Data processing method, device, electronic device and storage medium

Abstract

The present invention discloses a method, device, electronic device and storage medium for data processing, and relates to the field of data processing technology. A specific implementation of the method includes: receiving a request message sent by a gateway device; obtaining user information in the request message, querying a corresponding authentication field, and extracting a type identifier in the authentication field; obtaining a field structure associated with the type identifier to identify a first authentication summary and authentication parameters from the authentication field, and obtaining a corresponding authentication calculation model based on the type identifier; obtaining information to be authenticated from the request message, calling an authentication calculation model, and calculating a second authentication summary in combination with the authentication parameters and the information to be authenticated, so as to compare the second authentication summary with the first authentication summary and obtain an authentication result. This implementation can solve the problem that the password storage strategy commonly used in LDAP services is implemented based on a foreign fixed digest algorithm, which not only has a limited application scope and cannot meet business needs, but also has low data security.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method, device, electronic device and storage medium. Background Art

[0002] In various business processing scenarios, data security and confidentiality requirements often require data encryption and security authentication. For example, user information authentication can be implemented through directory storage services. LDAP (Lightweight Directory Access Protocol) services are one implementation of directory storage services. The commonly used password storage strategy in LDAP services relies on a foreign fixed digest algorithm. However, with the development of national encryption algorithms, this approach is not only limited in scope and unable to meet business needs, but also has low data security. Summary of the Invention

[0003] In view of this, the embodiments of the present invention provide a data processing method, device, electronic device and storage medium, which can solve the problem that the password storage strategy commonly used in LDAP services is based on a foreign fixed digest algorithm, which not only has a limited application scope and cannot meet business needs, but also has low data security.

[0004] To achieve the above objective, according to one aspect of an embodiment of the present invention, a data processing method is provided.

[0005] A data processing method of an embodiment of the present invention includes: receiving a request message sent by a gateway device, wherein the request message is sent by the gateway device after decrypting the request sent by the client; obtaining user information in the request message, querying the corresponding authentication field, and extracting the type identifier in the authentication field; obtaining the field structure associated with the type identifier to identify a first authentication summary and authentication parameters from the authentication field, and obtaining a corresponding authentication calculation model based on the type identifier; obtaining information to be authenticated from the request message, calling the authentication calculation model, and calculating a second authentication summary in combination with the authentication parameters and the information to be authenticated to compare with the first authentication summary to obtain an authentication result; and sending the authentication result to the client.

[0006] In one embodiment, obtaining the corresponding authentication calculation model based on the type identifier includes: in response to the type identifier belonging to the first type, obtaining the corresponding authentication calculation model based on the type identifier; in response to the type identifier belonging to the second type, obtaining the authentication calculation model corresponding to the second type.

[0007] In another embodiment, obtaining the field structure associated with the type identifier includes: identifying whether the type identifier includes a preset tag; in response to the type identifier including the preset tag, determining that the type identifier belongs to the first type, and obtaining the field structure associated with the first type; in response to the type identifier not including the preset tag, determining that the type identifier belongs to the second type, and obtaining the field structure associated with the second type.

[0008] In another embodiment, the method further includes: receiving a storage request for authentication information, obtaining corresponding user information and an authentication password; identifying the type of the authentication password to which it belongs, determining a corresponding type identifier based on the type, and generating an authentication string based on the authentication password; generating an authentication field based on the field structure associated with the type, the authentication string, and the type identifier, to establish a corresponding relationship with the user information in the storage request and store it.

[0009] In another embodiment, determining a corresponding type identifier based on the type, and generating an authentication string based on the authentication password, include: in response to the authentication password belonging to a first type, obtaining an algorithm identifier associated with the authentication information to determine a corresponding type identifier, and generating an authentication string based on an authentication calculation model associated with the algorithm identifier and the authentication password; in response to the authentication password belonging to a second type, obtaining an associated type tag to determine a corresponding type identifier, and generating an authentication string based on an authentication calculation model associated with the second type and the authentication password.

[0010] In another embodiment, the method further includes: responding to the status reporting task, querying the authentication time parameters corresponding to each request information within a preset time period, calculating the processing time of the request information, obtaining the number of corresponding request information in the queue to be processed, and sending the number and the processing time to the gateway device.

