Service request processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a service request processing method and device, electronic equipment and a storage medium, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps: obtaining and analyzing a service request, and obtaining service information; extracting feature characters from the service information to obtain a feature character set; defining a transfer function for each feature character, and generating a self-defined character corresponding to the feature character based on the transfer function; constructing a positive mapping conversion table based on the custom characters, converting the feature characters in the service information into corresponding custom characters based on the positive mapping conversion table, and generating a converted security service request; and an inverse mapping conversion table is generated according to the positive mapping conversion table, the security service request and the inverse mapping conversion table are sent to a receiving end, and the receiving end restores the security service request into the service request according to the inverse mapping conversion table. According to the invention, the technical problem that one-way security reinforcement is easy to cause failure of a service request in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related technical fields. Specifically, it relates to a method, apparatus, electronic device, and storage medium for processing business requests. Background Technology

[0002] With the widespread application of computer technology in various fields, information security has risen from a traditional technical support dimension to a core element ensuring system operation. Whether it's a small or medium-sized enterprise website or personal blog displaying basic information, or a complex business system supporting multiple business scenarios such as financial transaction platforms, government service systems, and medical data management platforms, problems caused by security vulnerabilities are continuously drawing industry attention. These issues not only lead to the leakage of users' ID numbers, financial card information, and other private data, but may also cause system malfunctions and business process interruptions, becoming a critical issue that urgently needs to be addressed in the current digital development process.

[0003] In related technologies, one-way hardening is used to strengthen the security of business requests in order to deal with abnormal attacks. One-way hardening strengthens business requests by strictly filtering user input, especially intercepting or escaping symbols that may be regarded as special SQL characters. However, one-way security hardening may replace characters that originally had special interactive meaning, thereby causing the business request to fail after security hardening and the system to become unusable after hardening. Moreover, overly strict security hardening strategies may not only cause functional abnormalities and business interruptions, but may even make the original system unusable in specific business scenarios.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for processing business requests, to at least solve the technical problem in related technologies where unidirectional security hardening can easily cause business requests to fail.

[0006] According to one aspect of the present invention, a method for processing a service request is provided, comprising: intercepting a service request sent by a user terminal and parsing the service request to obtain service information; scanning the service information to find feature characters contained in the service information and extracting the feature characters from the service information to obtain a feature character set; defining a conversion function for each feature character in the feature character set and generating a custom character corresponding to the feature character based on the conversion function; constructing a forward mapping conversion table based on the custom character and converting the feature characters in the service information into the corresponding custom characters based on the forward mapping conversion table, and generating a converted secure service request; generating an inverse mapping conversion table according to the forward mapping conversion table, and sending the secure service request and the inverse mapping conversion table to a receiving end, wherein the receiving end restores the secure service request to the service request according to the inverse mapping conversion table.

[0007] Furthermore, the step of scanning the business information to find the feature characters contained in the business information includes: performing word segmentation on the business information to obtain business information segments; and scanning all the business information segments in parallel based on a preset feature character table to find the feature characters contained in each business information segment.

[0008] Further, the step of constructing a positive mapping conversion table based on the custom characters includes: for each custom character, configuring a character identifier and an effective expiration time stamp for the custom character; obtaining the feature character and conversion time stamp corresponding to the custom character; and constructing the positive mapping conversion table based on the custom character, the character identifier, the effective expiration time stamp, the feature character, and the conversion time stamp.

[0009] Furthermore, after constructing the positive mapping conversion table based on the custom characters, the method further includes: Step 1, comparing all the custom characters with all the feature characters to obtain a comparison result; Step 2, if the comparison result indicates that any feature character is the same as any custom character, determining that the custom character and the feature character conflict; Step 3, redefining the conversion function for the conflicting custom characters, and generating new custom characters based on the conversion function; repeating steps 1 to 3 until there are no conflicting custom characters.

[0010] Furthermore, the step of converting the feature characters in the business information into the corresponding custom characters based on the positive mapping conversion table includes: reading the effective expiration timestamp of the custom characters in the positive mapping conversion table; if the effective expiration timestamp is empty or the current timestamp is earlier than the effective expiration timestamp, positively mapping the feature characters in the business information to the corresponding custom characters according to the mapping relationship between the feature characters and the custom characters in the positive mapping conversion table.

[0011] Furthermore, for each feature character in the feature character set, the step of defining a conversion function includes: generating a random code for each feature character in the feature character set; recording the conversion timestamp corresponding to the feature character; selecting a replacement character from the secure replacement character table; and constructing the conversion function based on the random code, the conversion timestamp, and the replacement character.

[0012] Furthermore, the processing of the business request also includes: deploying an aspect interceptor at the system framework layer; and intercepting the business request sent by the user terminal through the aspect interceptor.

[0013] According to another aspect of the present invention, a service request processing apparatus is also provided, comprising: a parsing unit, configured to intercept a service request sent by a user terminal and parse the service request to obtain service information; an extraction unit, configured to scan the service information, search for feature characters contained in the service information, and extract the feature characters from the service information to obtain a feature character set; a generation unit, configured to define a conversion function for each feature character in the feature character set and generate a custom character corresponding to the feature character based on the conversion function; a conversion unit, configured to construct a forward mapping conversion table based on the custom characters, and convert the feature characters in the service information into the corresponding custom characters based on the forward mapping conversion table, and generate a converted secure service request; and a sending unit, configured to generate an inverse mapping conversion table according to the forward mapping conversion table, and send the secure service request and the inverse mapping conversion table to a receiving end, wherein the receiving end restores the secure service request to the service request according to the inverse mapping conversion table.

[0014] Furthermore, the extraction unit includes: a first processing module, used to perform word segmentation on the business information to obtain business information segments; and a first scanning module, used to scan all the business information segments in parallel based on a preset feature character table to find the feature characters contained in each of the business information segments.

[0015] Further, the conversion unit includes: a first configuration module, configured to configure a character identifier and an effective expiration time stamp for each custom character; a first acquisition module, configured to acquire the feature character and conversion time stamp corresponding to the custom character; and a first construction module, configured to construct the positive mapping conversion table based on the custom character, the character identifier, the effective expiration time stamp, the feature character, and the conversion time stamp.

