Request processing method, electronic equipment and storage medium

Abstract

The invention discloses a request processing method, electronic equipment and a storage medium. The method is applied to a client, and comprises the steps of generating a first key based on a security operation under the condition that the security operation is detected, and receiving a second key sent by a server; under the condition that the task processing request is detected, determining a target key based on the first key and the second key, and performing encryption processing on the task processing request based on the target key to obtain an encryption request; based on a triggering process of the task processing request, determining a plurality of first signature elements associated with the triggering process; based on a behavior mode corresponding to the task processing request, determining a plurality of second signature elements matched with the behavior mode; adjusting the encryption request according to a message assembly rule based on the plurality of first signature elements and the plurality of second signature elements to obtain a request message; and sending the request message to the server, and receiving a request execution result returned by the server.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a request processing method, an electronic device and a storage medium. BACKGROUND

[0002] At present, in order to avoid the situation of replay attack, a timestamp or a random number can be added in the request to verify whether the time limit of the request is accurate. However, when replay attack is prevented in this way, the success probability of replay attack can only be reduced slightly due to the delay and time synchronization error that the timestamp may encounter in network transmission, so that the server still has the situation of replay when executing the task request sent by the client.

[0003] At present, no effective solution has been proposed for the above problems. SUMMARY

[0004] The embodiments of the present application provide a request processing method, an electronic device and a storage medium to at least solve the technical problem that the server may have the situation of replay when executing the task request sent by the client.

[0005] According to an aspect of the embodiments of the present application, a request processing method is provided, applied to a client, including: in the case of detecting a security operation, generating a first key based on the security operation, and receiving a second key sent by a server, wherein the values of the first keys generated based on the security operations detected at different times are different, and the security operation is used to represent an operation having an associated relationship with information security; in the case of detecting a task processing request, determining a target key based on the first key and the second key, and performing encryption processing on the task processing request based on the target key to obtain an encrypted request; determining a plurality of first signature elements having an associated relationship with the trigger process based on the trigger process of the task processing request; determining a plurality of second signature elements matched with the behavior mode based on the behavior mode corresponding to the task processing request, wherein the behavior mode is determined based on the historical processing requests triggered in the historical time period, and the behavior mode is used to reflect the generation rule of the task processing request; adjusting the encrypted request based on the plurality of first signature elements and the plurality of second signature elements according to a message assembly rule to obtain a request message; sending the request message to the server, and receiving the request execution result returned by the server.

[0006] Further, the determination of the target key based on the first key and the second key includes: obtaining a key combination rule corresponding to the security operation; combining the first key and the second key based on the key combination rule to obtain the target key.

[0007] Further, based on the plurality of first signature elements and the plurality of second signature elements, the encrypted request is adjusted according to a message assembly rule to obtain a request message, including: fusing the plurality of second signature elements based on a preset fusion algorithm to obtain a fused signature element; processing the fused signature element and the plurality of first signature elements based on a preset manner to generate a digital signature corresponding to the task processing request; and assembling the encrypted request and the digital signature according to the message assembly rule to obtain the request message.

[0008] According to another aspect of the embodiment of the present application, a request processing method applied to a server is further provided, including: in the case that a first key sent by a client is received, generating a second key based on a first request, wherein the first request is used to represent that the client triggers a security operation, and the generated second key has different values based on the first request detected at different time;

[0009] In the case that a request message sent by the client is received, the request message is parsed to obtain a plurality of first signature elements, a plurality of second signature elements and an encrypted request, wherein the request message is used to reflect service content provided by the server to the client, the plurality of first signature elements are used to represent elements associated with a triggering process determined based on a task processing request, the plurality of second signature elements are used to represent a plurality of second signature elements matched with a behavior mode determined based on the task processing request, and the behavior mode is determined based on historical processing requests triggered in a historical time period, and the behavior mode is used to reflect a generation rule of the task processing request; the encrypted request is security checked based on the plurality of first signature elements and the plurality of second signature elements to obtain a security check result; in the case that the security check result represents that the encrypted request is secure, the encrypted request is decrypted based on a target key to obtain the task processing request, wherein the target key is determined based on the first key and the second key; the task processing request is executed, and an execution result is sent to the client.

[0010] Further, the plurality of first signature elements include a timestamp and a request identifier corresponding to the encrypted request; the encrypted request is security checked based on the plurality of first signature elements and the plurality of second signature elements to obtain a security check result, including: obtaining a time difference value of the timestamp and a current time; in the case that the time difference value is less than or equal to a preset threshold, the request identifier is verified to obtain an identifier verification result, wherein the identifier verification result represents whether the encrypted request is being executed by the server; in the case that the identifier verification result represents that the encrypted request is not being executed by the server, any one of the second signature elements is matched with a preset signature element stored in an element table to obtain an element matching result, wherein the element matching result is used to represent whether the second signature element belongs to the element table; in the case that the element matching result represents that the second signature element belongs to the element table, it is determined that the security check result is that the encrypted request is secure.

[0011] Further, the encrypted request is decrypted based on the first key and the second key to obtain the task processing request, including: the first request is parsed to obtain a key combination rule corresponding to the security operation; the first key and the second key are combined based on the key combination rule to obtain a target key; and the encrypted request is decrypted by using the target key to obtain the task processing request.

[0012] Further, the task processing request is executed, including: in the process of executing the task processing request, a request identifier corresponding to the task processing request is obtained; and the request identifier is stored in the cache unit.