[0011] In another embodiment, sending the authentication result to the client includes: sending the authentication result to the gateway device, so that the gateway device encrypts the authentication result and then sends it to the client.

[0012] To achieve the above objective, according to another aspect of an embodiment of the present invention, a data processing device is provided.

[0013] A data processing device according to an embodiment of the present invention includes: a receiving unit for receiving a request message sent by a gateway device, wherein the request message is sent by the gateway device after decrypting the request sent by the client; an extraction unit for obtaining user information in the request message, querying the corresponding authentication field, and extracting the type identifier in the authentication field; an acquisition unit for obtaining a field structure associated with the type identifier to identify a first authentication summary and authentication parameters from the authentication field, and obtaining a corresponding authentication calculation model based on the type identifier; an authentication unit for obtaining information to be authenticated from the request message, calling the authentication calculation model, and calculating a second authentication summary in combination with the authentication parameters and the information to be authenticated, so as to compare the second authentication summary with the first authentication summary to obtain an authentication result; and a sending unit for sending the authentication result to the client.

[0014] In one embodiment, the acquisition unit is specifically used to: in response to the type identifier belonging to the first type, acquire the corresponding authentication calculation model based on the type identifier; in response to the type identifier belonging to the second type, acquire the authentication calculation model corresponding to the second type.

[0015] In another embodiment, the acquisition unit is specifically used to: identify whether the type identifier includes a preset tag; in response to the type identifier including the preset tag, determine that the type identifier belongs to the first type, and acquire the field structure associated with the first type; in response to the type identifier not including the preset tag, determine that the type identifier belongs to the second type, and acquire the field structure associated with the second type.

[0016] In another embodiment, the receiving unit is further used to receive a storage request for authentication information and obtain corresponding user information and authentication password; the device also includes: a generating unit for identifying the type of the authentication password to which it belongs, so as to determine the corresponding type identifier based on the type, and to generate an authentication string based on the authentication password; an establishing unit for generating an authentication field based on the field structure associated with the type, the authentication string and the type identifier, so as to establish a corresponding relationship with the user information in the storage request and store it.

[0017] In another embodiment, the generation unit is specifically used to: in response to the authentication password belonging to the first type, obtain the algorithm identifier associated with the authentication information to determine the corresponding type identifier, and generate an authentication string based on the authentication calculation model associated with the algorithm identifier and the authentication password; in response to the authentication password belonging to the second type, obtain the associated type tag to determine the corresponding type identifier, and generate an authentication string based on the authentication calculation model associated with the second type and the authentication password.

[0018] In another embodiment, the device also includes: a reporting unit, which is used to respond to the status reporting task, query the authentication time parameters corresponding to each request information within a preset time period, calculate the processing time of the request information, and obtain the number of corresponding request information in the queue to be processed, so as to send the number and the processing time to the gateway device.

[0019] In yet another embodiment, the sending unit is specifically configured to send the authentication result to the gateway device, so that the gateway device encrypts the authentication result and then sends it to the client.

[0020] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device is provided.

[0021] An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the data processing method provided by the embodiment of the present invention.

[0022] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer-readable medium is provided.

[0023] A computer-readable medium according to an embodiment of the present invention stores a computer program, which, when executed by a processor, implements the data processing method provided by the embodiment of the present invention.

[0024] To achieve the above objective, according to another aspect of the embodiments of the present invention, a computer program product is provided.

[0025] A computer program product according to an embodiment of the present invention includes a computer program, which, when executed by a processor, implements the data processing method provided by the embodiment of the present invention.

[0026] One embodiment of the above invention has the following advantages or beneficial effects:

[0027] In an embodiment of the present invention, after receiving the request information sent by the gateway device, the corresponding authentication field can be queried based on the user information therein, and the type identifier can be extracted therefrom to obtain the field structure associated with the type identifier, and then the first authentication summary and authentication parameters can be identified from the authentication field, and the corresponding authentication calculation model can be obtained based on the type identifier; after obtaining the information to be authenticated from the request information, the authentication calculation model can be called, and the second authentication summary can be calculated in combination with the authentication parameters and the information to be authenticated to compare with the first authentication summary to obtain the authentication result and send it to the client. In an embodiment of the present invention, different field structures and authentication calculation models can be set according to the type, so that when performing information authentication, the authentication summary and authentication parameters can be identified according to the field structure of the type to which they belong, and then the authentication summary to be compared can be calculated and compared by the corresponding authentication calculation model. In this way, information authentication can be performed based on a variety of national secret algorithms to meet the needs of different authentication services and scenarios, making the application scope more extensive; and, in an embodiment of the present invention, different field structures can be set for each type to improve the security and accuracy of data storage.