[0016] Furthermore, the processing device for the business request further includes: a first comparison module, used in step one to compare all the custom characters with all the feature characters to obtain a comparison result; a first determination module, used in step two to determine that the custom character and the feature character conflict if the comparison result indicates that any of the feature characters are the same as any of the custom characters; a first definition module, used in step three to redefine the conversion function for the conflicting custom characters and generate new custom characters based on the conversion function; and a first repeat module, used to repeat steps one to three until there are no conflicting custom characters.

[0017] Furthermore, the conversion unit includes: a first reading module, used to read the effective expiration timestamp of the custom character in the positive mapping conversion table; and a first mapping module, used to positively map the feature character in the business information to the corresponding custom character according to the mapping relationship between the feature character and the custom character in the positive mapping conversion table when the effective expiration timestamp is empty or the current timestamp is earlier than the effective expiration timestamp.

[0018] Further, the generation unit includes: a first generation module, used to generate a random code for each feature character in the feature character set; a first recording module, used to record the conversion timestamp corresponding to the feature character; a first selection module, used to select a replacement character from a safe replacement character table; and a first construction module, used to construct the conversion function based on the random code, the conversion timestamp, and the replacement character.

[0019] Furthermore, the processing of the business request also includes: a first deployment module, used to deploy an aspect interceptor at the system framework layer; and a first interception module, used to intercept the business request sent by the user terminal through the aspect interceptor.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, a method for processing any of the above-mentioned service requests of the device where the computer-readable storage medium is located is provided.

[0021] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the processing method of any of the above-mentioned service requests.

[0022] In this application, the following steps are performed: intercepting and parsing the business requests sent by the user terminal to obtain business information; scanning the business information to find feature characters contained in the business information and extracting the feature characters from the business information to obtain a feature character set; then, for each feature character in the feature character set, defining a conversion function and generating a custom character corresponding to the feature character based on the conversion function; constructing a forward mapping conversion table based on the custom characters; converting the feature characters in the business information into the corresponding custom characters based on the forward mapping conversion table and generating a converted secure business request; finally, generating an inverse mapping conversion table based on the forward mapping conversion table and sending the secure business request and the inverse mapping conversion table to the receiving end, whereby the receiving end restores the secure business request to the business request based on the inverse mapping conversion table.

[0023] In this application, special characters, or feature character sets, are identified and extracted through in-depth analysis of business requests. This process is dynamic and adaptable to constantly changing business needs and security hardening strategies. For each feature character, one or more conversion functions are defined to generate corresponding custom characters. This step achieves secure conversion of special characters, avoiding potential loss of business functionality due to direct filtering or escaping. Based on the defined conversion functions, a forward mapping conversion table is created to record the mapping relationship between feature characters and custom characters. Using the forward mapping conversion table, feature characters in business information are converted into custom characters, generating a converted secure business request. Based on the forward mapping conversion table, an inverse mapping conversion table is automatically generated. This table is used to restore the custom characters back to the original feature characters after the backend receives the secure business request, thereby restoring the original state of the business information. This avoids interference with business logic and data format due to security hardening measures, improving business security and effectiveness. Furthermore, it solves the technical problem in related technologies where unidirectional security hardening can easily cause business requests to fail. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a mobile terminal for processing a service request according to an embodiment of this application is shown.

[0026] Figure 2 This is a flowchart of an optional service request processing method according to an embodiment of the present invention;

[0027] Figure 3 This is an architecture diagram of an optional security hardening and processing system for business requests according to an embodiment of the present invention;

[0028] Figure 4 A schematic diagram of an optional service request processing apparatus according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0032] SQL injection is a type of cybersecurity attack that targets Web (World Wide Web) applications that use Structured Query Language (SQL) for data interaction. Attackers insert abnormal SQL code into the application's input fields, exploiting inadequate or improper handling of user input to cause the normally functioning application to execute unexpected SQL commands, thereby attacking or controlling the database.

[0033] Cross-Site Scripting (XSS) attacks are a common type of cybersecurity attack that primarily targets web applications.

[0034] It should be noted that the business request processing method and apparatus in this application can be used in the financial technology field when processing business requests based on security hardening, and can also be used in any field other than the financial technology field when processing business requests based on security hardening. This application does not limit the application field of the business request processing method and apparatus.

[0035] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of such data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0036] It should be noted that in this application, when collecting and analyzing customer information, users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision-making results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0037] The following embodiments of the present invention can be applied to various business request processing systems / applications / devices. The present invention establishes a dynamic bidirectional symbol mapping device, which uses a forward mapping device at the front end to convert special characters into custom characters, and a reverse mapping device at the back end to convert them back into the original special characters. This achieves lossless and correct transmission of special characters, ensuring that transactions containing special character transmissions remain usable even after security hardening.

[0038] This invention introduces a dynamic mapping engine mechanism. First, it automatically adds or removes the character set to be mapped based on the security hardening strategy. Second, it dynamically generates custom characters according to predefined rules, enabling the bidirectional mapping device to dynamically adapt. Third, this modification still allows for the filtering and blocking of insecure special characters, without reducing the effectiveness of the security hardening itself.

[0039] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0040] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a service request processing method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0041] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the service request processing method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0042] Example 1

[0043] According to an embodiment of the present invention, an embodiment of a method for processing business requests is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0044] Figure 2 This is a flowchart of an optional service request processing method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0045] Larger web systems typically deploy subsystems adapted to different access scenarios: one type is the external network subsystem facing the internet, supporting public user access; the other is the internal network subsystem serving internal personnel, meeting the organization's internal business operation needs. From a data architecture perspective, the internal and external network subsystems usually share a common underlying database to ensure the consistency of data flow. For example, in actual business operations, content editing (such as press release writing and product information entry) is often completed through the internal network subsystem, and then the edited content is published externally through the external network subsystem for internet users to browse.

[0046] From a security perspective, the two types of subsystems differ significantly: external network subsystems, being directly exposed to the internet environment, face a higher risk of network threats such as SQL injection and XSS attacks, thus requiring targeted security hardening; while internal network subsystems, located in a private network environment and physically isolated from the external network in some scenarios, are already configured with stricter security verification mechanisms (such as multi-factor authentication) and access control policies (such as IP address authorization lists), so independently operating internal network subsystems typically do not require additional security hardening.

