Parameter tamper-proofing method, system, electronic device and storage medium

Abstract

The present application provides a parameter anti-tampering method, system, electronic device and storage medium, which are applied to the field of parameter anti-tampering technology. When a client determines that an interface request needs to be processed for parameter anti-tampering, the result obtained by splicing URL information and data information is processed for anti-tampering to obtain a first signature string; a risk control server stores signature information generated according to the first signature string; when an interface interception middleware determines that an interface request needs to be processed for parameter anti-tampering, the result obtained by splicing URL information and data information is processed for anti-tampering to obtain a second signature string; the risk control server uses the signature information to perform parameter anti-tampering verification on the second signature string; when the interface interception middleware receives verification information indicating that the second signature string verification has passed, the interface request is sent to the application server, which can reduce the coupling between the system's business code and security verification logic, and reduce the system upgrade cycle and operation and maintenance costs.

Description

Technical Field

[0001] The present application relates to the technical field of parameter tamper prevention, and more specifically, to a parameter tamper prevention method, system, electronic device, and storage medium. Background Art

[0002] With the continuous development of computer technology, the problem of data or request parameters being tampered with during data or request transmission is easy to occur, especially in system interface requests. Once the parameters in the request are tampered with, the corresponding data of the request cannot be obtained, thus affecting the subsequent corresponding business processing. To prevent the problem of tampering during the request transmission process, the parameter tamper-proof processing can be performed on the transmitted request.

[0003] In existing interface parameter anti-tampering technology, the conventional implementation method usually includes the following steps: first, the parameters in the interface request are lexicographically sorted, so as to generate a signature value sign based on the parameter sequence obtained after sorting; finally, the obtained signature value sign is appended to the end of the request in plain text for transmission verification. However, this method requires the implementation of parameter extraction and sorting algorithms for each interface in advance, resulting in a high degree of coupling between the business code and the security verification logic, and limited system scalability. On the other hand, for historical systems that have been put into production and do not have an integrated anti-tampering mechanism, the transformation process requires the code reconstruction of each interface at a time, which not only leads to a long system upgrade cycle, but also increases the system's operation and maintenance costs. Summary of the Invention

[0004] In view of this, the present application provides a parameter anti-tampering method, system, electronic device and storage medium, with the purpose of reducing the coupling between the system's business code and security verification logic, reducing the system upgrade cycle and the system's operation and maintenance costs.

[0005] In a first aspect, the present application provides a parameter anti-tampering method, which is applied to a parameter anti-tampering system. The parameter anti-tampering system includes a client, a risk control server, an interface interception middleware, and an application server. The client establishes a long connection with the risk control server. The method includes:

[0006] Generate a corresponding interface request according to the target service through the client, wherein the interface request includes at least url information and data information;

[0007] If the interface request requires parameter tamper-proof processing, the client concatenates the URL information and the data information, and performs tamper-proof processing on the concatenated result to obtain a first signature string;

[0008] The client transmits the first signature string to the risk control server based on the long link protocol, so that the risk control server generates signature information according to the first signature string and stores the signature information;

[0009] The interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request needs to be tamper-proofed, concatenates the URL information and the data information in the interface request, and performs tamper-proofing on the concatenated result to obtain a second signature string;

[0010] The risk control server receives the second signature string sent by the interface interception intermediate, and performs parameter tamper-proof verification on the second signature string using the signature information stored in the server;

[0011] When the interface interception middleware receives verification information from the risk control server indicating that the second signature string verification has passed, it sends the interface request to the application server, so that the application server executes the target business based on the interface request.

[0012] Optionally, the generating, by the client, a corresponding interface request according to the target service includes:

[0013] Generate, by the client, a corresponding initial interface request according to the interface requested by the target service, and determine a request type of the initial interface request;

[0014] If the request type is a target request type, obtaining data information related to the target service through the client, and generating an interface request corresponding to the target service according to the URL information and the data information in the initial interface request;

[0015] If the request type is not the target request type, the client determines the initial interface request as an interface request for the target service.

[0016] Optionally, the client includes an interface interception component, and the method further includes:

[0017] Determining, by the interface interception component, whether a pre-set parameter anti-tampering configuration file has an interface corresponding to the interface request; wherein the parameter anti-tampering configuration file is pre-configured by a parameter anti-tampering configuration center in the parameter anti-tampering system;

[0018] If the parameter tamper-proof configuration file has the interface, determining through the interface interception component that the interface request needs to be processed for parameter tamper-proofing;

[0019] If the parameter anti-tampering configuration file does not contain the interface, the interface interception component determines that the interface request does not require parameter anti-tampering processing.

[0020] Optionally, the client concatenates the URL information and the data information, and performs tamper-proof processing on the concatenated result to obtain a first signature string, including:

[0021] The interface interception component is used to splice the url information and the data information, and the spliced ​​result is spliced ​​with the preset salt value to obtain an initial first signature string;

[0022] The interface interception component performs an MD5 operation on the initial first signature string to obtain a first signature string.

[0023] Optionally, the interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request requires parameter tamper-proof processing, splices the URL information and data information in the interface request, and performs tamper-proof processing on the spliced ​​result to obtain a second signature string, including:

[0024] The interface interception middleware receives the interface request sent by the client, and determines whether the interface request needs parameter tamper prevention processing according to the interface corresponding to the interface request and a preset parameter tamper prevention configuration file;

[0025] If the interface request needs to be processed for parameter tamper prevention, the url information and data information in the interface request are spliced ​​through the interface interception middleware, and the spliced ​​result is spliced ​​with the preset salt value to obtain the initial second signature string, and the MD5 operation is performed on the initial second signature string to obtain the second signature string.

