Inter-system hyperlink decryption method, encryption method, device and product

Abstract

The invention provides an inter-system hyperlink decryption method, an inter-system hyperlink encryption method, an inter-system hyperlink encryption device and a product, and the inter-system hyperlink decryption method comprises the following steps: receiving a system access request URL sent by a source system, and determining a source system identifier and a first user encryption identifier according to the system access request URL; according to the source system identifier and the first user encryption identifier, generating target system encryption data, and enabling the source system to generate a corresponding data hyperlink according to the target system encryption data; receiving a data access request URL sent by the source system, wherein the data access request URL is generated in response to clicking the data hyperlink; determining data access parameters and encryption token data according to the data access request URL; generating a target system control instruction according to the data access parameter and the encryption token data; according to the target system control instruction, outputting information corresponding to the data hyperlink or displaying verification failure prompt information; the problem of poor hyperlink security is solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, encryption method, apparatus and product for decrypting hyperlinks between systems. Background Technology

[0002] With the development of information technology infrastructure, multi-system integration has become the norm. For example, in scenarios such as office automation systems and electronic seal systems, financial systems and approval systems, and human resources systems and document management systems, users can quickly switch between different systems via hyperlinks to complete business operations.

[0003] In existing technologies, link calls between existing systems typically use a plaintext parameter passing mechanism. Taking the interaction between an office automation system and an electronic seal system as an example: after a user logs into the office automation system, clicking a hyperlink redirects to the electronic seal system. The office automation system and the electronic seal system directly pass parameters such as user ID and file ID through a Uniform Resource Locator (URL).

[0004] However, existing solutions have resulted in poor hyperlink security. Summary of the Invention

[0005] The hyperlink decryption method, encryption method, apparatus, and product provided in this application are intended to solve the problem of poor hyperlink security.

[0006] In a first aspect, embodiments of this application provide a method for decrypting hyperlinks between systems, applied to a target system, comprising: receiving a system access request URL sent by a source system; wherein the system access request URL is generated by the source system in response to a first user clicking a hyperlink in the target system; determining a source system identifier and a first user encrypted identifier based on the system access request URL; decrypting the first user encrypted identifier based on the source system identifier to obtain a first user identifier; generating target system encrypted data based on the first user identifier and a user interaction request; the target system encrypted data including encryption token data; sending the target system encrypted data to the source system, so that the source system generates and displays a data hyperlink corresponding to the target system encrypted data based on the target system encrypted data; receiving a data access request URL sent by the source system; wherein the data access request URL is generated by the source system in response to a second user clicking the data hyperlink; determining data access parameters and the encryption token data based on the data access request URL; generating a target system control instruction based on the data access parameters and the encryption token data; and outputting information corresponding to the data hyperlink or displaying a verification failure message based on the target system control instruction.

[0007] In one possible implementation, generating encrypted target system data based on the first user identifier and the user interaction request includes: verifying the user system login status of the first user based on the first user identifier; if the first user's user system login status is "user system logged in," determining the first user's operation permission information based on the first user identifier; determining whether the user interaction request satisfies the first user's operation permission information; if the user interaction request satisfies the first user's operation permission information, displaying the interaction request result; generating access token data in response to the first user's interaction operation on the interaction request result; wherein the access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, the temporary identifier of the request result corresponding to the interaction request result, and the data access permissions of the interaction request result; encrypting the access token data based on an encryption algorithm to generate encrypted token data; and obtaining the encrypted target system data based on the temporary identifier of the request result and the encrypted token data.

[0008] In one possible implementation, generating a target system control command based on the data access parameters and the encrypted token data includes: decrypting the encrypted token data to obtain access token data; verifying the access token data; if the access token data verification passes, performing a signature verification on the data access parameters; if the signature verification of the data access parameters passes, decrypting the data access parameters to obtain a source system identifier corresponding to the data access parameters; determining whether the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data; if the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data, generating the target system control command based on the data access parameters and the access token data.

[0009] In one possible implementation, generating the target system control instruction based on the data access parameters and the access token data includes: determining whether the unique random string in the data access parameters is a duplicate of a historical unique random string stored in the target system; if the unique random string in the data access parameters is not a duplicate of a historical unique random string, storing the historical unique random string in the target system, and determining the data hyperlink click time based on the data access parameters; calculating the time difference between the current access time and the data hyperlink click time to obtain the access request duration; determining whether the access request duration is less than the allowed access request duration; if the access request duration is less than the allowed access request duration, verifying the user system login status of the second user based on the data access parameters; if the user system login status of the second user is "user system logged in," determining the temporary identifier of the corresponding interaction request result and the data access permission based on the access token data; determining the second user's second user operation permission information in the target system based on the data access parameters; and generating the target system control instruction based on the temporary identifier of the request result, the data access permission, and the second user operation permission information.

[0010] Secondly, embodiments of this application provide a method for encrypting hyperlinks between systems, applied to a source system, comprising: responding to a first user clicking a target system hyperlink in a target system; encrypting a first user identifier based on an encryption algorithm to generate a first user encrypted identifier; generating a system access request URL based on the first user encrypted identifier and the source system identifier of the source system; sending the system access request URL to the target system, so that the target system generates target system encrypted data based on the system access request URL; the target system encrypted data including encryption token data; receiving the target system encrypted data sent by the target system; and generating and displaying the target system encrypted data based on the target system encrypted data. According to the corresponding data hyperlink; in response to the second user clicking the data hyperlink, the second user identifier, the data hyperlink click time, the allowed access request duration, the unique random string, and the source system identifier are encrypted using an encryption algorithm to generate a first segment of encrypted data; the first segment of encrypted data is signed to generate signature data; a data access request URL is generated based on the first segment of encrypted data, the signature data, and the encryption token data; the data access request URL is sent to the target system, so that the target system generates a target system control instruction based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure message according to the target system control instruction.