[0047] However, after the external network subsystem completes security hardening, it typically intervenes in the input of special characters (such as "#" and "--") through processing (e.g., filtering, escaping). This can alter the content of business parameters passed from the external network. The internal network subsystem, however, does not perform such hardening operations, resulting in differences in parameter processing logic between the two networks. This leads to inconsistencies in data between the two sides—for example, if parameters containing special characters passed from the external network are modified, they will differ from the original parameters directly entered from the internal network in the database. Simultaneously, changes to the parameters on the external network side can directly cause deviations in the data written to the underlying database, ultimately leading to data storage errors (such as text containing special characters being truncated or key identifiers being tampered with).

[0048] For example, suppose the user correctly enters the username 'user1' AND password='password1';

[0049] When an SQL injection attack occurs, the attacker will enter specific information in the username and password input fields: "admin'#" for username and "'OR'1'='1" for password. The resulting abnormal SQL query will be:

[0050] SELECT FROM users WHERE username='admin'#'AND password=''OR'1'='1';

[0051] In some SQL syntax rules, "#" can be used as a comment symbol, which ignores the content of the following statement. Therefore, in the above abnormal SQL, "#" will comment out the original validation part, making "'OR'1'='1'" the validation condition—this condition is always true, ultimately allowing the attacker to bypass normal login authentication and successfully log in to the system as the admin user.

[0052] Similarly, in other SQL syntax environments, "--" can be used to achieve a similar comment effect, thereby bypassing authentication to log in to any account. For example, the constructed SQL query statement is:

[0053] SELECT FROM users WHERE user name='admin' OR 1=1;--' AND password='any character'.

[0054] Based on the aforementioned risks, special characters such as "#" and "--" are usually identified as unsafe characters and are often filtered out and removed during system security hardening to improve the system's resistance to attacks.

[0055] However, in real-world business scenarios, some special characters play essential functional roles. Directly filtering or deleting them may lead to functional abnormalities, incomplete information, or even program errors. For example, in one business scenario, the front-end and back-end agree to concatenate account names and card numbers using "#", such as "Account Name 1#Card Number 1" and "Account Name 2#Card Number 2". The front-end transmits this information to the back-end in this format, and the back-end needs to split the content based on the "#" before proceeding with further processing. If "#" is filtered out for security hardening, the information transmitted to the back-end will become "Account Name 1 Card Number 1" and "Account Name 2 Card Number 2". The back-end cannot split the data correctly, directly causing the business function to fail. This is a typical example of a functional abnormality caused by security hardening.

[0056] For example, in another scenario, a text edit box allows the input of a hyphen "-" to represent an English dash. For instance, if the user enters "Please read pages 10-20 for the assignment" (meaning "Please read pages 10 to 20 to complete the task"), and the security hardening process filters out the hyphen "-", then the content passed from the front end to the back end will become "Please read pages 1020 for the assignment" (i.e., "Please read page 1020 to complete the task"). When the back end subsequently stores and transmits this field, the information will be incomplete, thus affecting information display and business judgment.

[0057] To resolve such data inconsistency and storage error issues, the conventional approach is to adjust the data structure and eliminate conflicts by avoiding the use of special characters. However, this method not only potentially impacts existing business functions (such as the failure of parameter concatenation and text expression functions that rely on special characters), but also requires a full-chain overhaul from the system's underlying layers—encompassing database table structure adjustments (such as redefining field formats), external network subsystem logic adaptation (such as updating parameter validation rules), and internal network subsystem function synchronization updates (such as adjusting data entry logic). The overall workload is enormous, leading to a significant increase in project time and manpower costs. Against this backdrop, how to achieve rapid, lightweight, and low-cost security hardening (such as special character control) without disrupting the system's original business logic and ensuring the availability of core functions has become a pressing challenge in the field of system security construction.

[0058] The embodiments of this invention adopt a global overall processing approach, and complete the conversion and restoration of special characters through a two-layer mapping mechanism of front-end and back-end. This not only ensures the effectiveness of security reinforcement for other characters, but also successfully solves various system function problems caused by filtering special characters.

[0059] Step S201: Intercept the business requests sent by the user terminal, parse the business requests, and obtain business information.

[0060] In step S201 above, firstly, all business requests originating from the user are uniformly intercepted by an aspect interceptor deployed at the application layer entry point. This means that regardless of which front-end channel the business request originates from (such as a web browser or mobile app) or which back-end service it is destined for, all requests will be captured by the aspect interceptor before reaching the target service, ensuring the global coverage and complete execution of the transformation plan.

[0061] Subsequently, the intercepted business requests are subjected to in-depth analysis. This process may involve analyzing multi-dimensional data such as HTTP request headers, request bodies, and URL parameters. The goal of the analysis is to extract business information from the requests, including but not limited to request type (such as GET, POST), request parameters (such as user ID, transaction amount), and request purpose (such as account information query, product purchase confirmation). In database-driven systems, business information is the key information for constructing SQL statements.

[0062] By combining global interception with deep analysis, potential security risks in business requests can be identified and controlled at an early stage, while the complete preservation of business information ensures the accuracy of subsequent data processing and the consistency of business logic.

[0063] Furthermore, the processing of business requests also includes: deploying aspect interceptors at the system framework layer; and intercepting business requests sent by the user through aspect interceptors.

[0064] Specifically, aspect-oriented interceptors are deployed at the framework layer of the system architecture, a layer typically located between the application's core logic and external data interactions. By integrating aspect-oriented interceptors at the framework layer, the system can uniformly monitor and control all data flows without modifying business module code or adjusting data structures, demonstrating the non-intrusiveness and flexibility of aspect-oriented programming. When a user initiates a business request, these requests first pass through the system framework layer. At this point, the aspect-oriented interceptor will automatically intercept each request.

[0065] The deployment of the aspect interceptor ensures that the security hardening and adaptation process can cover all business requests, regardless of their service type or business scenario. By implementing interception at this critical position of the system framework layer, it avoids the possibility of any request directly reaching the backend without processing, thereby improving the overall integrity and rigor of security protection.

[0066] Step S202: Scan the business information, find the characteristic characters contained in the business information, and extract the characteristic characters from the business information to obtain a set of characteristic characters.