[0028] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are provided for a better understanding of the present invention and are not intended to limit the present invention.

[0030] Figure 1 is a schematic diagram of an architecture of a data processing system according to an embodiment of the present invention;

[0031] Figure 2 is a schematic diagram of the field structure of the authentication field according to an embodiment of the present invention;

[0032] Figure 3 is a schematic diagram of a main flow of a data processing method according to an embodiment of the present invention;

[0033] Figure 4 is a schematic diagram of another main flow of a data processing method according to an embodiment of the present invention;

[0034] Figure 5 is a schematic diagram of main units of a data processing apparatus according to an embodiment of the present invention;

[0035] Figure 6 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

[0036] Figure 7 It is a schematic diagram of the structure of a computer system suitable for implementing the embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0038] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, certain software, components, models, and other existing solutions in the industry may be mentioned. They should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0039] An embodiment of the present invention provides a data processing system, which can be used in a data authentication processing scenario, and specifically can be used in a data authentication processing scenario in an LDAP service.

[0040] In the embodiment of the present invention, taking the processing scenario of data authentication by LDAP service as an example, Figure 1 FIG. 1 is a schematic diagram of the architecture of a data processing system according to an embodiment of the present invention. Figure 1 As shown, the data processing system may include a gateway device and an LDAP server. The number of gateway devices and LDAP servers can be set according to demand. Each gateway device can establish a data connection with each LDAP server. The LDAP protocol can be pre-configured in the gateway device to facilitate the establishment of a data connection with the LDAP server. The data processing system can establish a connection with the client through the gateway device. The client can include various types, such as a device for writing data and a device for requesting data authentication. To improve data security, encrypted data transmission can be performed between the client and the gateway device. For example, TLS (Transport Layer Security Protocol) that meets national encryption requirements can be used for encryption. After the client sends the data to the gateway device, the gateway device can decrypt the received data and transmit it to the LDAP server for subsequent processing.

[0041] For example, in the scenario of user login security authentication, the LDAP server can store the required authentication information, such as the user password. For example, if the required authentication information is the user password, the client used to write the user password can send the password and other information to the LDAP server via a gateway device. The LDAP server determines the appropriate storage method based on the user password type, generates the corresponding authentication fields, and stores them.

[0042] In the embodiments of the present invention, the user password sent by the client can be either plaintext or ciphertext. To improve data security, plaintext information is typically encrypted for storage. To simplify data processing, ciphertext information, which is already encrypted, can be omitted from the encryption process. Therefore, in the embodiments of the present invention, different types of user passwords can be processed separately, and the field structure of the authentication field corresponding to each type can be configured.

[0043] For the authentication field, its structure can be as follows Figure 2 As shown, it includes a type identifier, an authentication digest, and authentication parameters. The type identifier can indicate whether the current corresponding user password is plaintext or ciphertext. This not only determines the field structure of the authentication field, but also indicates the method for authenticating the user password. The authentication digest represents the encrypted data of the user password during authentication, which is used for subsequent user password authentication. The authentication parameters represent the parameters required for authentication, which can specifically be a salt value, such as an 8-bit string.

[0044] It should be noted that, since the user password can be encrypted based on different algorithms, in the embodiment of the present invention, the algorithm identifier corresponding to each encryption algorithm can be set, and then stored as a type identifier in the authentication field. For user password ciphertext that does not require repeated encryption, a corresponding mark, that is, a preset mark, can be set to determine it as a type identifier. Therefore, in the embodiment of the present invention, through the type identifier in the authentication field, not only the specific type can be determined, but also the encryption algorithm used for authentication can be determined, thereby meeting the needs of adapting to different authentication services and scenarios and improving the security and accuracy of data storage. Taking the user password as plain text and the encryption algorithm as SM3 as an example, the format of its authentication field is as follows: Figure 2 As shown, the type identifier can be an algorithm identifier, namely SM3, the authentication digest is a digest generated based on SM3 and the user password, and the authentication parameter is the salt value used when generating the digest.

