Information source data security protection method, device and equipment free of application service transformation and medium

Abstract

The invention discloses an information source data security protection method, device and equipment without application service modification and a medium, relates to the technical field of information security, is applied to an information source data encryption client, and comprises the following steps: when an initial service request is intercepted, sending a key negotiation data request to an information source data encryption server, on the basis of the obtained session key negotiation requester data and a first password resource component, performing field encryption and associated data authentication encryption on the initial service request, and obtaining an updated service request by using a corresponding request encryption result and session key responder data, so that an application system server triggers a first service logic processing operation; and when the response information returned by the application system server is intercepted, determining a response decryption result based on the first password resource component so as to trigger a second service logic processing operation through the application system client. According to the method, the confidentiality and the data integrity of the information source data are effectively guaranteed in an application service transformation-free mode.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, apparatus, equipment and medium for data security protection of information sources without modification of application services. Background Technology

[0002] Currently, existing solutions for source data in application systems mainly employ hybrid encryption methods based on symmetric and asymmetric encryption algorithms. These solutions have several drawbacks: 1) Some solutions use plaintext symmetric keys or the same key to encrypt important data, posing a risk of key leakage. This can lead to the theft of the original source data during transmission, storage, and use, resulting in the leakage of important data; 2) Some solutions, after encrypting important data, do not provide integrity protection. Attackers can modify the ciphertext data, causing the original data obtained by the recipient to be maliciously tampered with; 3) Some solutions, after encrypting important data, perform message authentication code calculations on the original source data, leading to a doubling of the number of keys, complex key management, data bloat, and performance degradation; 4) Some solutions require additional modifications to the application system's business logic when encrypting important data, resulting in low integration efficiency, high adaptation difficulty, and high modification costs. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for secure protection of source data without modification of application services. This solution addresses the problems existing in current related solutions and effectively ensures the confidentiality and integrity of source data through a modification-free application service approach. Furthermore, it ensures secure data transformation throughout the entire lifecycle of source data, including generation, transmission, storage, and use. The specific solution is as follows: Firstly, this application provides a method for secure protection of source data without modification of application services, applied to a source data encryption client running on an application system client, comprising: When an initial business request initiated by the application system client is intercepted based on the first interceptor, a key negotiation data request corresponding to the initial business request is sent to the source data encryption server to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server; Based on the session key negotiation requester data, the preset source data encryption strategy, and the first cryptographic resource component, the initial service request is encrypted with field encryption and associated data authentication encryption. The updated service request is obtained by using the corresponding request encryption result and session key responder data. The updated service request is sent to the application system server so that when the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result. When the response information returned by the application system server is intercepted based on the first interceptor, the response decryption result is determined based on the response information, the preset source data encryption strategy, and the first cryptographic resource component, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

[0004] Optionally, when an initial service request initiated by the application system client is intercepted based on the first interceptor, a key negotiation data request corresponding to the initial service request is sent to the source data encryption server to obtain session key negotiation requester data, including: When the application system client initiates an initial business request based on a preset request sending function, the initial business request is intercepted by a first interceptor; the first interceptor is an interceptor located in the source data encryption client. Based on a preset communication protocol, a key negotiation data request corresponding to the initial service request is sent to the source data encryption server, so that the session key negotiation requester data can be determined through the source data encryption server and by using the preset source data encryption strategy, the second cryptographic resource component, and the received key negotiation data request; wherein, the source data encryption server runs on the application system server. Based on the preset communication protocol, the session key negotiation request data sent by the source data encryption server is received.

[0005] Optionally, the step of encrypting the initial service request fields and encrypting associated data based on the session key negotiation requester data, the preset source data encryption strategy, and the first cryptographic resource component includes: The session key is determined based on the first cryptographic resource component, the session key negotiation requester data, and the preset source data encryption strategy. Based on the preset source data encryption strategy and the first cryptographic resource component, determine the session key responder data; Based on the encryption / decryption adaptive component, it is determined whether the length of the initial business request is greater than a preset number to determine the first length judgment result; the preset number is the upper limit of the number of parallel data obtained by reading the parallel instruction set of the central processing unit of the current running environment during the initialization process of the application system. If the first length determination result is greater than, then based on the single instruction multiple data technology and the session key, the field to be encrypted in the initial business request is encrypted to determine the encrypted request; During the encryption of the field to be encrypted in the initial business request, based on the first cryptographic resource component, a key management system, cryptographic device or cryptographic calculation service is called, and the corresponding first resource call result is used to authenticate and encrypt the associated data corresponding to the initial business request to obtain the first authentication tag. Based on the encrypted request and the first authentication tag, the request encryption result is determined.

[0006] Optionally, obtaining the updated business request using the corresponding request encryption result and session key responder data includes: Based on the first preset data format and the encrypted request, the fields are rewritten to determine the updated business request.

[0007] Optionally, when the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored in conjunction with the session key responder data, so that it can be processed by the application system server, and the first business logic processing operation is triggered according to the corresponding decryption and restoration result, including: When the application system server receives the updated service request and the first authentication tag sent by the source data encryption client, it intercepts the updated service request and the first authentication tag through the second interceptor local to the source data encryption server. The source data encryption server receives the session key response data sent by the source data encryption client. The first authentication tag is verified for integrity through the source data encryption server and based on the preset source data encryption strategy and the second cryptographic resource component, so as to determine the first verification result. If the first verification result indicates that the first authentication tag is complete, then the session key is determined through the source data encryption server based on the preset source data encryption strategy, the second cryptographic resource component, and the session key responder data. The updated service request is decrypted using the source data encryption server and the session key to determine the decryption result of the request data. The source data encryption server, based on the first preset data format and the decryption result of the request data, rewrites the fields to determine the decryption recovery result; The application system server triggers the first business logic processing operation based on the decryption and recovery result.

[0008] Optional, also includes: After the application system server completes the first business logic processing operation, the initial response data sent by the application system server is intercepted by the second interceptor on the local side of the source data encryption server. The initial response data is encrypted using the source data encryption server and based on the session key to determine the response encryption result. During the field encryption process of the initial response data, based on the second cryptographic resource component, a key management system, cryptographic device, or cryptographic calculation service is invoked, and the corresponding second resource invocation result is used to authenticate and encrypt the associated data corresponding to the initial response data to obtain a second authentication tag. The response information is determined by rewriting the fields through the source data encryption server and using the second preset data format and the response encryption result; The application system server, using the second interceptor, sends the response information and the second authentication tag to the application system client.