[0026] Optionally, the receiving, by the risk control server, the second signature string sent by the interface interception middleware, and performing parameter tamper-proof verification on the second signature string using the signature information stored in the server, includes:

[0027] Receiving, through the risk control server, the second signature string sent by the interface interception middleware;

[0028] The risk control server determines, based on the second signature string, whether there is signature information matching the second signature string among the signature information stored in the server; wherein the signature information matching the second signature string includes a first signature string identical to the second signature string and a timeout period;

[0029] If there is signature information matching the second signature string, obtain the current time through the risk control server, and verify the validity of the first signature string based on the current time and the timeout period;

[0030] If the validity verification of the first signature string passes, feedback is given to the interface interception middleware via the risk control server, indicating that the parameter tamper-proof verification of the second signature string passes;

[0031] If the validity check of the first signature string fails, or there is no signature information matching the second signature string, verification information indicating that the parameter anti-tampering check of the second signature string fails is fed back to the interface interception middleware through the risk control server.

[0032] Optionally, the method further includes:

[0033] When the interface interception middleware receives verification information from the risk control server indicating that the parameter tamper-proof verification of the second signature string has failed, it intercepts the interface request and feeds back prompt information indicating that the interface request verification has failed to the client.

[0034] A second aspect of the present application provides a parameter anti-tampering system, the system comprising: a client, a risk control server, an interface interception middleware, and an application server, wherein the client establishes a long link with the risk control server;

[0035] The client is configured to generate a corresponding interface request according to the target business, wherein the interface request includes at least URL information and data information; if the interface request requires parameter tamper-proof processing, the URL information and the data information are concatenated, and the concatenated result is tamper-proof processed to obtain a first signature string; the first signature string is transmitted to the risk control server based on a long link protocol, so that the risk control server generates signature information based on the first signature string and stores the signature information;

[0036] The interface interception middleware is configured to receive the interface request sent by the client, and upon determining that the interface request requires parameter tamper-proof processing, concatenate the URL information and the data information in the interface request, and perform tamper-proof processing on the concatenated result to obtain a second signature string; and upon receiving verification information fed back by the risk control server indicating that verification of the second signature string has passed, send the interface request to the application server, causing the application server to execute the target service based on the interface request;

[0037] The risk control server is configured to receive the second signature string sent by the interface interception middleware, and perform parameter tamper-proof verification on the second signature string using the signature information stored in the server.

[0038] The third aspect of the present application provides an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement a parameter anti-tampering method provided in the first aspect of the present application.

[0039] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute a parameter anti-tampering method provided in the first aspect of the present application.

[0040] The present application provides a parameter anti-tampering method, system, electronic device and storage medium, which are applied to the parameter anti-tampering system. The parameter anti-tampering system includes a client, a risk control server, an interface interception middleware and an application server. The client and the risk control server establish a long link; the client generates a corresponding interface request according to the target business, wherein the interface request includes at least url information and data information; if the interface request needs to be processed for parameter anti-tampering, the client splices the url information and the data information, and performs anti-tampering processing on the spliced ​​result to obtain a first signature string; the client transmits the first signature string to the risk control server based on the long link protocol, so that the risk control server generates a signature string according to the first signature string. The interface interception middleware generates signature information from a string and stores the signature information; receives the interface request sent by the client through the interface interception middleware, and when it is determined that the interface request needs to be tamper-proofed, splices the url information and data information in the interface request, and performs tamper-proofing on the spliced ​​result to obtain a second signature string; receives the second signature string sent by the interface interception middleware through the risk control server, and performs parameter tamper-proofing verification on the second signature string using the signature information stored in itself; when the interface interception middleware receives verification information from the risk control server indicating that the second signature string verification has passed, it sends the interface request to the application server, so that the application server executes the target business based on the interface request. It can be seen from this that the technical solution provided by the present application is that when the client and the interface interception middleware determine that the interface request needs to be processed for parameter anti-tampering, they directly splice the url information and data information in the interface request, and then perform anti-tampering processing on the spliced ​​result to obtain the corresponding signature string. There is no need to sort the parameters in the interface request, that is, there is no need to extract and sort the parameters separately for each interface, which reduces the coupling between business code and security verification and improves the scalability of the parameter anti-tampering system; and, for the parameter anti-tampering system that has been put into production and has not integrated the anti-tampering mechanism, there is no need to reconstruct the code for each interface, which can effectively reduce the system upgrade cycle and reduce the system's operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0042] Figure 1 A schematic diagram of the structure of a parameter anti-tampering system provided in an embodiment of the present application;

[0043] Figure 2A schematic diagram of the structure of another parameter anti-tampering system provided in an embodiment of the present application;

[0044] Figure 3 A flow chart of a parameter tamper prevention method provided in an embodiment of the present application;

[0045] Figure 4 An example diagram of a parameter tamper-proofing method provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0048] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0049] See also Figure 1 , shows a structural diagram of a parameter anti-tampering system provided in an embodiment of the present application; the parameter anti-tampering system includes a client, a risk control server, an interface interception middleware and an application server;

[0050] The client is configured to generate an interface request corresponding to the target business, wherein the interface request includes at least Uniform Resource Locator (URL) information and data information; if the interface request requires parameter tamper-proof processing, the URL information and the data information are concatenated, and the concatenated result is subjected to tamper-proof processing to obtain a first signature string; the first signature string is transmitted to the risk control server based on the long link protocol, so that the risk control server generates signature information based on the first signature string and stores the signature information;

[0051] The interface interception middleware is configured to receive an interface request sent by a client, and when determining that the interface request requires parameter tamper-proof processing, concatenate the URL information and data information in the interface request, and perform tamper-proof processing on the concatenated result to obtain a second signature string; upon receiving verification information from the risk control server indicating that the second signature string has passed verification, the interface request is sent to the application server, causing the application server to execute the target business based on the interface request;

[0052] The risk control server is used to receive the second signature string sent by the interface interception middleware, and use the signature information stored in the server to perform parameter tamper-proof verification on the second signature string.

