attempt to access data that should not be accessible to them by modifying the parameters in the request, such as viewing customer records of other users of the same level, or performing transaction operations that other users of the same level are authorized to perform. This detection mechanism is the key for the server to identify and prevent such unauthorized data access.

[0056] Alternatively, if the server finds the corresponding permission in the permission group of the target user, that is, the target function module identifier does exist in the set of functions accessible to the target user, then this data request is deemed to be within the scope of the target user's permission and there is no horizontal unauthorized behavior feature. The server will allow the request to proceed and perform the corresponding data processing or function access operation.

[0057] In summary, by comparing the permission group on the server side with the functional module identifier, the horizontal unauthorized behavior characteristics are effectively detected and identified, preventing data access and operation unauthorized between users of the same level of authority, thereby ensuring the system's data security and user privacy protection. As an important part of system permission management, this mechanism has significant technical effects and application value in improving overall security, avoiding information leakage risks, and maintaining user data isolation rules.

[0058] In an optional embodiment, Figure 2is an optional flow chart of detecting unauthorized behavior characteristics according to a target session identifier of a target user according to an embodiment of the present application, such as Figure 2 As shown, the following steps are included:

[0059] Step S201, receiving an encrypted string sent by a client through a server, wherein the encrypted string is a string obtained by encrypting a first string through a preset encryption protocol, and the first string includes a session identifier, a timestamp, and request parameters used by the client when sending a data request, and the request parameters are used to describe the request content of the data request.

[0060] Optionally, when the client sends a data request, an encrypted string is generated, which is obtained by encrypting a set of key parameters. This set of parameters is called the "first string", which includes the session identifier, timestamp and request parameters when the client sends the data request.

[0061] The session ID is the unique ID of the user in the current session and is used to verify the user identity and session status. The timestamp records the exact time when the request was sent and is used to prevent replay attacks, that is, attackers send the same request multiple times to try to bypass the verification mechanism. The request parameters describe the specific content of the data request, such as the functional module ID, customer information, transaction details, etc. that are expected to be accessed.

[0062] The generation of the encrypted string uses a preset encryption protocol to ensure the security of the data during transmission. The server receives and parses the encrypted string sent by the client for subsequent verification steps.

[0063] Step S202: The server encrypts the second string into a target string according to a preset encryption protocol, wherein the second string includes a target session identifier, a timestamp used when the client sends a data request, and request parameters.

[0064] Optionally, the server can encrypt another set of parameters according to the same preset encryption protocol to generate a "target string". This set of parameters is called the "second string" and contains the session identifier of the target user, the same timestamp associated with the data request, and the same request parameters. The purpose of generating the target string is to compare it with the encrypted string sent by the client to verify the integrity and legitimacy of the data request.

[0065] Step S203, based on the encrypted string and the target string, detect whether the data request has vertical unauthorized behavior characteristics, wherein the vertical unauthorized behavior characteristics indicate that the target user requests to access or operate the data of the second category of users, and the data processing authority of the second category of users is higher than the data processing authority of the target user.

[0066] Optionally, the server will then compare the encrypted string with the target string to detect whether the data request has vertical unauthorized behavior characteristics. Vertical unauthorized behavior characteristics refer to the target user attempting to access or operate data or functions with a higher permission level than his or her own permission. The detection process first checks whether the two strings are completely consistent. If they are consistent, it means that the session ID, timestamp, and request parameters in the request match the current session state and permissions of the target user, and the request is legal. Inconsistency may mean one or more of the following situations:

[0067] The first case: The session ID is tampered with, that is, the target user tries to use the session ID of other users who may have higher data processing permissions.

[0068] The second case: The timestamp is modified, possibly to bypass the time verification mechanism and attempt to operate in an expired session.

[0069] The third situation: The request parameters are illegally modified in an attempt to access data or functions that the target user is not authorized to access.

[0070] Step S204: when it is detected that the data request has vertical unauthorized behavior characteristics, the data request is prohibited from being passed.

[0071] Optionally, if the server finds that the encrypted string and the target string are inconsistent during the comparison process, this will be judged as the target user's data request having vertical unauthorized behavior characteristics. At this time, the server will refuse to execute the data request to prevent unauthorized high-level permission operations and protect the security of the system and data. Prohibiting data requests involves immediately interrupting the request processing flow and responding to the client with a failed status code and error message, indicating that the request was rejected due to insufficient permissions or unauthorized behavior. In addition, the server may also record this unauthorized attempt for subsequent security audits and analysis to identify potential attack patterns or system weaknesses.