[0013] Further, the method further includes: in the case that the security check result represents that the encrypted request is unsafe, stopping executing the encrypted request, and sending prompt information to the client, wherein the prompt information is used to prompt the reason for stopping the execution of the encrypted request.

[0014] According to another aspect of the embodiment of the application, a request processing device applied to a client is further provided, including: a first generation module, configured to generate a first key based on a security operation in the case that the security operation is detected, and receive a second key sent by a server, wherein the first key generated based on the security operation detected at different time points has different values, and the security operation is used to represent an operation having an associated relationship with information security; a request encryption module, configured to determine a target key based on the first key and the second key in the case that a task processing request is detected, and perform encryption processing on the task processing request based on the target key to obtain an encrypted request; a first determination module, configured to determine a plurality of first signature elements having an associated relationship with a triggering process of the task processing request based on the triggering process; a second determination module, configured to determine a plurality of second signature elements matched with a behavior mode based on the behavior mode corresponding to the task processing request, wherein the behavior mode is determined based on historical processing requests triggered in a historical time period, and the behavior mode is used to reflect a generation rule of the task processing request; a request adjustment module, configured to adjust the encrypted request based on the plurality of first signature elements and the plurality of second signature elements according to a message assembly rule to obtain a request message; and a request sending module, configured to send the request message to the server, and receive a request execution result returned by the server.

[0015] Further, the request encryption module is further configured to: obtain a key combination rule corresponding to the security operation; and combine the first key and the second key based on the key combination rule to obtain the target key.

[0016] Further, the request adjusting module is further configured to: fuse the plurality of second signature elements based on a preset fusion algorithm to obtain fused signature elements; process the fused signature elements and the plurality of first signature elements based on a preset manner to generate a digital signature corresponding to the task processing request; and assemble the encrypted request and the digital signature according to a message assembling rule to obtain a request message.

[0017] According to another aspect of the embodiment of the present application, a request processing apparatus applied to a server side is further provided, which comprises: a second generating module configured to generate a second key based on a first request in a case that the first key is received from a client, wherein the first request is used to represent that the client triggers a security operation, and the generated second key has different values based on the first request detected at different time; a request analyzing module configured to analyze a request message to obtain a plurality of first signature elements, a plurality of second signature elements and an encrypted request in a case that the request message is received from the client, wherein the request message is used to reflect service contents provided by the server side to the client, the plurality of first signature elements are used to represent elements associated with a triggering process based on a triggering process of a task processing request, and the plurality of second signature elements are used to represent a plurality of second signature elements matched with a behavior mode based on a behavior mode determined by historical processing requests triggered in a historical time period, and the behavior mode is used to reflect a generation rule of the task processing request; a security checking module configured to perform security check on the encrypted request based on the plurality of first signature elements and the plurality of second signature elements to obtain a security checking result; a request decrypting module configured to decrypt the encrypted request based on a target key to obtain the task processing request in a case that the security checking result represents that the encrypted request is safe, wherein the target key is determined based on the first key and the second key; and a request executing module configured to execute the task processing request and send a request execution result to the client.

[0018] Further, the plurality of first signature elements comprise a timestamp and a request identifier corresponding to the encrypted request; and the security checking module is further configured to: obtain a time difference value by obtaining a difference between the timestamp and a current time; verify the request identifier to obtain an identifier verification result in a case that the time difference value is less than or equal to a preset threshold, wherein the identifier verification result represents whether the server side is executing the encrypted request; match any one of the second signature elements with a preset signature element stored in an element table to obtain an element matching result in a case that the identifier verification result represents that the server side is not executing the encrypted request, wherein the element matching result is used to represent whether the second signature element belongs to the element table; and determine that the security checking result is that the encrypted request is safe in a case that the element matching result represents that the second signature element belongs to the element table.

[0019] Further, the request decryption module is further configured to: parse the first request to obtain a key combination rule corresponding to the security operation; combine the first key and the second key based on the key combination rule to obtain a target key; and decrypt the encrypted request by using the target key to obtain the task processing request.

[0020] Further, the request execution module is further configured to: obtain a request identifier corresponding to the task processing request in a process of executing the task processing request; and store the request identifier to the cache unit.

[0021] Further, the apparatus further comprises an information sending module configured to: in a case where the security check result represents that the encrypted request is unsafe, stop executing the encrypted request, and send prompt information to the client, wherein the prompt information is used to prompt a reason for stopping execution of the encrypted request.

[0022] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising: a memory storing an executable program; and a processor configured to run the program, wherein the program is configured to execute the method in the embodiments of the present application when running.

[0023] According to another aspect of the embodiments of the present application, a computer readable storage medium is provided, comprising a stored executable program, wherein the computer readable storage medium is configured to control a device where the computer readable storage medium is located to execute the method in the embodiments of the present application when the executable program is running.