[0009] Optionally, after intercepting the response information returned by the application system server based on the first interceptor, determining the response decryption result based on the response information, the preset source data encryption strategy, and the first cryptographic resource component includes: When the application system client receives the response information and the second authentication tag sent by the application system server, it intercepts the response information and the second authentication tag based on the first interceptor; Based on the preset source data encryption strategy and the first cryptographic resource component, the second authentication tag is subjected to integrity verification to determine the second verification result; If the second verification result indicates that the second authentication tag is complete, then based on the encryption / decryption adaptive component, it is determined whether the length of the response information is greater than a preset number, so as to determine the second length judgment result; If the second length determination result is greater than, then based on the single instruction multiple data technology, the preset source data encryption strategy and the first cryptographic resource component, the response information is decrypted to determine the response decryption result; Based on the second preset data format and the response decryption result, the fields are rewritten to determine the target response, so that the second business logic processing operation can be triggered through the application system client and based on the target response.

[0010] Secondly, this application provides a source data security protection device that requires no modification to application services, applied to a source data encryption client running on an application system client, comprising: The request negotiation module is used to send a key negotiation data request corresponding to the initial business request to the source data encryption server when the initial business request initiated by the application system client is intercepted based on the first interceptor, so as to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server; The request encryption module is used to perform field encryption and associated data authentication encryption on the initial business request based on the session key negotiation requester data, the preset source data encryption strategy and the first cryptographic resource component, and to obtain the updated business request using the corresponding request encryption result and session key responder data. The request decryption module is used to send the updated business request to the application system server so that when the updated business request is intercepted by the source data encryption server, the business request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result. The response decryption module is used to determine the response decryption result based on the response information, the preset source data encryption strategy, and the first cryptographic resource component after intercepting the response information returned by the application system server based on the first interceptor, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

[0011] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the aforementioned method for protecting source data security without modifying application services.

[0012] Fourthly, this application provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of the aforementioned application service source data security protection method without modification.

[0013] As can be seen, in this application, the source data encryption client applied to the application system client includes: when an initial business request initiated by the application system client is intercepted based on a first interceptor, a key negotiation data request corresponding to the initial business request is sent to the source data encryption server to obtain session key negotiation requester data; wherein, the source data encryption server runs on the application system server; based on the session key negotiation requester data, a preset source data encryption strategy, and a first cryptographic resource component, the initial business request is encrypted with fields and associated data authentication encryption, and the updated business request is obtained using the corresponding request encryption result and session key responseer data. The updated service request is sent to the application system server. When the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored using the session key response data. This is done through the application system server, and the first business logic processing operation is triggered based on the corresponding decryption and restoration result. When the response information returned by the application system server is intercepted based on the first interceptor, the response decryption result is determined based on the response information, the preset source data encryption strategy, and the first cryptographic resource component. This is done through the application system client and the response decryption result, triggering the second business logic processing operation. In other words, in this application, the source data encryption client running on the application system client first sends a key negotiation data request to the source data encryption server when it intercepts the initial business request initiated by the application system client. Then, using the obtained session key negotiation requester data, combined with the preset source data encryption strategy and the first cryptographic resource component, the initial business request is encrypted with fields and authentication encryption of associated data to determine the updated business request. After that, the updated business request is sent to the application system server so that when the updated business request is intercepted by the source data encryption server, the decryption recovery result is determined by combining the session key responder data. The application system server then triggers the first business logic processing operation based on the decryption recovery result. After that, when the source data encryption client intercepts the response information returned by the application system server, it determines the response decryption result based on the preset source data encryption strategy and the first cryptographic resource component. The application system client then triggers the second business logic processing operation based on the response decryption result. This approach addresses the issues present in existing solutions and effectively safeguards the confidentiality and integrity of source data through application-based business modifications, thereby ensuring the confidentiality transformation of source data throughout its entire lifecycle, including generation, transmission, storage, and use. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0015] Figure 1 A flowchart of a source data security protection method for application services without modification provided in this application; Figure 2 A timing diagram for encrypted protection of application service request source data provided in this application; Figure 3 A timing diagram for encrypted protection of application service response source data provided in this application; Figure 4 A schematic diagram of a source data security protection architecture that requires no modification for application services, as provided in this application. Figure 5 A timing diagram for an initialization source data security protection architecture provided in this application; Figure 6 A schematic diagram of a data security protection device for application services that requires no modification, provided in this application; Figure 7 This application provides a structural diagram of an electronic device. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Currently, existing solutions for source data in application systems mainly employ hybrid encryption methods based on symmetric and asymmetric encryption algorithms. These solutions have several drawbacks: 1) Some solutions use plaintext symmetric keys or the same key to encrypt important data, posing a risk of key leakage. This can lead to the theft of the original source data during transmission, storage, and use, resulting in the leakage of important data; 2) Some solutions, after encrypting important data, do not provide integrity protection. Attackers can modify the ciphertext data, causing the original data obtained by the recipient to be maliciously tampered with; 3) Some solutions, after encrypting important data, perform message authentication code calculations on the original source data, leading to a doubling of the number of keys, complex key management, data bloat, and performance degradation; 4) Some solutions require additional modifications to the application system's business logic when encrypting important data, resulting in low integration efficiency, high adaptation difficulty, and high modification costs.

[0018] To address this, this application provides a source data security protection solution that requires no modification to application services. This solution can solve the problems existing in the current related solutions and effectively protect the confidentiality and integrity of source data by requiring no modification to application services. This ensures the secure transformation of source data throughout its entire lifecycle, including generation, transmission, storage, and use.

[0019] See Figure 1 As shown, this embodiment of the invention discloses a source data security protection method that requires no modification to application services, applied to a source data encryption client running on an application system client, comprising: Step S11: When the initial business request initiated by the application system client is intercepted based on the first interceptor, a key negotiation data request corresponding to the initial business request is sent to the source data encryption server to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server.