[0011] In one possible implementation, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the method further includes: determining encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determining encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0012] Thirdly, embodiments of this application provide a hyperlink decryption device between systems, applied to a target system, comprising: a first receiving module, configured to receive a system access request URL sent by a source system; wherein the system access request URL is generated by the source system in response to a first user clicking a hyperlink in the target system; a first processing module, configured to determine a source system identifier and a first user encrypted identifier based on the system access request URL; decrypt the first user encrypted identifier based on the source system identifier to obtain a first user identifier; generate target system encrypted data based on the first user identifier and a user interaction request; the target system encrypted data includes encryption token data; and a first sending module, configured to send the target system... The first receiving module sends encrypted data to the source system, so that the source system generates and displays a data hyperlink corresponding to the encrypted data of the target system based on the encrypted data of the target system; the first receiving module is also used to receive a data access request URL sent by the source system; wherein, the data access request URL is generated by the source system in response to the second user clicking the data hyperlink; the first processing module is also used to determine data access parameters and the encryption token data based on the data access request URL; generate a target system control instruction based on the data access parameters and the encryption token data; and output the information corresponding to the data hyperlink or display a verification failure prompt message based on the target system control instruction.

[0013] In one possible implementation, when the first processing module generates encrypted target system data based on the first user identifier and the user interaction request, it specifically performs the following steps: verifying the user system login status of the first user based on the first user identifier; if the first user's user system login status is "user system logged in," determining the first user's operation permission information based on the first user identifier; determining whether the user interaction request satisfies the first user's operation permission information; if the user interaction request satisfies the first user's operation permission information, displaying the interaction request result; generating access token data in response to the first user's interaction with the interaction request result; wherein the access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, a temporary identifier for the request result corresponding to the interaction request result, and the data access permissions of the interaction request result; encrypting the access token data based on an encryption algorithm to generate encrypted token data; and obtaining the encrypted target system data based on the temporary identifier for the request result and the encrypted token data.

[0014] In one possible implementation, when the first processing module generates a target system control instruction based on the data access parameters and the encrypted token data, it specifically performs the following steps: decrypting the encrypted token data to obtain access token data; verifying the access token data; if the access token data verification passes, performing signature verification on the data access parameters; if the signature verification of the data access parameters passes, decrypting the data access parameters to obtain the source system identifier corresponding to the data access parameters; determining whether the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data; if the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data, generating the target system control instruction based on the data access parameters and the access token data.

[0015] In one possible implementation, when the first processing module generates the target system control instruction based on the data access parameters and the access token data, it specifically performs the following steps: determining whether the unique random string in the data access parameters is a duplicate of a historical unique random string stored in the target system; if the unique random string in the data access parameters is not a duplicate of a historical unique random string, then storing the historical unique random string in the target system, and determining the data hyperlink click time based on the data access parameters; calculating the time difference between the current access time and the data hyperlink click time to obtain the access request duration; determining whether the access request duration is less than the allowed access request duration; if the access request duration is less than the allowed access request duration, then verifying the second user's user system login status based on the data access parameters; if the second user's user system login status is "user system logged in," then determining the temporary identifier of the corresponding interaction request result and the data access permission based on the access token data; determining the second user's second user operation permission information in the target system based on the data access parameters; and generating the target system control instruction based on the temporary identifier of the request result, the data access permission, and the second user operation permission information.

[0016] In one possible implementation, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the inter-system hyperlink decryption device is further configured to: determine the encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determine the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0017] Fourthly, embodiments of this application provide a hyperlink encryption device between systems, applied to a source system, comprising: a second processing module, configured to, in response to a first user clicking a target system hyperlink in a target system, encrypt a first user identifier based on an encryption algorithm to generate a first user encrypted identifier; and generate a system access request URL based on the first user encrypted identifier and the source system identifier of the source system; a second sending module, configured to send the system access request URL to the target system, so that the target system generates target system encrypted data based on the system access request URL; the target system encrypted data includes encryption token data; a second receiving module, configured to receive the target system encrypted data sent by the target system; the second processing module is further configured to generate... The system generates and displays a data hyperlink corresponding to the encrypted data of the target system; in response to a second user clicking the data hyperlink, it encrypts the second user identifier, the data hyperlink click time, the allowed access request duration, a unique random string, and the source system identifier based on an encryption algorithm to generate a first segment of encrypted data; it performs signature processing on the first segment of encrypted data to generate signature data; and it generates a data access request URL based on the first segment of encrypted data, the signature data, and the encryption token data; the second sending module is further configured to send the data access request URL to the target system, so that the target system generates a target system control instruction based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure prompt message according to the target system control instruction.

[0018] In one possible implementation, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the inter-system hyperlink encryption device is further configured to: determine the encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determine the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0019] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0020] The memory stores computer-executed instructions;

[0021] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect, and / or the second aspect and / or various possible implementations of the second aspect.

[0022] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect, and / or the second aspect and / or various possible implementations of the second aspect.

[0023] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect, and / or the second aspect and / or various possible implementations of the second aspect.