[0024] According to another aspect of the embodiments of the present application, a computer program product is provided, comprising a computer program, wherein the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0025] According to another aspect of the embodiments of the present application, a computer program product is provided, comprising a non-volatile computer readable storage medium, wherein the non-volatile computer readable storage medium stores a computer program, and the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0026] According to another aspect of the embodiments of the present application, a computer program is provided, wherein the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0027] In this embodiment of the invention, upon detecting a security operation, a first key is generated based on the security operation, and a second key sent by the server is received; upon detecting a task processing request, a target key is determined based on the first and second keys, and the task processing request is encrypted based on the target key to obtain an encrypted request; based on the triggering process of the task processing request, multiple first signature elements associated with the triggering process are determined; based on the behavior pattern corresponding to the task processing request, multiple second signature elements matching the behavior pattern are determined; based on the multiple first signature elements and the multiple second signature elements, the encrypted request is adjusted according to the message assembly rules to obtain a request message; the request message is sent to the server, and a request response is received from the server. The method for obtaining the execution result involves dynamically determining a first key and a second key for encrypting the task processing request upon detecting a security operation. Then, upon receiving the task processing request, the target key constructed using the first and second keys is directly used to encrypt the task processing request. This improves the security of the communication process and prevents the task processing request from being cracked and replayed. Furthermore, after obtaining the encrypted request, multiple first and second signature elements are introduced to construct the request message corresponding to the task processing request, which enhances the verification mechanism for the encrypted request and effectively prevents the corresponding task processing request from being tampered with or replayed. This solves the technical problem that replay may occur when the server executes a task request sent by the client. Attached Figure Description

[0028] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0029] Figure 1 This is a flowchart illustrating a request processing method according to an embodiment of the present invention;

[0030] Figure 2 This is a flowchart illustrating another request processing method according to an embodiment of the present invention;

[0031] Figure 3 This is a structural block diagram of a request processing device shown in an embodiment of the present invention;

[0032] Figure 4 This is a structural block diagram of another request processing apparatus shown in an embodiment of the present invention. Detailed Implementation

[0033] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work should belong to the protection scope of the present application.

[0034] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a list of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0035] According to an embodiment of the present application, a method embodiment of request processing is provided, applied to a client. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0036] Figure 1 is a flowchart of a request processing method according to an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0037] Step S102, in the case of detecting a security operation, generating a first key based on the security operation, and receiving a second key sent by a server.

[0038] Among them, the generated first key has different values based on the security operation detected at different times, and the security operation is used to represent an operation having an associated relationship with information security.

[0039] The security operation can be an operation related to information security of the user, and can include, but is not limited to, user login, account password change, personal information query, and the like. The first key can be a temporarily generated key. To ensure the security of the first key, the client can generate a corresponding first key according to the triggering time of the security operation, that is, the client can generate a first key with different values according to the security operation detected at different times.

[0040] In an optional solution of the embodiment, considering that the server can exist in a replay situation in the process of processing the task processing request sent by the client, which can cause the risk of leakage of personal information of the user, and even cause unnecessary economic losses. Therefore, in order to avoid the replay of the task processing request triggered by the user on the client, the client can encrypt the task processing request to enhance the security and uniqueness of the request, thereby preventing the request from being illegally replayed.

[0041] Further, considering that the task processing request triggered by the user is encrypted by using a fixed key, there can be a risk of key leakage, and once the key is leaked, the attacker can use the key to decrypt and tamper with past and future communications, causing serious security problems. Therefore, in order to improve the security of the system and prevent the risk caused by key leakage, the client can dynamically generate a temporary security key, that is, the first key, according to the attributes or the environment of the security operation when detecting the security operation. At the same time, the client can receive the second key sent by the server, and cooperate with the first key to perform the encryption task processing request operation. The second key can be an independent key set by the client, that is, the server assigns an independent second key to each client according to the uniform setting of the client, which will not change due to the client environment or the content of the security operation, thereby ensuring the stability and security of the communication. Even if the client environment changes, the security of the communication can be guaranteed. Alternatively, the second key can be a temporary key dynamically generated according to the first request of the security operation sent by the client, to ensure that each security operation has an independent encryption channel, so that even if the key of a certain operation is leaked, it will not affect the security of other operations.

[0042] Step S104, in the case of detecting the task processing request, determining the target key based on the first key and the second key, and performing encryption processing on the task processing request based on the target key to obtain an encrypted request.

[0043] The task processing request can be a request performed by the user on the client that needs to ensure the security of the execution process, and can include, but is not limited to, resource transfer, permission change, information access, and the like.

[0044] In one optional embodiment, upon detecting the aforementioned task processing request, the client can use the generated first key (a time-sensitive key closely related to the current operation) and the received second key (an independent key uniformly set by the server or a dynamically generated temporary key) to encrypt the task processing request, thereby obtaining an encrypted request. This prevents the request from being intercepted and decrypted during transmission, and allows the server to verify the authenticity and freshness of the request when it receives it, preventing replay attacks and data tampering, and ensuring the security of user operations.

[0045] To enhance encryption strength and security, during the encryption of task processing requests, the client can first generate a more complex target key based on the first and second keys. This target key is then used to encrypt the task processing request, thereby improving the confidentiality of the request message and its resistance to attacks. Specifically, when generating the target key from the first and second keys, the client can combine the first and second keys according to preset combination rules to obtain the corresponding target key. Alternatively, the client can input the first and second keys into a pre-trained generative model, which will then fuse the first and second keys according to preset rules to obtain the corresponding target key.

[0046] Step S106: Based on the triggering process of the task processing request, determine multiple first signature elements that are associated with the triggering process.

[0047] The aforementioned multiple first signature elements can refer to easily obtainable and understandable static or semi-static data directly related to the task processing request, such as timestamps, order numbers, user IDs, and session IDs. This data can serve as the basis for constructing request messages, used to initially verify the freshness and uniqueness of the request. Through these multiple first signature elements, the client can construct a time-sensitive and operation-unique request framework, thereby ensuring that every request received by the server is immediate, tamper-proof, and represents a unique action by the user within a specific operational flow.