[0045] The embodiment of the present invention provides a data processing method, which can be executed by a data processing system. Figure 3 As shown, the method includes the following steps.

[0046] S301: Receive request information sent by a gateway device.

[0047] The request information is sent by the gateway device after decrypting the request sent by the client.

[0048] The client sends a request to the gateway device, which can decrypt it based on the pre-configured decryption strategy and then send it to the server as a request message. Figure 1 The LDAP server is shown.

[0049] The request information may indicate a request for authentication, and is used to authenticate the information to be authenticated carried in the request information. The request information may include user information, information to be authenticated, and so on. User information may specifically be a user ID, and the information to be authenticated may specifically be information that needs to be kept confidential, such as a user password.

[0050] S302: Obtain user information in the request information, query the corresponding authentication field, and extract the type identifier in the authentication field.

[0051] The authentication field is pre-generated and stored, which may include data required for authentication. A corresponding relationship between the authentication field and the user information may be pre-established, so in this step the corresponding authentication field may be queried based on the user information.

[0052] In the embodiment of the present invention, the authentication field can be configured with a corresponding field structure according to requirements. Since the field structures of authentication fields corresponding to different types may be different, the type identifier in the authentication field can be first extracted in this step.

[0053] Specifically, the type identifier can be a string constant whose length can be pre-configured and can be configured at the starting position of the authentication field. Therefore, in this step, a string of preset length can be extracted from the starting position of the authentication field to determine it as the type identifier.

[0054] It should be noted that user information may refer to information that uniquely identifies a user, such as a user ID. In the scenario of user login authentication, user information may be identification information such as a user login account.

[0055] S303: Acquire a field structure associated with the type identifier to identify a first authentication summary and authentication parameters from the authentication field, and acquire a corresponding authentication calculation model based on the type identifier.

[0056] The field structure is pre-set. Since different types of authentication fields may not necessarily use the same authentication encryption algorithm, the first authentication digest and authentication parameters may be identified from the authentication field based on the field structure in this step.

[0057] Specifically, for different types, due to the different implementation methods of their encrypted storage, the lengths of the authentication summary and authentication parameters in the corresponding authentication fields may be different. In this step, the specific positions of the first authentication summary and authentication parameters in the authentication field can be determined based on the field structure, and then the first authentication summary and authentication parameters can be identified from the authentication field.

[0058] The authentication calculation model represents the calculation model used to calculate the authentication digest. Typically, the authentication calculation model is based on the authentication algorithm used. For example, if SM3 is used for encryption, the authentication calculation model is the corresponding SM3 calculation model. Because different encryption algorithms are used for different types, this step retrieves the corresponding authentication calculation model based on the type.

[0059] Specifically, embodiments of the present invention support multiple encryption algorithms. Therefore, the algorithm identifier based on the encryption algorithm represents the type identifier. For ciphertext authentication, a universal algorithm can be used for authentication calculation. Therefore, obtaining the authentication calculation model in this step can be performed as follows: in response to the type identifier being a first type, obtaining the corresponding authentication calculation model based on the type identifier; and in response to the type identifier being a second type, obtaining the authentication calculation model corresponding to the second type.

[0060] The first type can indicate the authentication processing type when the information to be authenticated is plaintext, while the second type can indicate the authentication processing type when the information to be authenticated is ciphertext. In the first type, the type identifier indicates the encryption algorithm used, so the corresponding authentication calculation model can be obtained based on the type identifier. In the second type, a common encryption algorithm can be set, so the corresponding authentication calculation model can be obtained.

[0061] It should be noted that in some scenarios, the second type usually does not re-encrypt the information to be authenticated, so the authentication calculation model corresponding to the second type can be specifically a model that does not perform data processing, that is, directly using the ciphertext to be stored as the authentication summary.

[0062] In one embodiment, a preset identifier can be set to indicate the second type. Therefore, if the type identifier includes the preset tag, it can be determined to belong to the second type; if the type identifier does not include the preset tag, it can be determined to belong to the first type. After determining the type to which the type identifier belongs, the associated field structure and the corresponding authentication calculation model can be obtained. The preset tag can be set as required, for example, to OA.