[0024] The hyperlink decryption method, encryption method, apparatus, and product provided in this application embodiment, based on receiving a system access request URL sent by the source system, determining the source system identifier and a first user encryption identifier according to the system access request URL, wherein the system access request URL is generated by the source system in response to clicking the target system hyperlink; generating target system encrypted data according to the source system identifier and the first user encryption identifier, enabling the source system to generate a corresponding data hyperlink based on the target system encrypted data; receiving a data access request URL sent by the source system, the data access request URL being generated in response to clicking the data hyperlink; determining data access parameters and encryption token data according to the data access request URL; generating target system control instructions according to the data access parameters and encryption token data; and outputting information corresponding to the data hyperlink or displaying verification failure prompt information according to the target system control instructions; by encrypting and decrypting the target system hyperlink and the data hyperlink separately for access, the security of hyperlinks during use is ensured, solving the problem of poor hyperlink security. Attached Figure Description

[0025] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0026] Figure 1 A schematic diagram illustrating a scenario for the inter-system hyperlink decryption method provided in this application;

[0027] Figure 2 A flowchart illustrating a method for decrypting hyperlinks between systems provided in one embodiment of this application;

[0028] Figure 3 A flowchart illustrating a method for encrypting hyperlinks between systems, as provided in another embodiment of this application;

[0029] Figure 4 A schematic diagram of the structure of an inter-system hyperlink decryption device provided in one embodiment of this application;

[0030] Figure 5 A schematic diagram of the structure of an inter-system hyperlink encryption device provided in one embodiment of this application;

[0031] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.

[0032] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0033] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0034] The technical solution of this application involves the collection, storage, use, processing, transmission, provision and disclosure of user personal information and data, which comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0035] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0036] With the development of information technology infrastructure, multi-system integration has become commonplace. For example, in scenarios such as office automation systems and electronic seal systems, financial systems and approval systems, and human resources systems and document management systems, users can quickly switch between different systems via hyperlinks to complete business operations. In existing technologies, link calls between systems typically use a plaintext parameter transmission mechanism. Taking the interaction between an office automation system and an electronic seal system as an example: after logging into the office automation system, a user clicks a hyperlink to jump to the electronic seal system. The office automation system and the electronic seal system directly transmit parameters such as user ID and file ID through a Uniform Resource Locator (URL). However, the existing technology leads to poor hyperlink security.

[0037] The application scenarios of the embodiments of this application are explained below:

[0038] Figure 1 A schematic diagram illustrating the scenario of the inter-system hyperlink decryption method provided in this application, as shown below. Figure 1 As shown, the execution subject of the method provided in this application embodiment can be any form of electronic device. Using a computer device as the execution subject, the target system is deployed on computer device 101, and the source system is deployed on terminal device 102. Computer device 101 receives a system access request URL sent by the source system (terminal device 102). The system access request URL is generated by the source system in response to a first user clicking a hyperlink in the target system. Based on the system access request URL, the source system identifier and the first user encrypted identifier are determined. Based on the source system identifier, the first user encrypted identifier is decrypted to obtain the first user identifier. Based on the first user identifier and the user interaction request, target system encrypted data is generated. The target system encrypted data includes encryption token data. The system sends encrypted data from the target system to the source system (terminal device 102), enabling the source system (terminal device 102) to generate and display a data hyperlink corresponding to the encrypted data. It also receives a data access request URL from the source system (terminal device 102), generated by the source system in response to a second user clicking the data hyperlink. Based on the data access request URL, it determines the data access parameters and encryption token data. Based on the data access parameters and encryption token data, it generates a target system control command. Based on the target system control command, it outputs the information corresponding to the data hyperlink or displays a verification failure message. This ensures the security of the hyperlink during its use and solves the problem of poor hyperlink security.

[0039] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0040] Figure 2 A flowchart of a method for decrypting hyperlinks between systems provided in one embodiment of this application is shown below. Figure 2 As shown, the execution subject of the inter-system hyperlink decryption method provided in this embodiment can be any form of electronic device. For example, this embodiment uses a computer device as the execution subject of the method. The inter-system hyperlink decryption method provided in this embodiment is applied to a target system deployed on a computer device and includes the following steps:

[0041] Step S201: Receive the system access request URL sent by the source system; wherein, the system access request URL is generated by the source system in response to the first user clicking the target system hyperlink.

[0042] For example, the source system displays a hyperlink to the target system; then, after the first user clicks the target system hyperlink, the source system generates a corresponding system access request URL and sends the system access request URL to the target system; wherein, the process of generating the system access request URL includes at least: in response to the first user clicking the target system hyperlink, the source system encrypts the first user identifier based on an encryption algorithm to generate a first user encrypted identifier; and generates a system access request URL based on the first user encrypted identifier and the source system identifier; wherein, the encryption algorithm is, for example, the SM2 encryption algorithm.

[0043] Step S202: Determine the source system identifier and the first user encryption identifier based on the system access request URL.

[0044] Step S203: Decrypt the first user encrypted identifier according to the source system identifier to obtain the first user identifier.

[0045] For example, based on the source system identifier, a private key for the encryption algorithm used to decrypt the first user's encrypted identifier is determined; then, the first user's encrypted identifier is decrypted based on the private key of the encryption algorithm to obtain the first user identifier.

[0046] Specifically, for example, the target system is associated with multiple source systems, and the target system stores corresponding key pairs; for example, the target system and the first source system agree to use the first key pair to encrypt data, the target system and the second source system agree to use the second key pair to encrypt data, and the target system and the third source system agree to use the third key pair to encrypt data; then, the target system determines the corresponding associated source system based on the source system identifier, for example, the third source system, and determines the corresponding third key pair, that is, obtains the encryption algorithm private key used to decrypt the first user's encrypted identifier; then, the first user's encrypted identifier is decrypted to obtain the first user identifier.