[0020] In this embodiment, combined with Figure 2As shown, firstly, the source data encryption client intercepts the application system client's business HTTP request (Hypertext Transfer Protocol) and obtains the session encryption key negotiation data. Specifically: when the application system client initiates an initial business request based on a preset request sending function, the client intercepts the initial business request based on a first interceptor; the first interceptor is an interceptor located on the source data encryption client; based on a preset communication protocol, the client sends a key negotiation data request corresponding to the initial business request to the source data encryption server, so that the session key negotiation requester data can be determined through the source data encryption server using a preset source data encryption strategy, a second cryptographic resource component, and the received key negotiation data request; wherein, the source data encryption server runs on the application system server; and the client receives the session key negotiation requester data sent by the source data encryption server based on the preset communication protocol.

[0021] It's important to understand the following regarding intercepting application system client's business HTTP requests: When the application system client initiates a business request, it enters the overridden `send` method of the `XMLHttpRequest` class, captures the request body data, and performs subsequent key negotiation and source data encryption operations. Regarding obtaining session encryption key negotiation data: In the `send` method, a request to obtain key negotiation data is sent to the source data encryption server via an HTTP request. Furthermore, on the source data encryption server, session key negotiation requester data is generated: After receiving the request to obtain key negotiation data, the source data encryption server, according to the source data encryption strategy, uses the first cryptographic resource component and the key management system / cryptographic device / cryptographic calculation service to generate session key negotiation requester data, i.e., `KeyAgreementRequestData`; and then sends the session key negotiation requester data: The source data encryption server sends the session key negotiation requester data to the source data encryption client via an HTTP response.

[0022] It is understandable that the first cryptographic resource component is a functional module related to the encryption of source data on the application system client side. It uses cryptographic devices / modules on the terminal device to cooperate with the cryptographic resource module on the application system server side to complete key negotiation and data encryption / decryption, providing source data security protection for the application system client side.

[0023] Step S12: Based on the session key negotiation requester data, the preset source data encryption strategy, and the first cryptographic resource component, the initial service request is encrypted with field encryption and associated data authentication encryption. The updated service request is obtained by using the corresponding request encryption result and session key responder data.

[0024] In this embodiment, after receiving the session key negotiation requester data, the source data of the current service request is encrypted using a preset source data encryption strategy and a first cryptographic resource component. Specifically: a session key is determined based on the first cryptographic resource component, the session key negotiation requester data, and the preset source data encryption strategy; session key responder data is determined based on the preset source data encryption strategy and the first cryptographic resource component; and the encryption / decryption adaptive component determines whether the length of the initial service request is greater than a preset number to determine the first length determination result. The preset number is determined during the initialization process of the application system by reading the current operating environment... The central processing unit's parallel instruction set is used to obtain an upper limit for the number of parallel data items. If the first length judgment result indicates that it is greater than this limit, then based on Single Instruction Multiple Data (SID) technology and the session key, the field to be encrypted in the initial service request is encrypted to determine the encrypted request. During the encryption of the field to be encrypted in the initial service request, based on the first cryptographic resource component, a key management system, cryptographic device, or cryptographic computation service is invoked, and the corresponding first resource invocation result is used to authenticate and encrypt the associated data corresponding to the initial service request to obtain a first authentication tag. Based on the encrypted request and the first authentication tag, the request encryption result is determined. Based on the first preset data format and the encrypted request, the field is rewritten to determine the updated service request.

[0025] Furthermore, regarding the encryption of the source data in the current request, combined with... Figure 2 Steps 5 to 8 are as follows: First, a session key is negotiated and generated: The source data encryption client receives the session key negotiation requester data and, according to the source data encryption strategy, generates a session key, i.e., SessionKey, through the first cryptographic resource component and using the cryptographic device / cryptographic computation service. Next, session key negotiation response data is generated: The source data encryption client, according to the source data encryption strategy and through the first cryptographic resource component and using the cryptographic device / cryptographic computation service, generates session key response data, i.e., KeyAgreementeReponseData. Then, ciphertext of the request data is generated: The source data encryption client, according to the source data encryption strategy and the session key, encrypts the source data using the first cryptographic resource component and the cryptographic device / cryptographic computation service, employing an optimal performance encryption / decryption adaptive method, to generate ciphertext of the client's business request data, i.e., CipherData. Finally, the business HTTP request body is rewritten: According to the source data encryption strategy and combined with the JSON data format corresponding to the HTTP request body, the ciphertext of the request data is rewritten with the corresponding fields in the JSON data to form a new HTTP request body.

[0026] Regarding the optimal performance encryption / decryption adaptive method, based on the CPU's parallel instruction support in the operating environment and the size of the application's request and response data packets, large data packets are encrypted / decrypted using parallel instructions, while small data packets are encrypted / decrypted using CPU's ordinary instructions, thereby maximizing data processing performance.

[0027] Step S13: Send the updated service request to the application system server so that when the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result.

[0028] Combination Figure 2 As shown in this embodiment, after determining the updated business request, it is sent to the application system server. That is, regarding the client sending business HTTP request data after encrypting the source data: the `send` method, overridden by the `XMLHttpRequest` class, sends the new HTTP request body from the client to the application system server.

[0029] Furthermore, after the transmission of the request is completed, the decryption and execution of the updated business request will be performed. Specifically: when the application system server receives the updated business request and the first authentication tag sent by the source data encryption client, the updated business request and the first authentication tag are intercepted by the second interceptor on the source data encryption server; the session key response data sent by the source data encryption client is received by the source data encryption server; and the integrity of the first authentication tag is verified by the source data encryption server based on the preset source data encryption strategy and the second cryptographic resource component to determine the first authentication tag. The first verification result is as follows: If the first verification result indicates that the first authentication tag is complete, then the session key is determined through the source data encryption server based on the preset source data encryption strategy, the second cryptographic resource component, and the session key responder data; the updated business request is decrypted through the source data encryption server based on the session key to determine the request data decryption result; the fields are rewritten through the source data encryption server based on the first preset data format and the request data decryption result to determine the decryption recovery result; and the first business logic processing operation is triggered through the application system server based on the decryption recovery result. The second cryptographic resource component has a similar function to the first cryptographic resource component, the difference being the service object. The service object of the second cryptographic resource component is the source data encryption server, while the service object of the first cryptographic resource component is the source data encryption client.