[0053] The present application provides a parameter tamper-proofing system, which generates a corresponding interface request according to a target business through a client, wherein the interface request includes at least URL information and data information; if the interface request needs to be processed for parameter tamper-proofing, the URL information and the data information are spliced ​​through the client, and the result of the splicing is processed for tamper-proofing to obtain a first signature string; the first signature string is transmitted to a risk control server by the client based on a long link protocol, so that the risk control server generates signature information according to the first signature string and stores the signature information; the interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request needs to be processed for parameter tamper-proofing, the URL information and the data information in the interface request are spliced, and the result of the splicing is processed for tamper-proofing to obtain a second signature string; the risk control server receives the second signature string sent by the interface interception middleware, and performs parameter tamper-proofing verification on the second signature string using the signature information stored in the interface interception middleware; when the interface interception middleware receives verification information from the risk control server indicating that the second signature string verification has passed, the interface request is sent to the application server, so that the application server executes the target business based on the interface request. It can be seen from this that the technical solution provided by the present application is that when the client and the interface interception middleware determine that the interface request needs to be processed for parameter anti-tampering, they directly splice the url information and data information in the interface request, and then perform anti-tampering processing on the spliced ​​result to obtain the corresponding signature string. There is no need to sort the parameters in the interface request, that is, there is no need to extract and sort the parameters separately for each interface, which reduces the coupling between business code and security verification and improves the scalability of the parameter anti-tampering system; and, for the parameter anti-tampering system that has been put into production and has not integrated the anti-tampering mechanism, there is no need to reconstruct the code for each interface, which can effectively reduce the system upgrade cycle and reduce the system's operation and maintenance costs.

[0054] Optionally, a client that generates a corresponding interface request based on the target business is used to:

[0055] Generate the corresponding initial interface request according to the interface requested by the target business, and determine the request type of the initial interface request; if the request type is the target request type, obtain the data information related to the target business, and generate the interface request corresponding to the target business based on the url information and data information in the initial interface request; if the request type is not the target request type, determine the initial interface request as the interface request of the target business.

[0056] Combine Figure 1 See also Figure 2 ,The parameter tamper-proof system also includes a parameter tamper-proof configuration center, and the client also includes an application module and an interface interception component;

[0057] An interface interception component is used to determine whether a pre-set parameter anti-tampering configuration file has an interface corresponding to the interface request; wherein the parameter anti-tampering configuration file is pre-configured through the parameter anti-tampering configuration center in the parameter anti-tampering system; if the parameter anti-tampering configuration file has an interface, it is determined that the interface request needs to be processed for parameter anti-tampering; if the parameter anti-tampering configuration file does not have an interface, it is determined that the interface request does not need to be processed for parameter anti-tampering.

[0058] Optionally, the URL information and the data information are concatenated, and the concatenated result is tamper-proofed to obtain the client of the first signature string, specifically for:

[0059] The url information and data information are spliced ​​together through the interface interception component, and the spliced ​​result is spliced ​​with the preset salt value to obtain an initial first signature string; the interface interception component performs a message digest algorithm (Message-Digest Algorithm, MD5) operation on the initial first signature string to obtain a first signature string.

[0060] Optionally, an interface interception component is provided that receives an interface request sent by a client and, when it is determined that the interface request requires parameter tamper-proof processing, concatenates the URL information and data information in the interface request, and performs tamper-proof processing on the concatenated result to obtain a second signature string, specifically for:

[0061] Receive the interface request sent by the client, and determine whether the interface request needs to be processed for parameter anti-tampering based on the interface corresponding to the interface request and the preset parameter anti-tampering configuration file; if the interface request needs to be processed for parameter anti-tampering, splice the url information and data information in the interface request, and splice the spliced ​​result with the preset salt value to obtain an initial second signature string, perform MD5 operation on the initial second signature string, and obtain a second signature string.

[0062] Optionally, the risk control server, which receives the second signature string sent by the middleware and uses its own stored signature information to perform parameter tamper-proof verification on the second signature string, is specifically used to:

[0063] Intercept the second signature string sent by the middleware through the risk control server receiving interface;

[0064] Based on the second signature string, it is determined whether there is signature information matching the second signature string in each signature information stored in itself; wherein, the signature information matching the second signature string includes the first signature string and timeout period that are identical to the second signature string; if there is signature information matching the second signature string, the current time is obtained, and the validity of the first signature string is verified based on the current time and the timeout period; if the validity verification of the first signature string passes, verification information indicating that the parameter anti-tampering check of the second signature string passes is fed back to the interface interception middleware; if the validity verification of the first signature string fails, or there is no signature information matching the second signature string, verification information indicating that the parameter anti-tampering check of the second signature string fails is fed back to the interface interception middleware.

[0065] Optionally, interface interception middleware is also used to:

[0066] When receiving verification information fed back by the risk control server indicating that the parameter tamper-proof verification of the second signature string has failed, the interface request is intercepted, and prompt information indicating that the interface request verification has failed is fed back to the client.

[0067] Based on the parameter anti-tampering system provided by the embodiment of the present application, the embodiment of the present application accordingly provides a parameter anti-tampering method, such as Figure 3 As shown, the method is applied to a parameter anti-tampering system, and the method specifically includes the following steps:

[0068] S301: Generate a corresponding interface request according to the target service through the client, wherein the interface request at least includes URL information and data information.

[0069] During the specific execution of step S301, when the client detects the existence of a regular business that requests a server interface behavior during the execution of a regular business, the regular business that requests a server interface behavior can be taken as the target business, and a corresponding interface request can be generated according to the request type of the target business, wherein the interface request includes at least url information and data information.