[0047] Step S204: Generate target system encrypted data based on the first user identifier and user interaction request; the target system encrypted data includes encrypted token data.

[0048] Specifically, the specific implementation steps of step S204 include:

[0049] Step S2041: Verify the user system login status of the first user based on the first user identifier.

[0050] Step S2042: If the user system login status of the first user is "user system logged in", then determine the operation permission information of the first user based on the first user identifier.

[0051] For example, the first user operation permission information is used to indicate the first user's permissions or scope for operating (e.g., adding, deleting, copying, downloading) and querying data in the target system.

[0052] Step S2043: Determine whether the user interaction request satisfies the first user operation permission information.

[0053] Step S2044: If the user interaction request satisfies the first user operation permission information, then display the interaction request result.

[0054] For example, if the user interaction request is to query and browse file file_1, and the first user operation permission information allows the user to query and browse file file_1, then the user interaction request satisfies the first user operation permission information, and the target system can then display the interaction request result on the display interface.

[0055] Step S2045: In response to the first user's interaction operation on the interaction request result, access token data is generated; wherein, the access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, the temporary identifier of the request result corresponding to the interaction request result, and the data access permissions of the interaction request result.

[0056] For example, if the first user's interaction with the result of the interaction request is "check" → "OK", then the target system responds to the first user's interaction by generating access token data. The access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, the temporary identifier of the request result corresponding to the interaction request result, and the data access permissions of the interaction request result.

[0057] The temporary identifier of the request result corresponding to the interaction request result further corresponds to a permanent identifier of the request result. The target system stores the correspondence between the temporary identifier and the permanent identifier of the request result. For example, the permanent identifier of the request result is a name with a real concept, and the temporary identifier of the request result is a string without a real concept. The target system determines the permanent identifier of the request result based on the temporary identifier of the request result, and determines the corresponding interaction request result based on the permanent identifier of the request result. The method of not transmitting the permanent identifier of the request result (the name with a real concept) between systems ensures the security of the data.

[0058] Step S2046: Encrypt the access token data based on the encryption algorithm to generate encrypted token data.

[0059] The encryption algorithm is, for example, the SM2 encryption algorithm, which is based on the target system public key to encrypt the access token data to obtain encrypted token data.

[0060] Step S2047: Obtain the target system encrypted data based on the temporary identifier and encryption token data of the request result.

[0061] In step S2048, if the first user's system login status is "not logged in", the system login interface is displayed so that the first user can enter their information to log in. If the login is successful, the process returns to step S2042. If the login fails, a login failure message is generated.

[0062] In step S2049, if the user interaction request does not meet the first user's operation permission information, an insufficient operation permission prompt message is displayed to prompt the first user to re-enter the user interaction request and return to execute step S2043, or exit the target system.

[0063] Step S205: Send the encrypted data of the target system to the source system so that the source system can generate and display the data hyperlinks corresponding to the encrypted data of the target system.

[0064] Step S206: Receive the data access request URL sent by the source system; wherein the data access request URL is generated by the source system in response to the second user clicking the data hyperlink.

[0065] For example, a data hyperlink is displayed on the source system's interface. The second user and the first user can be the same user or different users. When the second user clicks the data hyperlink, the source system generates a data access request URL based on at least the second user's identifier. Specifically, the process of generating the data access request URL includes at least the following steps: in response to the second user clicking the data hyperlink, encrypting the second user's identifier, the data hyperlink click time, the allowed access request duration, a unique random string, and the source system identifier using an encryption algorithm to generate a first segment of encrypted data; signing the first segment of encrypted data to generate signature data; and generating the data access request URL based on the first segment of encrypted data, the signature data, and the encryption token data.

[0066] Step S207: Determine the data access parameters and encryption token data based on the data access request URL.

[0067] Step S208: Generate target system control instructions based on data access parameters and encryption token data.

[0068] Specifically, the specific implementation steps of step S208 include:

[0069] Step S2081: Decrypt the encrypted token data to obtain the access token data.

[0070] The encryption algorithm is, for example, the SM2 encryption algorithm; that is, the encrypted token data is decrypted based on the target system private key corresponding to the SM2 encryption algorithm to obtain the access token data.

[0071] In this step, the target system public key in step S2046 and the target system private key in this step are corresponding key pairs.

[0072] Step S2082: Verify the access token data.

[0073] Specifically, the access token data includes a first user identifier, a source system identifier, a target system identifier, the generation time of the access token data, the expiration time of the access token data, a temporary identifier for the request result corresponding to the interaction request result, and the data access permissions for the interaction request result. It is determined whether the current access time is before the expiration time of the access token data; if the current access time is before the expiration time of the access token data, the access token data verification passes, and step S2083 is executed; if the current access time is not before the expiration time of the access token data, the access token data verification fails, and step S2087 is executed.

[0074] Step S2083: If the access token data verification passes, then the data access parameters are signed and verified.

[0075] Specifically, the data access parameters include a first segment of encrypted data and signature data; the signature data is generated by signing the first segment of encrypted data based on a hash algorithm. The signature data is then verified based on the hash algorithm to determine the integrity of the first segment of encrypted data; if the first segment of encrypted data is complete (i.e., the signature verification passes), step S2084 is executed; if the first segment of encrypted data is incomplete (i.e., the signature verification fails), step S2088 is executed.