[0067] In step S202 above, after the business request is intercepted, the system performs a deep scan of the business information word by word. This process may involve multiple scanning algorithms, aiming to comprehensively and thoroughly cover all types of characters, including text, numbers, and symbols, ensuring that all characteristic characters that may cause security issues are identified. Deep scanning of business information is a prerequisite for constructing a characteristic character set and the foundation for subsequent character conversion and inverse mapping. During the scan, the system locates and extracts all characteristic characters contained in the business information according to preset security rules. Characteristic characters typically refer to symbols with special meaning in SQL statements, such as "#" and "--", as well as any characters that may be used for XSS attacks, command injection, or other security risks. The purpose of extracting characteristic characters is to ensure that these characters do not directly cause system malfunctions or data processing errors during security hardening. Through location and extraction, the system summarizes all discovered characteristic characters into a characteristic character set, which will serve as the direct basis for subsequent conversion function definitions and mapping conversions. The construction of the characteristic character set enables centralized management of potential threat sources in business information and is an important step in achieving harmonious coexistence between security and business functions.

[0068] Furthermore, the steps of scanning business information and searching for characteristic characters contained in the business information include: performing word segmentation on the business information to obtain business information segments; and scanning all business information segments in parallel based on a preset characteristic character table to search for characteristic characters contained in each business information segment.

[0069] Specifically, to accelerate the scanning process, the system segments the captured business information into multiple segments. This segmentation process is based on semantic boundaries, symbolic boundaries, or preset field delimiters, aiming to break down the business information into smaller, more manageable units, facilitating subsequent feature character lookup and processing. Subsequently, the system uses a preset feature character table to scan all the decomposed business information segments in parallel. The feature character table is a database that centrally manages special character rules, containing all symbols that pose a potential threat in SQL statements. The parallel scanning strategy significantly improves search efficiency, ensuring that each business information segment can be quickly and comprehensively checked in a high-concurrency environment, thereby locating potential feature characters. During the parallel scanning process, once a character matching the feature character table is found in a business information segment, the system immediately marks and extracts these feature characters, thus obtaining the feature character set that needs to be converted.

[0070] Step S203: For each feature character in the feature character set, define a conversion function and generate a custom character corresponding to the feature character based on the conversion function.

[0071] In step S203 above, after deep scanning of business information and constructing a feature character set, the system identifies and lists all special characters. These characters have specific meanings in SQL statements or data processing and may become trigger points for security vulnerabilities. For each special character in the feature character set, a conversion function is defined. The conversion function can be defined according to the characteristics of the character and the conversion target, and can include various algorithms such as random number generation, timestamp combination, and character encoding conversion. By defining the conversion function, the system can generate a unique custom word for each feature character, ensuring the uniqueness and security of the conversion process. Based on the defined conversion function, the system will convert each feature character to generate its corresponding custom word. These custom words are secure characters or character combinations that can avoid attacks such as SQL injection without affecting business logic. The generation of custom words ensures both the continuity of business information and improves the security of the system.

[0072] Furthermore, for each feature character in the feature character set, the steps for defining the conversion function include: generating a random code for each feature character in the feature character set; recording the conversion timestamp corresponding to the feature character; selecting a replacement character from the safe replacement character table; and constructing the conversion function based on the random code, the conversion timestamp, and the replacement character.

[0073] Specifically, the system generates a random code for each feature character in the feature character set. This random code is generated based on the current time point and is unique, ensuring that the conversion result of each feature character is unique at any given moment, enhancing the randomness and unpredictability of security protection. Simultaneously with generating the random code, the system records the conversion timestamp corresponding to the feature character. This timestamp records the precise moment the feature character conversion occurred, which is crucial for the subsequent reverse conversion process, ensuring that all conversions are accurately tracked and restored within a specific time window. From a pre-set safe replacement character table, the system selects a safe replacement character that does not conflict with the feature character. The safe replacement character table contains a filtered set of characters that will not be mistaken by the system for SQL injection or other abnormal behavior. The purpose of selecting a replacement character is to ensure that the replaced character is safe in the business logic and will not introduce new security risks. Finally, based on the generated random code, the recorded conversion timestamp, and the selected replacement character, the system constructs the conversion function.

[0074] The logical design of the conversion function ensures that the original feature characters can be correctly and safely converted into custom characters. At the same time, by retaining the random code and timestamp, it provides the necessary information for the subsequent reverse conversion, ensuring the reversibility and security of the conversion process.

[0075] Step S204: Construct a positive mapping conversion table based on custom characters, convert the feature characters in the business information into corresponding custom characters based on the positive mapping conversion table, and generate the converted security business request.

[0076] In step S204 above, a positive mapping conversion table is constructed to record the conversion information of feature characters. This table records the custom character, character identifier, effective expiration time stamp, feature character, and conversion timestamp. Based on this positive mapping table, the system can quickly replace feature characters in business information with corresponding secure custom characters during subsequent data processing, while ensuring that the conversion rules for feature characters are traceable during business execution. Using the positive mapping conversion table, the system begins converting feature characters in the business information. Whenever a feature character is scanned, the system queries the conversion table to find the corresponding custom character and completes the replacement.

[0077] After the characteristic characters are converted, the system generates a new, secure business request. This request contains the converted business information, with all characteristic characters replaced by secure custom characters, thus significantly reducing the risk of security attacks such as SQL injection, while ensuring that the integrity and functionality of the business request are not affected.

[0078] Furthermore, the steps for constructing a positive mapping conversion table based on custom characters include: configuring a character identifier and an effective expiration time stamp for each custom character; obtaining the feature character and conversion time stamp corresponding to the custom character; and constructing a positive mapping conversion table based on the custom character, character identifier, effective expiration time stamp, feature character, and conversion time stamp.

[0079] Specifically, a unique character identifier is assigned to each generated custom character. This character identifier uniquely identifies each custom character and its corresponding feature character in the forward mapping conversion table, facilitating subsequent system identification and processing. An effective expiration time stamp is specified for each custom character, defining when the conversion rule for that custom character terminates. By setting a deadline, the system can flexibly control the conversion cycle of feature characters, ensuring that the reverse mapping conversion can accurately restore the original feature character within the deadline, avoiding the loss of business flexibility caused by the permanent solidification of conversion rules. The original feature character corresponding to each custom character and its specific conversion timestamp are accurately obtained from the feature character set and system records. This information is crucial for constructing conversion rules, ensuring an accurate correspondence between conversion rules and reverse conversion rules. Based on the above information, a forward mapping conversion table is constructed. This table records in detail the mapping relationship between each custom character and feature character, including key fields such as character identifier, effective expiration time stamp, feature character, and conversion timestamp. The construction of the forward mapping conversion table enables standardized management of conversion rules, facilitating dynamic system adjustment and querying.