[0070] It should be noted that the conventional services executed by the client may include ordering services, voting services, etc., which are not limited in the embodiments of the present application.

[0071] Optionally, the process of generating a corresponding interface request according to the target business through the client includes: generating a corresponding initial interface request according to the interface requested by the target business through the client, and determining the request type of the initial interface request; if the request type is the target request type, obtaining data information related to the target business, and generating an interface request corresponding to the target business based on the url information and data information in the initial interface request; if the request type is not the target request type, determining the initial interface request as the interface request of the target business.

[0072] It should be noted that the request type of the initial interface request of the target service is the request type of the target service. The initial interface request can be a post request or a get request, where post and get refer to the request methods of the http protocol.

[0073] It should also be noted that the target request type may be a Get request type, that is, if the initial interface request is a Get request, then the request type of the initial interface request may be considered to be a Get request type.

[0074] In an embodiment of the present application, research has found that in the prior art, if the interface request for a regular business executed by the client is a Get request, then the data information corresponding to the regular business is placed in the body, rather than carried by the Get request itself. Therefore, in order to ensure that the interface request for the generated target business will definitely include url information and data information, this application will first determine whether the initial interface request for the target business is a Get request before generating the interface request for the target business. If so, the data information corresponding to the target business can be obtained first, and then an interface request containing url information and data information can be generated based on the url information in the initial interface request and the obtained data information. In this way, it can be ensured that the interface request for the generated target business must include url information and data information.

[0075] In actual application, the client includes an application module and an interface interception component. When the client detects the existence of a regular business that requests a server interface, that is, detects the existence of a target business, it can determine the interface requested by the target business through the application module, and generate a corresponding initial interface request for the interface; determine the request type of the initial interface request; so that when the request type is the target request type, according to the URL information in the initial interface request and the data information of the target business, a corresponding interface request is generated and the interface request is initiated; or, when the request type is not the target request type, the initial interface request is directly determined as the interface request of the target business, and the interface request is initiated.

[0076] S302: The client determines whether the interface request requires parameter tamper-proof processing; if the interface request requires parameter tamper-proof processing, execute step S303.

[0077] In an embodiment of the present application, the parameter anti-tampering system also includes a parameter anti-tampering configuration center, through which the user can configure multiple interfaces that require parameter anti-tampering judgment, that is, after the parameter anti-tampering configuration center detects multiple interfaces configured by the user, it can generate a parameter anti-tampering configuration file based on the multiple interfaces configured by the user, and distribute the generated parameter anti-tampering configuration file to the client and the interface interception middleware.

[0078] During the specific execution of step S302, after initiating the interface request corresponding to the target business, the client can further determine the interface requested by the target business, that is, determine the interface corresponding to the interface request, and judge whether the interface request needs to be processed for parameter anti-tampering based on the interface and the parameter anti-tampering configuration file distributed by the parameter anti-tampering center; if the interface request needs to be processed for parameter anti-tampering, execute step S303; if the interface request does not need to be processed for parameter anti-tampering, the interface request can be directly sent to the application server, so that the application server completes the corresponding business request based on the interface request received.

[0079] Optionally, the client includes an interface interception component, and the process of determining whether an interface request requires parameter anti-tampering processing through the client can be specifically as follows: determining through the interface interception component whether there is an interface corresponding to the interface request in a pre-set parameter anti-tampering configuration file; wherein, the parameter anti-tampering configuration file is pre-configured through the parameter anti-tampering configuration center in the parameter anti-tampering system; if there is an interface in the parameter anti-tampering configuration file, determining through the interface interception component that the interface request requires parameter anti-tampering processing; if there is no interface in the parameter anti-tampering configuration file, determining through the interface interception component that the interface request does not require parameter anti-tampering processing.

[0080] It can be seen from this that after the client initiates the corresponding interface request through the application module, the interface interception component can use the pre-configured parameter anti-tampering configuration file to identify the interface requests that need to be processed for parameter anti-tampering, avoiding indiscriminate parameter anti-tampering processing for each interface request. This can not only improve the corresponding processing efficiency, but also save a certain amount of computing resources.

[0081] S303: The client concatenates the URL information and the data information, and performs tamper-proof processing on the concatenated result to obtain a first signature string.

[0082] During the specific execution of step S303, when the client determines that the initiated interface request requires parameter tamper-proof processing, it can first extract the URL information and data information from the interface request, splice the URL information and data information, and perform tamper-proof processing on the splicing result and the preset salt value to obtain the final first signature string.

[0083] Optionally, the url information and data information are spliced ​​through the client, and the spliced ​​result is tamper-proofed. The process of obtaining the first signature string can be specifically as follows: the url information and data information are spliced ​​through the interface interception component, and the spliced ​​result is spliced ​​with the preset salt value to obtain the initial first signature string; the MD5 operation is performed on the initial first signature string through the interface interception component to obtain the first signature string.

[0084] In an embodiment of the present application, the splicing position of the url information, data information and preset salt value can be pre-set so that when the client determines that the initiated interface request needs to be processed for parameter anti-tampering, the url information and data information can be extracted from the interface request through the interface interception component, and the url information, data information and preset salt value are spliced ​​according to the pre-set splicing position to obtain the initial first signature string, and finally the MD5 operation is performed on the initial first signature string to obtain the first signature string.

[0085] As an implementation method of an embodiment of the present application, the pre-set splicing positions of the url information, data information and preset salt value can be: the url information is in the first position, the data information is in the second position, and the preset salt value is in the third position; the above is a preferred method for setting the splicing position provided for the implementation of the present application. The specific setting method of the splicing position can be set according to actual application, and is not limited in this embodiment of the present application.