[0072] In an optional embodiment, based on the encrypted string and the target string, detecting whether the data request has vertical unauthorized behavior characteristics includes: detecting whether the encrypted string and the target string are the same through the server. When it is detected that the encrypted string and the target string are the same, it is determined that the data request does not have vertical unauthorized behavior characteristics; when it is detected that the encrypted string and the target string are not the same, it is determined that the data request has vertical unauthorized behavior characteristics.

[0073] If the encrypted string is the same as the target string, this indicates that the session ID, timestamp, and request parameters of the client and target user match, and no signs of tampering are found. This means that the parameters in the data request (especially the session ID and request content) match the identity and permissions of the target user in the system, and there is no sign of attempting to exploit the identity or data of a higher-privileged user. The server will consider the data request to be legitimate and without vertical unauthorized behavior characteristics, and will then execute the operations in the data request, such as accessing specific functional modules, processing customer data, etc.

[0074] If the encrypted string and the target string are inconsistent, this may indicate that the parameters in the data request have been tampered with. Tampering may include but is not limited to: the session identifier (SID) is replaced with the session identifier of another user (possibly a user with higher permissions); the timestamp is modified so that it no longer matches the time when the target user sent the request, which may be to bypass the session validity check; the request parameters are illegally modified, and the target user attempts to access data or functions beyond the permission.

[0075] The server will regard this inconsistency as evidence of vertical unauthorized behavior in the data request and immediately refuse to execute the data request to prevent unauthorized high-level permission operations and protect the security of the system and data. In addition, the server may also record this unauthorized attempt for subsequent security audits, analysis of potential security threats, and optimization of the system permission control mechanism.

[0076] In an optional embodiment, based on the permission group corresponding to the target user and the target session identifier of the target user, it is detected whether the data request has unauthorized behavior characteristics, and the processing operation of the data request is determined based on the detection result, including: detecting whether the data request has horizontal unauthorized behavior characteristics based on the permission group corresponding to the target user and the target function module identifier corresponding to the data request by the server. Based on the target session identifier of the target user, the session identifier used when the client sends the data request, the timestamp, and the request parameters, it is detected whether the data request has vertical unauthorized behavior characteristics. In the case that the data request has horizontal unauthorized behavior characteristics and / or vertical unauthorized behavior characteristics, it is determined that the data request has unauthorized behavior characteristics, and the data request is prohibited from being passed; in the case that the data request does not have horizontal unauthorized behavior characteristics and vertical unauthorized behavior characteristics, it is determined that the data request does not have unauthorized behavior characteristics, and the data request is allowed to be passed.

[0077] Optionally, when a data request has horizontal unauthorized behavior characteristics and / or vertical unauthorized behavior characteristics, the server determines that the data request has unauthorized behavior characteristics. This means that the parameters contained in the data request attempt to access or operate data or functions that the target user is not authorized to access, and the server will refuse to execute this data request to prevent unauthorized access and operation. In the case where the data request does not have horizontal unauthorized behavior characteristics and vertical unauthorized behavior characteristics, the server determines that the data request does not have unauthorized behavior characteristics, that is, the parameters in the data request match the target user's permissions and identity in the system, and it is a legitimate request. The server will allow the data request to pass and execute the functional module operation or data processing in the request.

[0078] Optionally, as to how to detect whether a data request has horizontal unauthorized behavior characteristics according to the permission group corresponding to the target user and the target function module identifier corresponding to the data request, the following methods may be used:

[0079] Check whether the target function module identifier is included in the permission group corresponding to the target user;

[0080] When it is detected that the target function module identifier is not included in the permission group corresponding to the target user, it is determined that the data request has horizontal unauthorized behavior characteristics;

[0081] When it is detected that the target function module identifier is included in the permission group corresponding to the target user, it is determined that the data request does not have horizontal unauthorized behavior characteristics.

[0082] The relevant implementation details have been explained in the above content and will not be repeated here.

[0083] Optionally, how to detect whether a data request has vertical unauthorized behavior characteristics based on the target user's target session identifier, the session identifier used by the client when sending the data request, the timestamp, and the request parameters. The following methods can be used:

[0084] Receiving, through the server, an encrypted string sent by the client, wherein the encrypted string is a string obtained by encrypting a first string through a preset encryption protocol, the first string including a session identifier, a timestamp, and a request parameter used when the client sends a data request, and the request parameter is used to describe the request content of the data request;

[0085] The server encrypts the second character string into a target character string according to a preset encryption protocol, wherein the second character string includes a target session identifier, a timestamp used when the client sends a data request, and a request parameter;

[0086] Check whether the encrypted string and the target string are the same;

[0087] When it is detected that the encrypted string and the target string are identical, it is determined that the data request does not have vertical unauthorized behavior characteristics;

[0088] When it is detected that the encrypted string and the target string are different, it is determined that the data request has vertical unauthorized behavior characteristics.

