Data serialization method, data deserialization method, data deserialization system and related products

Abstract

The embodiment of the invention discloses a data serialization method, a data deserialization method, a data deserialization system and a related product, aiming at the particularity that the data type of each component element in a dynamic entity is dynamically variable, each component element is disassembled into a plurality of temporary number sets, so that the dynamic entity can also be serialized, such as JSON serialization; therefore, the same type of component elements can be output into a group of JSON character strings in a segmented manner, and each component element of the original type can be quickly recovered in a targeted manner based on the corresponding type description information during deserialization. According to the method and the device, the deserialization of the additional data except the data packet is refused, so that even if the additional data is maliciously injected, which data is initially transmitted can be known according to the indication of the first character string, an object for deserialization is prompted to be transparent and controllable, successful deserialization is ensured, and the consistency and the security of the data are ensured.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data processing technology, and in particular to a data serialization method, a data deserialization method, a system, and related products. Background Art

[0002] Serialization and deserialization are bridges for data transmission between different systems, different storage media or different transmission media. Serialization technology mainly serializes objects into byte streams (or data), and then saves this byte stream to a storage device or transmits it to an external system; while deserialization technology is the process of restoring the previously serialized data to the original object, that is, restoring the data to its original data type (or data structure) or original state, so that the data can be reused when needed. In short, the two processes of serialization and deserialization ensure the integrity and consistency of data.

[0003] When metadata and related objects need to be transmitted between clients and servers, or between heterogeneous systems, the current method used is mainly binary stream serialization and deserialization.

[0004] Although the traditional binary stream method of serialization and deserialization has advantages such as high storage efficiency and fast reading and writing speed, it also has serious disadvantages: dynamic entities (which can be regarded as data packets) can be dynamically created and modified at each run, that is, their data structure is a special structure that is dynamically variable. Therefore, facing the special data of dynamic entities, this traditional method is difficult to support the serialization and deserialization of dynamic entities; at the same time, precisely because of the particularity of dynamic entities, this deserialization process is prone to malicious injection attacks, resulting in incorrect data types obtained by deserialization, and unable to ensure data consistency and security. Summary of the invention

[0005] The embodiments of the present application provide a data serialization method, a data deserialization method, a system and related products, which support serialization and deserialization of dynamic entities and can block malicious injection attacks during deserialization to ensure information security.

[0006] A first aspect of an embodiment of the present application provides a data serialization method, which is applied to a serialization system, including:

[0007] For a dynamic entity to be serialized, serialize type description information of each component element in the dynamic entity to obtain a first character string; the type description information is used to describe the type to which the component element as specific data belongs;

[0008] Divide each of the constituent elements into a plurality of temporary number sets for serialization, so as to obtain a second string outputted corresponding to each of the temporary number sets; wherein the constituent elements gathered in each of the temporary number sets have a common type, and the data exchange format of the first string and the second string includes a JSON format;

[0009] The first character string and each of the second character strings are integrated into a data packet and sent to a deserialization system, so that the deserialization system restores each of the component elements arranged according to the original type according to the first character string to obtain the created dynamic entity; the deserialization system refuses to deserialize additional data except the data packet.

[0010] A second aspect of an embodiment of the present application provides a data deserialization method, which is applied to a deserialization system, including:

[0011] Receive data packets sent by the serialization system;

[0012] Deserialize the first string in the data packet to obtain type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information;

[0013] Based on each of the type description information, each of the second strings in the data packet is deserialized respectively to restore each of the component elements from each of the second strings; the data exchange format of the first string and the second string includes the JSON format;

[0014] Filling each of the restored component elements as specific data into a corresponding position in the component structure according to the position indicated by each of the type description information, so as to construct the dynamic entity;

[0015] The deserialization system refuses to deserialize additional data other than the data packet.

[0016] When the method described in the second aspect of the present application is implemented, the content described in the first aspect of the present application can be adopted to achieve it.

[0017] A third aspect of the embodiments of the present application provides a serialization system, including: a serialization unit and a sending unit;

[0018] The serialization unit is used to, for a dynamic entity to be serialized, serialize type description information of each component element in the dynamic entity to obtain a first character string; the type description information is used to describe the type to which the component element as specific data belongs;

[0019] The serialization unit is further used to divide each of the constituent elements into a plurality of temporary number sets for serialization, so as to obtain a second string outputted corresponding to each of the temporary number sets; wherein the constituent elements gathered in each of the temporary number sets have a common type, and the data exchange format of the first string and the second string includes a JSON format;

[0020] The sending unit is used to integrate the first character string and each of the second character strings into a data packet and send it to a deserialization system, so that the deserialization system can restore each of the component elements arranged according to the original type according to the first character string to obtain the created dynamic entity; the deserialization system refuses to deserialize additional data except the data packet.

