Gateway for quickly realizing secure interaction between terminal and server and interaction method thereof

Abstract

The invention discloses a gateway for quickly realizing secure interaction between a terminal and a server and an interaction method thereof, and belongs to the technical field of telecommunication networks. The request access module is used for managing all access requests and serves as request entries of all APIs; the service aggregation module is used for registering all service back ends on the gateway and unifying services through the gateway; the interception strategy module is used for providing a unified public service adding component; the data encryption module is used for performing complex encryption on request parameters and response values in an interactive interface to avoid data leakage and tampering; the dynamic routing module forwards the request to a corresponding service system according to a configuration rule; the identity authentication module is used for generating and managing tokens of different service systems and carrying out identity authentication and verification request data tampering; according to the scheme, the token generation strategies of different systems can be managed in the gateway, the security field can be configured, and whether the value of each request is tampered or not is checked. The service system is prevented from being directly exposed to the terminal.

Description

Technical Field

[0001] The present invention belongs to the technical field of telecommunication networks, and in particular relates to a gateway for quickly realizing secure interaction between a terminal and a server, and an interaction method thereof. Background Art

[0002] On the large-screen TV side, currently, traditional terminals (large screens, apps, mini-programs) interact with server interfaces, and network security protection is relatively weak, such as preventing data leakage, tampering, and unauthorized access. As the country pays more and more attention to network information security, some existing software manufacturers have begun to transform system data security, but the functions are relatively simple and the portability and reusability are not high.

[0003] Microservices are prevalent in the current mainstream technical architecture. A system is often composed of dozens or even hundreds of systems. Abstracting them into reusable and assemblable modules to achieve rapid reuse and unified management has become a demand. The gateway integrates the identity authentication module, dynamic routing forwarding module, load balancing module, current limiting module, fuse degradation module, data security module and log management module into the secure switching gateway to improve interaction efficiency.

[0004] Technical solutions of the prior art: 1) JSON Web Tokens (JWT): used to securely transmit information between two parties. JWT can verify the identity of the user without retaining the session state, reducing the storage burden on the server. 2) Use the HTTPS protocol to ensure that the data is not eavesdropped or tampered with during transmission. However, the prior art also has the following disadvantages: First, security vulnerability exploits: such as insecure redirection URIs, token leakage (especially in plain text transmission in URLs, logs or HTTP headers), XSS (cross-site scripting attacks) and CSRF (cross-site request forgery) are all potential risks. Secondly, with more and more microservices, if each microservice has to implement a set of authentication operations by itself, then such operations will be redundant. Summary of the invention

[0005] The purpose of the present invention is to address the above-mentioned problems and propose a gateway and an interaction method thereof for quickly realizing secure interaction between a terminal and a server. The present invention passes all terminal requests through the gateway system, and then the gateway system distributes them to various business systems. At the same time, to add a new business system, it is only necessary to increase the gateway configuration to quickly realize secure interaction between the terminal and the server. In the gateway, the token generation strategies of different systems are managed, the security fields are configured, and the value of each request is checked to see if it has been tampered with. Avoid direct exposure of the business system to the terminal. Complex encryption is performed on the request parameters and response values ​​in the interactive interface to avoid data leakage and tampering.

[0006] In order to solve the above technical problems, the present invention provides a gateway for quickly realizing secure interaction between a terminal and a server, comprising:

[0007] The request access module is used to manage all access requests and serves as the request entry for all API interfaces;

[0008] Business aggregation module, used to register all service backends on the gateway and expose services uniformly through the gateway;

[0009] The interception policy module is used to provide unified public service components for increasing security, routing, and flow control;

[0010] Data encryption module, used to perform complex encryption on request parameters and response values ​​in interactive interfaces to prevent data leakage and tampering;

[0011] The dynamic routing module forwards the request to the corresponding business system according to the configuration rules;

[0012] The identity authentication module is used to generate and manage tokens for different business systems, and to perform identity authentication and verify request data tampering.

[0013] Preferably, the access request module comprises:

[0014] A request receiving unit, used for receiving a request from a terminal;

[0015] A request preprocessing unit, used for preprocessing the request;

[0016] The request distribution unit forwards the request to the corresponding processing module according to the request information and configuration rules.

[0017] Preferably, the preprocessing specifically includes extracting request parameters and parsing the protocol.