[0030] It's important to understand that on the source data encryption server side, regarding the aforementioned request decryption and business execution process, the process involves several steps. First, the client's HTTP request is intercepted: After receiving the HTTP request body, the application system server enters the `preHandle` method of the custom interceptor `EncryptHandlerInterceptor` on the source data encryption server side. This captures the request body data and performs subsequent key negotiation and source data decryption operations. Next, a session key is negotiated and generated: Based on the source data encryption strategy, the source data encryption server, through the first cryptographic resource component, uses key management / cryptographic devices / cryptographic computation services, combined with the session key negotiation response data sent by the source data encryption client, to negotiate and generate the session key, i.e., `SessionKey`. Next, the original request data is decrypted and obtained: The source data encryption server, based on the source data encryption strategy and session key, uses the first cryptographic resource component and cryptographic device / cryptographic calculation service to decrypt the source data ciphertext and generate the client's original business request data (Data); then, the client's business HTTP request body is rewritten: The source data encryption server, combined with the corresponding JSON data format of the HTTP request body, rewrites the corresponding fields in the JSON data of the original request data to form a new HTTP request body; finally, the application system server processes the client's business request: The application system server, based on the HTTP request body, executes the corresponding business logic of the application system, completing the confidentiality and integrity protection of important data during the application system client-to-server request process.

[0031] Furthermore, in this embodiment, regarding the encryption protection of application business response source data, after obtaining the initial response data, the source data will also be encrypted. Specifically: after the application system server completes the first business logic processing operation, the initial response data sent by the application system server is intercepted by the second interceptor localized on the source data encryption server; the initial response data is encrypted by the source data encryption server based on the session key to determine the response encryption result; during the field encryption of the initial response data, a key management system, cryptographic device, or cryptographic calculation service is called based on the second cryptographic resource component, and the associated data corresponding to the initial response data is authenticated and encrypted using the corresponding second resource call result to obtain a second authentication tag; the fields are rewritten by the source data encryption server using the second preset data format and the response encryption result to determine the response information; the response information and the second authentication tag are sent to the application system client by the application system server using the second interceptor.

[0032] It's important to understand that on the data encryption server side, the source data of the current response is encrypted, combined with... Figure 3 As shown, firstly, the application system server-side business HTTP response is intercepted: After the application system server completes its business logic, it returns response data via HTTP. This triggers the `beforeBodyWrite` method of the custom interceptor `EncryptResponseBodyAdvice` class, capturing the response body data and performing subsequent source data encryption. Secondly, the application system server-side business response data is encrypted: The source data encryption server, based on the source data encryption strategy, uses a second cryptographic resource component and a cryptographic device / cryptographic computation service to encrypt the source data, generating ciphertext for the server-side business response data. Finally, the application system server-side business HTTP response body is rewritten: Based on the source data encryption strategy and the corresponding JSON data format of the HTTP response body, the ciphertext of the response data is used to rewrite the corresponding fields in the JSON data, forming a new HTTP response body.

[0033] Furthermore, regarding the transmission of the encrypted response, in this embodiment, the application system server sends the business HTTP response data: based on the beforeBodyWrite method corresponding to the custom interceptor EncryptResponseBodyAdvice class, the application system server sends the new business HTTP response body to the application system client.

[0034] Step S14: After intercepting the response information returned by the application system server based on the first interceptor, determine the response decryption result based on the response information, the preset source data encryption strategy, and the first cryptographic resource component, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

[0035] In this embodiment, after intercepting the response information, it is necessary to decrypt the source data of the current response and perform business processing. Specifically: when the application system client receives the response information and the second authentication tag sent by the application system server, the response information and the second authentication tag are intercepted based on the first interceptor; based on the preset source data encryption strategy and the first cryptographic resource component, the integrity of the second authentication tag is checked to determine the second verification result; if the second verification result indicates that the second authentication tag is complete, the length of the response information is determined based on the encryption / decryption adaptive component to determine whether the length is greater than a preset number to determine the second length judgment result; if the second length judgment result indicates that it is greater than a preset number, the response information is decrypted based on single instruction multiple data technology, the preset source data encryption strategy, and the first cryptographic resource component to determine the response decryption result; based on the second preset data format and the response decryption result, the fields are rewritten to determine the target response, so that it can pass through the application system client, and based on the target response, the second business logic processing operation is triggered.

[0036] It is important to understand that, in combination Figure 3 As shown, regarding the source data decryption and business processing of the current response, firstly, the application system server's business HTTP response data is intercepted: After receiving the HTTP response returned by the application system server, the application system client enters the overridden onreadystatechange and onload methods of the source data encryption client's XMLHttpRequest class to capture the response body data and perform subsequent source data decryption operations; then, the application system server's business response data is decrypted: The source data encryption client, based on the source data encryption strategy and the key SessionKey, uses the first cryptographic resource component, a cryptographic device / cryptographic computation service, and an optimal performance-adaptive encryption / decryption method to encrypt the ciphertext of the response data, obtaining the plaintext of the application system server's response data; then, the application system server's business HTTP response body is rewritten: Combining the JSON data format corresponding to the HTTP response body, the corresponding fields in the JSON data are rewritten from the original response data to form a new HTTP response body; finally, the application system server's business response is processed: The application system client, based on the HTTP response data, executes the corresponding business logic of the application system, completing the confidentiality and integrity protection of important data during the response process from the application system server to the application system client.

[0037] Furthermore, in the scheme proposed in this embodiment, 1) the key negotiation methods involved include, but are not limited to: asymmetric public key negotiation, public key protected symmetric key negotiation, symmetric key protected symmetric key negotiation, key derivation negotiation, etc., and the sources of the protection keys include, but are not limited to: key management system keys, cryptographic device keys, cryptographic computing service keys, temporary session keys, etc.; 2) the asymmetric encryption algorithms and asymmetric key management involved adopt the SM2 standard algorithm that meets the commercial cryptography specifications, and the data confidentiality and integrity protection algorithms involved adopt the SM4 standard algorithm that meets the commercial cryptography specifications; 3) the front-end technology framework involved includes, but is not limited to: browsers (including in-application browsers), mini-programs, WebView, Electron, etc., and the back-end service technology architecture includes, but is not limited to: Spring, Spring Boot, etc.