[0021] A fourth aspect of the embodiments of the present application provides a deserialization system, including: a deserialization unit and a receiving unit;

[0022] The receiving unit is used to receive a data packet sent by the serialization system;

[0023] The deserialization unit is used to deserialize the first string in the data packet to obtain type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information;

[0024] The deserialization unit is further used to, based on each of the type description information, respectively deserialize each of the second strings in the data packet to restore each of the component elements from each of the second strings; the data exchange format of the first string and the second string includes the JSON format;

[0025] The deserialization unit is further used to fill the restored component elements as specific data into corresponding positions in the component architecture according to the positions indicated by the type description information, so as to construct the dynamic entity;

[0026] The deserialization unit refuses to deserialize additional data except the data packet.

[0027] A fifth aspect of an embodiment of the present application provides an electronic device, including: a processor and a memory;

[0028] The processor is configured to communicate with the memory and execute instructions in the memory to implement the method described in the first aspect of the embodiment of the present application or any specific implementation of the first aspect.

[0029] A sixth aspect of an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by a processor, they implement the method described in the first aspect of the embodiment of the present application or any specific implementation of the first aspect.

[0030] A seventh aspect of an embodiment of the present application provides a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, they implement the method described in the first aspect of the embodiment of the present application or any specific implementation of the first aspect.

[0031] It can be seen from the above technical solutions that the embodiments of the present application have at least the following advantages:

[0032] In view of the particularity that the data types of each component element in a dynamic entity are dynamically changeable, the embodiment of the present application disassembles each of the component elements into multiple temporary data sets, so that the dynamic entity can also be serialized such as JSON serialization, and then the component elements of the same type can be segmented and output into a group of JSON strings, and at the same time, when deserializing, the component elements of the original type can be quickly and targetedly restored based on the corresponding type description information. In addition, refusing to deserialize additional data other than the data packet can ensure that even if additional data is maliciously injected, it can be known which data is originally transmitted according to the indication of the first string, because the type description information of the additional data is not initially recorded in the first string, that is, the object to be deserialized is made transparent and controllable, ensuring successful deserialization and guaranteeing data consistency and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0034] It should be noted that, although the steps in the process diagrams (if any) involved in the embodiments are drawn in sequence as indicated by the arrows, unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0035] Figure 1 A schematic diagram of the system architecture of the data serialization method and deserialization method of the embodiment of the present application;

[0036] Figure 2 A schematic diagram of a flow chart of a data serialization method according to an embodiment of the present application;

[0037] Figure 3 A classic data structure of a dynamic entity of the data serialization method of the embodiment of the present application;

[0038] Figure 4 This is a dynamic entity JSON serialization flow chart of the data serialization method of the embodiment of the present application;

[0039] Figure 5 A schematic diagram of a flow chart of a data deserialization method according to an embodiment of the present application;

[0040] Figure 6 This is a dynamic entity JSON deserialization flow chart of the data deserialization method of the embodiment of the present application;

[0041] Figure 7 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0043] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] In the following description, similar expressions such as "a specific implementation" or "a specific example" are involved, which describe a subset of all possible embodiments, but it can be understood that "a specific implementation" or "a specific example" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. In the following description, the term multiple refers to at least two. In some specific examples, the numerical value mentioned in this application reaches the threshold value (if any), which may include the case where the former is greater than the latter of the threshold value; if similar expressions such as "any" or "at least one" are mentioned, it can specifically refer to any one of the listed examples or any combination of these examples.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0046] In order to better implement the method of this application, the following is now provided: Figure 1 The system architecture diagram shown. The system may include at least one terminal device 101 and a server 102. The systems used by the terminal device 101 and the server 102 may be heterogeneous systems. Of course, the terminal device 101 may also be regarded as another server independent of the server 102. Different types of applications may be installed on the terminal device 101. For example, instant messaging applications, live broadcast applications, conference communication applications, etc. may be installed on the terminal device 101. The terminal device 101 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart car, etc. The server 102 may be used to store application data generated by different types of applications of the terminal device 101. The server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and basic cloud computing services such as big data and artificial intelligence platforms, etc.

[0047] The above method can be executed by the terminal device 101 or the server 102, or by both parties. The specific method can be determined according to the actual application scenario and is not limited here. Exemplarily, the system used by the terminal device 101 can be called a serialization system, and the system used by the server 102 can be called a deserialization system. The terminal device 101 can send a serialized data packet to the server 102, and the data packet includes a first string and each second string; then, the deserialization system of the server 102 can deserialize the first string and each second string to create the dynamic entity stored in the terminal device 101 as it is.