[0048] In one feasible solution of this embodiment, considering that simply encrypting a task processing request may lead to its vulnerability to being cracked or replayed due to the singularity of the encryption method and the static nature of the key, the client can adjust the encrypted request using multiple signature elements to increase its complexity and dynamism. To ensure the unpredictability and attack resistance of the encrypted request, the signature elements used to adjust the encrypted request can include at least the aforementioned multiple first signature elements, allowing the client to construct a more secure and unique encrypted request message.

[0049] In order to improve the effectiveness of the plurality of first signature elements obtained, the client can determine, according to the triggering process of the task processing request, a plurality of first signature elements having an association with the triggering process. For example, when a user initiates a purchase transaction on an e-commerce platform, the generation timestamp of the order, the order number, the user ID, the ID of the current session, and the unique identification code of the user device can be used as the first signature elements. This selection not only covers the immediacy of the time dimension, but also contains multiple levels of operation uniqueness, user identity verification, and device verification, thereby effectively improving the complexity of the signature. Even if the attacker can intercept or predict part of the information, it is difficult to completely copy the entire signature, greatly enhancing the security mechanism of anti-replay and anti-tampering.

[0050] Step S108, based on the behavior mode corresponding to the task processing request, a plurality of second signature elements matching the behavior mode are determined.

[0051] The behavior mode is determined based on the historical processing requests triggered in the historical time period, and the behavior mode is used to reflect the generation rule of the task processing request.

[0052] The above-mentioned behavior mode can refer to analyzing the historical records of a series of user operations or requests in the past, thereby identifying and defining the typical behavior characteristics and rules of the user when performing a certain type of task or operation, which can reflect the normal operation process of the user in different scenarios. By continuously collecting and analyzing the patterns of the user triggering the task processing request in different situations, the client can establish a behavior baseline to evaluate whether the current task processing request conforms to the user's regular operation habits, thereby serving as an additional verification means.

[0053] The above-mentioned plurality of second signature elements can refer to data extracted from the behavior mode, which can reflect the generation rule of the task processing request. Specifically, the plurality of second signature elements can include but are not limited to: sensor data of the user device (such as accelerometer, gyroscope, ambient light sensor, etc.), habit characteristics of user operation (such as typing rhythm, sliding trajectory), dynamic identification of the environment where the user is located (such as the currently connected WiFi hotspot, surrounding Bluetooth device information), and even the estimation of the user's emotional state (by analyzing the tone of interaction, emoticons, etc.). Through the deeper contextual information and user behavior characteristics provided by the second signature elements, the dynamic nature and unpredictability of adjusting the encrypted request using the signature elements can be greatly increased, thereby increasing the difficulty of forging the signature.

[0054] In an optional solution of the embodiment, considering that the first signature elements are mostly static or semi-static data, only adjusting the encrypted request by using the first signature elements can reduce the complexity and attack resistance of the encrypted request. Therefore, in order to further improve the security and dynamics of adjusting the encrypted request, the client can further obtain the plurality of second signature elements to construct a more comprehensive and dynamic security signature framework. In order to improve the pertinence and effectiveness of the obtained second signature elements, the client can first determine the behavior mode corresponding to the task processing request, that is, determine the generation rule of the task processing request, and then determine the plurality of second signature elements matched according to the behavior mode, so as to enhance the verification of the authenticity of the user operation and the freshness of the request.

[0055] In order to ensure the accuracy of the determined behavior mode, the client can obtain historical processing requests triggered in a historical time period, and analyze the historical processing requests, for example, count the average operation interval, commonly used location, commonly used device state and operation habit of the user when performing a certain type of task, so as to obtain the behavior mode of the task processing request. In this way, the security system can more intelligently understand and adapt to the user's behavior, so as to ensure security while not excessively affecting user experience, and achieve a balance between security and convenience.

[0056] In step S110, the encrypted request is adjusted according to the message assembly rule based on the plurality of first signature elements and the plurality of second signature elements, and a request message is obtained.

[0057] In an optional solution of the embodiment, in order to avoid the replay situation, after obtaining the plurality of first signature elements and the plurality of second signature elements, the client can adjust the encrypted request according to the message assembly rule based on the plurality of first signature elements and the plurality of second signature elements, and obtain the request message, thereby increasing the complexity and verification difficulty of the request, so that the attacker is difficult to perform effective replay attack only by capturing the message.

[0058] In step S112, the request message is sent to the server, and the request execution result returned by the server is received.

[0059] In an optional solution of the embodiment, after the request message is assembled, the client can send the request message to the server, and the server can decrypt and parse the request message to execute the corresponding task processing request, and obtain the request execution result. Correspondingly, after obtaining the request execution result, the server can send the request execution result to the client, and the client can display the request execution result to the user after receiving the request execution result returned by the server, so as to complete the operation demand feedback of the user, inform the user of the execution state of the task processing request, and ensure that the user can timely understand and confirm the execution result of the task processing request, thereby improving the user experience.

[0060] In the embodiment of the present application, in the case of detecting a security operation, a first key is generated based on the security operation, and a second key sent by a server is received; in the case of detecting a task processing request, a target key is determined based on the first key and the second key, and the task processing request is encrypted based on the target key to obtain an encrypted request; a plurality of first signature elements associated with a trigger process of the task processing request are determined based on the trigger process; a plurality of second signature elements matched with a behavior mode corresponding to the task processing request are determined based on the behavior mode; the encrypted request is adjusted based on the plurality of first signature elements and the plurality of second signature elements according to a message assembly rule to obtain a request message; and the request message is sent to the server, and a request execution result returned by the server is received. By dynamically determining the first key and the second key used for encrypting the task processing request in the case of detecting the security operation, and then directly using the target key constructed by the first key and the second key to encrypt the task processing request in the case of receiving the task processing request, the security of the communication process can be improved, and the situation of replay construction caused by the task processing request being cracked can be avoided. Moreover, after obtaining the encrypted request, the plurality of first signature elements and the plurality of second signature elements are introduced to construct the request message corresponding to the task processing request, which can enhance the verification mechanism of the encrypted request, effectively prevent the corresponding task processing request from being tampered with or replayed, and further solve the technical problem that the server may be replayed when executing the task request sent by the client.