[0063] S304: Obtain the information to be authenticated from the request information, call the authentication calculation model, and calculate the second authentication digest based on the authentication parameters and the information to be authenticated, so as to compare the second authentication digest with the first authentication digest and obtain the authentication result.

[0064] Among them, for the information to be authenticated, encryption calculation can be performed in combination with authentication parameters and through an authentication calculation model to obtain a second authentication digest, and then the authentication result is obtained by comparing the first authentication digest and the second authentication digest.

[0065] Specifically, if the comparison result of the first authentication summary and the second authentication summary is consistent, the authentication result can be determined as authentication passed; if the comparison result of the first authentication summary and the second authentication summary is inconsistent, the authentication result can be determined as authentication failed.

[0066] Taking the SM3 calculation model as an example, the information to be authenticated is specifically the user password, and the authentication parameter can be the last 8-digit string in the authentication field. The user password and the 8-digit string can be input into the SM3 calculation model to obtain the calculation result, and then compare it with the first authentication summary identified in the authentication field to obtain the authentication result.

[0067] S305: Send the authentication result to the client.

[0068] After the authentication result is obtained, it can be returned to the client. Specifically, it can be sent to a gateway device first, which will encrypt it again and send it to the corresponding client, thereby improving the security of data transmission.

[0069] In another embodiment, the client can also write authentication information as needed to facilitate subsequent authentication processing. Therefore, embodiments of the present invention can also perform the following steps: receiving a request to store authentication information, obtaining corresponding user information and an authentication password; identifying the type of the authentication password to determine a corresponding type identifier based on the type, and generating an authentication string based on the authentication password; generating an authentication field based on the type-associated field structure, the authentication string, and the type identifier, establishing a corresponding relationship with the user information in the storage request, and storing the corresponding authentication field.

[0070] In embodiments of the present invention, the authentication password in the storage request can be identified to determine whether it is plaintext or ciphertext, and then its type can be determined to determine the corresponding processing method to generate the authentication field. In this step, the authentication password can be processed to obtain an authentication string, which can then be stored according to the field structure of the authentication field to generate the authentication field, thereby determining the authentication digest and authentication parameters.

[0071] It should be noted that the authentication password type can specifically include: the authentication processing type when the authentication password is plain text and the authentication processing type when the authentication password is cipher text. Therefore, after determining whether it is plain text or cipher text, its type is determined, and then the storage method is determined.

[0072] Specifically, in the above process, after determining that the authentication password belongs to the first type, it can be said that the authentication password is in plain text, and encryption processing needs to be performed, that is, obtaining the associated algorithm identifier to determine it as the corresponding type identifier, and generating an authentication string based on the authentication calculation model and authentication password associated with the algorithm identifier; after determining that the authentication password belongs to the second type, obtaining the associated type tag, that is, the preset tag corresponding to the second type, to determine the corresponding type identifier, and generating an authentication string based on the authentication calculation model and authentication password associated with the second type.

[0073] It should be noted that after determining that the authentication password belongs to the first type, the associated algorithm identifier can be obtained based on the storage request. That is, the service identifier is stored in the storage request, and the preset algorithm identifier is queried based on the service identifier. Alternatively, if the storage request does not specify the algorithm, in this embodiment of the present invention, the algorithm identifier can be obtained randomly or based on the priority of each algorithm. After determining that the authentication password belongs to the second type, processing is generally performed using a general algorithm, that is, the general authentication calculation model associated with the second type.

[0074] It should be noted that a salt value is usually used in the process of generating an authentication field. In the embodiment of the present invention, the salt value can be determined according to the generation requirement and stored according to the field structure.

[0075] In an embodiment of the present invention, different field structures and authentication calculation models can be set according to the type, so that when performing information authentication, the authentication summary and authentication parameters can be identified according to the field structure of the type to which they belong, and then the authentication summary to be compared can be calculated and compared through the corresponding authentication calculation model. In this way, information authentication can be performed based on a variety of national secret algorithms to meet the needs of different authentication businesses and scenarios, making the application scope more extensive; and, in an embodiment of the present invention, different field structures can be set for each type to improve the security and accuracy of data storage.