[0076] Step S2084: If the signature verification of the data access parameters passes, the data access parameters are decrypted to obtain the source system identifier corresponding to the data access parameters.

[0077] The data access parameters include the first segment of encrypted data. Decrypting the data access parameters, i.e., decrypting the first segment of encrypted data, yields the source system identifier corresponding to the data access parameters.

[0078] Step S2085: Determine whether the source system identifier corresponding to the data access parameter is consistent with the source system identifier in the access token data.

[0079] Step S2086: If the source system identifier corresponding to the data access parameter is consistent with the source system identifier in the access token data, then generate the target system control instruction based on the data access parameter and the access token data.

[0080] Specifically, the data access parameters include a first segment of encrypted data, which is then decrypted to obtain a second user identifier, the data hyperlink click time, the allowed access request duration, and a unique random string. Specifically, the implementation steps of step S2086 include:

[0081] Step S20861: Determine whether the unique random string in the data access parameters is a duplicate of the historical unique random string stored in the target system.

[0082] For example, the first segment of encrypted data is decrypted to obtain a unique random string. It is then determined whether the unique random string in the data access parameters is a duplicate of a historical unique random string stored in the target system, to ascertain whether the current data access request URL has been used. If the unique random string in the data access parameters is a duplicate of a historical unique random string, it indicates that the current data access request URL has been used, so step S20868 is executed; if the unique random string in the data access parameters is not a duplicate of a historical unique random string, it indicates that the current data access request URL has not been used, so step S20862 is executed.

[0083] Step S20862: If the unique random string in the data access parameters does not repeat with the historical unique random string, then the historical unique random string is stored in the target system, and the data hyperlink click time is determined according to the data access parameters.

[0084] For example, the first piece of encrypted data is decrypted to obtain the click time of the data hyperlink.

[0085] Step S20863: Calculate the time difference between the current access time and the data hyperlink click time to obtain the access request duration.

[0086] Step S20864: Determine whether the access request duration is less than the allowed access request duration.

[0087] Specifically, the access request timeout is determined by whether the access request duration is less than the allowed access request duration. If the access request duration is less than the allowed access request duration, the access request does not time out, so step S20865 is executed. If the access request duration is greater than or equal to the allowed access request duration, the access request times out, so step S20869 is executed.

[0088] Step S20865: If the access request duration is less than the allowed access request duration, then verify the second user's system login status according to the data access parameters.

[0089] For example, the first encrypted data is decrypted to obtain the second user identifier; the user system login status of the second user is verified based on the second user identifier.

[0090] Step S20866: If the second user's user system login status is "user system logged in", then determine the temporary identifier of the corresponding interaction request result and the data access permission based on the access token data.

[0091] The temporary identifier of the interaction request result and the data access permissions are generated based on step S2045.

[0092] Step S20867: Determine the second user's operation permission information in the target system based on the data access parameters.

[0093] For example, the first segment of encrypted data is decrypted to obtain the second user identifier; based on the second user identifier, the second user's second user operation permission information in the target system is determined.

[0094] Step S20868: Generate target system control instructions based on the temporary identifier of the request result, data access permissions, and second user operation permission information.

[0095] For example, based on the temporary identifier of the request result, the corresponding interaction request result is determined. The interaction request result is, for example, file_2 or system interface_web_1. Then, based on whether the second user's operation permission information meets the data access permission requirements, if the second user's operation permission information meets the data access permission requirements (e.g., add, delete, copy, download), then the second user is allowed to perform the corresponding permission operation (add, delete, copy, download) on file_2. If the second user's operation permission information does not meet the data access permission requirements (e.g., add, delete, copy, download), then the second user is not allowed to perform the corresponding permission operation (add, delete, copy, download) on file_2. That is, based on whether the second user's operation permission information meets the data access permission requirements, the corresponding target system control instruction is generated.

[0096] Step S20869: If the unique random string in the data access parameters is the same as the historical unique random string, then generate data access request URL reuse information.

[0097] Step S208610: If the access request duration is greater than or equal to the allowed access request duration, an access request timeout message is generated.

[0098] In step S2087, if the access token data verification fails, an access token verification failure message is generated.

[0099] In step S2088, if the signature verification of the data access parameters fails, a message indicating that the data access parameters are incomplete is generated.

[0100] Step S2089: If the source system identifier corresponding to the data access parameter is inconsistent with the source system identifier in the access token data, a source system identifier mismatch prompt message is generated.

[0101] Step S209: According to the target system control command, output the information corresponding to the data hyperlink or display the verification failure prompt message.

[0102] Specifically, for example, if the second user's operation permission information meets the data access permission requirements (e.g., add, delete, copy, download), then according to the corresponding target system control instruction, the information corresponding to the output data hyperlink includes "Allow the second user to perform the corresponding permission operation (add, delete, copy, download) on file file_2"; if the second user's operation permission information does not meet the data access permission requirements (e.g., add, delete, copy, download), then according to the corresponding target system control instruction, the displayed verification failure message includes "The second user is not allowed to perform the corresponding permission operation (add, delete, copy, download) on file file_2".

