Transparent data encryption method and device based on parameter resolver agent and electronic equipment

Abstract

This invention provides a transparent data encryption method, apparatus, and electronic device based on a parameter parser proxy. In this method, by constructing an encryption proxy parser that encapsulates the original parameter parser and replacing the default parser chain in Spring MVC, unified transparent automatic encryption of various heterogeneous request parameter types is achieved without intruding on business code (because the types of the original parameter parsers in the enhanced parser chain are diverse). This technology sinks the encryption logic from the business layer to the parameter binding stage of the framework layer, not only completely eliminating the burden and risk of omissions for developers to manually write repetitive encryption code and ensuring that sensitive data is converted to ciphertext before entering business logic, but also significantly improving the system's data security compliance and code maintainability.

Description

Technical Field

[0001] This invention relates to the technical field of computer software security, and in particular to a transparent data encryption method, apparatus, and electronic device based on a parameter parser proxy. Background Technology

[0002] In enterprise-level web applications, sensitive fields often need to be stored encrypted to meet data security compliance requirements. Existing technologies mainly include: Manual encryption: Explicitly calling encryption tools in the Controller or Service layer intrudes into business logic, is prone to omissions, and has high maintenance costs; AOP aspect interception: intercepts method parameters through @Around, but only applies to @RequestBody objects and cannot handle simple type parameters such as @RequestParam and @PathVariable; Custom message converter: Rewrite HttpMessageConverter to perform field-level encryption on JSON request bodies, but cannot cover non-JSON scenarios such as form submissions and URL parameters.

[0003] The aforementioned traditional encryption methods have the following technical problems: Incomplete parameter type support: Existing solutions generally only support JSON objects, making it difficult to handle URL parameters, path variables, form data, etc. simultaneously; Highly intrusive to business logic: Encryption and decryption logic must be explicitly called in the business code.

[0004] In summary, how to achieve transparent and automatic encryption of various request parameter types in Spring MVC without modifying the business logic has become a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a transparent data encryption method, apparatus and electronic device based on parameter parser proxy, so as to alleviate the technical problem that traditional technologies cannot achieve transparent automatic encryption of various request parameter types in Spring MVC without modifying business code.

[0006] In a first aspect, the present invention provides a transparent data encryption method based on a parameter parser proxy, applied to a request processing chain of a web application, wherein the enhanced parser chain in the request processing chain includes an encryption proxy parser encapsulating the original parameter parser, and the method includes: Upon receiving a client request, the encrypted proxy parser is used to perform parameter parsing to obtain an initial business parameter object; Before the business logic is executed, sensitive data items in the initial business parameter object are identified and encrypted. The encrypted business parameter object is delivered to the business controller method to execute subsequent business logic.

[0007] Further, the parameter parsing is performed using the encryption proxy parser, including: Traverse the enhanced parser chain, call the parameter support detection logic of each parser, and locate the target cryptographic proxy parser that supports the client request from the enhanced parser chain; The parameter parsing method of the target encryption proxy parser is invoked. Inside the parameter parsing method, the target original parameter parser encapsulated by the parser is delegated to perform standard parameter binding operations to generate an unencrypted temporary parameter object. The unencrypted temporary parameter object is intercepted and identified as the initial business parameter object for subsequent encryption processing.

[0008] Furthermore, identifying and encrypting sensitive data items in the initial business parameter object includes: Check if the initial business parameter object is empty; If the initial business parameter object is empty, return an empty value and terminate the encryption process; If the initial business parameter object is not empty, then identify the type of the target raw parameter parser; The corresponding encryption logic is executed according to the type of the target original parameter parser and the attributes of the initial business parameter object to obtain the encrypted business parameter object.

[0009] Further, based on the type of the target original parameter parser and the attributes of the initial business parameter object, the corresponding encryption logic is executed, including: If the type of the target original parameter parser is an object type, and the class path to which the initial business parameter object belongs belongs to the preset target business package, then the following object encryption operation is performed: determine whether the initial business parameter object is a non-empty list; if it is a non-empty list, then traverse each element in the list and call the field encryption subroutine for each element; if it is not a non-empty list, then directly call the field encryption subroutine on the initial business parameter object. If the target original parameter parser is of a simple parameter type, then a simple parameter encryption operation is performed: determine whether the parameter type of the initial business parameter object is a string type and whether an encryption annotation is marked at the parameter declaration; if yes, then call the encryption method of the encryption utility class to perform string conversion and encryption processing on the initial business parameter object; if no, then skip the encryption processing.