[0076] It should be noted that in Figure 1 In the system architecture shown, the gateway device can establish connections with multiple LDAP servers, so when executing the authentication process in the above embodiment, the gateway device can send the request sent by the client to one or more LDAP servers according to the preset routing policy. For example, the gateway device can determine the LDAP server to which the request information is to be sent based on the operating status of each LDAP server. In order to avoid excessive concentration of request information on some LDAP servers, each LDAP server can report its operating data at regular intervals. The operating data can specifically include the request information to be processed and the response time of the request information. Then, the gateway device can determine the busyness of each LDAP server based on this parameter, and determine the LDAP server that will subsequently process the request information based on the busyness.

[0077] Therefore, in an embodiment of the present invention, the LDAP server may further perform the following: in response to a status reporting task, query the authentication time parameters corresponding to each request message within a preset time period, calculate the processing time limit of the request message, obtain the number of corresponding request messages in the pending queue, and transmit the number and processing time limit to the gateway device. The status reporting task may be pre-configured and periodically triggered, and the authentication time parameters may include the start and end times of processing the request messages, thereby calculating the average processing time for processing the request messages within the preset time period, i.e., the processing time limit. The pending queue is pre-configured and may be used to store pending request messages.

[0078] The following combination Figure 1 The embodiment shown in FIG. 1 specifically illustrates the method for data processing in the embodiment of the present invention. Figure 4 As shown, the method includes the following steps.

[0079] S401: Receive request information sent by a gateway device.

[0080] S402: Obtain user information in the request information, query the corresponding authentication field, and extract the type identifier in the authentication field.

[0081] S403: Identify whether the type identifier includes a preset tag; in response to the type identifier including the preset tag, determine that the type identifier belongs to the first type, and obtain the field structure associated with the first type; in response to the type identifier not including the preset tag, determine that the type identifier belongs to the second type, and obtain the field structure associated with the second type.

[0082] S404: Identify a first authentication digest and authentication parameters from the authentication field according to the field structure.

[0083] S405: In response to the type identifier belonging to the first type, obtaining a corresponding authentication calculation model based on the type identifier; in response to the type identifier belonging to the second type, obtaining an authentication calculation model corresponding to the second type.

[0084] S406: Obtain the information to be authenticated from the request information, call the authentication calculation model, and calculate the second authentication digest based on the authentication parameters and the information to be authenticated, so as to compare the second authentication digest with the first authentication digest and obtain the authentication result.

[0085] S407: Send the authentication result to the client.

[0086] It should be noted that the data processing principle in the embodiment of the present invention is the same as Figure 3 The corresponding data processing principles in the illustrated embodiments are the same and will not be described again here.

[0087] In order to solve the problems existing in the prior art, an embodiment of the present invention provides a data processing device 500, such as Figure 5 As shown, the device 500 includes: a receiving unit 501, which is used to receive a request message sent by a gateway device, and the request message is sent by the gateway device after decrypting the request sent by the client; an extraction unit 502, which is used to obtain user information in the request message, query the corresponding authentication field, and extract the type identifier in the authentication field; an acquisition unit 503, which is used to obtain the field structure associated with the type identifier to identify the first authentication summary and authentication parameters from the authentication field, and obtain the corresponding authentication calculation model based on the type identifier; an authentication unit 504, which is used to obtain the information to be authenticated from the request message, call the authentication calculation model, and calculate a second authentication summary in combination with the authentication parameters and the information to be authenticated, so as to compare it with the first authentication summary to obtain an authentication result; a sending unit 505, which is used to send the authentication result to the client.

[0088] It should be understood that the manner in which the embodiments of the present invention are implemented is different from the manner in which the embodiments of the present invention are implemented. Figure 3 The methods of the illustrated embodiments are the same and will not be described again here.

[0089] In one embodiment, the acquisition unit 503 is specifically used to: in response to the type identifier belonging to the first type, acquire the corresponding authentication calculation model based on the type identifier; in response to the type identifier belonging to the second type, acquire the authentication calculation model corresponding to the second type.