[0080] By constructing a forward mapping conversion table, the system can manage the conversion rules of each feature character in a structured way, which not only facilitates tracking and auditing, but also provides a clear basis for reverse mapping, ensuring the reversibility and traceability of the conversion process.

[0081] Furthermore, after constructing the positive mapping conversion table based on the custom characters, the process includes: Step 1, comparing all custom characters with all feature characters to obtain the comparison results; Step 2, if the comparison results indicate that any feature character is the same as any custom character, determining that there is a conflict between the custom character and the feature character; Step 3, redefining the conversion function for the conflicting custom characters, and generating new custom characters based on the conversion function; repeating steps 1 to 3 until there are no conflicting custom characters.

[0082] Specifically, after constructing the forward mapping conversion table and completing the initial conversion from feature characters to custom characters, to ensure the reliability of the conversion and the integrity of business information, a checking step is required to eliminate potential conflicts between custom characters and feature characters. The system compares all custom characters in the constructed forward mapping conversion table with all possible feature characters in the business information one by one to check for any overlap between custom characters and feature characters. The comparison process ensures that the converted custom characters will not be confused with special characters in the business logic, guaranteeing the correctness and security of business requests. If a custom character is found to be identical to any feature character during the comparison process, the system immediately marks the custom character as conflicting. Such conflicts may prevent the accurate restoration of the original feature characters in the subsequent reverse mapping process, affecting the integrity and accuracy of business data. For custom characters marked as conflicting, the system redefines the conversion function and generates new custom characters. This process may be based on random algorithms, timestamps, etc., to ensure that the newly generated custom characters are different from all feature characters, thereby eliminating conflicts. After completing one conflict detection and redefinition of custom characters, the system will compare the custom characters with feature characters again. This process will continue to repeat until all custom characters do not conflict with the characteristic characters, ensuring that the converted business requests have the highest level of security and accuracy.

[0083] Furthermore, the step of converting the feature characters in the business information into corresponding custom characters based on the positive mapping conversion table includes: reading the effective expiration timestamp of the custom characters in the positive mapping conversion table; if the effective expiration timestamp is empty or the current timestamp is earlier than the effective expiration timestamp, the feature characters in the business information are positively mapped to the corresponding custom characters according to the mapping relationship between feature characters and custom characters in the positive mapping conversion table.

[0084] Specifically, during character conversion, the system first reads the expiration timestamp corresponding to each custom character in the positive mapping conversion table. This expiration timestamp is used to determine the current validity of the custom character conversion rule, improving the reuse of custom characters and avoiding excessive interference with business logic. Then, the expiration timestamp of the custom character is evaluated to confirm whether it is empty or whether the current timestamp is earlier than the expiration timestamp. If either of these two conditions is met, the current custom character conversion rule is still valid and can be applied to the processing of business information. By introducing timestamps, the system can flexibly control the lifecycle of conversion rules, avoiding the maintenance difficulties that may arise from long-term rule fixation, and improving the system's flexibility and efficiency.

[0085] After confirming the validity of the conversion rules, the system replaces each characteristic character encountered in the business information with its corresponding custom character based on the mapping relationship between characteristic characters and custom characters recorded in the forward mapping conversion table. This conversion process is a crucial step in ensuring the security of business information while maintaining the integrity of its business logic. After completing the conversion from characteristic characters to custom characters, the system generates the converted business request. The business request continues to be transmitted. During transmission, an insecure character injected by attackers is filtered through a security hardening mechanism. Subsequently, the request is restored on the backend according to the relevant reverse conversion rules, without losing the information about the reason in the request. This ensures that business requests containing special characters can be transmitted normally and securely to the backend processing logic without triggering system-level security alarms or functional abnormalities.

[0086] Step S205: Generate an inverse mapping transformation table based on the forward mapping transformation table, and send the security service request and the inverse mapping transformation table to the receiving end. The receiving end then restores the security service request to the service request based on the inverse mapping transformation table.

[0087] In step S205 above, after completing the forward mapping from feature characters to custom characters in the business information, it is also necessary to ensure that the receiving end can accurately restore the original business request to restore the integrity of the original business logic. The system will create an inverse mapping conversion table based on the already constructed forward mapping conversion table. This table records the conversion relationship between custom characters and the original feature characters, ensuring the accuracy and consistency of the inverse conversion. In the inverse mapping conversion table, the original feature characters are used as the target, and the custom characters are used as the source, forming a one-to-one inverse mapping rule.

[0088] Once the reverse mapping conversion table is ready, the system will send it, along with the converted security business request, to the receiving end. The receiving end can be a backend server that processes business requests, or other system components that require information restoration. After receiving the reverse mapping conversion table and the security business request, the receiving end will, based on the rules recorded in the reverse mapping conversion table, reverse-convert the custom characters in the security business request into the original characteristic characters, thereby restoring the original state of the business request to continue executing financial transactions.

[0089] By generating a reverse mapping transformation table, it is ensured that secure business requests can be accurately reversed back to the original business request state after being transmitted to the receiving end. This strategy not only maintains the integrity and functionality of business information, but also enhances the security and stability of the system, allowing the system to maintain the continuity of business logic even after security hardening.

[0090] Through the above steps, the business requests sent by the user are intercepted and parsed to obtain business information. The business information is then scanned to find characteristic characters contained within it, and these characteristic characters are extracted to obtain a characteristic character set. For each characteristic character in the characteristic character set, a conversion function is defined, and a custom character corresponding to the characteristic character is generated based on the conversion function. A forward mapping conversion table is constructed based on the custom characters, and the characteristic characters in the business information are converted into the corresponding custom characters based on the forward mapping conversion table, generating a converted secure business request. Finally, an inverse mapping conversion table is generated based on the forward mapping conversion table, and the secure business request and the inverse mapping conversion table are sent to the receiving end. The receiving end then uses the inverse mapping conversion table to restore the secure business request to the business request.