[0103] In this embodiment, after receiving a system access request URL sent by the source system, and determining the source system identifier and the first user encryption identifier based on the system access request URL (where the system access request URL is generated by the source system in response to clicking the target system hyperlink), encrypted data of the target system is generated based on the source system identifier and the first user encryption identifier, enabling the source system to generate a corresponding data hyperlink based on the encrypted data of the target system. The system also receives a data access request URL sent by the source system (generated in response to clicking the data hyperlink), determines data access parameters and encryption token data based on the data access request URL, generates target system control instructions based on the data access parameters and encryption token data, and outputs information corresponding to the data hyperlink or displays a verification failure message based on the target system control instructions. By encrypting and decrypting the target system hyperlink and the data hyperlink separately for access, the security of the hyperlink during its use is ensured, solving the problem of poor hyperlink security.

[0104] Figure 3 A flowchart of a hyperlink encryption method between systems provided in another embodiment of this application is shown below. Figure 3As shown, the hyperlink encryption method between systems provided in this embodiment is applied to the source system, which is deployed on the terminal device, and includes the following steps:

[0105] Step S301: In response to the first user clicking the target system hyperlink of the target system, the first user identifier is encrypted based on the encryption algorithm to generate the first user encrypted identifier.

[0106] The encryption algorithm is, for example, the SM2 encryption algorithm.

[0107] Step S302: Generate a system access request URL based on the first user encryption identifier and the source system identifier of the source system.

[0108] Step S303: Send the system access request URL to the target system so that the target system generates target system encrypted data based on the system access request URL; the target system encrypted data includes encryption token data.

[0109] Step S304: Receive encrypted data sent by the target system.

[0110] Step S305: Generate and display the data hyperlinks corresponding to the encrypted data of the target system based on the encrypted data of the target system.

[0111] Step S306: In response to the second user clicking the data hyperlink, the second user identifier, the data hyperlink click time, the allowed access request duration, the unique random string, and the source system identifier are encrypted using an encryption algorithm to generate the first piece of encrypted data.

[0112] The encryption algorithm is, for example, the AES encryption algorithm.

[0113] In this embodiment, a unique random string verification mechanism is used to prevent replay attacks. For example, even if an attacker intercepts the data access request URL, they cannot bypass the verification by reusing the unique random string, ensuring that the data access request URL can only be used once and reducing the risk of the data access request URL being stolen multiple times.

[0114] Step S307: Sign the first segment of encrypted data to generate signature data.

[0115] The first segment of encrypted data is signed using a hash algorithm (such as HMAC-SHA256) to generate signature data, thus ensuring the integrity of the data.

[0116] Step S308: Generate a data access request URL based on the first encrypted data, signature data, and encryption token data.

[0117] The data access request URL is encrypted as a whole data packet, rather than encrypting individual parameter values. This avoids the leakage of parameter meaning, type, and number. The data packet format is similar to a JWT token, consisting of a header, payload, and signature (all three parts are base64 encoded). The payload stores a second user identifier, the data hyperlink click time, the allowed access request duration, a unique random string, and the source system identifier. The signature stores the signature data. Upon receiving the data access request URL, the target system needs to unpack the URL and perform dual authentication (system permissions and user permissions) before opening the specific data access request URL link. The target system's processing procedure is described below. Figure 2 The embodiments shown are not described in detail here.

[0118] Step S309: Send the data access request URL to the target system so that the target system generates a target system control command based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure message according to the target system control command.

[0119] exist Figure 2 or Figure 3 Based on the embodiments shown, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the method provided in this application embodiment further includes: determining the encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determining the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0120] For example, encryption algorithm parameters include, for instance, the length of the SM2 key pair and the number of bits in the AES key. Specifically, security requirements are determined based on the system type, and encryption algorithm parameters are determined based on these security requirements; for high security, a 256-bit SM2 key pair and a 256-bit AES key are selected; for compatibility, a 256-bit SM2 key pair and a 128-bit AES key are selected.

[0121] Figure 4 This is a schematic diagram of the structure of a hyperlink decryption device between systems provided in one embodiment of this application, as shown below. Figure 4 As shown, the inter-system hyperlink decryption device 40 provided in this embodiment is applied to the target system and includes: a first receiving module 401, a first processing module 402 and a first sending module 403.

[0122] The first receiving module 401 is used to receive the system access request URL sent by the source system; wherein the system access request URL is generated by the source system in response to the first user clicking the hyperlink of the target system.

[0123] The first processing module 402 is used to determine the source system identifier and the first user encrypted identifier based on the system access request URL; decrypt the first user encrypted identifier based on the source system identifier to obtain the first user identifier; and generate target system encrypted data based on the first user identifier and the user interaction request; the target system encrypted data includes encryption token data.

[0124] The first sending module 403 is used to send encrypted data from the target system to the source system, so that the source system can generate and display the data hyperlinks corresponding to the encrypted data from the target system.

[0125] The first receiving module 401 is also used to receive a data access request URL sent by the source system; wherein the data access request URL is generated by the source system in response to the second user clicking the data hyperlink.

[0126] The first processing module 402 is also used to determine the data access parameters and encryption token data according to the data access request URL; generate the target system control command according to the data access parameters and encryption token data; and output the information corresponding to the data hyperlink or display the verification failure prompt message according to the target system control command.

[0127] In one possible implementation, when the first processing module 402 generates encrypted data for the target system based on the first user identifier and the user interaction request, it specifically performs the following steps: verifying the user system login status of the first user based on the first user identifier; if the user system login status of the first user is "user system logged in," determining the first user's operation permission information based on the first user identifier; determining whether the user interaction request satisfies the first user's operation permission information; if the user interaction request satisfies the first user's operation permission information, displaying the interaction request result; generating access token data in response to the first user's interaction with the interaction request result; wherein the access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, the temporary identifier of the request result corresponding to the interaction request result, and the data access permissions of the interaction request result; encrypting the access token data based on an encryption algorithm to generate encrypted token data; and obtaining the encrypted data for the target system based on the temporary identifier of the request result and the encrypted token data.