[0090] In another embodiment, the acquisition unit 503 is specifically used to: identify whether the type identifier includes a preset tag; in response to the type identifier including the preset tag, determine that the type identifier belongs to the first type, and obtain the field structure associated with the first type; in response to the type identifier not including the preset tag, determine that the type identifier belongs to the second type, and obtain the field structure associated with the second type.

[0091] In another embodiment, the receiving unit 501 is further used to receive a storage request for authentication information and obtain corresponding user information and authentication password; the device 500 also includes: a generating unit, used to identify the type of the authentication password to determine the corresponding type identifier based on the type, and generate an authentication string based on the authentication password; an establishing unit, used to generate an authentication field based on the field structure associated with the type, the authentication string and the type identifier, so as to establish a corresponding relationship with the user information in the storage request and store it.

[0092] In another embodiment, the generation unit is specifically used to: in response to the authentication password belonging to the first type, obtain the algorithm identifier associated with the authentication information to determine the corresponding type identifier, and generate an authentication string based on the authentication calculation model associated with the algorithm identifier and the authentication password; in response to the authentication password belonging to the second type, obtain the associated type tag to determine the corresponding type identifier, and generate an authentication string based on the authentication calculation model associated with the second type and the authentication password.

[0093] In another embodiment, the device 500 also includes: a reporting unit, which is used to respond to the status reporting task, query the authentication time parameters corresponding to each request information within a preset time period, calculate the processing time of the request information, and obtain the number of corresponding request information in the queue to be processed, so as to send the number and the processing time to the gateway device.

[0094] In another embodiment, the sending unit 505 is specifically configured to send the authentication result to the gateway device, so that the gateway device encrypts the authentication result and then sends it to the client.

[0095] It should be understood that the manner in which the embodiments of the present invention are implemented is different from the manner in which the embodiments of the present invention are implemented. Figure 3 、 4 The methods of the illustrated embodiments are the same and will not be described again here.

[0096] In an embodiment of the present invention, different field structures and authentication calculation models can be set according to the type, so that when performing information authentication, the authentication summary and authentication parameters can be identified according to the field structure of the type to which they belong, and then the authentication summary to be compared can be calculated and compared through the corresponding authentication calculation model. In this way, information authentication can be performed based on a variety of national secret algorithms to meet the needs of different authentication businesses and scenarios, making the application scope more extensive; and, in an embodiment of the present invention, different field structures can be set for each type to improve the security and accuracy of data storage.

[0097] According to an embodiment of the present invention, an electronic device and a readable storage medium are further provided.

[0098] An electronic device according to an embodiment of the present invention includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the one processor, and the instructions are executed by the at least one processor so that the at least one processor performs the data processing method provided by the embodiment of the present invention.

[0099] Figure 6 An exemplary system architecture 600 is shown to which the data processing method or data processing apparatus according to the embodiment of the present invention can be applied.

[0100] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, a network 604, and a server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0101] Users can use terminal devices 601, 602, and 603 to interact with server 605 via network 604 to receive or send messages, etc. Various client applications can be installed on terminal devices 601, 602, and 603.

[0102] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0103] The server 605 may be a server that provides various services. The server may analyze and process received data such as product information query requests, and feed back processing results (such as product information—only an example) to the terminal device.

[0104] It should be noted that the data processing method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the data processing device is generally set in the server 605 .

[0105] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0106] Reference below Figure 7 , which shows a schematic structural diagram of a computer system 700 suitable for implementing an embodiment of the present invention. Figure 7 The computer system shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0107] like Figure 7 As shown, computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage unit 708 into a random access memory (RAM) 703. Various programs and data required for the operation of system 700 are also stored in RAM 703. CPU 701, ROM 702, and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0108] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, and the like; an output section 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 708 including devices such as a hard disk; and a communication section 709 including a network interface card such as a LAN card or a modem. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. Removable media 711, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 710 as needed, so that computer programs read from the media can be installed in the storage section 708 as needed.

[0109] In particular, according to embodiments disclosed herein, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed herein include a computer program product comprising a computer program embodied on a computer-readable medium, the computer program containing program code for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709 and / or installed from removable media 711. When executed by central processing unit (CPU) 701, the computer program performs the aforementioned functions defined in the system of the present invention.

[0110] It should be noted that the computer-readable medium described in the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable storage media may include, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, or any suitable combination thereof.