[0061] Further, the target key is determined based on the first key and the second key, including: obtaining a key combination rule corresponding to the security operation; and combining the first key and the second key based on the key combination rule to obtain the target key.

[0062] In an optional solution of the embodiment, in the process of encrypting the task processing request by using the first key and the second key, in order to improve the encryption strength and security, the client can first obtain a key combination rule corresponding to the security operation, and then combine the first key and the second key based on the key combination rule to obtain the target key.

[0063] Further, the target key is determined based on the first key and the second key, including: obtaining a key combination rule corresponding to the security operation; and combining the first key and the second key based on the key combination rule to obtain the target key.

[0064] The fusion signature element can refer to a signature element with higher complexity obtained by fusing multiple second signature elements. The fusion is not simply merging data, but integrating the feature information of multiple second signature elements together through mathematical operations, algorithm processing or machine learning models, etc. to form a more comprehensive and dynamic security marker. By fusing multiple second signature elements, the fusion signature element obtained by fusion is put into the process of adjusting the encrypted request, the unpredictability and tamper resistance of the request message can be significantly improved, and the protection level and the effectiveness of resisting replay attacks of the entire security system are enhanced.

[0065] In an optional solution of the embodiment, in the process of adjusting the encrypted request by using multiple signature elements, in order to enhance the uniqueness and security of the signature and avoid the second signature element being cracked or replayed alone, the client can first fuse multiple second signature elements by using a preset fusion algorithm to obtain a fusion signature element, and then process the fusion signature element and multiple first signature elements in a preset manner to generate a digital signature corresponding to the task processing request. For example, the client can concatenate these signature elements into a string in a predefined order and format as the digital signature. Alternatively, in order to improve the confidentiality of the obtained digital signature, the client can further process the concatenated string to generate a fixed-length digest, and then encrypt the string by using the first key to obtain the corresponding digital signature.

[0066] After generating the digital signature, the client can assemble the encrypted request and the digital signature according to the message assembly rule to obtain the request message, thereby enhancing the security and verification of the request message.

[0067] According to the embodiment of the application, another request processing method is also provided, which is applied to the server. Figure 2 is a flowchart of another request processing method according to the embodiment of the application, as shown in Figure 2 The method can include the following steps:

[0068] Step S202, in the case where the first key sent by the client is received, a second key is generated based on the first request.

[0069] The first request is used to represent that the client triggers a security operation, and the generated second key has different values based on the first request detected at different times.

[0070] The second key can be a temporarily generated key. In order to ensure the security of the first key, the server can generate a corresponding second key according to the trigger time of the security operation, that is, the generated second key can have different values based on the first request detected at different times.

[0071] In an optional solution of the embodiment, in the case where the first key sent by the client is received, the server can obtain the first request capable of reflecting the triggered security operation on the client, and generate the corresponding second key in real time according to the first request. Through the first key and the second key, the server can ensure that each communication is fresh and from a legitimate client when decrypting and verifying the request of the client, thereby preventing an illegal third party from performing a replay attack by capturing previous communications, greatly enhancing the overall security of the system and protecting the security of user data and operations.

[0072] Step S204, in the case where the request message sent by the client is received, the request message is parsed to obtain a plurality of first signature elements, a plurality of second signature elements, and an encrypted request.

[0073] The request message is used to reflect the service content that the server needs to provide to the client, the plurality of first signature elements are used to represent the elements associated with the triggering process determined based on the triggering process of the task processing request, the plurality of second signature elements are used to represent the plurality of second signature elements matched with the behavior mode determined based on the behavior mode of the task processing request, and the behavior mode is determined based on the historical processing request triggered in the historical time period. The behavior mode is used to reflect the generation rule of the task processing request.

[0074] The above request message can refer to a message capable of reflecting the task processing request triggered by the user on the client.

[0075] In an optional solution of the embodiment, in the case where the request message sent by the client is received, the server can parse the request message to obtain a plurality of first signature elements and a plurality of second signature elements, and a corresponding encrypted request. Correspondingly, the request message can be used to reflect the service content that the server needs to provide to the client, the plurality of first signature elements can be used to represent the elements associated with the triggering process determined based on the triggering process of the task processing request, the plurality of second signature elements can be used to represent the plurality of second signature elements matched with the behavior mode determined based on the behavior mode of the task processing request, and the behavior mode is determined based on the historical processing request triggered in the historical time period. The behavior mode is used to reflect the generation rule of the task processing request.

[0076] Step S206, security verification is performed on the encrypted request based on the plurality of first signature elements and the plurality of second signature elements, to obtain a security verification result.

[0077] In an optional solution of the embodiment, after the plurality of first signature elements, the plurality of second signature elements and the encrypted request are parsed, to avoid replay attacks and data tampering, the server can first perform security verification on the encrypted request by using the plurality of first signature elements and the plurality of second signature elements to obtain a security verification result, so as to determine whether the encrypted request is safe and whether a replay situation occurs through the security verification result.

[0078] Step S208, in the case that the security verification result represents that the encrypted request is safe, the encrypted request is decrypted based on the target key to obtain a task processing request.