[0048] The method of the present application will be further described in detail below, and some specific possible implementation examples will be provided. In actual applications, the implementation contents between these examples can be combined or implemented separately as needed according to the corresponding functional principles and application logic. If implemented in combination, the execution order between the combined examples can be determined according to their respective processing logics, which may be determined by the actual scenario.

[0049] See also Figure 2 In a first aspect, the present application provides a specific embodiment of a data serialization method, which is applied to a serialization system. The embodiment includes the following steps:

[0050] Step S21: For a dynamic entity to be serialized, serialize the type description information of each component element in the dynamic entity to obtain a first character string;

[0051] The above type description information is used to describe the type to which the constituent elements of specific data belong. This type (or structure) may refer to at least one of the following attributes: the storage location of the constituent elements, the data structure (such as an array or list), the data type (such as a string type, an integer type or a numeric type), and the organizational form between constituent elements (such as the collocation form or context between constituent elements). The definition of these attributes makes the data itself more orderly and easier to understand during storage and transmission. Therefore, the above type description information can be called metadata in terms of the smallest unit. Metadata, also known as intermediary data or relay data, refers to data used to describe data. It is mainly used to support functions such as data storage location, historical data, resource search, and file records. Metadata describes the context, definition, and structure of the data. It is a custom structured complex that describes a set of rules for describing interface layout, business rules, and data storage. It can help users and managers understand the background and meaning of the data.

[0052] The type description information of each component element in a dynamic entity can be combined and considered as a dynamic entity type: a type definition that describes how to construct a dynamic entity. The dynamic entity type is constructed based on metadata. A dynamic entity can be understood as: a data packet with a dictionary structure that is formed by orderly assembling key-value data according to the data defined by the dynamic entity type. A dynamic entity is an instantiation of a dynamic entity type and stores specific data. Therefore, a dynamic entity may be referred to as a data packet below. In short, there is a close connection between metadata, dynamic entity types, and dynamic entities. Metadata describes the structure and properties of a dynamic entity type, the dynamic entity type defines the behavior and rules of a dynamic entity, and the dynamic entity is a specific instance or collection of these rules and properties.

[0053] Step S22, dividing each component element into a plurality of temporary number sets for serialization, so as to obtain a second character string outputted corresponding to each temporary number set;

[0054] Among them, the data exchange format of the first character string and the second character string includes the JSON format, so this method can be called a method that supports JSON serialization of dynamic entities. Of course, this data exchange format can also be other formats such as XML format, which can be determined by needs, and this application is not limited; for the convenience of explanation and understanding, the embodiments of this application are mainly exemplified in JSON format. There is a common type between the constituent elements gathered in each temporary number set. In other words, the corresponding types between the constituent elements gathered in each temporary number set are the same, that is, there is a commonality, and each second character string can be divided according to the common type between the constituent elements contained.

[0055] Step S23: Integrate the first character string and each second character string into a data packet and send it to the deserialization system, so that the deserialization system restores each component element arranged according to the original type according to the first character string to obtain the created dynamic entity;

[0056] As described above, the first character string of the embodiment of the present application can be used to fully describe the construction details of the dynamic entity to help the deserialization system recover the data itself and its data structure, that is, to restore the specific data arranged according to the original type, thereby reconstructing the dynamic entity as it is and ensuring the consistency of data transmission.

[0057] In summary, in the face of the particularity that the data types of each component element in a dynamic entity are dynamically changeable, the embodiment of the present application disassembles each component element into multiple temporary data sets, so that the dynamic entity can also be serialized such as JSON serialization, and then the components of the same type can be segmented and output into a group of JSON strings. At the same time, when deserializing, the components of the original type can be quickly and targeted based on the corresponding type description information. In addition, refusing to deserialize additional data other than data packets can block the deserialization injection vulnerability, ensuring that even if additional data is maliciously injected, it is possible to know which data is originally transmitted according to the instructions of the first string, because the type description information of the additional data is not initially recorded in the first string, that is, the object to be deserialized is transparent and controllable, ensuring successful deserialization and ensuring data consistency and security.

[0058] Based on the above examples, some specific possible implementation examples of the above data serialization method will be provided below. Figure 2 The examples shown illustrate that the following additional or detailed example contents or possible implementations do not necessarily have to be executed during the specific implementation. If more than two examples or possible implementations are added or refined, these examples or possible implementations may be implemented in combination or separately. If implemented in combination, the execution order of the combined examples may be determined according to their respective processing logic, which may depend on the actual scenario.

[0059] based on Figure 2 In some specific examples, the above types include at least one of dirty data, data snapshots, macros, basic data types, complex data types, and collection types; wherein, constituent elements belonging to complex data types are at least composed of constituent elements belonging to basic data types; constituent elements belonging to collection types are at least composed of constituent elements belonging to basic data types and / or complex data types.