[0038] In summary, the proposed solution in this embodiment has the following beneficial effects: (1) By using the application business without modification, the confidentiality and integrity protection of important data in the application system is solved, and the confidentiality transformation of important data is ensured throughout the entire life cycle of generation, transmission, storage and use; (2) By using the application business without modification, the key negotiation and key distribution operations of the application system client and server are automatically completed, ensuring that different encryption keys are used for each data request, and ensuring the security of the encryption key throughout its entire life cycle; (3) By using the application business without modification, it supports different cryptographic devices to protect the confidentiality and integrity of important data. The types of cryptographic devices include, but are not limited to: cryptographic machines, encryption cards, security chips, software cryptographic modules, cryptographic computing services, etc. (4) Encryption of source data between application system terminals: A unique session key is automatically negotiated and generated for each business request to reduce key management complexity, ensure the confidentiality and security of data transmission, and prevent security risks caused by long-term key reuse. (5) Employing the AEAD encryption algorithm (Authenticated Encryption with Associated Data), confidentiality and integrity protection are achieved in a single cryptographic operation, reducing key management complexity and improving data processing performance. In a CPU environment supporting parallel instruction acceleration such as AVX (Advanced Vector Extensions) and NEO, it can process data larger than the parallelizable data volume. The 16-byte data packet is encrypted and decrypted in parallel using hardware instructions to maximize encryption and decryption performance; (6) By using the application service without modification, it supports flexible configuration of two AEAD algorithms, SM4 GCM and SM4 CCM, and automatically completes the confidentiality and integrity protection of source data; (7) By adopting an application service-free approach, and based on the parallel instruction acceleration supported by the central processing unit and the size of the data source packet, instruction acceleration is adaptively adopted to maximize the data processing performance.

[0039] Therefore, in this embodiment, the source data encryption client running on the application system client first sends a key negotiation data request to the source data encryption server when it intercepts the initial business request initiated by the application system client. Then, using the obtained session key negotiation requester data, combined with the preset source data encryption strategy and the first cryptographic resource component, the initial business request is encrypted with fields and authentication encryption of associated data to determine the updated business request. After that, the updated business request is sent to the application system server so that when the updated business request is intercepted by the source data encryption server, the decryption recovery result is determined by combining the session key responder data. The application system server then triggers the first business logic processing operation based on the decryption recovery result. After that, when the source data encryption client intercepts the response information returned by the application system server, it determines the response decryption result based on the preset source data encryption strategy and the first cryptographic resource component. The application system client then triggers the second business logic processing operation based on the response decryption result. This approach addresses the issues present in existing solutions and effectively safeguards the confidentiality and integrity of source data through application-based business modifications, thereby ensuring the confidentiality transformation of source data throughout its entire lifecycle, including generation, transmission, storage, and use.

[0040] The following is combined Figures 2 to 5 The schematic / timing diagrams disclosed herein provide a detailed description of the technical solutions of the embodiments of this application.

[0041] This embodiment introduces a system for source data security protection without requiring modification to application services. The system consists of two parts: a source data encryption client and a source data encryption server. The source data encryption client is integrated into the application system's front-end technology framework and runs on the application system's client side; the source data encryption server is integrated into the application system's back-end technology framework and runs on the application system's server side. The main structure is as follows: Figure 4 As shown: (1) The source data encryption client is divided into the following four modules: 1. Encryption configuration policy parsing module.

[0042] The source data encryption strategy is obtained and parsed from the source data encryption server. The strategy includes: ① Password resource policy: Configure the URL address (Uniform Resource Locator), tenant ID (Identifier), application ID, working path, cryptographic device / module name, protection key ID, etc. of the password service; ② Encryption field strategy: The application system configures the field tags in the HTTP request and response bodies that need to be protected by encryption of the source data according to the important data encryption requirements.

[0043] 2. Network proxy interceptor module, i.e., the first interceptor.

[0044] Based on JavaScript, the key methods of the native XMLHttpRequest class, such as open, setRequestHeader, send, onreadystatechange, and onload, are overridden to capture and process HTTP requests and responses. According to the encryption configuration strategy, fields corresponding to important data are encrypted and protected for integrity.

[0045] 3. Optimal performance encryption / decryption adaptive module, i.e., encryption / decryption adaptive component.

[0046] Based on the CPU's support for parallel instructions in the operating environment, and according to the size of application request and response data packets, large data packets are encrypted and decrypted using parallel instructions, while small data packets are encrypted and decrypted using CPU's ordinary instructions, thereby maximizing data processing performance.

[0047] 4. Cryptographic resource module, i.e., the first cryptographic resource component.

[0048] The application system client-side data encryption-related functional modules use cryptographic devices / modules on the terminal device to collaborate with the application system server-side cryptographic resource module to complete key negotiation and data encryption / decryption, providing data security protection for the application system client-side.

[0049] (2) The source data encryption server is divided into the following three modules: 1. Encryption policy configuration management module.

[0050] It provides default and custom configuration options, offering password resource configuration and field label configuration for encryption protection to the application system. It also generates configuration files based on the configuration strategy and distributes them to the source data encryption client.

[0051] 2. Network proxy interceptor module, i.e., the second interceptor.

[0052] Based on Spring MVC's interceptor mechanism, a custom HTTP interceptor is used, implementing the HandlerInterceptor and ResponseBodyAdvice interfaces to capture and process HTTP requests and responses. According to the encryption configuration strategy, fields corresponding to important data are encrypted and protected for integrity.

[0053] 3. Cryptographic resource module, i.e., the second cryptographic resource component.

[0054] The functional modules related to source data encryption on the application system server side use key management systems, cryptographic devices, cryptographic services, etc., to cooperate with the cryptographic resource modules on the application system client side to complete key negotiation, data encryption and decryption, and other operations, providing source data security protection for the application system server side.