[0079] The target key is determined based on the first key and the second key.

[0080] In an optional solution of the embodiment, in the case that the security verification result represents that the encrypted request is safe, the server can first determine the target key according to the first key and the second key, and then decrypt the encrypted request by using the target key to obtain the task processing request triggered by the user on the client.

[0081] Step S210, the task processing request is executed, and a request execution result is sent to the client.

[0082] In an optional solution of the embodiment, after the encrypted request is decrypted to obtain the task processing request, the server can execute the task processing request to obtain a corresponding request execution result, and send the request execution result to the client, so as to facilitate the user to view.

[0083] Further, the plurality of first signature elements include a timestamp and a request identifier corresponding to the encrypted request; the security verification on the encrypted request based on the plurality of first signature elements and the plurality of second signature elements to obtain a security verification result includes: obtaining a time difference value of the timestamp and a current time; in the case that the time difference value is less than or equal to a preset threshold, verifying the request identifier to obtain an identifier verification result, wherein the identifier verification result represents whether the server is executing the encrypted request; in the case that the identifier verification result represents that the server is not executing the encrypted request, matching any one of the second signature elements with a preset signature element stored in an element table to obtain an element matching result, wherein the element matching result is used to represent whether the second signature element belongs to the element table; in the case that the element matching result represents that the second signature element belongs to the element table, it is determined that the security verification result is that the encrypted request is safe.

[0084] In an optional solution of the embodiment, in order to improve the security of the server processing the encrypted request as much as possible and avoid the occurrence of replay, the above plurality of signature elements can include but are not limited to: a timestamp corresponding to the encrypted request and a request identifier. The timestamp corresponding to the encrypted request can be the time related to the process of triggering the task processing request by the user on the client, for example, it can be the time when the client generates the request message, the time point of the last successful communication or the expected time window start time when the server receives the request, etc. The request identifier can be a unique data that can point to the task processing request, for example, it can be an order number, a hash value, a self-incrementing serial number, etc.

[0085] Correspondingly, in the process of security verification of the encrypted request by using the plurality of signature elements, the server can first determine the difference between the above timestamp and the current time, obtain the above time difference, and evaluate the freshness of the request by using the time difference. If the time difference is large, for example, greater than a preset threshold (such as 2 minutes), it means that the request may come from a past time point, at this time, it can be considered that the encrypted request may be insecure, and there may be a replay situation; if the time difference is small, for example, less than or equal to the preset threshold, it means that the request occurs within a reasonable time range, at this time, in order to further verify the security of the encrypted request, the server can verify the request identifier to obtain an identifier verification result, and determine whether the server is currently executing or has executed the encrypted request by using the identifier verification result.

[0086] Specifically, if the server finds that there is no request record corresponding to the request identifier in the current processing queue, it means that the current request is a new and unprocessed request, and it can be considered that the encrypted request is secure, that is, the security verification result can be determined as the encrypted request is secure; on the contrary, if the server finds a request record corresponding to the request identifier in the processing queue, it means that the current request may be a repeated and processed request, at this time, it can be considered that the encrypted request may be insecure, and there may be a replay situation, that is, the security verification result can be determined as the encrypted request may be insecure. By double verification of the timestamp and the request identifier, the server can effectively identify and intercept the replay attack, and ensure that all request processing is carried out under safe and controllable conditions.

[0087] In order to further ensure the security of the encrypted request, the server can match any one of the second signature elements with the preset signature elements stored in the element table to obtain an element matching result, determine whether the second signature element belongs to the element according to the element matching result, and then determine that the security check result is that the encrypted request is safe when the element matching result indicates that the second signature element belongs to the element table. The element table can be a data table constructed for the second signature element, which can be constructed and updated in real time according to the user's behavior mode, environmental changes and system security policy.

[0088] Further, the encrypted request is decrypted based on the first key and the second key to obtain the task processing request, including: parsing the first request to obtain a key combination rule corresponding to the secure operation; combining the first key and the second key based on the key combination rule to obtain a target key; and decrypting the encrypted request by using the target key to obtain the task processing request.

[0089] In an optional solution of the embodiment, in order to enhance the communication security and prevent replay attacks, in the process of decrypting the encrypted request by using the first key and the second key, the server can first parse the first request to determine the key combination rule corresponding to the secure operation, and combine the first key and the second key based on the key combination rule to obtain a target key used for encrypting the task processing request to obtain the encrypted request. After obtaining the target key, the server can decrypt the encrypted request by using the target key to obtain the task processing request, so as to accurately understand the specific demand of the user and safely execute the corresponding service operation.

[0090] Further, the task processing request is executed, including: obtaining a request identifier corresponding to the task processing request in the process of executing the task processing request; and storing the request identifier in the cache unit.

[0091] In an optional solution of the embodiment, in the process of executing the task processing request, in order to enable the server to monitor the execution state of the task processing request in real time, so as to determine whether the task processing request is in the execution process, thereby avoiding the replay situation, the processing system can obtain a request identifier corresponding to the task processing request in the process of executing the task processing request, and store the request identifier in the cache unit to record the request currently being processed or having been processed, thereby effectively identifying the replay attack and ensuring the uniqueness of each transaction.

[0092] Based on this, by storing request identifiers in cache units, the server establishes a fast-access request state database. Upon receiving a new request, it can quickly check if the request identifier already exists in the cache. If the request identifier exists in the cache, it indicates that the request has already been processed, and the server will directly block the current request, avoiding duplicate processing and potential replay attacks. Simultaneously, the request identifiers in the cache units are set with a reasonable expiration time. After this time, the request identifiers are automatically removed, ensuring that the cache units do not grow indefinitely and consume excessive resources, while also providing an opportunity for legitimate retry requests.