[0060] Exemplarily, the above-mentioned basic data types include at least one of string type, numeric type, Boolean type, date type, etc. The constituent elements of the basic data types can be regarded as specific data of the smallest unit that cannot be further divided, such as a numeric value, a string of text, etc., and in the embodiment of the present application, the storage space of simple attributes can be used to store the constituent elements of the basic data types. Further, the above-mentioned complex data types may include at least one of arrays, lists, sets, dictionaries, dynamic entities, etc. Similarly, the storage space of complex attributes can be used to store the constituent elements of complex data types, and the constituent elements of complex data types can be composed of constituent elements of multiple basic data types. Similarly, the storage space of collection attributes can be used to store aggregates such as one or more dynamic entities.

[0061] In other words, the structure of a simple attribute is very simple, that is, a key-value pair; a complex attribute is a complex object, which can be a dynamic entity object composed of one or more simple types, complex types, or dynamic entities, that is, a complex attribute can be called a dynamic entity. A collection attribute can be composed of one or more dynamic entities, a complex attribute of a dynamic entity can be a dynamic entity, and a collection attribute of a dynamic entity can also be a dynamic entity, that is, dynamic entities and complex attributes can be nested to form each other. It can be seen that a dynamic entity is essentially a super dictionary that supports multi-layer nesting and can be split in a fine-grained manner.

[0062] The above-mentioned simple attributes, complex attributes, and collection attributes mainly emphasize the specific data stored itself. Therefore, compared with the above-mentioned dynamic entity types, simple attributes, complex attributes, and collection attributes can be called data itself. The dynamic entity type is the information that describes the type of these data itself (that is, the data used to describe the data). In short, the above-mentioned simple attributes, complex attributes, and collection attributes can be nested in levels. Complex attributes and collection attributes are larger units that can be further subdivided. Therefore, complex attributes can also be called a dynamic entity, and simple attributes are the smallest unit that is no longer subdivided. For example, a classic data structure of a dynamic entity can be as follows Figure 3 The multi-level nested structure shown, that is, a large dynamic entity A can contain at least one component element selected from simple attributes, complex attributes (which can be regarded as small dynamic entities), collection attributes, dynamic entity types, data status managers, etc.; this data status manager can be used to manage or define the type information of all components within the dynamic entity A, or can be understood as being used to summarize or describe the dynamic entity type of the dynamic entity A.

[0063] Therefore, it can be considered that the above-mentioned constituent elements may specifically include at least one type of specific data among: dirty data, data snapshot, simple attributes, complex attributes, collection attributes, other attributes (such as macro-type data), etc.

[0064] It should be noted that data taken from the database but modified by the local system can be called dirty data; a data snapshot refers to a static copy or replica of the data at a certain moment, which captures and retains the data state at a specific point in time; data belonging to the macro type can be used as an independent command to automate daily tasks, improve work efficiency and ease of operation.

[0065] As explained above, see Figure 4The dynamic entity JSON serialization process shown in the figure can be implemented by using at least one type of custom Json converter for the JSON serialization of a dynamic entity. Specifically, all elements required for deserialization (such as various components and their dynamic entity types) can be output in batches into multiple JSON strings in a self-disassembling manner, and finally packaged and integrated into a JSON object (i.e., a JSON data packet).

[0066] The JSON string generated after JSON serialization using this solution can contain both the data itself, such as the specific ID number "1, 2052, 8", the field value "RMB", etc., and the data used to describe these data structures (i.e., dynamic entity types), such as: $$DynamicObjectType, $$DirtyFlags, $$Snapshots, and $$FromDatabase type description information. These type description information (with prefix symbols $$) describe in sequence: the types of all elements within the dynamic entity (which can be collectively referred to as the dynamic entity type), a component element that belongs to dirty data, a component element that belongs to a data snapshot, and a component element that comes from the database (including clean data that is not modified). These type description information is the core data used to reconstruct the data structure and data state of the dynamic entity during deserialization. The above $$DynamicObjectType attribute can be called a dynamic entity type, which fully describes how a dynamic entity object is constructed, including at least one construction detail of the basic data type, field definition, feature definition, runtime information, and database storage information of the dynamic entity.

[0067] During the serialization process of a dynamic entity, the serialization order of its dynamic entity type and its various constituent elements can be executed in any order or simultaneously, that is, the output order between the first string and each second string can be unlimited, which can be determined by the computing power and time cost, etc., and is not limited in the embodiments of the present application.