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a unit, program segment, or a part of code, and the above-mentioned unit, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The units described in the embodiments of the present invention may be implemented in software or hardware. The units described may also be provided in a processor. For example, a processor may be described as comprising a receiving unit, an extraction unit, an acquisition unit, an authentication unit, and a sending unit. The names of these units do not, in some cases, limit the units themselves. For example, a receiving unit may also be described as a "unit having a receiving function."

[0113] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiments, or may exist independently and not incorporated into the device. The computer-readable medium carries one or more programs, and when executed by the device, the device performs the data processing method provided by the present invention.

[0114] As another aspect, the present invention further provides a computer program product, including a computer program, which implements the data processing method provided by an embodiment of the present invention when the program is executed by a processor.

[0115] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: include: Receive request information sent by the gateway device, where the request information is sent by the gateway device after decrypting the request sent by the client; Obtain user information in the request information, query the corresponding authentication field, and extract the type identifier in the authentication field; Obtaining a field structure associated with the type identifier to identify a first authentication digest and authentication parameters from the authentication field, and obtaining a corresponding authentication calculation model based on the type identifier; Obtaining the information to be authenticated from the request information, calling the authentication calculation model, and calculating a second authentication digest based on the authentication parameters and the information to be authenticated, and comparing the digest with the first authentication digest to obtain an authentication result; The authentication result is sent to the client.

2. The method according to claim 1, characterized in that Acquiring a corresponding authentication calculation model based on the type identifier includes: In response to the type identifier belonging to the first type, a corresponding authentication calculation model is acquired based on the type identifier; in response to the type identifier belonging to the second type, an authentication calculation model corresponding to the second type is acquired.

3. The method according to claim 1 or 2, characterized in that Get the field structure associated with the type identifier, including: Identifying whether the type identifier includes a preset mark; In response to the type identifier including a preset mark, it is determined that the type identifier belongs to the first type, and the field structure associated with the first type is obtained; in response to the type identifier not including the preset mark, it is determined that the type identifier belongs to the second type, and the field structure associated with the second type is obtained.

4. The method according to claim 1, wherein The method further comprises: Receive a storage request for authentication information and obtain the corresponding user information and authentication password; Identifying the type of the authentication password, determining a corresponding type identifier based on the type, and generating an authentication string based on the authentication password; An authentication field is generated based on the field structure associated with the type, the authentication string, and the type identifier, so as to establish a corresponding relationship with the user information in the storage request and store the corresponding field.

5. The method according to claim 4, characterized in that Determining a corresponding type identifier based on the type, and generating an authentication string based on the authentication password, including: In response to the authentication password belonging to the first type, the algorithm identifier associated with the authentication information is obtained to determine the corresponding type identifier, and an authentication string is generated based on the authentication calculation model associated with the algorithm identifier and the authentication password; in response to the authentication password belonging to the second type, the associated type tag is obtained to determine the corresponding type identifier, and an authentication string is generated based on the authentication calculation model associated with the second type and the authentication password.

6. The method according to claim 1, characterized in that The method further comprises: In response to the status reporting task, query the authentication time parameters corresponding to each request information within the preset time period, calculate the processing time of the request information, obtain the number of corresponding request information in the queue to be processed, and send the number and the processing time to the gateway device.

7. The method according to claim 1, characterized in that Sending the authentication result to the client includes: The authentication result is sent to the gateway device, so that the gateway device encrypts the authentication result and then sends it to the client.

8. A data processing device, characterized in that: include: A receiving unit, configured to receive a request message sent by a gateway device, wherein the request message is sent by the gateway device after decrypting the request sent by the client; an extraction unit, configured to obtain user information from the request information, query a corresponding authentication field, and extract a type identifier from the authentication field; an acquiring unit, configured to acquire a field structure associated with the type identifier, so as to identify a first authentication digest and authentication parameters from the authentication field, and acquire a corresponding authentication calculation model based on the type identifier; an authentication unit, configured to obtain the information to be authenticated from the request information, invoke the authentication calculation model, calculate a second authentication digest based on the authentication parameters and the information to be authenticated, and compare the second authentication digest with the first authentication digest to obtain an authentication result; A sending unit is used to send the authentication result to the client.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program, characterized in that When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images