[0086] For example, assume that the splicing positions of the url information, data information and preset salt value are pre-set as follows: the url information is in the first position, the data information is in the second position, and the preset salt value is in the third position; when the client determines that the initiated interface request requires parameter tamper-proof operation, the url information extracted from the interface request through the interface interception component is https: / / www.mgtv.com?a=1&b=2', and the data information is: '{"c":1, "d":2}'; if the preset salt value is 'mgtv123', then the url information, data information and preset salt value are spliced ​​according to the preset splicing position, and the obtained initial first signature string is orign_str='https: / / www.mgtv.com?a=1&b=2{"c":1, "d":2}mgtv123'; finally, the MD5 operation is performed on the initial first signature string to obtain the final first signature string.

[0087] In the embodiment of the present application, research has found that the current parameter tamper-proof method is to sort the various parameters in the interface request, but sorting the various parameters may insert the parameters in the url information into the data information, and insert the parameters in the data information into the url information. For example, the url information contains a goods_id parameter. Using this method may pass the goods_id parameter of the url information into the data information. Moreover, different results may appear for the same key sorting in different languages, which not only easily leads to subsequent signature verification failure, but also is non-standard for some client interface requests. Once the parameters of the url information are placed in the data information, it may also affect the business logic, thereby causing bugs in the subsequent corresponding business processing process.

[0088] Therefore, the client provided by this application, when determining that the interface request initiated needs to perform parameter anti-tampering operation, splices the url information and data information through the interface interception component, and splices the spliced ​​result with the preset salt value to obtain the initial first signature string, and finally performs the MD5 operation on the initial first signature string through the interface interception component to obtain the first signature string, without sorting the url information and data information, so as not to disrupt the original url information and data information, not only to a certain extent, but also to avoid affecting the business logic, thereby avoiding bugs in the subsequent business processing process. It can be seen that the technical solution provided by this application does not need to implement parameter extraction and sorting for each interface separately in advance, that is, there is no need to transform the existing interface logic, reduce the low coupling between the business code and the security verification logic, and improve the scalability of the system; on the other hand, for historical systems that have been put into production and have not integrated anti-tampering mechanisms, there is no need to reconstruct the code for each interface, which can effectively shorten the system upgrade cycle and reduce the system operation and maintenance costs. In short, the technical solution provided by this application can complete the corresponding parameter anti-tampering processing without perception, intrusion, and low risk.

[0089] S304: The client transmits the first signature string to the risk control server based on the long link protocol, so that the risk control server generates signature information according to the first signature string and stores the signature information.

[0090] During the specific execution of step S304, after the client generates the first signature string of the interface request through the interface interception component, it can transmit the first signature string to the risk control server through the long link protocol, so that the risk control server will store the received first signature string in the form of a key-value pair to the key-value middleware. That is to say, after receiving the first signature string transmitted by the client, the risk control server can generate signature information based on the first signature string and the timeout period, and store the generated signature information to the key-value middleware.

[0091] It should be noted that the signature information includes a key-value pair generated according to the first signature string and a preset timeout period. For example, if the first signature string is "sign_str", then the key-value pair generated according to the first signature string can be key=sign_str, value=1.

[0092] It should also be noted that the timeout period can be 5 seconds, 6 seconds, etc., and can be set according to actual applications, and is not limited in this embodiment of the present application.

[0093] In an embodiment of the present application, the interface interception middleware effectively conceals the first signature string to be transmitted via a long link protocol. Transmission via the long link protocol also adds logic such as cryptographic verification to the long link itself, thereby increasing the security of data transmission. Configuring a pre-set timeout on the generated key-value pair effectively facilitates subsequent parameter tamper-proof verification, ensuring that a signature can only be successfully verified once within the timeout period.

[0094] It should be noted that the key verification logic of the long link itself can be account and key verification, which is not limited in this embodiment of the present application.

[0095] S305: The interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request needs to be tamper-proofed, the URL information and data information in the interface request are spliced, and the tamper-proofed result is processed to obtain a second signature string.

[0096] During the specific execution of step S305, the client can send the interface request to the interface interception middleware while sending the first signature string corresponding to the interface request to the risk control server, so that after receiving the interface request sent by the client, the interface interception middleware can determine whether the interface request needs to be processed for parameter anti-tampering based on the parameter anti-tampering configuration file sent by the parameter anti-tampering configuration center. If necessary, the interface request will continue to be processed for parameter anti-tampering; if not, the corresponding prompt information can be output first to allow the user to further manually confirm the interface request; when the user confirms that the interface request is correct, the interface request is forwarded to the application server; when the user determines that there is a problem with the interface request, the interface request is intercepted to avoid forwarding the interface request to the application server, and information about the failure of the interface request is fed back to the client.

[0097] Optionally, the interface request sent by the client is received through the interface interception middleware, and when it is determined that the interface request needs to be processed for parameter anti-tampering, the url information and data information in the interface request are spliced, and the spliced ​​result is processed for parameter anti-tampering. The process of obtaining the second signature string can be specifically as follows: the interface request sent by the client is received through the interface interception middleware, and whether the interface request needs to be processed for parameter anti-tampering is determined according to the interface corresponding to the interface request and a preset parameter anti-tampering configuration file; if the interface request needs to be processed for parameter anti-tampering, the url information and data information in the interface request are spliced, and the spliced ​​result is spliced ​​with a preset salt value to obtain an initial second signature string, and an MD5 operation is performed on the initial second signature string to obtain a second signature string.

[0098] In some embodiments, the interface interception middleware can determine whether there is an interface corresponding to the interface request in the parameter anti-tampering configuration file; if there is an interface in the parameter anti-tampering configuration file, it is determined that the interface request needs to be processed for parameter anti-tampering; if there is no interface in the parameter anti-tampering configuration file, it is determined that the interface request does not need to be processed for parameter anti-tampering.