[0068] based on Figure 2 In some specific examples, after step S22, the data serialization method of the embodiment of the present application may further include (marking anonymous types): for component elements belonging to anonymous types, identifying the real type of the component elements; and adding descriptive information about the real type to the second string of the output corresponding to the component elements.

[0069] In some cases, some data needs to be hidden during transmission to ensure data security, so attributes can be used to mark types that need to be specially processed during JSON serialization and deserialization. For example, for anonymous type components, although anonymous types do not have explicit names (can be regarded as having no clear type), they still have type information, so implicit type declaration attributes (JsonWithInstClassName) information can be added to the corresponding output second string, such as description information about the real type of the component element, to assist the deserialization system to reliably restore the component element to its original type, effectively solving the deserialization problem of implicit types (or anonymous types). In other words, during the serialization process, the attribute __InstClassType__ can be dynamically injected as a marker to mark a component element as an anonymous type, and the description information of its real type can be output as an attribute value to the serialized JSON string, so that the component element can be reconstructed through this attribute value during deserialization. In general, anonymous types can be classified as complex types or special types (special types are also called other types).

[0070] based on Figure 2 In some specific examples, the method of the embodiment of the present application may also include: identifying the types to which the constituent elements and type description information respectively belong; selecting a converter that matches the type from the encapsulated converters to serialize and deserialize the constituent elements and type description information.

[0071] Specifically, for different types of component elements and type description information, converters that match the type can be used for serialization and deserialization. Because the types of internal component elements of dynamic entities are uncertain and diverse, and data conversion also has personalized needs, a large number of converters can be encapsulated to match the serialization and deserialization of various types of elements, so as to improve the processing efficiency and effect of various types of data in a targeted manner. The following briefly introduces the core converters and their uses. These converters can be initialized before serialization and deserialization.

[0072] DynamicObjectConverter: A dynamic entity converter that supports lightweight JSON serialization of dynamic entities. This lightweight feature means that this type of converter can be applied to entities that only carry the specific data itself and do not carry the description information of the type to which it belongs.

[0073] DynamicObjectV9Converter: Dynamic entity converter that supports JSON serialization and deserialization of dynamic entities.

[0074] DynamicObjectCollectionConverter: Dynamic entity collection converter, supporting lightweight JSON serialization of dynamic entity collections.

[0075] DynamicObjectCollectionV9Converter: Dynamic entity collection converter, supports JSON serialization and deserialization of dynamic entity collections.

[0076] DynamicObjectViewConverter: Dynamic view converter that supports JSON serialization and deserialization of dynamic views.

[0077] SelfDeserializeConverter: A self-deserialization converter that supports special types to implement customized JSON deserialization; this self-deserialization converter can add a self-deserialization feature (JsonSelfDeserialize) to effectively solve the deserialization failure problem caused by object self-reference. This self-deserialization converter can be implemented by rewriting the JsonConverter interface, so that during the JSON serialization and deserialization process, some customized special types can be intercepted and personalized.

[0078] InstWithClassNameConverter: Anonymous type deserialization converter that supports JSON deserialization of anonymous types.

[0079] JsonWithInstClassNameConverter: Anonymous type serialization converter that supports JSON serialization of anonymous types.

[0080] JSONArrayConverter: JSON array converter, supports serialization and deserialization of JSON arrays.

[0081] JSONObjectConverter: JSON object converter, supports serialization and deserialization of JSON objects.

[0082] DecimalJsonConverter: A numeric converter that supports JSON serialization and deserialization of numeric data.

[0083] IsoDateTimeConverter: Date converter that supports JSON serialization and deserialization of date data.

[0084] CultureInfoConverter: Regional converter that supports JSON serialization and deserialization of regional information.

[0085] The serialization process of the embodiment of the present application can also be achieved by rewriting the GetObjectData method under the serialization interface System.Runtime.Serialization.ISerializable provided by the .NET Framework framework. This method is mainly suitable for dynamic entities with little nesting or no self-reference, and the details are not repeated here.

[0086] based on Figure 2 In some specific examples, the data can be compressed to avoid wasting storage resources and reducing transmission efficiency. Specifically, each component element itself can be set not to carry its corresponding type description information, so that the deserialization efficiency is also significantly improved.

[0087] For example, the JSON object (i.e., data packet) packaged during serialization only stores one copy of the type description information as a copy, which is the complete body of the dynamic entity type, that is, it fully describes the types of all elements in the dynamic entity. Therefore, the sub-data packets in the collection attributes (such as document body, sub-document body, sub-document header, etc.) and specific data such as complex attributes only carry the data itself, and no longer carry its type information, so as to significantly compress the size of the data packet. Of course, without considering storage space and transmission costs, or pursuing data security backup, you can also store an additional copy of the type description information as a backup and pass it to the deserialization system. The specific needs can be determined by yourself and are not limited here.