[0055] It's important to understand the implementation details of the front-end technology framework's network interceptor, specifically the first interceptor: It leverages the JavaScript prototype chain modification feature to rewrite key functions of the native XHR class (XMLHttpRequest). Without disrupting native functionality or affecting application business logic, custom logic is inserted to capture and process HTTP requests and responses. Based on the application system's business needs, fields corresponding to important data are encrypted and their integrity protected. The implementation steps are as follows: 1. Save XMLHttpRequest native methods: Save key methods such as open, setRequestHeader, send, onreadystatechange, and onload to prevent native functionality from failing after rewriting; 2. Override XMLHttpRequest request-related methods: Override the open method to capture the request method and URL information, and save the original request information to the XHR instance; override the setRequestHeader method to uniformly inject or modify the request header; override the send method to capture the request body data, perform encryption and integrity protection processing on important data, rewrite the encrypted ciphertext into the request body, and then use the native method to send the request data. 3. Override XMLHttpRequest response-related methods: Override onreadystatechange and onload, capture the response body data, decrypt and verify the integrity of the response data, rewrite the data into the response body, and then return the response body using the native method.

[0056] Regarding the implementation of the backend technology framework network interceptor, specifically the second interceptor: We can utilize Spring MVC's interceptor mechanism to create a custom HTTP interceptor, implementing the HandlerInterceptor and ResponseBodyAdvice interfaces. Without disrupting native functionality or ensuring seamless application business logic, we can insert custom logic to capture and process HTTP requests and responses. Based on the application system's business needs, we can encrypt and protect the integrity of fields corresponding to important data. The implementation steps are as follows: 1. Custom HTTP Request Interceptor: Create a custom source data encryption interceptor class EncryptHandlerInterceptor, which implements the HandlerInterceptor interface and overrides the preHandle method. Before the request body reaches the Controller, it captures the request body data, performs encryption and integrity protection on important data, rewrites the encrypted ciphertext into the request body, and then sends the request body to the Controller. 2. Custom HTTP Response Interceptor: Define a custom source data encryption interceptor class EncryptResponseBodyAdvice, which implements the ResponseBodyAdvice interface and overrides the beforeBodyWrite method. Before the response body reaches the controller, capture the response body data, decrypt and verify its integrity, rewrite the data into the response body, and then send the response body to the controller. 3. Register a custom HTTP interceptor: Define a configuration class EncryptWebMvcConfigurer that implements the WebMvcConfigurer interface, override the addInterceptors method, register the EncryptHandlerInterceptor and specify the request path to be intercepted; add the @ControllerAdvice annotation to the EncryptResponseBodyAdvice class to complete the registration of the custom HTTP interceptor.

[0057] Regarding the usage instructions for the AEAD encryption algorithm, in this embodiment, based on the AEAD encryption short message, an authentication tag is generated while encrypting the data. During decryption, the integrity of the tag is verified first, and then the ciphertext is decrypted. A single cryptographic operation request ensures both data confidentiality and integrity, and has significant advantages in terms of data processing flow and resource consumption. This invention uses a cryptographic algorithm suite to call the cryptographic capabilities provided by the cryptographic device, and uses the SM4-GCM and SM4-CCM algorithms to protect the source transmission of important data in the application system.

[0058] Regarding the optimal performance adaptive encryption / decryption implementation: SM4-GCM and SM4-CCM algorithms can be used for source data encryption, leveraging the single-instruction multiple-data capability provided by the central processing unit. This is particularly relevant when the data length exceeds the number of data that can be processed in parallel. At 16:00, using SIMD (Single Instruction Multiple Data) parallel instructions to encrypt or decrypt data can improve performance by more than 3 times, maximizing data processing performance. The optimal performance encryption and decryption adaptive implementation steps of this invention are as follows: 1. Identify the CPU's parallel instruction set: During system initialization, read information about the CPU in the current operating environment, including the CPU architecture, version, and parallel instruction set. If SIMD instructions are supported, set the parallel instruction flag to [value]. And record the amount of data that can be parallelized. Source data encryption and integrity protection will use parallel instruction acceleration adaptive processing. If SIMD instructions are not supported, the parallel instruction flag will be set to FALSE, and source data encryption and integrity protection will use general-purpose central processing unit instructions. 2. Optimal Performance Adaptive Encryption and Decryption: When critical data in the application system is encrypted and protected for integrity, if parallel instructions are marked as... Determine the length of the current important data; if the length is greater than the number of data that can be processed in parallel. If the value is 16, then SIMD instructions are used to encrypt or decrypt the data; otherwise, general-purpose CPU instructions are used.

[0059] In addition, combined Figure 5 As shown, initialization is required before performing source data security protection. The specific process is as follows: 1) Configure source data encryption strategy: The application system configures the source data encryption strategy according to business needs, including: field label to be encrypted, URL address of the cryptographic service, tenant ID, application ID, working path, cryptographic device / module name, key negotiation key ID, etc. If no source data encryption strategy is configured, the system default strategy will be used. 2) Initialization of the cryptographic resource module of the source data encryption server: According to the source data encryption strategy, the cryptographic resource module is initialized, including: connecting to the key management system, cryptographic service, initializing cryptographic devices, etc., so that the source data encryption server has the ability to negotiate keys and encrypt data; 3) Source data encryption client obtains encryption policy: The source data encryption client sends a request to the source data encryption server to obtain the source data encryption policy via an HTTP request; 4. Source data encryption server generates encryption policy: Upon receiving the request to obtain the source data encryption policy, the source data encryption server generates the source data encryption policy based on the configuration items during application system initialization; 5) Source data encryption server returns encryption policy: The source data encryption server returns the source data encryption configuration policy to the source data encryption client via an HTTP request; 6) Source data encryption client parsing configuration policy: After receiving the encryption policy, the source client parses the field label to be encrypted, the URL address of the cryptographic service, the tenant ID, the application ID, the working path, the cryptographic device / module name, the key negotiation key ID, etc., and saves them to the system context; 7) Initialization of the cryptographic resource module of the source data encryption client: According to the source data encryption strategy, the cryptographic resource module is initialized and the terminal cryptographic device / module is loaded, so that the source data encryption client has the ability to negotiate keys and encrypt data.

[0060] In other words, this embodiment provides both default and custom configuration options, flexibly generating cryptographic resource policies such as key negotiation methods, confidentiality and integrity algorithms, and cryptographic device types. This ensures that important data encryption and integrity protection are implemented automatically and without the business being aware of the configuration. Through the configuration of cryptographic resources, heterogeneous access to different cryptographic devices is automatically achieved, meeting the security requirements of cryptographic devices in various scenarios. Employing SM2 and SM4 standard algorithms that comply with commercial cryptographic specifications ensures security and compliance of interactive data, while also meeting the application system's security assessment and compliance requirements, thus enhancing the application system's security. In this way, by combining key identifier management and cryptographic module collaboration within the key management system, key negotiation, distribution, and use can be automatically completed, ensuring the security of the key throughout its entire lifecycle.