[0010] Furthermore, the execution logic of the field encryption subroutine includes: Use reflection to scan all fields of the passed-in object; Filter out target fields that simultaneously meet the following conditions: the target field has an encrypted annotation declared on it, and the value of the target field is not empty; For each selected target field, perform differential encryption based on its data type: If the value of the target field is a list type, the list is converted into a string stream, and each element in the string stream is encrypted one by one to generate a new encrypted string list. Then, the new encrypted string list is written back to the target field through reflection. If the value of the target field is a normal string, then the normal string is directly encrypted to generate an encrypted string, and the encrypted string is written back to the target field through reflection.

[0011] Furthermore, before receiving a client request, the method further includes: In response to the startup command of the web application, an encrypted configuration class is instantiated, and a request mapping processor adapter component is injected during the instantiation process; The original parameter parser list is obtained through the request mapping processor adapter component; Create a new list of custom parameter resolvers and iterate through each instance of the original parameter resolver in the original parameter resolver list; During the traversal, a type matching judgment is performed on the current original parameter parser instance: if the type of the current original parameter parser instance belongs to the preset target type, an encryption proxy parser is created, the current original parameter parser instance is encapsulated in the encryption proxy parser, and the encryption proxy parser is added to the custom parameter parser list; if the type of the current original parameter parser instance does not belong to the preset target type, the current original parameter parser instance is directly added to the custom parameter parser list. After traversing all the original parameter resolver instances, the setting method of the request mapping processor adapter component is called to inject the custom parameter resolver list to replace the original parameter resolver list, so that the enhanced resolver chain can be used in subsequent request processing.

[0012] Furthermore, the original parameter parser includes at least one or more of the following: a request-response body method processor for processing JSON request bodies, a Servlet model attribute method processor for processing form model attributes, a request parameter method parser for processing URL query parameters, and a path variable method parser for processing URL path variables.

[0013] Secondly, the present invention also provides a transparent data encryption device based on a parameter parser proxy, applied to a request processing chain of a web application, wherein the enhanced parser chain in the request processing chain includes an encryption proxy parser encapsulating the original parameter parser, and the device comprises: The parameter parsing unit is used to receive client requests, perform parameter parsing using the encrypted proxy parser, and obtain an initial business parameter object. An encryption processing unit is used to identify sensitive data items in the initial business parameter object and perform encryption processing before the business logic is executed; The delivery execution unit is used to deliver the encrypted business parameter object to the business controller method for subsequent business logic execution.

[0014] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the method described in the first aspect.

[0015] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method described in the first aspect.

[0016] This invention provides a transparent data encryption method based on a parameter parser proxy, applied to the request processing chain of a web application. The enhanced parser chain in the request processing chain includes an encryption proxy parser that encapsulates the original parameter parser. The method includes: receiving a client request; performing parameter parsing using the encryption proxy parser to obtain an initial business parameter object; identifying sensitive data items in the initial business parameter object and encrypting them before executing business logic; and delivering the encrypted business parameter object to the business controller method to execute subsequent business logic. As described above, the transparent data encryption method based on parameter parser proxy of the present invention achieves unified, transparent, and automatic encryption of various heterogeneous request parameter types without intruding on business code by constructing an encryption proxy parser that encapsulates the original parameter parser and replacing the default parser chain in Spring MVC. (Because the types of the original parameter parsers in the enhanced parser chain are diverse). This technology sinks the encryption logic from the business layer to the parameter binding stage of the framework layer, which not only completely eliminates the burden and risk of omissions for developers to manually write repetitive encryption code and ensures that sensitive data is converted into ciphertext before entering the business logic, but also significantly improves the data security compliance and code maintainability of the system, alleviating the technical problem that traditional technologies cannot achieve transparent and automatic encryption of various request parameter types in Spring MVC without modifying the business code. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a transparent data encryption method based on a parameter parser proxy, provided in an embodiment of the present invention; Figure 2 A flowchart of the automatic configuration stage parser proxy encapsulation process provided in this embodiment of the invention; Figure 3 A flowchart of parameter encryption processing provided in an embodiment of the present invention; Figure 4 A system architecture diagram provided for embodiments of the present invention; Figure 5 A schematic diagram of a transparent data encryption device based on a parameter parser proxy provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Traditional technologies cannot achieve transparent and automatic encryption of various request parameter types in Spring MVC without modifying the business logic.