[0088] In summary, compared with the binary stream serialization method, the JSON serialization of the embodiment of the present application has better readability, supports cross-platform, is more suitable for persistent storage, helps to block deserialization injection vulnerabilities, and enhances information security. At the same time, the use of multiple types of converters and data compression processing can significantly improve the efficiency of serialization and deserialization.

[0089] See also Figure 5 In a first aspect, the present application provides a specific embodiment of a data deserialization method, which is applied to a deserialization system. The embodiment includes the following steps:

[0090] Step S51, receiving a data packet sent by a serialization system;

[0091] As described in the first aspect above, the first string in this data packet is used to fully describe the type description information of all the components in the dynamic entity, that is, to fully describe the details of how the dynamic entity is constructed, such as revealing the organizational form between the components, which can be used to locate and extract the required components from the second string. Each second string records the various components of the specific data itself (which can be regarded as specific data values).

[0092] Step S52: Deserialize the first character string in the data packet to obtain type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information;

[0093] The deserialization operation is the reverse process of the serialization operation. First, the first string can be extracted from the data packet (or JSON object) for deserialization to obtain the type description information corresponding to each component element (which can be collectively referred to as the dynamic entity type information), and these type description information are used to create the component structure of the dynamic entity. This process can be called using the first string to rebuild or restore the dynamic entity type, and the dynamic entity at this time can be simply regarded as an empty shell without adding specific data. In other words, the component structure is used to indicate the type (including the organization method between the components) or arrangement structure corresponding to each component element of the dynamic entity.

[0094] In some instances, the first string may be a JSON string, and the characters in the JSON string may be prefixed with symbols such as $$. For details, please refer to the description of the first aspect above, which will not be repeated here.

[0095] Step S53: Deserialize each second character string in the data packet based on each type of description information, so as to restore each component element from each second character string;

[0096] The data exchange format of the first string and the second string may include the JSON format, so this method can be called a method for supporting JSON deserialization of dynamic entities. Of course, it can also be other data exchange formats such as XML, which can be determined by needs.

[0097] Since the type description information can reveal the position of the required constituent elements in the second string (which can be called the organization method), each second string can be deserialized separately based on the instructions of each type description information, and then the required constituent elements can be located and extracted from the second string. This process can be regarded as deserializing and restoring the internal elements of the dynamic entity one by one.

[0098] Step S54, according to the position indicated by each type of description information, fill the restored component elements as specific data into the corresponding position in the component architecture to construct a dynamic entity; wherein the deserialization system refuses to deserialize additional data except the data packet.

[0099] After deserialization (Deserialize) recovers each component element, each component element can be inserted into the corresponding position in the composition architecture, so as to self-assemble and construct a dynamic entity containing specific data. In this way, the dynamic entity type is used to reconstruct the dynamic entity data, making the deserialization of complex and changeable dynamic data packets feasible. In addition, the deserialization system of the embodiment of the present application refuses to deserialize additional data other than the data packet, which is equivalent to deserializing only the data packet content sent by the serialization system, so that the deserialization injection vulnerability can be blocked and information security can be guaranteed.

[0100] based on Figure 5 In some specific examples, the specific operation of step S53 may include: if the type description information includes marked type description information, using the reflection mechanism and the real type indicated by the marked type description information to restore the component elements arranged according to the real type; wherein the real type is hidden as an anonymous type during serialization.

[0101] like Figure 6 As shown, the first string defines the construction process of the internal components of the dynamic entity. After the dynamic entity type is restored through deserialization, each second string can be traversed to deserialize and restore the internal elements of the dynamic entity one by one, thereby creating a dynamic entity containing specific data. However, if there are components of anonymous types, the real type of this component and the reflection mechanism (such as the value of the reflection injection attribute InstClassType) can be used to restore the components arranged according to the real type to ensure that this component is restored to its original state and ensure data consistency. The use of reflection technology can also solve the serialization and deserialization problems of private types (such as anonymous types) in types.

[0102] The above-mentioned constituent elements may specifically include: at least one type of specific data among dirty data, data snapshots, simple attributes, complex attributes, collection attributes, other attributes (such as macro-type data), etc. For details, please refer to the description of the first aspect above, which will not be repeated here.

[0103] In the embodiment of the present application, the operations performed by the data deserialization method are similar to the operations described in the aforementioned first aspect (i.e., data serialization method) or any specific method embodiment of the first aspect, and will not be described in detail here. Of course, the specific implementation process of each operation in the first aspect of the present application can also refer to the relevant description of the second aspect.