[0128] In one possible implementation, when the first processing module 402 generates a target system control instruction based on the data access parameters and the encryption token data, it specifically performs the following steps: decrypting the encryption token data to obtain access token data; verifying the access token data; if the access token data verification passes, performing signature verification on the data access parameters; if the signature verification of the data access parameters passes, decrypting the data access parameters to obtain the source system identifier corresponding to the data access parameters; determining whether the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data; if the source system identifier corresponding to the data access parameters is consistent with the source system identifier in the access token data, generating a target system control instruction based on the data access parameters and the access token data.

[0129] In one possible implementation, when the first processing module 402 generates the target system control instruction based on the data access parameters and access token data, it specifically performs the following steps: determining whether the unique random string in the data access parameters is a duplicate of a historical unique random string stored in the target system; if the unique random string in the data access parameters is not a duplicate of a historical unique random string, then storing the historical unique random string in the target system and determining the data hyperlink click time based on the data access parameters; calculating the time difference between the current access time and the data hyperlink click time to obtain the access request duration; determining whether the access request duration is less than the allowed access request duration; if the access request duration is less than the allowed access request duration, then verifying the second user's user system login status based on the data access parameters; if the second user's user system login status is "user system logged in," then determining the temporary identifier of the corresponding interaction request result and the data access permission based on the access token data; determining the second user's second user operation permission information in the target system based on the data access parameters; and generating the target system control instruction based on the temporary identifier of the request result, the data access permission, and the second user operation permission information.

[0130] In one possible implementation, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the inter-system hyperlink decryption device 40 is further configured to: determine the encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determine the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0131] The inter-system hyperlink decryption device 40 provided in this embodiment can perform actions such as... Figure 2 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0132] Figure 5 This is a schematic diagram of the structure of a hyperlink encryption device between systems provided in one embodiment of this application, as shown below. Figure 5As shown, the inter-system hyperlink encryption device 50 provided in this embodiment is applied to the source system and includes: a second processing module 501, a second sending module 502, and a second receiving module 503.

[0133] The second processing module 501 is used to respond to the first user clicking the target system hyperlink of the target system, encrypt the first user identifier based on the encryption algorithm to generate the first user encrypted identifier; and generate the system access request URL based on the first user encrypted identifier and the source system identifier of the source system.

[0134] The second sending module 502 is used to send the system access request URL to the target system, so that the target system generates target system encrypted data according to the system access request URL; the target system encrypted data includes encryption token data.

[0135] The second receiving module 503 is used to receive encrypted data sent by the target system.

[0136] The second processing module 501 is further configured to generate and display a data hyperlink corresponding to the encrypted data of the target system based on the encrypted data of the target system; in response to the second user clicking the data hyperlink, encrypt the second user identifier, the data hyperlink click time, the allowed access request duration, the unique random string and the source system identifier based on the encryption algorithm to generate a first segment of encrypted data; perform signature processing on the first segment of encrypted data to generate signature data; and generate a data access request URL based on the first segment of encrypted data, the signature data and the encryption token data.

[0137] The second sending module 502 is also used to send the data access request URL to the target system, so that the target system generates a target system control command based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure prompt message based on the target system control command.

[0138] In one possible implementation, the encryption algorithm includes an asymmetric encryption algorithm and / or a symmetric encryption algorithm; the inter-system hyperlink encryption device 50 is further configured to: determine the encryption algorithm parameters of the encryption algorithm according to the system type of the source system; and / or, determine the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

[0139] The inter-system hyperlink encryption device 50 provided in this embodiment can perform the following: Figure 3 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0140] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Figure 6As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus.

[0141] In a specific implementation, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to perform the above-described method.

[0142] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0143] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0144] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0145] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0146] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0147] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0148] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0149] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0150] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0151] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0152] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0153] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0154] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0155] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for decrypting hyperlinks between systems, characterized in that, Applied to a target system, the method includes: Receive a system access request URL sent by the source system; wherein the system access request URL is generated by the source system in response to the first user clicking the target system hyperlink; Based on the system access request URL, determine the source system identifier and the first user encryption identifier; Based on the source system identifier, the first user encrypted identifier is decrypted to obtain the first user identifier; Based on the first user identifier and the user interaction request, target system encrypted data is generated; the target system encrypted data includes encrypted token data. The target system's encrypted data is sent to the source system, so that the source system generates and displays data hyperlinks corresponding to the target system's encrypted data based on the target system's encrypted data. Receive the data access request URL sent by the source system; wherein the data access request URL is generated by the source system in response to the second user clicking the data hyperlink; Based on the data access request URL, determine the data access parameters and the encryption token data; Based on the data access parameters and the encryption token data, generate target system control instructions; According to the target system control command, output the information corresponding to the data hyperlink or display the verification failure prompt message.

2. The method according to claim 1, characterized in that, The step of generating encrypted data for the target system based on the first user identifier and the user interaction request includes: Verify the user system login status of the first user based on the first user identifier; If the first user's system login status is "user system logged in", then the first user's operation permission information is determined based on the first user's identifier. Determine whether the user interaction request satisfies the first user operation permission information; If the user interaction request satisfies the first user operation permission information, then the interaction request result is displayed; In response to the first user's interaction with the result of the interaction request, access token data is generated; wherein, the access token data includes the first user identifier, the source system identifier, the target system identifier, the generation time of the access token data, the expiration time of the access token data, the temporary identifier of the request result corresponding to the interaction request result, and the data access permissions of the interaction request result; The access token data is encrypted using an encryption algorithm to generate the encrypted token data; Based on the temporary identifier of the request result and the encryption token data, the encrypted data of the target system is obtained.