[0089] The relevant implementation details have been explained in the above content and will not be repeated here.

[0090] In an optional embodiment, after receiving the data request submitted by the target user through the client, the target user identifier and the target session identifier of the target user are obtained through the server, including: after receiving the data request submitted by the target user through the client, the server reads the session information corresponding to the target user from the client according to the name of the target user and the network address of the client, wherein the session information is the login information stored by the target user negotiated by the server and the client when the target user previously logged into the target system. The target user identifier and the target session identifier are obtained by parsing the session information through the server.

[0091] Optionally, when the target user sends a data request to the server through his client device (such as a computer, smart phone, etc.), the server will receive this request. The data request usually contains the operation that the user wants to perform or the data to be accessed, such as requesting to access specific bank account information, perform transactions, etc. After receiving the data request, the server will read the session information corresponding to the target user from the client's storage based on the name of the target user (it can also be information that identifies the user, such as a user name, account number, etc.) and the client's network address (IP address). Session information is the login information negotiated and stored by the server and its client when the target user logs into the system, and is usually contained in the client's temporary storage, such as Cookies or Session Storage. Among them, reading session information is the first step in verifying the user's identity and session status. It ensures that the server can identify which logged-in user the request comes from and whether the user's current session status is valid.

[0092] Optionally, the server parses two key identifiers from the read session information: the target user identifier and the target session identifier. It should be noted that by reading the session information from the client and parsing the target user identifier and the target session identifier, the server can verify the user identity and session status, which is a prerequisite for authority detection and identification of unauthorized behavior characteristics. This process plays a vital role in ensuring user data security, preventing unauthorized access and operation, and maintaining the legality of system operations. This mechanism is basic and necessary in any system that needs to implement user session management and authority verification.

[0093] According to another aspect of the present application, a data request processing device is also provided, wherein: Figure 3 is a schematic diagram of a data request processing device according to an embodiment of the present application, such as Figure 3 As shown, it includes: an acquisition unit 301, a first determination unit 302, and a second determination unit 303.

[0094] Optionally, the acquisition unit 301 is used to obtain the target user identifier and target session identifier of the target user through the server after receiving the data request submitted by the target user through the client, wherein the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by the server and the client before negotiation; the first determination unit 302 is used to determine the permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record the identifier of the functional module for which the target user has data processing authority; the second determination unit 303 is used to detect whether the data request has unauthorized behavior characteristics according to the permission group corresponding to the target user and / or the target session identifier of the target user, and determine the processing operation of the data request according to the detection result, wherein the unauthorized behavior characteristics represent that the target user requests to access or operate unauthorized data.

[0095] Optionally, the second determination unit 303 includes: a first detection subunit, used to detect the target function module identifier corresponding to the data request, wherein the target function module identifier is a unique identifier of the target function module that the target user expects to execute through the data request; a second detection subunit, used to detect whether the data request has horizontal unauthorized behavior characteristics based on the permission group and the target function module identifier corresponding to the target user, wherein the horizontal unauthorized behavior characteristics characterize that the target user requests to access or operate the data of a first type of user, the first type of user belongs to a user with the same permission level as the target user, and there is data isolation between the first type of user and the target user; a first processing subunit, used to prohibit the data request from being passed when it is detected that the data request has horizontal unauthorized behavior characteristics.

[0096] Optionally, the second detection sub-unit includes: a first detection module, used to detect whether the target function module identifier is included in the permission group corresponding to the target user; a first determination module, used to determine that the data request has horizontal unauthorized behavior characteristics when it is detected that the target function module identifier is not included in the permission group corresponding to the target user; and a second determination module, used to determine that the data request does not have horizontal unauthorized behavior characteristics when it is detected that the target function module identifier is included in the permission group corresponding to the target user.