[0104] In summary, the data serialization method and data deserialization method of the present application redefine the serialization and deserialization process through self-disassembly and self-assembly operations between objects and JSON data, so that the present application complies with national information security requirements and laws and regulations, and blocks deserialization injection vulnerabilities. The data serialization method and data deserialization method of the present application can be applied to complex dynamic entities as well as simple static entities.

[0105] A third aspect of the present application provides a specific embodiment of a serialization system, the system comprising: a serialization unit, a sending unit;

[0106] The serialization unit is used to, for a dynamic entity to be serialized, serialize type description information of each component element in the dynamic entity to obtain a first character string; the type description information is used to describe the type to which the component element as specific data belongs;

[0107] The serialization unit is further used to divide each component element into multiple temporary number sets for serialization, so as to obtain a second string outputted corresponding to each temporary number set; wherein the component elements gathered in each temporary number set have a common type, and the data exchange format of the first string and the second string includes a JSON format;

[0108] The sending unit is used to integrate the first character string and each second character string into a data packet and send it to the deserialization system, so that the deserialization system can restore the component elements arranged according to the original type according to the first character string to obtain the created dynamic entity; the deserialization system refuses to deserialize additional data except the data packet.

[0109] In some examples, the type includes at least one of dirty data, data snapshot, macro, basic data type, complex data type, and collection type;

[0110] Among them, the constituent elements belonging to the complex data type are at least composed of constituent elements belonging to the basic data type; the constituent elements belonging to the collection type are at least composed of constituent elements belonging to the basic data type and / or the complex data type.

[0111] Some examples of serialization units are also used for:

[0112] For a component element of an anonymous type, identify the actual type of the component element;

[0113] The descriptive information about the real type is added to the second string of the corresponding output of the component element.

[0114] Some examples of serialization units are also used for:

[0115] Identify the types to which the constituent elements and type description information belong respectively;

[0116] From the encapsulated converters, select the converter that matches its type to serialize and deserialize the constituent elements and type description information.

[0117] In some examples, each component element itself is set to not carry its corresponding type description information.

[0118] In the embodiment of the present application, the operations performed by each unit of the serialization system are similar to the operations described in the first aspect or any specific method embodiment of the first aspect, and will not be described in detail here. Of course, the specific implementation process of each operation in the first aspect of the present application can also refer to the relevant description of the third aspect.

[0119] A fourth aspect of the present application provides a specific embodiment of a deserialization system, the system comprising: a deserialization unit, a receiving unit;

[0120] The receiving unit is used to receive data packets sent by the serialization system;

[0121] The deserialization unit is used to deserialize the first string in the data packet to obtain the type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information;

[0122] The deserialization unit is further used to deserialize each second string in the data packet based on each type of description information, so as to restore each component element from each second string; the data exchange format of the first string and the second string includes JSON format;

[0123] The deserialization unit is further used to fill the restored component elements as specific data into the corresponding positions in the component architecture according to the positions indicated by the description information of each type, so as to construct a dynamic entity;

[0124] The deserialization unit refuses to deserialize additional data except the data packet.

[0125] In some examples, the deserialization unit is specifically used for:

[0126] If the type description information includes the marked type description information, the reflection mechanism and the real type indicated by the marked type description information are used to restore the component elements arranged according to the real type; wherein the real type is hidden as an anonymous type during serialization.

[0127] In the embodiment of the present application, the operations performed by each unit of the deserialization system are similar to the operations described in the aforementioned second aspect or any specific method embodiment of the second aspect, and will not be described in detail here. Of course, the specific implementation process of each operation in the second aspect of the present application can also refer to the relevant description of the fourth aspect.

[0128] See also Figure 7 The electronic device of the embodiment of the present application may include one or more processors (such as central processing units (CPU)) and a memory, in which one or more applications or data are stored.

[0129] The memory may be a volatile memory or a persistent memory. The program stored in the memory may include one or more modules, each of which may include a series of instruction operations in the electronic device. Furthermore, the processor may be configured to communicate with the memory and execute a series of instruction operations in the memory on the electronic device.

[0130] The electronic device may also include one or more power supplies, one or more wired or wireless network interfaces, one or more input and output interfaces, and / or one or more operating systems, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.

[0131] The processor can execute the operations performed by any specific method embodiment in the first aspect or the second aspect mentioned above, and the details will not be repeated here.

[0132] The present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enable the computer to execute a method as described in any specific implementation of the first aspect or the second aspect.

[0133] The present application provides a computer program product comprising instructions or a computer program. When the computer program product is run on a computer, the computer is enabled to execute the method described in any specific implementation of the first aspect or the second aspect.

[0134] It is understood that in various embodiments of the present application, the sequence number of each step does not mean the order of execution, and the execution order of each step should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The operation content added or refined in each example scheme of the above method, system or device (if any) does not necessarily have to be executed in the specific implementation. If more than two operations are added, these operations can be implemented in combination or separately, depending on the actual scenario.