[0021] Based on this, the transparent data encryption method based on parameter parser proxy of the present invention achieves unified transparent automatic encryption of various heterogeneous request parameter types without zero intrusion into business code by constructing an encryption proxy parser that encapsulates the original parameter parser and replacing the default parser chain of Spring MVC. (Because the types of the original parameter parsers in the enhanced parser chain are diverse). This technology sinks the encryption logic from the business layer to the parameter binding stage of the framework layer, which not only completely eliminates the burden and risk of omission of developers manually writing repetitive encryption code, ensuring that sensitive data is converted into ciphertext before entering the business logic, but also significantly improves the data security compliance and code maintainability of the system.

[0022] To facilitate understanding of this embodiment, a transparent data encryption method based on a parameter parser proxy, as disclosed in this embodiment of the invention, will first be described in detail.

[0023] Example 1: According to an embodiment of the present invention, an embodiment of a transparent data encryption method based on a parameter parser agent is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] Figure 1 This is a flowchart of a transparent data encryption method based on a parameter parser proxy according to an embodiment of the present invention. The method is applied to the request processing chain of a web application. The enhanced parser chain in the request processing chain includes an encryption proxy parser encapsulating the original parameter parser, such as... Figure 1 As shown, the method includes the following steps: Step S102: Receive the client request, use the encrypted proxy parser to perform parameter parsing, and obtain the initial business parameter object; Specifically, the aforementioned web application can be a Java web application in the Spring Boot 2.x / 3.x environment, or other web applications. This embodiment of the invention does not impose any specific restrictions on it.

[0025] The aforementioned client request can be an HTTP request initiated by the client (such as POST / user / create, carrying JSON or form data), containing URL, header, and body data. The encrypted proxy parser can parse the parameters of the aforementioned client request to obtain the initial business parameter object (a Java object converted from the request data that has not yet been encrypted (at this time, it contains plaintext sensitive data)).

[0026] This step enables automatic routing of request processing, locating the encryption proxy parser with encryption capabilities without manual intervention, thus ensuring the inevitable execution of encryption logic.

[0027] Step S104: Before the business logic is executed, identify sensitive data items in the initial business parameter object and encrypt them. Specifically, "before business logic execution" refers to the time window before the controller method is called; "sensitive data items" refers to fields marked with specific annotations (such as @Encrypt, which is called an encryption annotation) or object attributes located in a specific package path; and "encryption processing" refers to the process of converting plaintext into ciphertext using encryption algorithms (such as AES and RSA).

[0028] This invention achieves "transparent" encryption. Business developers see objects in an encrypted state, eliminating the need to write encryption calls in any business code, thus completely decoupling security logic from business logic.

[0029] Step S106: Deliver the encrypted business parameter object to the business controller method to execute subsequent business logic.

[0030] Specifically, the encrypted business parameter object refers to a Java object whose sensitive fields have been replaced with ciphertext; the business controller method refers to the specific processing method written by the developer in `@RestController` or `@Controller`; the Spring MVC framework automatically injects the encrypted business parameter object as an actual parameter into the corresponding formal parameter of the controller method. When the controller method starts executing, it directly uses the encrypted business parameter object.

[0031] After the above processing, all fields annotated with `@EncryptField` (whether object properties or URL parameters) in the encrypted business parameter object received by the Controller method have been converted into encrypted strings. Business logic can directly use these encrypted values ​​for subsequent operations (such as storing in a database or calling downstream services) without needing to concern itself with the encryption / decryption details. For example, if the frontend passes in a plaintext phone number "13800138000", the Controller method will receive ciphertext like "U2FsdGVkX1+...". Even if this object is logged or cached, it will not cause sensitive information leakage.