[0097] Optionally, the second determination unit 303 includes: a second processing subunit, used to receive an encrypted string sent by the client through the server, wherein the encrypted string is a string obtained by encrypting the first string through a preset encryption protocol, and the first string includes a session identifier, a timestamp and a request parameter used when the client sends a data request, and the request parameter is used to describe the request content of the data request; a third processing subunit, used to encrypt the second string into a target string through the server according to a preset encryption protocol, wherein the second string includes a target session identifier, a timestamp used when the client sends the data request, and the request parameter; a third detection subunit, used to detect whether the data request has a vertical unauthorized behavior feature based on the encrypted string and the target string, wherein the vertical unauthorized behavior feature indicates that the target user requests to access or operate the data of the second type of user, and the data processing authority of the second type of user is higher than the data processing authority of the target user; a fourth processing subunit, used to prohibit the data request from being passed when it is detected that the data request has a vertical unauthorized behavior feature.

[0098] Optionally, the third detection subunit includes: a second detection module, used to detect whether the encrypted string and the target string are the same; a third determination module, used to determine that the data request does not have vertical unauthorized behavior characteristics when it is detected that the encrypted string and the target string are the same; a fourth determination module, used to determine that the data request has vertical unauthorized behavior characteristics when it is detected that the encrypted string and the target string are not the same.

[0099] Optionally, the second determination unit 303 includes: a fourth detection subunit, a fifth detection subunit, a first determination subunit, and a second determination subunit. The fourth detection subunit is used to detect whether the data request has horizontal over-authorization behavior characteristics according to the permission group corresponding to the target user and the target function module identifier corresponding to the data request; the fifth detection subunit is used to detect whether the data request has vertical over-authorization behavior characteristics according to the target session identifier of the target user, the session identifier used when the client sends the data request, the timestamp, and the request parameters; the first determination subunit is used to determine that the data request has over-authorization behavior characteristics and prohibit the data request from being passed if the data request has horizontal over-authorization behavior characteristics and / or vertical over-authorization behavior characteristics; the second determination subunit is used to determine that the data request does not have over-authorization behavior characteristics and allow the data request to be passed if the data request does not have horizontal over-authorization behavior characteristics and vertical over-authorization behavior characteristics.

[0100] Optionally, the acquisition unit 301 includes: a reading subunit, which is used to read session information corresponding to the target user from the client according to the name of the target user and the network address of the client through the server after receiving the data request submitted by the target user through the client, wherein the session information is the login information stored by the target user negotiated by the server and the client when the target user previously logged into the target system; and a parsing subunit, which is used to parse the session information through the server to obtain the target user identifier and the target session identifier.

[0101] An embodiment of the present application may provide an electronic device, Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 Only one is shown) a processor, a memory, a storage controller, and a peripheral interface, wherein the peripheral interface is connected to a radio frequency module, an audio module, and a display.

[0102] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the processing method of the above-mentioned data request. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0103] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: after receiving the data request submitted by the target user through the client, obtain the target user identifier and target session identifier of the target user through the server, wherein the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by the server and the client before negotiation; determine the permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record the identifier of the functional module for which the target user has data processing authority; detect whether the data request has unauthorized behavior characteristics according to the permission group corresponding to the target user and / or the target session identifier of the target user, and determine the processing operation of the data request according to the detection result, wherein the unauthorized behavior characteristics represent that the target user requests to access or operate unauthorized data.

[0104] According to another aspect of the present application, a computer program product is provided, wherein the computer program product includes computer instructions, wherein when the computer instructions are executed, the device where the computer program product is located executes the above-mentioned method for processing data requests.

[0105] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes the above-mentioned method for processing data requests.

[0106] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0107] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0108] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0109] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0110] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0111] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing a data request, characterized in that: include: After receiving the data request submitted by the target user through the client, the target user identifier and the target session identifier of the target user are obtained through the server, wherein the target session identifier is used to represent the unique identifier of the target user when logging into the target system, and the target session identifier is retained in the session information generated by the negotiation between the server and the client before; Determining a permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record identifiers of functional modules for which the target user has data processing authority; According to the permission group corresponding to the target user and / or the target session identifier of the target user, detect whether the data request has unauthorized behavior characteristics, and determine the processing operation of the data request according to the detection result, wherein the unauthorized behavior characteristics indicate that the target user requests to access or operate unauthorized data.

2. The method for processing a data request according to claim 1, characterized in that: According to the permission group corresponding to the target user, detecting whether the data request has unauthorized behavior characteristics, and determining a processing operation for the data request according to the detection result, including: Detecting a target function module identifier corresponding to the data request, wherein the target function module identifier is a unique identifier of a target function module that the target user expects to execute through the data request; According to the permission group corresponding to the target user and the target functional module identifier, detecting whether the data request has a horizontal unauthorized behavior feature, wherein the horizontal unauthorized behavior feature indicates that the target user requests to access or operate the data of a first category of users, the first category of users are users with the same permission level as the target user, and there is data isolation between the first category of users and the target user; When it is detected that the data request has the horizontal unauthorized behavior characteristics, the data request is prohibited from being passed.