3. The method according to claim 2, characterized in that, The step of generating target system control instructions based on the data access parameters and the encryption token data includes: The encrypted token data is decrypted to obtain the access token data; The access token data is verified; If the access token data passes verification, then the data access parameters undergo signature verification. If the signature verification of the data access parameter passes, the data access parameter is decrypted to obtain the source system identifier corresponding to the data access parameter; Determine whether the source system identifier corresponding to the data access parameter is consistent with the source system identifier in the access token data; If the source system identifier corresponding to the data access parameter is consistent with the source system identifier in the access token data, then the target system control instruction is generated based on the data access parameter and the access token data.

4. The method according to claim 3, characterized in that, The step of generating the target system control command based on the data access parameters and the access token data includes: Determine whether the unique random string in the data access parameters is a duplicate of the historical unique random string stored in the target system; If the unique random string in the data access parameters does not repeat with the historical unique random string, then the historical unique random string is stored in the target system, and the data hyperlink click time is determined according to the data access parameters; Calculate the time difference between the current access time and the click time of the data hyperlink to obtain the access request duration; Determine whether the duration of the access request is less than the allowed duration of the access request; If the access request duration is less than the allowed access request duration, then the user system login status of the second user is verified according to the data access parameters. If the second user's user system login status is "user system logged in", then based on the access token data, determine the temporary identifier of the corresponding interaction request result and the data access permission. Based on the data access parameters, determine the second user's second user operation permission information in the target system; The target system control command is generated based on the temporary identifier of the request result, the data access permission, and the second user operation permission information.

5. A method for encrypting hyperlinks between systems, characterized in that, Applied to a source system, the method includes: In response to the first user clicking the target system hyperlink, the first user's identifier is encrypted using an encryption algorithm to generate an encrypted first user identifier; Generate a system access request URL based on the first user encryption identifier and the source system identifier of the source system; The system access request URL is sent to the target system, so that the target system generates encrypted data based on the system access request URL; the encrypted data includes encryption token data. Receive encrypted data from the target system sent by the target system; Based on the encrypted data of the target system, generate and display the data hyperlinks corresponding to the encrypted data of the target system; In response to the second user clicking the data hyperlink, the second user identifier, the data hyperlink click time, the access request allowed duration, the unique random string and the source system identifier are encrypted based on an encryption algorithm to generate the first segment of encrypted data; The first segment of encrypted data is signed to generate signature data; Generate a data access request URL based on the first encrypted data, the signature data, and the encryption token data; The data access request URL is sent to the target system, so that the target system generates a target system control instruction based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure prompt message according to the target system control instruction.

6. The method according to any one of claims 1-5, characterized in that, The encryption algorithm includes asymmetric encryption algorithms and / or symmetric encryption algorithms; The method further includes: The encryption algorithm parameters are determined based on the system type of the source system. And / or, determine the encryption algorithm parameters of the encryption algorithm according to the system type of the target system.

7. A device for decrypting hyperlinks between systems, characterized in that, Applied to the target system, including: The first receiving module is used to receive a system access request URL sent by the source system; wherein the system access request URL is generated by the source system in response to the first user clicking the target system hyperlink; The first processing module is configured to determine the source system identifier and the first user encrypted identifier based on the system access request URL; decrypt the first user encrypted identifier based on the source system identifier to obtain the first user identifier; and generate target system encrypted data based on the first user identifier and the user interaction request; the target system encrypted data includes encryption token data. The first sending module is used to send the encrypted data of the target system to the source system, so that the source system generates and displays the data hyperlinks corresponding to the encrypted data of the target system based on the encrypted data of the target system. The first receiving module is further configured to receive a data access request URL sent by the source system; wherein the data access request URL is generated by the source system in response to the second user clicking the data hyperlink; The first processing module is further configured to determine data access parameters and encryption token data based on the data access request URL; generate target system control instructions based on the data access parameters and encryption token data; and output information corresponding to the data hyperlink or display verification failure prompt information based on the target system control instructions.

8. A hyperlink encryption device for inter-system communication, characterized in that, Applied to the source system, including: The second processing module is used to respond to the first user clicking the target system hyperlink of the target system, encrypt the first user identifier based on the encryption algorithm to generate the first user encrypted identifier; and generate the system access request URL based on the first user encrypted identifier and the source system identifier of the source system. The second sending module is used to send the system access request URL to the target system, so that the target system generates target system encrypted data according to the system access request URL; the target system encrypted data includes encryption token data; The second receiving module is used to receive encrypted data sent by the target system. The second processing module is further configured to generate and display a data hyperlink corresponding to the encrypted data of the target system based on the encrypted data of the target system; in response to a second user clicking the data hyperlink, encrypt the second user identifier, the data hyperlink click time, the allowed access request duration, a unique random string, and the source system identifier based on an encryption algorithm to generate a first segment of encrypted data; perform signature processing on the first segment of encrypted data to generate signature data; and generate a data access request URL based on the first segment of encrypted data, the signature data, and the encryption token data. The second sending module is further configured to send the data access request URL to the target system, so that the target system generates a target system control instruction based on the data access request URL, and outputs the information corresponding to the data hyperlink or displays a verification failure prompt message based on the target system control instruction.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images