[0099] It should be noted that when the interface interception middleware receives an interface request, it can first use the pre-configured parameter anti-tampering configuration file to identify whether the currently received interface request requires parameter anti-tampering processing, so as to avoid indiscriminate parameter anti-tampering processing for each interface request, which can not only improve the corresponding processing efficiency, but also save certain computing resources; however, since the interface interception middleware will receive the interface request sent by the client on the premise that the client believes that the interface request needs to be processed for parameter anti-tampering, therefore, normally the interface request received by the interface interception middleware also needs to be processed for parameter anti-tampering. At this time, if the interface interception middleware believes that the received interface request does not need to be processed for parameter anti-tampering, then the received interface request may have changed. In order to further ensure the accuracy of the parameter anti-tampering processing judgment, the corresponding prompt information can be output to intervene in the corresponding manual confirmation to avoid erroneous interception of the correct interface request, thereby affecting the subsequent processing of the target business.

[0100] It should also be noted that this application flexibly manages interface requests that require parameter anti-tampering processing by accessing the interface middleware. When a bug in the parameter anti-tampering logic is found, the corresponding parameter anti-tampering logic can be temporarily removed from the shelves without modifying the overall business processing logic, thereby avoiding affecting the corresponding business logic and avoiding bugs in the execution of business processing.

[0101] In an embodiment of the present application, when the interface interception middleware determines that the interface request needs to be processed for parameter anti-tampering, it can splice the URL information, data information and preset salt value in the interface request according to the preset splicing position to obtain the initial second signature string, and perform the MD5 operation on the initial second signature string to obtain the final second signature string.

[0102] It should be noted that the preset salt value and splicing position involved in the interface interception middleware's parameter tamper-proof processing of the interface request are the same as the preset salt value and splicing position involved in the client's parameter tamper-proof processing of the interface request.

[0103] S306: intercept the second signature string sent by the middleware through the receiving interface of the risk control server, and use the signature information stored in the server to perform parameter tamper-proof verification on the second signature string.

[0104] During the specific execution of step S306, after obtaining the second signature string of the interface request, the interface interception middleware can send the second signature string of the interface request to the risk control server; after receiving the second signature string of the interface request, the risk control server uses the first signature string and timeout time in each signature information stored in itself to perform parameter anti-tampering verification on the second signature string; if the verification passes, verification information indicating that the second signature string verification has passed is fed back to the interface interception middleware; if the verification fails, verification information indicating that the second signature string verification has failed is fed back to the interface interception middleware.

[0105] Optionally, the interface interception middleware obtains the signature information of the interface request from the risk control server, and uses the signature information and the second signature string to perform parameter anti-tampering verification on the interface request. The specific process can be: receiving the second signature string sent by the interface interception middleware through the risk control server; judging by the risk control server whether there is signature information matching the second signature string among the signature information stored in itself based on the second signature string; wherein the signature information matching the second signature string includes the first signature string and timeout time that are the same as the second signature string; if there is signature information matching the second signature string, the current time of the risk control server is used to verify the validity of the first signature string based on the current time and the timeout time; if the validity verification of the first signature string passes, the risk control server feeds back verification information indicating that the parameter anti-tampering verification of the second signature string passes to the interface interception middleware; if the validity verification of the first signature string fails, or there is no signature information matching the second signature string, the risk control server feeds back verification information indicating that the parameter anti-tampering verification of the second signature string fails to the interface interception middleware.

[0106] In some embodiments, after receiving the second signature string sent by the interface interception middleware, the risk control server can use Key=second signature string to search in [key-value middleware] whether there is a first signature string that is identical to the second signature string; if so, the signature information corresponding to the first signature string that is identical to the second signature string can be determined as the signature information that matches the second signature string; the risk control server obtains the current time and the storage time when the signature string is stored, and calculates the time difference between the current time and the storage time; determines whether the time difference is greater than the timeout time in the signature information that matches the second signature string; if not, determines that the parameter anti-tampering check of the second signature string has passed; if greater, or there is no first signature string that is identical to the second signature string, it can be determined that the parameter anti-tampering check of the second signature string has failed.

[0107] Furthermore, in an embodiment of the present application, when the risk control server determines that the parameter tamper-proof verification of the second signature string has passed, the signature information matching the second signature string can be deleted from the [key-value middleware] to ensure that the signature information is not subject to replay attacks.

[0108] S307: Determine, through the interface interception middleware, whether the verification information fed back by the risk control server indicates that the parameter tamper-proof verification of the second signature string has passed; if so, execute step S308; if not, execute step S309.

[0109] S308: The interface interception middleware sends the interface request to the application server, so that the application server executes the target service based on the interface request.

[0110] During the specific execution of step S308, when the risk control server determines that the parameter tamper-proof verification of the second signature string of the interface request sent by the interface interception middleware has passed, the risk control server will feedback verification information indicating that the second signature string verification has passed to the interface interception middleware, so that the interface interception middleware will forward the complete interface request to the application server after receiving the verification information, so that the application server can complete the corresponding business according to the received interface request.

[0111] For example, when the target business corresponding to the interface request is placing an order, the application server can complete the corresponding order request logic after receiving the interface request, thereby completing the corresponding order business.

[0112] In the embodiment of the present application, research has found that the existing parameter anti-tampering processing will put the signature string at the end of the URL information after obtaining the corresponding signature string, as a new parameter, so that the interface request carrying the signature string can be directly sent to the server. When the business intrusion is large, bugs may occur when the server performs corresponding business processing based on the received interface request. Business processing fails; the present application sends the obtained first signature string separately to the risk control server for storage, and sends the complete interface request to the interface interception middleware for parameter anti-tampering processing and parameter anti-tampering verification. When the parameter anti-tampering verification passes, the complete interface request is also forwarded to the server. In this way, even if the business intrusion is large, there will be no bug due to changes in the received interface request, which can reduce the business processing failure to a certain extent.