[0091] In this embodiment, special characters, i.e., feature character sets, are identified and extracted through in-depth analysis of business requests. This process is dynamic and adaptable to constantly changing business needs and security hardening strategies. For each feature character, one or more conversion functions are defined to generate corresponding custom characters. This step achieves secure conversion of special characters, avoiding potential loss of business functionality due to direct filtering or escaping. Based on the defined conversion functions, a forward mapping conversion table is created to record the mapping relationship between feature characters and custom characters. Using the forward mapping conversion table, feature characters in the business information are converted into custom characters, generating a converted secure business request. Based on the forward mapping conversion table, an inverse mapping conversion table is automatically generated. This table is used to restore the custom characters back to the original feature characters after the backend receives the secure business request, thereby restoring the original state of the business information. This avoids interference with business logic and data format due to security hardening measures, improving business security and effectiveness. Furthermore, it solves the technical problem in related technologies where unidirectional security hardening can easily cause business requests to fail.

[0092] The following describes in detail another optional implementation method.

[0093] Figure 3 This is an architecture diagram of an optional security hardening and processing system for business requests according to an embodiment of the present invention, such as... Figure 3 As shown, the business request is received through the front-end layer, and a dynamic bidirectional symbol mapping device is used to convert specific characters (corresponding to the above-mentioned characteristic characters) before transmission. During the request transmission process, the security reinforcement mechanism of the security reinforcement layer filters or converts insecure characters to achieve secure transmission of the request and ensure system security.

[0094] Specifically, the dynamic bidirectional symbol mapping device includes a forward mapping device and a reverse mapping device. The forward mapping device is used to map unsafe special characters and custom character codes that the system determines may pose security risks, that is, to associate them one by one with a predefined exclusive custom character set. For example, # is mapped to a preset character set A, and @ is mapped to a preset character set B, etc.

[0095] The inverse mapping device is used to implement character restoration functionality that is completely the opposite of the forward mapping device. Specifically, based on the established mapping relationship between insecure special characters and custom character sets in the forward mapping device, it converts the custom character set back to the original insecure special characters. Specifically, it restores custom character set A, which corresponds to "#", to the original special character "#", and restores custom character set B, which corresponds to "@", to the original special character "@".

[0096] The security hardening and processing system for business requests also includes a special symbol collection and change handling module. When the set of special symbols managed by the security hardening layer is added, deleted, or modified, this module can automatically identify the changes and synchronously update the range of insecure special characters to be processed in this dynamic bidirectional symbol mapping device. This ensures that the processing logic of the mapping device always matches the latest rules of the security hardening system, guaranteeing the real-time performance and effectiveness of the adaptation.

[0097] A positive mapping conversion table is constructed to record structured data of conversion rules from unsafe special characters to custom characters. This table stores complete information for each conversion rule, converting special characters into custom characters. Conversion information may include rule ID (unique rule identifier), conversion time (specifying the effective time to start the conversion), original character, converted character, and effective expiration time (such as effective start / end time, temporary activation duration), etc. Rule parameters can be flexibly adjusted through a visual configuration interface or standardized interface.

[0098] The structure of the reverse mapping conversion table is the same as that of the forward mapping conversion table. Its core function is to record the rules for restoring custom characters to the original unsafe special characters. The original character field of this table corresponds to the converted character field of the forward mapping conversion table, and the converted character field corresponds to the original character field of the forward mapping conversion table. That is, the reverse matching with the forward mapping conversion table is achieved through the field correspondence.

[0099] The custom code generated by the dynamic bidirectional mapping device is compared with all the front-end request content that needs to be replaced. If the latter contains the former, that is, there is a conflict, the mapping function F is reselected and the custom code is regenerated to resolve the conflict, so as to ensure the accuracy and completeness of the original entered information.

[0100] Using aspect-oriented programming, we scan all input locations in the front-end code and use a dynamic bidirectional symbol mapping device to replace special characters in the input fields with custom characters, such as replacing # with character set A.

[0101] During the request to continue transmission, based on security hardening mechanisms, special characters such as '#' injected by attackers are filtered or converted to full-width characters for security purposes. Since special characters have already been replaced through mapping, input fields containing special symbols remain unchanged, ensuring the integrity of the original data.

[0102] The effective deadline in the forward mapping and reverse mapping conversion tables can be modified as needed, for example, to any desired date and time. Before that date and time, the adaptation conversion rule is valid and the forward mapping and reverse mapping process is executed. After that date and time, the conversion rule will no longer be executed.

[0103] For example, the process of securing and hardening a transmission request includes:

[0104] Step 1: The business request is transmitted to the front-end module of the external network system via the Internet. Before the front-end sends the request to the back-end, the aspect interceptor detects and intercepts the new request, and sends the business information of the request to the dynamic bidirectional symbol mapping device for relevant processing.

[0105] Step 2: Scan the content of the business information to check if it contains characters from the special symbol set. If it does, filter these characters out as the character set to be replaced, C={c1,c2,……ck}, and send it to the positive mapping device for processing.

[0106] Step 3: Within the positive mapping device, a custom conversion function F is determined for each character ci in the character set to be replaced according to preset rules. F = {f1, f2, ..., fk} is then mapped to the safe character set Csafe through function F, i.e., Csafe = F(C), resulting in Csafe = {f1(c1), f2(c2), ..., fk(ck)}. This process is called dynamically generating custom codes, where fi can be constructed based on random codes, timestamps, special characters, or can be defined by the user as other mappings.

[0107] Step 4, Conflict Checking and Resolution:

[0108] 1) Scan the original request message and check if it contains characters from the set Csafe={f1(c1),f2(c2),……fk(ck)};

[0109] 2) If it is contained, remove these elements from Csafe. These removed elements form the subset to be regenerated, Cconflict={f(ci1),f(ci2),……f(cim)}.

[0110] 3) For the original character set elements corresponding to the subset, reselect the mapping function F to remap, regenerate a new mapping result set, and check whether the set has conflicts. Merge the subsets without conflicts into Csafe, and reconstruct the Cconflict set for the subsets with conflicts. Execute step 3) until all elements in Csafe have no conflicts with the original message content.

[0111] Step 5: Construct a positive mapping conversion table. Based on the mapping result set Csafe obtained in Step 3, construct a positive mapping conversion table to record structured data of the conversion rules from unsafe special characters to custom characters. This includes the rule ID (unique identifier of the rule), conversion time (specifying the effective time of the conversion), original character, converted character, and execution validity time (such as effective start / end time, temporary activation duration), etc. The rule parameters can be flexibly adjusted through a visual configuration interface or standardized interface.