[0061] See Figure 6 As shown in the illustration, this application also discloses a source data security protection device that requires no modification to the application service, applied to a source data encryption client running on the application system client, comprising: The request negotiation module 11 is used to send a key negotiation data request corresponding to the initial business request to the source data encryption server when the initial business request initiated by the application system client is intercepted based on the first interceptor, so as to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server; The request encryption module 12 is used to perform field encryption and associated data authentication encryption on the initial business request based on the session key negotiation requester data, the preset source data encryption strategy and the first cryptographic resource component, and to obtain the updated business request using the corresponding request encryption result and session key responder data. The request decryption module 13 is used to send the updated business request to the application system server so that when the updated business request is intercepted by the source data encryption server, the business request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result. The response decryption module 14 is used to determine the response decryption result based on the response information, the preset source data encryption strategy, and the first cryptographic resource component after intercepting the response information returned by the application system server based on the first interceptor, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

[0062] In some specific embodiments, the request negotiation module 11 can be used to intercept the initial business request based on a first interceptor when the application system client initiates the initial business request based on a preset request sending function; the first interceptor is an interceptor located in the source data encryption client; based on a preset communication protocol, it sends a key negotiation data request corresponding to the initial business request to the source data encryption server, so as to determine the session key negotiation requester data through the source data encryption server and by using a preset source data encryption strategy, a second cryptographic resource component, and the received key negotiation data request; wherein, the source data encryption server runs on the application system server; and receives the session key negotiation requester data sent by the source data encryption server based on the preset communication protocol.

[0063] In some specific embodiments, the request encryption module 12 can be used to determine a session key based on a first cryptographic resource component, the session key negotiation requester data, and a preset source data encryption strategy; determine session key responder data based on the preset source data encryption strategy and the first cryptographic resource component; determine whether the length of the initial service request is greater than a preset number based on an encryption / decryption adaptive component, to determine a first length judgment result; the preset number is the upper limit of the number of parallel data obtained by reading the parallel instruction set of the central processing unit of the current operating environment during the initialization process of the application system; if the first length judgment result is greater than, then the field to be encrypted in the initial service request is encrypted based on single instruction multiple data technology and the session key to determine the encrypted request; during the encryption of the field to be encrypted in the initial service request, a key management system, cryptographic device, or cryptographic computing service is called based on the first cryptographic resource component, and the associated data corresponding to the initial service request is authenticated and encrypted using the corresponding first resource call result to obtain a first authentication tag; and the request encryption result is determined based on the encrypted request and the first authentication tag.

[0064] In some specific embodiments, the request encryption module 12 can be used to rewrite fields based on a first preset data format and the encrypted request in order to determine the updated business request.

[0065] In some specific embodiments, the request decryption module 13 can be specifically used to intercept the updated service request and the first authentication tag sent by the source data encryption client when the application system server receives the updated service request and the first authentication tag from the source data encryption client; receive the session key response data sent by the source data encryption client through the source data encryption server; and perform integrity verification on the first authentication tag based on the preset source data encryption strategy and the second cryptographic resource component through the source data encryption server to determine the first verification result; if If the first verification result indicates that the first authentication tag is complete, then the session key is determined through the source data encryption server based on the preset source data encryption strategy, the second cryptographic resource component, and the session key responder data; the updated business request is decrypted through the source data encryption server based on the session key to determine the request data decryption result; the fields are rewritten through the source data encryption server based on the first preset data format and the request data decryption result to determine the decryption recovery result; and the first business logic processing operation is triggered through the application system server based on the decryption recovery result.

[0066] In some specific embodiments, the application service-free source data security protection device can also be used to intercept the initial response data sent by the application system server after the first business logic processing operation is completed on the application system server, through a second interceptor localized on the source data encryption server; to encrypt the initial response data by field using the source data encryption server and based on the session key to determine the response encryption result; during the field encryption of the initial response data, to call the key management system, cryptographic device, or cryptographic calculation service based on the second cryptographic resource component, and to use the corresponding second resource call result to authenticate and encrypt the associated data corresponding to the initial response data to obtain a second authentication tag; to rewrite the field using the source data encryption server and based on the second preset data format and the response encryption result to determine the response information; and to send the response information and the second authentication tag to the application system client through the application system server and using the second interceptor.

[0067] In some specific embodiments, the response decryption module 14 can also be used to: intercept the response information and the second authentication tag sent by the application system server when the application system client receives the response information and the second authentication tag from the application system server; perform integrity verification on the second authentication tag based on the preset source data encryption strategy and the first cryptographic resource component to determine a second verification result; if the second verification result indicates that the second authentication tag is complete, determine whether the length of the response information is greater than a preset number based on the encryption / decryption adaptive component to determine a second length judgment result; if the second length judgment result indicates that it is greater than a preset number, decrypt the response information based on single instruction multiple data technology, the preset source data encryption strategy, and the first cryptographic resource component to determine a response decryption result; and rewrite fields based on the second preset data format and the response decryption result to determine a target response so that it can pass through the application system client and trigger a second business logic processing operation based on the target response.

[0068] Furthermore, embodiments of this application also disclose an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0069] Figure 7This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the application service-free source data security protection method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0070] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0071] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0072] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the application service-free source data security protection method for execution by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0073] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for source data security protection without modification of application services. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0074] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0075] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0076] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0077] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0078] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for protecting source data security without modifying application services, characterized in that, Source data encryption clients used in application system clients include: When an initial business request initiated by the application system client is intercepted based on the first interceptor, a key negotiation data request corresponding to the initial business request is sent to the source data encryption server to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server; Based on the session key negotiation requester data, the preset source data encryption strategy, and the first cryptographic resource component, the initial service request is encrypted with field encryption and associated data authentication encryption. The updated service request is obtained by using the corresponding request encryption result and session key responder data. The updated service request is sent to the application system server so that when the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result. When the response information returned by the application system server is intercepted based on the first interceptor, the response decryption result is determined based on the response information, the preset source data encryption strategy, and the first cryptographic resource component, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

2. The application service-free source data security protection method according to claim 1, characterized in that, When an initial service request initiated by the application system client is intercepted based on the first interceptor, a key negotiation data request corresponding to the initial service request is sent to the source data encryption server to obtain session key negotiation requester data, including: When the application system client initiates an initial business request based on a preset request sending function, the initial business request is intercepted by a first interceptor; the first interceptor is an interceptor located in the source data encryption client. Based on a preset communication protocol, a key negotiation data request corresponding to the initial service request is sent to the source data encryption server, so that the session key negotiation requester data can be determined through the source data encryption server and by using the preset source data encryption strategy, the second cryptographic resource component, and the received key negotiation data request; wherein, the source data encryption server runs on the application system server. Based on the preset communication protocol, the session key negotiation request data sent by the source data encryption server is received.