[0135] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system (if any) and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0136] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system or device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0137] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0138] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0139] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product (or computer program product) is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a business server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A data serialization method, characterized in that: Applicable to serialization systems, including: For a dynamic entity to be serialized, serialize type description information of each component element in the dynamic entity to obtain a first character string; the type description information is used to describe the type to which the component element as specific data belongs; Divide each of the constituent elements into a plurality of temporary number sets for serialization, so as to obtain a second string outputted corresponding to each of the temporary number sets; wherein the constituent elements gathered in each of the temporary number sets have a common type, and the data exchange format of the first string and the second string includes a JSON format; The first character string and each of the second character strings are integrated into a data packet and sent to a deserialization system, so that the deserialization system restores each of the component elements arranged according to the original type according to the first character string to obtain the created dynamic entity; the deserialization system refuses to deserialize additional data except the data packet.

2. The data serialization method according to claim 1, characterized in that: The type includes at least one of dirty data, data snapshot, macro, basic data type, complex data type, and collection type; Among them, the constituent elements belonging to the complex data type are at least composed of the constituent elements belonging to the basic data type; the constituent elements belonging to the set type are at least composed of the constituent elements belonging to the basic data type and / or the complex data type.

3. The data serialization method according to claim 1, characterized in that: After obtaining the second character string outputted corresponding to each of the temporary number sets, the method further includes: For the component element that is of an anonymous type, identifying the real type of the component element; The description information about the real type is markedly added to the second character string outputted corresponding to the component element.

4. The data serialization method according to claim 1, characterized in that: The method further comprises: Identify the types to which the component elements and the type description information respectively belong; A converter matching the type is selected from the encapsulated converters to perform the serialization and deserialization processing on the component elements and the type description information.

5. A data deserialization method, characterized in that: Applicable to the deserialization system, including: Receive data packets sent by the serialization system; Deserialize the first string in the data packet to obtain type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information; Based on each of the type description information, each of the second strings in the data packet is deserialized respectively to restore each of the component elements from each of the second strings; the data exchange format of the first string and the second string includes the JSON format; Filling each of the restored component elements as specific data into a corresponding position in the component structure according to the position indicated by each of the type description information, so as to construct the dynamic entity; The deserialization system refuses to deserialize additional data other than the data packet.

6. The data deserialization method according to claim 5, characterized in that: The deserializing each second character string in the data packet based on each type description information includes: If the type description information includes marked type description information, the component elements arranged according to the real type are restored by using a reflection mechanism and the real type indicated by the marked type description information; wherein the real type is hidden as an anonymous type during serialization.

7. A serialization system, characterized in that: include: Serialization unit, sending unit; The serialization unit is used to, for a dynamic entity to be serialized, serialize type description information of each component element in the dynamic entity to obtain a first character string; the type description information is used to describe the type to which the component element as specific data belongs; The serialization unit is further used to divide each of the constituent elements into a plurality of temporary number sets for serialization, so as to obtain a second string outputted corresponding to each of the temporary number sets; wherein the constituent elements gathered in each of the temporary number sets have a common type, and the data exchange format of the first string and the second string includes a JSON format; The sending unit is used to integrate the first character string and each of the second character strings into a data packet and send it to a deserialization system, so that the deserialization system can restore each of the component elements arranged according to the original type according to the first character string to obtain the created dynamic entity; the deserialization system refuses to deserialize additional data except the data packet.

8. A deserialization system, characterized in that: include: Deserialization unit, receiving unit; The receiving unit is used to receive a data packet sent by the serialization system; The deserialization unit is used to deserialize the first string in the data packet to obtain type description information corresponding to each component element, and create a component structure of the dynamic entity according to each type description information; The deserialization unit is further used to, based on each of the type description information, respectively deserialize each of the second character strings in the data packet to restore each of the component elements from each of the second character strings; The data exchange format of the first character string and the second character string includes JSON format; The deserialization unit is further used to fill the restored component elements as specific data into corresponding positions in the component architecture according to the positions indicated by the type description information, so as to construct the dynamic entity; The deserialization unit refuses to deserialize additional data except the data packet.

9. An electronic device, characterized in that: include: Processor and memory; The processor is configured to communicate with the memory and execute instructions in the memory to implement the method of any one of claims 1 to 4 or 5 to 6.

10. A readable storage medium, characterized in that: The readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1 to 4 or 5 to 6 is implemented.

11. A computer program product, characterized in that The computer program product comprises computer instructions, which implement the method according to any one of claims 1 to 4 or 5 to 6 when executed by a processor.

Images