[0018] Preferably, the data encryption module adopts an encryption and decryption algorithm based on the AES / CBC / PKCS5Padding principle, uses the randomly generated requestId and the agreed secret to perform MD5 encryption as the key, performs AES encryption on the request parameters, and also performs AES encryption on the response data.

[0019] Preferably, the dynamic routing module supports multiple routing configuration methods, including a basic URI routing configuration method, a code-based routing configuration method, and a routing configuration method combined with a registration center.

[0020] Preferably, the configuration rules include Predicate assertion conditions and filter rules, which are configured through code and implement the circuit breaker and degradation function.

[0021] Preferably, the identity authentication module supports generating different tokens for different business systems according to configuration rules, and performs identity authentication and data tampering verification during request processing.

[0022] A gateway interaction method for quickly realizing secure interaction between a terminal and a server comprises the following steps:

[0023] S1. The client generates requestId and encrypts request parameters;

[0024] S2. Request the login interface to obtain a token. The gateway determines whether the current request needs to generate a token based on the configuration. If necessary, it decrypts the request data and forwards it to the corresponding business system through routing.

[0025] S3. The gateway forwards the decrypted request parameters to the business system through the intranet;

[0026] S4. The business system processes the request and returns data and token;

[0027] S5. The gateway performs AES encryption on the response data according to the key, and returns the encrypted response data to the client;

[0028] S6. The client decrypts the response data and obtains the token information to enter the next interaction scenario;

[0029] S7, the client generates a new requestId and encrypted request parameters;

[0030] S8. Request the service interface to carry the token and encrypted service data;

[0031] S9, verify the validity of the token and decrypt the request data, decrypt the request data, and forward it to the corresponding business system through routing. If the token is valid, the subsequent interaction is synchronized with S4; if the token is invalid, return token expiration or token error; among them, if the token is invalid, the gateway returns the information that the token is expired;

[0032] S10, the client requests the refresh token interface, verifies whether the refresh token is legal, and if so, generates the latest valid token according to the configuration, and the gateway returns the latest valid token to the client;

[0033] S11. The client uses the latest token and repeats S7 for subsequent requests.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. The gateway of this solution is a system before the application or service, which is used to manage authorization, access control and traffic restrictions, so that the microservices will be protected by the microservice gateway and transparent to all callers. Therefore, the business system hidden behind the microservice gateway can focus more on the business itself. At the same time, the microservice gateway can also provide and accumulate more additional functions for the service.

[0036] 2. This solution has been put into use. When adding new systems or interfaces, no additional development is required. Through the unified entrance of the security gateway, data leakage, tampering and unauthorized access can be prevented and passed the acceptance of the security department.

[0037] 3. This solution serves as a unified entry point for all interactive requests, and implements identity authentication, dynamic routing forwarding module, load balancing module, traffic control, monitoring and logging functions, which increases security while facilitating management and maintenance. It enables rapid development and rapid interaction, saving labor costs.

[0038] 4. All terminal requests in this solution go through the gateway system, which then distributes them to various business systems. To add a new business system, you only need to add gateway configuration to quickly realize secure interaction between the terminal and the server.

[0039] 5. This solution can manage token generation strategies of different systems in the gateway, configure security fields, and verify whether the value of each request has been tampered with. Avoid exposing the business system directly to the terminal. Perform complex encryption on the request parameters and response values ​​in the interactive interface to avoid data leakage and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the overall system of the present invention;

[0041] Figure 2 It is a schematic diagram of the microservice application architecture based on Spring Cloud Gateway of the present invention;

[0042] Figure 3 is a schematic diagram of a filter system of the present invention;

[0043] Figure 4 It is a schematic diagram of the system flow of the present invention. DETAILED DESCRIPTION

[0044] Example 1: Figure 2As shown in the figure, this solution is implemented based on Spring Cloud Gateway. In order to improve the performance of the gateway, Spring Cloud Gateway is implemented based on the WebFlux framework, and the underlying WebFlux framework uses the high-performance Reactor mode communication framework Netty. The goal of Spring Cloud Gateway is not only to provide a unified routing method, but also to implement basic gateway functions such as security, monitoring / indicators, and current limiting through custom filters.

[0045] SpringCloud Gateway is a new project of Spring Cloud. It is a gateway developed based on technologies such as Spring5.0, Spring Boot 2.0 and Project Reactor. It aims to provide a simple, effective and unified API routing management method for microservice architecture.