[0112] Step 6: Construct a reverse mapping conversion table to record the restoration rules of custom characters → original unsafe special characters; where the original character field of this table corresponds to the converted character field of the forward mapping conversion table, and the converted character field corresponds to the original character field of the forward mapping conversion table, that is, the reverse matching with the forward mapping conversion table is achieved through the field correspondence.

[0113] Step 7: Determine if the expiration date in the mapping table is empty. If it is empty, or if the current time is less than the expiration date, then according to the rules of the positive mapping conversion table, perform positive mapping replacement on all fields that need to be replaced in the request req to generate a new request reqS. At this time, reqS no longer contains unsafe characters; otherwise, terminate the execution of this process.

[0114] Step 8: Request data transmission to continue. During the transmission process, use security hardening mechanisms to filter special characters injected by attackers or convert them to full-width characters, etc.

[0115] Step nine: The backend receives the transaction from the frontend, uses aspect-oriented programming, and performs inverse mapping through a dynamic bidirectional symbol mapping device to convert the custom character code into field values ​​containing special characters, thus restoring it to the original business request.

[0116] Step 10: The field values ​​after reverse conversion will be able to proceed with subsequent transactions and storage normally.

[0117] This invention establishes a dynamic bidirectional symbol mapping device. A forward mapping device at the front end converts special characters into custom characters, while a reverse mapping device at the back end converts them back into the original special characters. This achieves lossless and correct transmission of special characters, ensuring the system remains usable for transactions containing these special characters even after security hardening. A dynamic mapping engine mechanism is also introduced. First, it automatically adds or removes the character set to be mapped based on the security hardening strategy. Second, it dynamically generates custom characters according to predefined rules, enabling the bidirectional mapping device to dynamically adapt. Third, this modification still filters and blocks insecure special characters without reducing the effectiveness of the security hardening itself.

[0118] The following is a detailed description with reference to another embodiment.

[0119] Example 2

[0120] The service request processing apparatus provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in the above embodiment one. The specific implementation method and beneficial effects can be referred to the foregoing method embodiment, and will not be repeated here.

[0121] Figure 4 This is a schematic diagram of an optional service request processing apparatus according to an embodiment of the present invention, such as... Figure 4 As shown, the processing device for this service request may include: a parsing unit 41, an extraction unit 42, a generation unit 43, a conversion unit 44, and a sending unit 45, wherein,

[0122] The parsing unit 41 is used to intercept the business requests sent by the user terminal, parse the business requests, and obtain business information.

[0123] Extraction unit 42 is used to scan business information, find feature characters contained in the business information, and extract feature characters from the business information to obtain a feature character set;

[0124] The generation unit 43 is used to define a conversion function for each feature character in the feature character set, and generate a custom character corresponding to the feature character based on the conversion function;

[0125] The conversion unit 44 is used to construct a positive mapping conversion table based on custom characters, convert the feature characters in the business information into corresponding custom characters based on the positive mapping conversion table, and generate a converted security business request.

[0126] The sending unit 45 is used to generate an inverse mapping transformation table based on the forward mapping transformation table, and send the security service request and the inverse mapping transformation table to the receiving end, so that the receiving end can restore the security service request to the service request based on the inverse mapping transformation table.

[0127] The aforementioned service request processing device intercepts and parses the service requests sent by the user terminal through the parsing unit 41 to obtain service information; the extraction unit 42 scans the service information to find the feature characters contained in the service information and extracts the feature characters from the service information to obtain a feature character set; the generation unit 43 defines a conversion function for each feature character in the feature character set and generates a custom character corresponding to the feature character based on the conversion function; the conversion unit 44 constructs a forward mapping conversion table based on the custom characters and converts the feature characters in the service information into the corresponding custom characters based on the forward mapping conversion table, generating a converted security service request; the sending unit 45 generates an inverse mapping conversion table based on the forward mapping conversion table and sends the security service request and the inverse mapping conversion table to the receiving end, where the receiving end restores the security service request to the service request based on the inverse mapping conversion table.

[0128] In this embodiment, special characters, i.e., feature character sets, are identified and extracted through in-depth analysis of business requests. This process is dynamic and adaptable to constantly changing business needs and security hardening strategies. For each feature character, one or more conversion functions are defined to generate corresponding custom characters. This step achieves secure conversion of special characters, avoiding potential loss of business functionality due to direct filtering or escaping. Based on the defined conversion functions, a forward mapping conversion table is created to record the mapping relationship between feature characters and custom characters. Using the forward mapping conversion table, feature characters in the business information are converted into custom characters, generating a converted secure business request. Based on the forward mapping conversion table, an inverse mapping conversion table is automatically generated. This table is used to restore the custom characters back to the original feature characters after the backend receives the secure business request, thereby restoring the original state of the business information. This avoids interference with business logic and data format due to security hardening measures, improving business security and effectiveness. Furthermore, it solves the technical problem in related technologies where unidirectional security hardening can easily cause business requests to fail.

[0129] Furthermore, the extraction unit includes: a first processing module, used to perform word segmentation on the business information to obtain business information segments; and a first scanning module, used to scan all business information segments in parallel based on a preset feature character table to find the feature characters contained in each business information segment.

[0130] Furthermore, the conversion unit includes: a first configuration module, used to configure a character identifier and an effective expiration time stamp for each custom character; a first acquisition module, used to acquire the feature character and conversion time stamp corresponding to the custom character; and a first construction module, used to construct a positive mapping conversion table based on the custom character, character identifier, effective expiration time stamp, feature character, and conversion time stamp.

[0131] Furthermore, the business request processing device further includes: a first comparison module, used in step one, to compare all custom characters with all feature characters to obtain a comparison result; a first determination module, used in step two, to determine that there is a conflict between a custom character and a feature character if the comparison result indicates that any feature character is the same as any custom character; a first definition module, used in step three, to redefine the conversion function for the conflicting custom characters and generate new custom characters based on the conversion function; and a first repeat module, used to repeat steps one to three until there are no conflicting custom characters.

[0132] Furthermore, the conversion unit includes: a first reading module, used to read the effective expiration timestamp of the custom character in the positive mapping conversion table; and a first mapping module, used to positively map the feature character in the business information to the corresponding custom character according to the mapping relationship between feature characters and custom characters in the positive mapping conversion table when the effective expiration timestamp is empty or the current timestamp is earlier than the effective expiration timestamp.

