An interface encryption processing method based on request interception mechanism

Abstract

This invention discloses an interface encryption method based on a request interception mechanism, relating to the field of network security technology. The method includes processing flows on both the client and server sides. On the client side: After responding to a user operation and generating a business request carrying original data, a preset request interceptor is invoked to intercept the request. The interceptor performs local encryption processing on the original data to obtain encrypted data, specifically including obtaining a timestamp and client identifier to generate a dynamic key, and using this key to encrypt the original data. Subsequently, the original data in the business request is replaced with encrypted data, forming an encrypted request, which is then sent to the server. On the server side: After receiving the encrypted request, the encrypted data, timestamp, and client identifier are parsed. The validity of the timestamp and client identifier is first verified. After successful verification, the dynamic encryption key is restored using the same algorithm, and then the original data is decrypted to execute the business logic. This invention achieves unified and transparent interface encryption without intrusion into business code by embedding an interceptor at the network request framework layer. Simultaneously, by utilizing dynamic keys and a two-way verification mechanism, it significantly improves the security of data transmission and the ability to prevent replay attacks, and facilitates centralized maintenance and policy upgrades.

Description

Technical Field

[0001] This invention relates to the fields of network security and data communication technology, and in particular to an interface encryption processing method based on a request interception mechanism. Background Technology

[0002] In mobile internet and web application development, it is common for clients (such as apps and browsers) to interact with servers via APIs (Application Programming Interfaces). This data exchange typically contains sensitive user information (such as identity credentials, payment information, and personal privacy data). To prevent data from being stolen, tampered with, or subjected to replay attacks during transmission, encrypting API requests has become a fundamental security requirement.

[0003] Currently, there are generally two common API encryption schemes: First, developers manually call an encryption function to process the data at each network request, and then fill the encrypted data into the request. While this method is direct, it suffers from low development efficiency, high code duplication, ease of omissions, and huge maintenance costs when changing encryption algorithms or strategies later. Second, HTTPS (HTTP over SSL / TLS) is used to encrypt the entire communication link. HTTPS effectively prevents man-in-the-middle attacks and eavesdropping, but it cannot protect "end-to-end" security. That is, data remains in plaintext before being sent by the client and after arriving at the server. Furthermore, HTTPS itself does not address the security issues of data processing locally on the client side, nor can it defend against replay attacks and parameter tampering targeting the API itself.

[0004] Furthermore, in complex applications, network requests may be initiated by different business modules, third-party libraries, or general network frameworks. How to implement a unified, transparent, and flexibly configurable interface data encryption mechanism without modifying a large amount of business code is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide an interface encryption processing method based on a request interception mechanism, which addresses the above-mentioned deficiencies of the prior art and aims to achieve an interface data encryption scheme that is non-intrusive to business code, uniformly managed, and more secure.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: An interface encryption processing method based on a request interception mechanism, applied to a client, the method comprising: In response to user actions, generate a business request carrying the original data; Invoke the preset request interceptor to intercept the business request; The request interceptor performs local encryption on the original data to obtain encrypted data. The original data in the business request is replaced with the encrypted data to form an encrypted request; The encryption request is sent to the server.

[0007] Furthermore, the step of invoking a preset request interceptor to intercept the business request includes: Register a global request interceptor in the application's network request framework; When the network request framework initiates the business request, the business request is intercepted by the global request interceptor.

[0008] Furthermore, the step of performing local encryption on the original data to obtain encrypted data includes: Get the current timestamp and the preset client identifier; Based on the timestamp and the client identifier, a dynamic encryption key is generated using the first encryption algorithm; Using the dynamic encryption key, the original data is encrypted using a second encryption algorithm to generate the encrypted data.

[0009] Further, the step of replacing the original data in the business request with the encrypted data to form an encrypted request includes: The encrypted data, the timestamp, and the client identifier are encapsulated according to a predetermined format to generate a request body; The request body of the business request is replaced with the encapsulated request body to form the encrypted request.

[0010] This invention also provides an interface encryption processing method based on a request interception mechanism, applied to the server side, the method comprising: Receive encryption requests sent by the client; The request body of the encrypted request is parsed to obtain the encrypted data, timestamp, and client identifier; Based on the timestamp and the client identifier, the dynamic encryption key is restored using the first encryption algorithm; Using the restored dynamic encryption key, the encrypted data is decrypted using the second encryption algorithm to obtain the original data; Execute the corresponding business logic based on the original data.