[0046] SpringCloud officially introduces the features of SpringCloud Gateway as follows:

[0047] (1) Based on Spring Framework 5, Project Reactor and Spring Boot 2.0;

[0048] (2)Integrate Hystrix circuit breaker;

[0049] (3)Integrate Spring Cloud DiscoveryClient;

[0050] (4) Predicates and Filters act on specific routes and are easy to write;

[0051] (5) It has some advanced gateway functions: dynamic routing, current limiting, and path rewriting;

[0052] From the above features, there is not much difference from Zuul. The main difference between SpringCloud Gateway and Zuul is still in the underlying communication framework.

[0053] Let me briefly explain the three terms above:

[0054] (1) Filter:

[0055] Filters are filtering logic that routes forward requests and can be used to modify request and response content. Similar in concept to Zuul filters, they can be used to intercept and modify requests and perform secondary processing on upstream responses. Filters are instances of the org.springframework.cloud.gateway.filter.GatewayFilter class.

[0056] (2)Route:

[0057] The route is the basic unit of the gateway, which consists of an ID, a URI, a set of predicates, and a set of filters. The forwarding is matched according to the predicate. The basic building block of the gateway configuration is similar to the Zuul route configuration module. A Route module is defined by an ID, a target URI, a set of predicates, and a set of filters. If the predicate is true, the route matches and the target URI is accessed.

[0058] (3)Predicate:

[0059] The judgment condition of route forwarding. Currently, SpringCloud Gateway supports multiple methods, such as Path, Query, Method, Header, etc. The writing method must follow the key=vlue format. This is a Java 8 Predicate, which can be used to match any content from HTTP requests, such as headers or parameters. The input parameter type of the predicate is a ServerWebExchange.

[0060] like Figure 2 As shown in the figure, a microservice application architecture based on Spring Cloud Gateway is presented in detail, and the logical relationship between each component is clear.

[0061] exist Figure 2 The large box in the middle represents the core of the entire Spring Cloud Gateway Boot Application. This large box contains three key rectangular boxes, marked as "Route1", "Route2" and "Route3". These three boxes represent the three routes in the application, which are responsible for forwarding different requests to the corresponding microservices.

[0062] Inside each route box, there is a small square with a white background and "Predicate" and "Filter" written on it. These two words are crucial in Spring Cloud Gateway. "Predicate" represents the matching condition of the route, which determines which route will receive and process the incoming request. "Filter" represents a set of filters that can pre-process and post-process requests and responses to meet specific business needs.

[0063] On the left, there is a single rectangle that represents a "Single Page / Mobile App" client. This client communicates with the Spring Cloud Gateway Boot Application by sending HTTP requests. These requests will be forwarded to the corresponding routes based on the "Predicate" conditions.

[0064] On the right side, there are two small squares labeled "Netty Server" and "MicroService1". They are connected by arrows, indicating that "Netty Server" is responsible for receiving requests from "Single Page / Mobile App" and forwarding these requests to "MicroService1" for processing. The "Netty Server" here is the underlying communication framework of Spring CloudGateway, which provides high-performance network communication capabilities.

[0065] Below, there is a small box labeled "Netty Client", which is connected to "Route2" by an arrow. This means that "Netty Client" can actively send requests to "Route2" to achieve communication between microservices. This communication method is very common in microservice architecture, which allows different microservices to exchange data and collaborate.

[0066] On the far right is another small square labeled "MicroService2", which is connected to "Route2" by an arrow. This means that "Route2" can forward requests not only to "MicroService1", but also to "MicroService2". This flexibility enables Spring Cloud Gateway to easily implement routing and load balancing between microservices.

[0067] The implementation based on Spring Cloud Gateway is the protection point of this solution.

[0068] like Figure 1 - Figure 4 As shown, a gateway and an interaction method thereof for quickly realizing secure interaction between a terminal and a server include:

[0069] The request access module is used to manage all access requests and serves as the request entry for all API interfaces; the business aggregation module is used to register all service backends on the gateway and expose services uniformly through the gateway; the interception strategy module is used to provide unified public service components for increasing security, routing, and flow control; the data encryption module is used to perform complex encryption on the request parameters and response values ​​in the interactive interface to avoid data leakage and tampering; the dynamic routing module forwards the request to the corresponding business system according to the configuration rules; the identity authentication module is used to generate and manage tokens for different business systems, and perform identity authentication and verify request data tampering.