3. The application service-free source data security protection method according to claim 1, characterized in that, The step of encrypting the initial service request fields and encrypting associated data based on the session key negotiation requester data, the preset source data encryption strategy, and the first cryptographic resource component includes: The session key is determined based on the first cryptographic resource component, the session key negotiation requester data, and the preset source data encryption strategy. Based on the preset source data encryption strategy and the first cryptographic resource component, determine the session key responder data; Based on the encryption / decryption adaptive component, it is determined whether the length of the initial business request is greater than a preset number to determine the first length judgment result; the preset number is the upper limit of the number of parallel data obtained by reading the parallel instruction set of the central processing unit of the current running environment during the initialization process of the application system. If the first length determination result is greater than, then based on the single instruction multiple data technology and the session key, the field to be encrypted in the initial business request is encrypted to determine the encrypted request; During the encryption of the field to be encrypted in the initial business request, based on the first cryptographic resource component, a key management system, cryptographic device or cryptographic calculation service is called, and the corresponding first resource call result is used to authenticate and encrypt the associated data corresponding to the initial business request to obtain the first authentication tag. Based on the encrypted request and the first authentication tag, the request encryption result is determined.

4. The application service-free source data security protection method according to claim 3, characterized in that, The step of obtaining the updated business request using the corresponding request encryption result and session key responder data includes: Based on the first preset data format and the encrypted request, the fields are rewritten to determine the updated business request.

5. The application service-free source data security protection method according to claim 4, characterized in that, When the updated service request is intercepted by the source data encryption server, the service request is decrypted and restored by combining the session key response data, so that it can be processed by the application system server. Based on the corresponding decryption and restoration result, the first business logic processing operation is triggered, including: When the application system server receives the updated service request and the first authentication tag sent by the source data encryption client, it intercepts the updated service request and the first authentication tag through the second interceptor local to the source data encryption server. The source data encryption server receives the session key response data sent by the source data encryption client. The first authentication tag is verified for integrity through the source data encryption server and based on the preset source data encryption strategy and the second cryptographic resource component, so as to determine the first verification result. If the first verification result indicates that the first authentication tag is complete, then the session key is determined through the source data encryption server based on the preset source data encryption strategy, the second cryptographic resource component, and the session key responder data. The updated service request is decrypted using the source data encryption server and the session key to determine the decryption result of the request data. The source data encryption server, based on the first preset data format and the decryption result of the request data, rewrites the fields to determine the decryption recovery result; The application system server triggers the first business logic processing operation based on the decryption and recovery result.

6. The application service-free source data security protection method according to claim 5, characterized in that, Also includes: After the application system server completes the first business logic processing operation, the initial response data sent by the application system server is intercepted by the second interceptor on the local side of the source data encryption server. The initial response data is encrypted using the source data encryption server and based on the session key to determine the response encryption result. During the field encryption process of the initial response data, based on the second cryptographic resource component, a key management system, cryptographic device, or cryptographic calculation service is invoked, and the corresponding second resource invocation result is used to authenticate and encrypt the associated data corresponding to the initial response data to obtain a second authentication tag. The response information is determined by rewriting the fields through the source data encryption server and using the second preset data format and the response encryption result; The application system server, using the second interceptor, sends the response information and the second authentication tag to the application system client.

7. The application service-free source data security protection method according to claim 6, characterized in that, When the response information returned by the application system server is intercepted based on the first interceptor, the response decryption result is determined based on the response information, the preset source data encryption strategy, and the first cryptographic resource component, including: When the application system client receives the response information and the second authentication tag sent by the application system server, it intercepts the response information and the second authentication tag based on the first interceptor; Based on the preset source data encryption strategy and the first cryptographic resource component, the second authentication tag is subjected to integrity verification to determine the second verification result; If the second verification result indicates that the second authentication tag is complete, then based on the encryption / decryption adaptive component, it is determined whether the length of the response information is greater than a preset number, so as to determine the second length judgment result; If the second length determination result is greater than, then based on the single instruction multiple data technology, the preset source data encryption strategy and the first cryptographic resource component, the response information is decrypted to determine the response decryption result; Based on the second preset data format and the response decryption result, the fields are rewritten to determine the target response, so that the second business logic processing operation can be triggered through the application system client and based on the target response.

8. A data security protection device for application services that requires no modification, characterized in that, Source data encryption clients used in application system clients include: The request negotiation module is used to send a key negotiation data request corresponding to the initial business request to the source data encryption server when the initial business request initiated by the application system client is intercepted based on the first interceptor, so as to obtain the session key negotiation requester data; wherein, the source data encryption server runs on the application system server; The request encryption module is used to perform field encryption and associated data authentication encryption on the initial business request based on the session key negotiation requester data, the preset source data encryption strategy and the first cryptographic resource component, and to obtain the updated business request using the corresponding request encryption result and session key responder data. The request decryption module is used to send the updated business request to the application system server so that when the updated business request is intercepted by the source data encryption server, the business request is decrypted and restored in combination with the session key response data, so that the first business logic processing operation is triggered by the application system server based on the corresponding decryption and restoration result. The response decryption module is used to determine the response decryption result based on the response information, the preset source data encryption strategy, and the first cryptographic resource component after intercepting the response information returned by the application system server based on the first interceptor, so as to trigger the second business logic processing operation through the application system client and the response decryption result.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the application service-free source data security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the source data security protection method for application services without modification as described in any one of claims 1 to 7.

Images