[0093] Furthermore, the above method also includes: if the security verification result indicates that the encryption request is insecure, stopping the execution of the encryption request and sending a prompt message to the client, wherein the prompt message is used to indicate the reason for stopping the execution of the encryption request.

[0094] In one optional embodiment, to enhance system transparency and user experience, and to provide timely feedback on security status, if the security verification result of the encryption request indicates that the encryption request is insecure, the server can immediately stop executing the encryption request and send detailed prompts to the client. These prompts may include the specific reasons for the verification failure, such as an invalid timestamp, a duplicate request identifier, or a signature verification error. This allows the user to understand why the encryption request stopped executing and take appropriate remedial measures, such as re-initiating the request, checking the network connection, updating the client software, or contacting customer service to resolve potential security issues.

[0095] According to an embodiment of the present invention, an embodiment of a request processing apparatus is provided, which is applied to a client. It should be noted that the apparatus can be used to execute the above-described request processing method. Figure 3 This is a structural block diagram of a request processing device shown in an embodiment of the present invention, such as... Figure 3 As shown, the device may include: a first generation module 302, a request encryption module 304, a first determination module 306, a second determination module 308, a request adjustment module 310, and a request sending module 312.

[0096] The system comprises the following modules: a first generation module 302, which generates a first key based on a detected security operation and receives a second key from the server; the value of the first key varies depending on the security operation detected at different times, and the security operation represents an operation related to information security; a request encryption module 304, which determines a target key based on the first and second keys and encrypts the task processing request based on the target key to obtain an encrypted request; a first determination module 306, which determines multiple first signature elements related to the triggering process of the task processing request; a second determination module 308, which determines multiple second signature elements matching the behavior pattern corresponding to the task processing request, where the behavior pattern is determined based on historical processing requests triggered within a historical time period and reflects the generation pattern of the task processing request; a request adjustment module 310, which adjusts the encrypted request according to message assembly rules based on multiple first and second signature elements to obtain a request message; and a request sending module 312, which sends the request message to the server and receives the request execution result returned by the server.

[0097] Furthermore, the request encryption module is also used to: obtain the key combination rules corresponding to the security operation; and combine the first key and the second key based on the key combination rules to obtain the target key.

[0098] Furthermore, the request adjustment module is also used to: fuse multiple second signature elements based on a preset fusion algorithm to obtain a fused signature element; process the fused signature element and multiple first signature elements based on a preset method to generate a digital signature corresponding to the task processing request; and assemble the encryption request and the digital signature according to the message assembly rules to obtain a request message.

[0099] According to an embodiment of the present invention, another embodiment of a request processing apparatus is provided, which is applied to a server. Figure 4 This is a structural block diagram of another request processing apparatus shown in an embodiment of the present invention, such as... Figure 4 As shown, the device may include: a second generation module 402, a request parsing module 404, a security verification module 406, a request decryption module 408, and a request execution module 410.

[0100] The second generation module 402 is configured to generate a second key based on a first request in a case that the first key sent by the client is received, wherein the first request is used to represent that the client triggers a security operation, and the generated second key has different values based on the first request detected at different times. The request analysis module 404 is configured to analyze a request message sent by the client to obtain a plurality of first signature elements, a plurality of second signature elements, and an encrypted request in a case that the request message is received, wherein the request message is used to reflect service content provided by the server to the client, the plurality of first signature elements are used to represent elements associated with a triggering process determined based on a task processing request, and the plurality of second signature elements are used to represent a plurality of second signature elements matched with a behavior mode determined based on the task processing request. The behavior mode is determined based on historical processing requests triggered in a historical time period, and the behavior mode is used to reflect a generation rule of the task processing request. The security verification module 406 is configured to perform security verification on the encrypted request based on the plurality of first signature elements and the plurality of second signature elements to obtain a security verification result. The request decryption module 408 is configured to decrypt the encrypted request based on a target key to obtain the task processing request in a case that the security verification result represents that the encrypted request is secure, wherein the target key is determined based on the first key and the second key. The request execution module 410 is configured to execute the task processing request and send a request execution result to the client.

[0101] Further, the plurality of first signature elements include a timestamp corresponding to the encrypted request and a request identifier. The security verification module is further configured to obtain a time difference value by obtaining a difference between the timestamp and a current time, verify the request identifier to obtain an identifier verification result in a case that the time difference value is less than or equal to a preset threshold, wherein the identifier verification result represents whether the server is executing the encrypted request, match any one of the second signature elements with a preset signature element stored in an element table to obtain an element matching result in a case that the identifier verification result represents that the server is not executing the encrypted request, wherein the element matching result is used to represent whether the second signature element belongs to the element table, and determine that the security verification result is that the encrypted request is secure in a case that the element matching result represents that the second signature element belongs to the element table.

[0102] Further, the request decryption module is further configured to analyze the first request to obtain a key combination rule corresponding to the security operation, combine the first key and the second key based on the key combination rule to obtain the target key, and decrypt the encrypted request by using the target key to obtain the task processing request.

[0103] Further, the request execution module is further configured to obtain a request identifier corresponding to the task processing request in a process of executing the task processing request, and store the request identifier to a cache unit.

[0104] Further, the apparatus further includes an information sending module configured to, in a case where the security check result indicates that the encryption request is unsafe, stop executing the encryption request and send prompt information to the client, wherein the prompt information is used to prompt a reason for stopping execution of the encryption request.