[0070] Specifically, the request access module includes a request receiving unit for receiving requests from the terminal; a request preprocessing unit for preprocessing the requests, specifically including extracting request parameters and parsing the protocol; a request distribution unit forwards the request to the corresponding processing module according to the request information and configuration rules, wherein the configuration rules include Predicate assertion conditions and filter rules, which are configured through code and implement the circuit breaker and degradation function.

[0071] The data encryption module uses an encryption and decryption algorithm based on the AES / CBC / PKCS5Padding principle, and uses the randomly generated requestId and the agreed secret as the key after MD5 encryption to encrypt the request parameters and the response data. The dynamic routing module supports multiple routing configuration methods, including basic URI routing configuration method, code-based routing configuration method and routing configuration method combined with the registration center. The identity authentication module supports the generation of different tokens for different business systems according to the configuration rules, and performs identity authentication and data tampering verification during the request processing process.

[0072] It should be noted that data encryption can be achieved in the following ways:

[0073]

[0074]

[0075]

[0076] like Figure 3 As shown in the figure, the logical relationship between "Filter" and "Proxy" is clearly shown. The following is a detailed description of the logical relationship:

[0077] First, the diagram consists of three rectangular boxes, in each of which the upper half is written "Filter" and the lower half is written "Proxy". This layout indicates that each rectangular box represents a specific link or stage, in which "Filter" and "Proxy" are two key elements in this link or stage. Each rectangular box represents a filter or proxy filter, and they are arranged vertically, indicating a sequential or hierarchical relationship. From top to bottom, data or requests pass through these five filters or proxy filters in sequence. On the left and right sides of the table, there are arrows pointing to the top and bottom of the table. The arrow on the left goes from bottom to top, indicating that the data or request starts from the "ProxyFilter" below and passes through the "Filter" above in sequence. The arrow on the right goes from top to bottom, indicating that the data or request goes from the "Filter" above to the "ProxyFilter" below in sequence. There is a vertical dotted line in the middle of the table, separating "Filter" and "ProxyFilter", which may indicate the logical or functional difference between "Filter" and "ProxyFilter".

[0078] The technical difficulty of this solution lies in: dynamically generating keys, dynamically rewriting request parameters and response values ​​according to the keys, and realizing data encryption and decryption; according to the configuration rules, different business systems generate different tokens to complete identity authentication and verify request data tampering.

[0079] Example 2: Figure 4 The figure shows the interaction process between a client, a gateway and a business system, involving steps such as request encryption, token acquisition and verification. The following is a detailed description of the method logic relationship:

[0080] S1. The client generates a requestId and encrypts the request parameters: The client randomly generates a requestId, concatenates the requestId with the agreed secret, and then uses the md5 key to encrypt the request parameters using AES.

[0081] S2. Request the login interface to obtain a token: The client requests the login interface from the gateway to obtain a token.

[0082] S3. Determine whether a token needs to be generated: The gateway determines whether a token needs to be generated for the current request based on the configuration. If necessary, the request data is decrypted and forwarded to the corresponding business system through routing.

[0083] S4. Decrypt the request parameters and send them to the business system: The gateway forwards the decrypted request parameters to the business system through the intranet.

[0084] S5. The business system processes the request and returns data and token: The business system processes the request and returns response data and token information.

[0085] S6. Perform AES encryption on the response data: The gateway performs AES encryption on the response data according to the key.

[0086] S7. Return encrypted response data: The gateway returns the encrypted response data to the client.

[0087] S8. The client decrypts the response data and obtains the token: The client decrypts the response data and obtains the token information, and enters the next interaction scenario.

[0088] S9. The client generates a new requestId and encrypts the request parameters: The client randomly generates a requestId again. The requestId is concatenated with the agreed secret, and the user information is added. The request parameters are then encrypted using the AES key after the MD5. The request parameters are encrypted using the AES key after the MD5.

[0089] S10. Request the service interface with the token and encrypted service data: The client requests the service interface and brings the token and encrypted service data.

[0090] S11. Verify token validity and decrypt request data: The gateway verifies token validity. Decrypts request data and forwards it to the corresponding business system through routing. If the token is valid, subsequent interactions are synchronized to S5; if the token is invalid, token expiration or error is returned.

[0091] S12. Return token expiration: If the token is invalid, the gateway returns the token expiration information.

[0092] S13. Interface for requesting to refresh the token: The interface for the client to request to refresh the token.