[0113] S309: The interface request is intercepted by the interface interception middleware, and prompt information indicating that the interface request verification has failed is fed back to the client.

[0114] During the specific execution of step 309, when the risk control server determines that the parameter tamper-proof verification of the second signature string has failed, it sends verification information indicating that the signature string verification has failed to the interface interception middleware, so that the interface interception middleware intercepts the corresponding interface request when receiving the verification information to prevent the interface request from being transmitted to the application server. At the same time, it can also feedback prompt information indicating that the interface request verification has failed to the client, so that the client user can promptly understand that the interface request verification has failed and take corresponding measures in time to affect the corresponding business processing progress.

[0115] The present application provides a parameter anti-tampering method, which is applied to a parameter anti-tampering system. The parameter anti-tampering system includes a client, a risk control server, an interface interception middleware and an application server. The client and the risk control server establish a long link; the client generates a corresponding interface request according to the target business, wherein the interface request includes at least url information and data information; if the interface request needs to be processed for parameter anti-tampering, the client splices the url information and the data information, and performs anti-tampering processing on the spliced ​​result to obtain a first signature string; the client transmits the first signature string to the risk control server based on the long link protocol, so that the risk control server generates a signature according to the first signature string information, and stores the signature information; the interface request sent by the client is received through the interface interception middleware, and when it is determined that the interface request needs to be processed for parameter anti-tampering, the url information and data information in the interface request are spliced, and the spliced ​​result is processed for anti-tampering to obtain a second signature string; the second signature string sent by the interface interception middleware is received through the risk control server, and the parameter anti-tampering verification of the second signature string is performed by using the signature information stored in itself; when the interface interception middleware receives the verification information fed back by the risk control server indicating that the second signature string verification has passed, the interface request is sent to the application server, so that the application server executes the target business based on the interface request. It can be seen from this that the technical solution provided by the present application is that when the client and the interface interception middleware determine that the interface request needs to be processed for parameter anti-tampering, they directly splice the url information and data information in the interface request, and then perform anti-tampering processing on the spliced ​​result to obtain the corresponding signature string. There is no need to sort the parameters in the interface request, that is, there is no need to extract and sort the parameters separately for each interface, which reduces the coupling between business code and security verification and improves the scalability of the parameter anti-tampering system; and, for the parameter anti-tampering system that has been put into production and has not integrated the anti-tampering mechanism, there is no need to reconstruct the code for each interface, which can effectively reduce the system upgrade cycle and reduce the system's operation and maintenance costs.

[0116] In order to better understand the parameter anti-tampering method provided by this application, the following is explained by way of example. Figure 4 shown.

[0117] For example, the user configures the corresponding parameter anti-tampering configuration file in advance through the parameter anti-tampering configuration center, and distributes the parameter anti-tampering configuration file to the client and the interface interception middleware through the parameter anti-tampering configuration center.

[0118] When the client detects that a target business currently exists, it can initiate an interface request for the target business through the application module, that is, generate an initial interface request for the interface requested by the target business through the application module, wherein the request type of the initial interface request is a post request type; the initial interface request is directly used as the interface request for the target business.

[0119] The client intercepts the interface request through the interface interception component and performs parameter tamper-proof processing on the interface request, that is, it determines whether the parameter tamper-proof configuration file contains the interface corresponding to the interface request; if it does, it determines that the interface request needs to be tamper-proofed, and splices the URL information, data information and preset salt value in the interface request according to the pre-set splicing position to obtain the initial first signature string, and performs MD5 operation on the initial first signature string to obtain the first signature string, and finally sends the first signature string to the risk control server through the long link protocol.

[0120] The risk control server generates signature information based on the received first signature string and timeout period, and stores the signature information in the key-value middleware.

[0121] The client sends the interface request to the interface interception middleware through the interface interception component.

[0122] The interface interception middleware performs parameter tamper-proof processing on the interface request sent by the client, that is, it determines whether the parameter tamper-proof configuration file contains the interface corresponding to the interface request; if it does, it determines that the interface request needs to be tamper-proofed, and splices the URL information, data information and preset salt value in the interface request according to the pre-set splicing position to obtain the initial second signature string, and performs MD5 operation on the initial second signature string to obtain the second signature string, and finally sends the second signature string to the risk control server.

[0123] The risk control server (containing a long link) performs parameter tamper-proof verification on the second signature string, that is, it determines whether there is a first signature string consistent with the second signature string among the signature information stored in itself; if so, the signature information corresponding to the first signature string consistent with the second signature string is determined as the signature information matching the second signature string; it determines whether the timeout time in the signature information is greater than the time difference, where the time difference is the difference between the current time of the risk control server and the time when the signature information is stored; if not, it determines that the parameter tamper-proof verification of the second signature string has passed, and feedbacks verification information indicating that the second signature string verification has passed to the interface interception middleware.

[0124] When the interface interception middleware receives the verification information indicating that the second signature string verification has passed, it sends an interface request to the application server, so that the application server performs corresponding business processing according to the interface request.

[0125] The present application also provides a storage medium, which stores program instructions. When the program instructions are loaded and executed by a processor, any of the above-mentioned parameter anti-tampering method embodiments is implemented.

[0126] The present application also provides an electronic device, such as Figure 5 As shown, the device includes a processor 501 and a memory 502, and the processor and the memory are connected via a bus; program instructions are stored in the memory; the processor calls the program instructions in the memory to execute any of the above-mentioned parameter anti-tampering method embodiments.

[0127] The processor in this article can be the CPU of the terminal, or the MCU integrated in the terminal, or a combination of the CPU and MCU. In addition, the processor includes a core, which calls the corresponding program from the memory. There can be one or more cores.

[0128] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0129] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple. For relevant parts, refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without making any creative efforts.