[0032] This ensures that sensitive data is encrypted before entering the business logic layer, preventing the risk of plaintext leakage in memory and greatly reducing the probability of errors by developers.

[0033] This invention provides a transparent data encryption method based on a parameter parser proxy, applied to the request processing chain of a web application. The enhanced parser chain in the request processing chain includes an encryption proxy parser that encapsulates the original parameter parser. The method includes: receiving a client request; performing parameter parsing using the encryption proxy parser to obtain an initial business parameter object; identifying sensitive data items in the initial business parameter object and encrypting them before executing business logic; and delivering the encrypted business parameter object to the business controller method to execute subsequent business logic. As described above, the transparent data encryption method based on parameter parser proxy of the present invention achieves unified, transparent, and automatic encryption of various heterogeneous request parameter types without intruding on business code by constructing an encryption proxy parser that encapsulates the original parameter parser and replacing the default parser chain in Spring MVC. (Because the types of the original parameter parsers in the enhanced parser chain are diverse). This technology sinks the encryption logic from the business layer to the parameter binding stage of the framework layer, which not only completely eliminates the burden and risk of omissions for developers to manually write repetitive encryption code and ensures that sensitive data is converted into ciphertext before entering the business logic, but also significantly improves the data security compliance and code maintainability of the system, alleviating the technical problem that traditional technologies cannot achieve transparent and automatic encryption of various request parameter types in Spring MVC without modifying the business code.

[0034] The above provides a brief overview of the transparent data encryption method based on a parameter parser proxy of the present invention. The specific details involved are described in detail below.

[0035] In an optional embodiment of the present invention, the method further includes the following steps before receiving a client request: (1) In response to the startup command of the Web application, instantiate the encryption configuration class and inject the request mapping processor adapter component during the instantiation process; Specifically, such as Figure 2 As shown, during the startup process of a Spring Boot application, the Spring container loads and instantiates all `@Configuration` classes. This invention explicitly imports the internal static configuration class `EncryptConfig` using the `@Import({CryptoAutoConfiguration.EncryptConfig.class})` annotation. The constructor of this class accepts the Spring MVC core component `RequestMappingHandlerAdapter` as a dependency.

[0036] The RequestMappingHandlerAdapter component refers to the core class RequestMappingHandlerAdapter in the Spring MVC framework, which is responsible for adapting different handler methods and is a container for parameter resolvers.

[0037] (2) Obtain the list of raw parameter parsers by requesting the mapping processor adapter component; Specifically, the original parameter parser list refers to the List maintained internally by default within the adapter. <handlermethodargumentresolver>This collection contains dozens of pre-built parsers from Spring (such as parsers for handling JSON, forms, file uploads, etc.), ordered by a specific priority.

[0038] The RequestMappingHandlerAdapter is responsible for invoking the appropriate HandlerMethodArgumentResolver to resolve the parameters of the Controller method during request dispatch. Internally, it maintains a List. <handlermethodargumentresolver>This is called the "parameter resolver chain," which includes standard resolvers (i.e., the list of raw parameter resolvers) in order of priority, such as RequestParamMethodArgumentResolver (processing @RequestParam), PathVariableMethodArgumentResolver (processing @PathVariable), RequestResponseBodyMethodProcessor (processing @RequestBodyJSON), and ServletModelAttributeMethodProcessor (processing form objects).

[0039] During the Spring Boot startup phase, the list of original HandlerMethodArgumentResolvers registered in RequestMappingHandlerAdapter is obtained through the auto-configuration class.

[0040] The above process fully preserves all the original parsing capabilities of the framework, ensuring that newly built chains will not lose support for any standard HTTP request formats, thus guaranteeing system compatibility.