[0093] S14. Verify whether the refresh token is legal and generate a new token: The gateway verifies whether the refresh token is legal. If legal, it generates the latest valid token according to the configuration.

[0094] S15. Return the latest valid token: The gateway returns the latest valid token to the client.

[0095] S16, repeat S9: The client uses the latest token and repeats S9 for subsequent requests.

[0096] This process ensures secure interaction between the client and the business system, protects data security through encryption and decryption mechanisms, and manages session status through a token mechanism. The interaction process includes: Request access: manage all access requests as the request entry for all API interfaces. Business aggregation: all service backends can be registered in the API gateway, and services are uniformly exposed through the API gateway. Interception strategy: can provide unified public service components such as increased security, routing, and flow control. The above are the technical key points and core protection points of this solution.

[0097] In this solution, all terminal requests pass through the gateway system, which then distributes them to various business systems. To add a new business system, you only need to add gateway configuration to quickly implement secure interaction between the terminal and the server. In addition, this solution can manage token generation strategies for different systems in the gateway, configure security fields, and verify whether the value of each request has been tampered with. Avoid exposing the business system directly to the terminal. Perform complex encryption on the request parameters and response values ​​in the interactive interface to avoid data leakage and tampering.

Claims

1. A gateway for quickly realizing secure interaction between a terminal and a server, characterized in that: include: The request access module is used to manage all access requests and serves as the request entry for all API interfaces; Business aggregation module, used to register all service backends on the gateway and expose services uniformly through the gateway; The interception policy module is used to provide unified public service components for increasing security, routing, and flow control; Data encryption module, used to perform complex encryption on request parameters and response values ​​in interactive interfaces to prevent data leakage and tampering; The dynamic routing module forwards the request to the corresponding business system according to the configuration rules; The identity authentication module is used to generate and manage tokens for different business systems, and to perform identity authentication and verify request data tampering.

2. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 1, characterized in that: The access request module includes: A request receiving unit, used for receiving a request from a terminal; A request preprocessing unit, used for preprocessing the request; The request distribution unit forwards the request to the corresponding processing module according to the request information and configuration rules.

3. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 2, characterized in that: The preprocessing specifically includes extracting request parameters and parsing the protocol.

4. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 1, characterized in that: The data encryption module adopts an encryption and decryption algorithm based on the AES / CBC / PKCS5Padding principle, uses the randomly generated requestId and the agreed secret to perform MD5 encryption as the key, performs AES encryption on the request parameters, and also performs AES encryption on the response data.

5. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 1, characterized in that: The dynamic routing module supports multiple routing configuration methods, including a basic URI routing configuration method, a code-based routing configuration method, and a routing configuration method combined with a registration center.

6. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 1, characterized in that: The configuration rules include Predicate assertion conditions and filter rules, which are configured through code and implement the circuit breaker and degradation function.

7. A gateway for quickly realizing secure interaction between a terminal and a server according to claim 1, characterized in that: The identity authentication module supports generating different tokens for different business systems according to configuration rules, and performs identity authentication and data tampering verification during request processing.

8. A gateway interaction method for quickly realizing secure interaction between a terminal and a server, applicable to a gateway for quickly realizing secure interaction between a terminal and a server as claimed in any one of claims 1 to 7, characterized in that: The steps include: S1. The client generates requestId and encrypts request parameters; S2. Request the login interface to obtain a token. The gateway determines whether the current request needs to generate a token based on the configuration. If necessary, it decrypts the request data and forwards it to the corresponding business system through routing. S3. The gateway forwards the decrypted request parameters to the business system through the intranet; S4. The business system processes the request and returns data and token; S5. The gateway performs AES encryption on the response data according to the key, and returns the encrypted response data to the client; S6. The client decrypts the response data and obtains the token information to enter the next interaction scenario; S7, the client generates a new requestId and encrypted request parameters; S8. Request the service interface to carry the token and encrypted service data; S9, verify the validity of the token and decrypt the request data, decrypt the request data, and forward it to the corresponding business system through routing. If the token is valid, the subsequent interaction is synchronized with S4; if the token is invalid, return token expiration or token error; among them, if the token is invalid, the gateway returns the information that the token is expired; S10, the client requests the refresh token interface, verifies whether the refresh token is legal, and if so, generates the latest valid token according to the configuration, and the gateway returns the latest valid token to the client; S11. The client uses the latest token and repeats S7 for subsequent requests.

Images