[0130] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0131] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

[0132] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A parameter tamper-proof method, characterized in that: Applied to a parameter anti-tampering system, the parameter anti-tampering system includes a client, a risk control server, an interface interception middleware, and an application server. The client establishes a long link with the risk control server. The method includes: Generate, by the client, a corresponding initial interface request according to the interface requested by the target service, and determine a request type of the initial interface request; If the request type is a target request type, obtaining data information related to the target service through the client, and generating an interface request corresponding to the target service according to the URL information and the data information in the initial interface request; If the request type is not the target request type, determining the initial interface request as an interface request for the target service through the client, wherein the interface request includes at least url information and data information; If the interface request requires parameter tamper-proof processing, the client concatenates the URL information and the data information, and performs tamper-proof processing on the concatenated result to obtain a first signature string; The client transmits the first signature string to the risk control server based on the long link protocol, so that the risk control server generates signature information according to the first signature string and stores the signature information; The interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request needs to be tamper-proofed, concatenates the URL information and the data information in the interface request, and performs tamper-proofing on the concatenated result to obtain a second signature string; Receiving, through the risk control server, the second signature string sent by the interface interception middleware, and performing parameter tamper-proof verification on the second signature string using the signature information stored in the server; When the interface interception middleware receives verification information from the risk control server indicating that the second signature string verification has passed, it sends the interface request to the application server, so that the application server executes the target business based on the interface request.

2. The method according to claim 1, characterized in that The client includes an interface interception component, and the method further includes: Determining, by the interface interception component, whether a pre-set parameter anti-tampering configuration file has an interface corresponding to the interface request; wherein the parameter anti-tampering configuration file is pre-configured by a parameter anti-tampering configuration center in the parameter anti-tampering system; If the parameter tamper-proof configuration file has the interface, determining through the interface interception component that the interface request needs to be processed for parameter tamper-proofing; If the parameter anti-tampering configuration file does not contain the interface, the interface interception component determines that the interface request does not require parameter anti-tampering processing.

3. The method according to claim 2, characterized in that The client concatenates the URL information and the data information, and performs tamper-proof processing on the concatenated result to obtain a first signature string, including: The interface interception component is used to splice the url information and the data information, and the spliced ​​result is spliced ​​with the preset salt value to obtain an initial first signature string; The interface interception component performs an MD5 operation on the initial first signature string to obtain a first signature string.

4. The method according to claim 1, wherein The interface interception middleware receives the interface request sent by the client, and when it is determined that the interface request needs to be tamper-proof, splices the URL information and data information in the interface request, and performs tamper-proof processing on the spliced ​​result to obtain a second signature string, including: The interface interception middleware receives the interface request sent by the client, and determines whether the interface request needs parameter tamper prevention processing according to the interface corresponding to the interface request and a preset parameter tamper prevention configuration file; If the interface request needs to be processed for parameter tamper prevention, the url information and data information in the interface request are spliced ​​through the interface interception middleware, and the spliced ​​result is spliced ​​with the preset salt value to obtain the initial second signature string, and the MD5 operation is performed on the initial second signature string to obtain the second signature string.

5. The method according to claim 1, wherein The step of receiving, by the risk control server, the second signature string sent by the interface interception middleware, and performing parameter tamper-proof verification on the second signature string using the signature information stored in the server, includes: Receiving, through the risk control server, the second signature string sent by the interface interception middleware; The risk control server determines, based on the second signature string, whether there is signature information matching the second signature string among the signature information stored in the server; wherein the signature information matching the second signature string includes a first signature string identical to the second signature string and a timeout period; If there is signature information matching the second signature string, obtain the current time through the risk control server, and verify the validity of the first signature string based on the current time and the timeout period; If the validity verification of the first signature string passes, feedback is given to the interface interception middleware via the risk control server, indicating that the parameter tamper-proof verification of the second signature string passes; If the validity check of the first signature string fails, or there is no signature information matching the second signature string, verification information indicating that the parameter anti-tampering check of the second signature string fails is fed back to the interface interception middleware through the risk control server.

6. The method according to claim 1, wherein The method further comprises: When the interface interception middleware receives verification information from the risk control server indicating that the parameter tamper-proof verification of the second signature string has failed, it intercepts the interface request and feeds back prompt information indicating that the interface request verification has failed to the client.

7. A parameter anti-tampering system, characterized in that: The system includes: a client, a risk control server, an interface interception middleware and an application server, wherein the client establishes a long link with the risk control server; The client is used to generate a corresponding initial interface request according to the interface requested by the target business through the client, and determine the request type of the initial interface request; if the request type is a target request type, obtain data information related to the target business through the client, and generate an interface request corresponding to the target business according to the url information and the data information in the initial interface request; if the request type is not the target request type, determine the initial interface request as an interface request for the target business through the client, wherein the interface request at least includes url information and data information; if the interface request needs to perform parameter tamper-proof processing, splice the url information and the data information, and perform tamper-proof processing on the spliced ​​result to obtain a first signature string; transmit the first signature string to the risk control server based on the long link protocol, so that the risk control server generates signature information according to the first signature string, and stores the signature information; The interface interception middleware is configured to receive the interface request sent by the client, and upon determining that the interface request requires parameter tamper-proof processing, concatenate the URL information and the data information in the interface request, and perform tamper-proof processing on the concatenated result to obtain a second signature string; and upon receiving verification information fed back by the risk control server indicating that verification of the second signature string has passed, send the interface request to the application server, causing the application server to execute the target service based on the interface request; The risk control server is configured to receive the second signature string sent by the interface interception middleware, and perform parameter tamper-proof verification on the second signature string using the signature information stored in the server.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a bus; wherein the processor is configured to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement a parameter anti-tampering method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute a parameter anti-tampering method according to any one of claims 1 to 6.

Images