3. The method for processing data request according to claim 2, characterized in that: According to the permission group corresponding to the target user and the target functional module identifier, detecting whether the data request has horizontal unauthorized behavior characteristics includes: Detecting whether the target function module identifier is included in the permission group corresponding to the target user; When it is detected that the target function module identifier is not included in the permission group corresponding to the target user, determining that the data request has the horizontal unauthorized behavior feature; When it is detected that the target function module identifier is included in the permission group corresponding to the target user, it is determined that the data request does not have the horizontal unauthorized behavior feature.

4. The method for processing a data request according to claim 1, characterized in that: According to the target session identifier of the target user, detecting whether the data request has unauthorized behavior characteristics, and determining a processing operation for the data request according to the detection result, including: Receiving, by the server, an encrypted string sent by the client, wherein the encrypted string is a string obtained by encrypting a first string by a preset encryption protocol, the first string including a session identifier, a timestamp, and a request parameter used by the client when sending the data request, the request parameter being used to describe the request content of the data request; Encrypting the second character string into a target character string by the server according to the preset encryption protocol, wherein the second character string includes the target session identifier, the timestamp used when the client sends the data request, and the request parameter; According to the encrypted string and the target string, detecting whether the data request has a vertical unauthorized behavior feature, wherein the vertical unauthorized behavior feature indicates that the target user requests to access or operate the data of the second type of user, and the data processing authority of the second type of user is higher than the data processing authority of the target user; When it is detected that the data request has the vertical unauthorized behavior characteristics, the data request is prohibited from being passed.

5. The method for processing data request according to claim 4, characterized in that: Detecting whether the data request has vertical unauthorized behavior characteristics according to the encrypted character string and the target character string includes: Detecting whether the encrypted string and the target string are identical; When it is detected that the encrypted character string is identical to the target character string, determining that the data request does not have the vertical unauthorized behavior feature; When it is detected that the encrypted character string is different from the target character string, it is determined that the data request has the vertical unauthorized behavior feature.

6. The method for processing data request according to claim 1, characterized in that: According to the permission group corresponding to the target user and the target session identifier of the target user, detecting whether the data request has unauthorized behavior characteristics, and determining a processing operation for the data request according to the detection result, including: According to the permission group corresponding to the target user and the target function module identifier corresponding to the data request, detecting whether the data request has horizontal unauthorized behavior characteristics; Detecting whether the data request has vertical unauthorized behavior characteristics according to the target session identifier of the target user, the session identifier used by the client when sending the data request, the timestamp, and the request parameters; In the case that the data request has the horizontal unauthorized behavior characteristics and / or the vertical unauthorized behavior characteristics, determining that the data request has the unauthorized behavior characteristics, and prohibiting the data request from being approved; In the case that the data request does not have the horizontal unauthorized behavior characteristics and the vertical unauthorized behavior characteristics, it is determined that the data request does not have the unauthorized behavior characteristics and the data request is allowed to pass.

7. The method for processing a data request according to claim 1, characterized in that: After receiving the data request submitted by the target user through the client, obtaining the target user identifier and the target session identifier of the target user through the server includes: After receiving the data request submitted by the target user through the client, the server reads the session information corresponding to the target user from the client according to the name of the target user and the network address of the client, wherein the session information is the login information stored by the target user negotiated by the server and the client when the target user previously logged into the target system; The target user identifier and the target session identifier are obtained by parsing the session information through the server.

8. A data request processing device, characterized in that: include: an acquisition unit, configured to acquire a target user identifier and a target session identifier of the target user through a server after receiving a data request submitted by the target user through a client, wherein the target session identifier is used to represent a unique identifier of the target user when logging into a target system, and the target session identifier is retained in the session information generated by negotiation between the server and the client before; A first determining unit, configured to determine a permission group corresponding to the target user according to the target user identifier, wherein the permission group is used to record identifiers of function modules for which the target user has data processing authority; The second determination unit is used to detect whether the data request has unauthorized behavior characteristics according to the permission group corresponding to the target user and / or the target session identifier of the target user, and determine the processing operation of the data request according to the detection result, wherein the unauthorized behavior characteristics indicate that the target user requests to access or operate unauthorized data.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the data request processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein the program, when running, executes the method for processing data requests as described in any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method for processing a data request described in any one of claims 1 to 7 are implemented.

Images