[0105] Embodiments of the present application also provide an electronic device, including a memory storing an executable program, and a processor configured to run the program, wherein the program is configured to execute the method in the embodiments of the present application when running.

[0106] Embodiments of the present application also provide a computer readable storage medium, including a stored executable program, wherein the computer readable storage medium is configured to control a device where the computer readable storage medium is located to execute the method in the embodiments of the present application when the executable program runs.

[0107] Embodiments of the present application also provide a computer program product, including a computer program, wherein the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0108] Embodiments of the present application also provide a computer program product, including a non-volatile computer readable storage medium, wherein the non-volatile computer readable storage medium is configured to store a computer program, and the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0109] Embodiments of the present application also provide a computer program, wherein the computer program is configured to implement the method in the embodiments of the present application when executed by a processor.

[0110] In the above-described embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0111] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other means. Among them, the above-described device embodiments are only schematic, for example, the division of units can be a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between units or modules, which can be electrical or other forms.

[0112] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e. may be located in one place, or may be distributed to multiple units. Part or all of the units may be selected according to actual needs to achieve the purpose of the embodiment.

[0113] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0114] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the prior art that essentially contributes or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various program code storage media.

[0115] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A request processing method, characterized in that, Applied to the client side, including: Upon detecting a security operation, a first key is generated based on the security operation, and a second key sent by the server is received. The value of the first key is different depending on the security operation detected at different times. The security operation is used to characterize an operation that is related to information security. Upon detecting a task processing request, a target key is determined based on the first key and the second key, and the task processing request is encrypted based on the target key to obtain an encrypted request. Based on the triggering process of the task processing request, a number of first signature elements that are associated with the triggering process are determined; Based on the behavior pattern corresponding to the task processing request, a number of second signature elements matching the behavior pattern are determined, wherein the behavior pattern is determined based on historical processing requests triggered within a historical time period, and the behavior pattern is used to reflect the generation pattern of the task processing request. Based on the plurality of first signature elements and the plurality of second signature elements, the encryption request is adjusted according to the message assembly rules to obtain a request message; Send the request message to the server and receive the request execution result returned by the server.

2. The method according to claim 1, characterized in that, Based on the first key and the second key, the target key is determined, including: Obtain the key combination rules corresponding to the security operation; The first key and the second key are combined based on the key combination rules to obtain the target key.

3. The method according to claim 1, characterized in that, Based on the plurality of first signature elements and the plurality of second signature elements, the encryption request is adjusted according to the message assembly rules to obtain a request message, including: The multiple second signature elements are fused based on a preset fusion algorithm to obtain a fused signature element; The fused signature element and the plurality of first signature elements are processed according to a preset method to generate a digital signature corresponding to the task processing request. The encryption request and the digital signature are assembled according to the message assembly rules to obtain the request message.

4. A request processing method, characterized in that, Applied to the server side, including: Upon receiving a first key sent by the client, a second key is generated based on a first request, wherein the first request is used to characterize that the client has triggered a security operation, and the value of the generated second key is different based on the first request detected at different times; Upon receiving a request message from the client, the request message is parsed to obtain multiple first signature elements, multiple second signature elements, and an encrypted request. The request message reflects the service content that the server needs to provide to the client. The multiple first signature elements characterize elements that are related to the triggering process based on the task processing request. The multiple second signature elements characterize multiple second signature elements that match the behavior pattern corresponding to the task processing request. The behavior pattern is determined by historical processing requests triggered within a historical time period and reflects the generation pattern of the task processing request. The encryption request is security verified based on the plurality of first signature elements and the plurality of second signature elements to obtain a security verification result. If the security verification result indicates that the encryption request is secure, the encryption request is decrypted based on the target key to obtain the task processing request, wherein the target key is determined based on the first key and the second key; The task processing request is executed, and the execution result is sent to the client.

5. The method according to claim 4, characterized in that, The plurality of first signature elements include: a timestamp and a request identifier corresponding to the encryption request; security verification is performed on the encryption request based on the plurality of first signature elements and the plurality of second signature elements to obtain a security verification result, including: Obtain the difference between the timestamp and the current time to get the time difference; If the time difference is less than or equal to a preset threshold, the request identifier is verified to obtain an identifier verification result, wherein the identifier verification result indicates whether the server is executing the encryption request; If the identifier verification result indicates that the server did not execute the encryption request, any second signature element is matched with a preset signature element stored in the element table to obtain an element matching result, wherein the element matching result is used to indicate whether the second signature element belongs to the element table; If the element matching result indicates that the second signature element belongs to the element table, the security verification result is determined to be secure for the encryption request.

6. The method according to claim 4, characterized in that, The encryption request is decrypted based on the first key and the second key to obtain a task processing request, including: The first request is parsed to obtain the key combination rule corresponding to the security operation; The first key and the second key are combined based on the key combination rules to obtain the target key; The encrypted request is decrypted using the target key to obtain the task processing request.

7. The method according to claim 4, characterized in that, Executing the task processing request includes: During the execution of the task processing request, the request identifier corresponding to the task processing request is obtained; The request identifier is stored in the cache unit.

8. The method according to claim 4, characterized in that, The method further includes: If the security verification result indicates that the encryption request is insecure, the execution of the encryption request is stopped, and a prompt message is sent to the client, wherein the prompt message is used to indicate the reason for stopping the execution of the encryption request.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the storage medium is located to perform the method according to any one of claims 1 to 8.

Images