[0011] Furthermore, before restoring the dynamic encryption key using the first encryption algorithm based on the timestamp and the client identifier, the method further includes: Verify whether the timestamp is within a valid time window; And / or, verify whether the client identifier is an authorized and legitimate identifier; If any verification fails, an error response is returned to the client.

[0012] Furthermore, the first encryption algorithm used by the client and the first encryption algorithm used by the server are the same key generation algorithm, and the second encryption algorithm used by the client and the second encryption algorithm used by the server are the same symmetric encryption and decryption algorithm.

[0013] The interface encryption processing method based on the request interception mechanism of the present invention has the following beneficial effects: Non-intrusive to business code: By registering a global interceptor at the network request framework layer, all business requests are automatically intercepted and processed before they are sent. Business developers do not need to worry about encryption details; they can simply send requests containing the raw data in the usual way, greatly improving development efficiency and code cleanliness. Secure and unified, easy to maintain: The encryption logic is implemented centrally in the interceptor, enabling unified management of security policies. When it is necessary to update the encryption algorithm, key management policy, or add new security checks (such as anti-replay), only one piece of code in the interceptor needs to be modified, reducing maintenance costs and error risks. Enhanced security: A dynamic key generation mechanism (combining timestamps and client identifiers) ensures that each request may use a different encryption key, effectively preventing large-scale data risks caused by a single key leak. Server-side verification of timestamps and client identifiers effectively defends against replay attacks and requests from unauthorized clients. High flexibility: The interceptor can be configured to encrypt which requests and which parts of the data, providing flexible policy control capabilities. Furthermore, this method can be used in conjunction with transport layer security protocols such as HTTPS to build a multi-layered security defense system.

Claims

1. An interface encryption processing method based on a request interception mechanism, characterized in that, Applied to a client, the method includes: In response to user actions, generate a business request carrying the original data; Invoke the preset request interceptor to intercept the business request; The request interceptor performs local encryption on the original data to obtain encrypted data. The original data in the business request is replaced with the encrypted data to form an encrypted request; The encryption request is sent to the server.

2. The method according to claim 1, characterized in that, The step of invoking a preset request interceptor to intercept the business request includes: Register a global request interceptor in the application's network request framework; When the network request framework initiates the business request, the business request is intercepted by the global request interceptor.

3. The method according to claim 1 or 2, characterized in that, The step of performing local encryption on the original data to obtain encrypted data includes: Get the current timestamp and the preset client identifier; Based on the timestamp and the client identifier, a dynamic encryption key is generated using the first encryption algorithm; Using the dynamic encryption key, the original data is encrypted using a second encryption algorithm to generate the encrypted data.

4. The method according to claim 3, characterized in that, The step of replacing the original data in the business request with the encrypted data to form an encrypted request includes: The encrypted data, the timestamp, and the client identifier are encapsulated according to a predetermined format to generate a request body; The request body of the business request is replaced with the encapsulated request body to form the encrypted request.

5. An interface encryption processing method based on a request interception mechanism, characterized in that, Applied to the server side, the method includes: Receive encryption requests sent by the client; The request body of the encrypted request is parsed to obtain the encrypted data, timestamp, and client identifier; Based on the timestamp and the client identifier, the dynamic encryption key is restored using the first encryption algorithm; Using the restored dynamic encryption key, the encrypted data is decrypted using the second encryption algorithm to obtain the original data; Execute the corresponding business logic based on the original data.

6. The method according to claim 5, characterized in that, Before restoring the dynamic encryption key using the first encryption algorithm based on the timestamp and the client identifier, the method further includes: Verify whether the timestamp is within a valid time window; And / or, verify whether the client identifier is an authorized and legitimate identifier; If any verification fails, an error response is returned to the client.

7. The method according to claim 3 or 4, in conjunction with the method according to claim 5 or 6, characterized in that, The first encryption algorithm used by the client is the same key generation algorithm used by the server, and the second encryption algorithm used by the client is the same symmetric encryption / decryption algorithm used by the server.