[0133] Furthermore, the generation unit includes: a first generation module for generating a random code for each feature character in the feature character set; a first recording module for recording the conversion timestamp corresponding to the feature character; a first selection module for selecting a replacement character from the safe replacement character table; and a first construction module for constructing a conversion function based on the random code, the conversion timestamp, and the replacement character.

[0134] Furthermore, the processing of business requests also includes: a first deployment module, used to deploy aspect interceptors at the system framework layer; and a first interception module, used to intercept business requests sent by the user through the aspect interceptors.

[0135] The processing device for the aforementioned business requests may also include a processor and a memory. The parsing unit 41, extraction unit 42, generation unit 43, conversion unit 44, and sending unit 45 are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0136] The processor described above contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and service requests can be processed by adjusting kernel parameters.

[0137] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0138] This invention provides a computer-readable storage medium including a stored program, wherein a method for controlling the device where the computer-readable storage medium is located to execute a service request processing method during program execution.

[0139] According to another aspect of the present invention, a processor is also provided, which is used to run a program, wherein the program executes a method for processing business requests during runtime.

[0140] This invention provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps: intercepting a service request sent by a user terminal and parsing the service request to obtain service information; scanning the service information to find characteristic characters contained within it and extracting these characteristic characters to obtain a characteristic character set; defining a conversion function for each characteristic character in the characteristic character set and generating a custom character corresponding to the characteristic character based on the conversion function; constructing a forward mapping conversion table based on the custom characters and converting the characteristic characters in the service information into the corresponding custom characters based on the forward mapping conversion table, and generating a converted secure service request; generating an inverse mapping conversion table based on the forward mapping conversion table and sending the secure service request and the inverse mapping conversion table to a receiving end, whereby the receiving end restores the secure service request to a service request based on the inverse mapping conversion table.

[0141] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0142] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps: intercepting a business request sent by a user terminal and parsing the business request to obtain business information; scanning the business information to find feature characters contained in the business information and extracting feature characters from the business information to obtain a feature character set; for each feature character in the feature character set, defining a conversion function and generating a custom character corresponding to the feature character based on the conversion function; constructing a forward mapping conversion table based on the custom characters, and converting the feature characters in the business information into the corresponding custom characters based on the forward mapping conversion table, and generating a converted secure business request; generating an inverse mapping conversion table based on the forward mapping conversion table, and sending the secure business request and the inverse mapping conversion table to the receiving end, whereby the receiving end restores the secure business request to a business request based on the inverse mapping conversion table.

[0143] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0144] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0146] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0147] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0148] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0149] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0150] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0151] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0152] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0153] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method of processing a service request, characterized by, The method comprises the following steps: intercepting a service request sent by a user terminal, and analyzing the service request to obtain service information; scanning the service information to find feature characters contained in the service information, and extracting the feature characters from the service information to obtain a feature character set; defining a conversion function for each feature character in the feature character set, and generating a custom character corresponding to the feature character based on the conversion function; constructing a positive mapping conversion table based on the custom characters, converting the feature characters in the service information into corresponding custom characters based on the positive mapping conversion table, and generating a converted secure service request; generating an inverse mapping conversion table according to the positive mapping conversion table, and sending the secure service request and the inverse mapping conversion table to a receiving terminal, so that the receiving terminal restores the secure service request into the service request according to the inverse mapping conversion table.

2. The method of claim 1, wherein, The step of scanning the service information to find feature characters contained in the service information comprises: performing word segmentation processing on the service information to obtain service information segments; parallelly scanning all the service information segments based on a preset feature character table to find feature characters contained in each service information segment.

3. The method of claim 1, wherein, The step of constructing a positive mapping conversion table based on the custom characters comprises: configuring a character identifier and an effective expiration timestamp for each custom character; obtaining a feature character corresponding to the custom character and a conversion timestamp; constructing the positive mapping conversion table based on the custom character, the character identifier, the effective expiration timestamp, the feature character, and the conversion timestamp.

4. The method of claim 1, wherein, After constructing the positive mapping conversion table based on the custom characters, the method further comprises the following steps: Step 1: comparing all the custom characters with all the feature characters to obtain a comparison result; Step 2: in the case that the comparison result indicates that any feature character is the same as any custom character, determining that there is a conflict between the custom character and the feature character; Step 3: redefining a conversion function for the custom character in conflict, and generating a new custom character based on the conversion function; repeating steps 1 to 3 until there is no custom character in conflict.

5. The method of claim 1, wherein, The step of converting the feature characters in the service information into corresponding custom characters based on the positive mapping conversion table comprises: reading an effective expiration timestamp of a custom character in the positive mapping conversion table; in the case that the effective expiration timestamp is empty or a current timestamp is earlier than the effective expiration timestamp, positively mapping a feature character in the service information into a corresponding custom character according to a mapping relationship between the feature character and the custom character in the positive mapping conversion table.

6. The method of claim 1, wherein, The step of defining a conversion function for each feature character in the feature character set comprises: generating a random code for each feature character in the feature character set; recording a conversion timestamp corresponding to the feature character; selecting a replacement character from a secure replacement character table; constructing the conversion function based on the random code, the conversion timestamp and the replacement character.

7. The method of claim 1, wherein, Further comprising: deploying a aspect interceptor at a system framework layer; intercepting the service request sent by the user end through the aspect interceptor.

8. A processing apparatus of a service request, characterized by, comprising: a parsing unit configured to intercept the service request sent by the user end and parse the service request to obtain service information; an extracting unit configured to scan the service information, find feature characters contained in the service information, and extract the feature characters from the service information to obtain a feature character set; a generating unit configured to define a conversion function for each feature character in the feature character set, and generate a custom character corresponding to the feature character based on the conversion function; a converting unit configured to construct a positive mapping conversion table based on the custom character, convert the feature characters in the service information into corresponding custom characters based on the positive mapping conversion table, and generate a converted secure service request; a sending unit configured to generate an inverse mapping conversion table according to the positive mapping conversion table, and send the secure service request and the inverse mapping conversion table to a receiving end, so that the receiving end restores the secure service request to the service request according to the inverse mapping conversion table.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer program controls the device where the computer readable storage medium is located to execute the processing method of the service request according to any one of claims 1 to 7 when the computer program is running.

10. An electronic device, comprising: comprising one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the processing method of the service request according to any one of claims 1 to 7.

Images