[0041] (3) Create a new list of custom parameter resolvers and iterate through each instance of the original parameter resolver in the original parameter resolver list; Specifically, in the `EncryptConfig` constructor, `requestMappingHandlerAdapter.getArgumentResolvers()` is first called to obtain a copy of the current resolver chain. Then, a new list `customArgumentResolvers` (i.e., a list of custom parameter resolvers) is created to construct the enhanced resolver chain. Each resolver instance `argumentResolver` in the original list is then iterated through.

[0042] The custom parameter parser list is a newly instantiated ArrayList. <handlermethodargumentresolver>It is used to store parser objects that have been filtered, encapsulated, or directly copied.

[0043] This process provides an independent memory space for building new parser chains, avoiding concurrent modification exceptions or inconsistencies in the framework's internal state that may be caused by directly modifying the original list, and ensuring safe isolation during the construction process.

[0044] (4) During the traversal, perform type matching judgment for the current original parameter parser instance: if the type of the current original parameter parser instance belongs to the preset target type, then create an encrypted proxy parser, encapsulate the current original parameter parser instance into the encrypted proxy parser, and add the encrypted proxy parser to the custom parameter parser list; if the type of the current original parameter parser instance does not belong to the preset target type, then directly add the current original parameter parser instance to the custom parameter parser list. Specifically, if the resolver is any one of RequestResponseBodyMethodProcessor, ServletModelAttributeMethodProcessor, RequestParamMethodArgumentResolver, or PathVariableMethodArgumentResolver (i.e., the type of the current original parameter resolver instance belongs to the preset target type), then an EncryptMethodArgumentResolver instance (i.e., an encrypted proxy resolver) is created. The current argumentResolver (i.e., the current original parameter resolver) is passed as a constructor parameter to form a proxy encapsulation, and this proxy object is added to the customArgumentResolvers list. Note: The original resolver itself is no longer added separately; it is only called indirectly through the proxy object.

[0045] Type matching checks whether the current object belongs to a preset "target type".

[0046] The current raw parameter parser instance refers to the specific parser object that is currently being processed in the loop.

[0047] A cryptographic proxy resolver refers to a custom-implemented class (such as EncryptProxyResolver) that implements the HandlerMethodArgumentResolver interface and internally holds a reference to the original resolver.

[0048] Encapsulation refers to storing the original parameter resolver instance as a member variable inside the proxy object, enabling the proxy object to delegate the execution of the core binding logic to the original parameter resolver instance and insert encryption logic before and after it.

[0049] Non-target type: refers to parsers that do not require parameter encryption processing, such as parsers that handle error pages, static resources, or specific protocol headers.

[0050] Iterate through the list and encapsulate the parsers that require encryption processing (including RequestResponseBodyMethodProcessor, ServletModelAttributeMethodProcessor, RequestParamMethodArgumentResolver, and PathVariableMethodArgumentResolver) into a custom EncryptMethodArgumentResolver proxy object.

[0051] The above process achieves precise "surgical" enhancement, intercepting and proxying only parsers involving sensitive business data, while leaving other unrelated parsers unchanged, minimizing the impact on overall system performance. It utilizes the proxy pattern to achieve non-intrusive functional enhancement. The business code is completely unaware that the parser has been replaced, but during actual runtime, the parsing process of all critical parameters automatically possesses encryption capabilities. This ensures system compatibility and integrity, guarantees that the request processing flow for non-business parameters is not interfered with, and maintains the original high-performance characteristics and extensibility of Spring MVC.

[0052] (5) After all the original parameter resolver instances have been traversed, the set method of the request mapping processor adapter component is called to inject a custom parameter resolver list to replace the original parameter resolver list so that the enhanced resolver chain can be used in subsequent request processing.

[0053] Specifically, after completing the traversal, `requestMappingHandlerAdapter.setArgumentResolvers(customArgumentResolvers)` is called to inject the enhanced resolver chain into the Spring MVC framework. From then on, the parameter parsing of all subsequent HTTP requests will pass through the proxy layer of this invention.

[0054] The above process describes how, during the web application startup phase, the proxy pattern dynamically constructs and replaces the original parameter resolver chain in Spring MVC, thus laying the foundation for subsequent transparent encryption. The process covers the entire flow from obtaining the original list to finally injecting the enhanced list.

[0055] In an optional embodiment of the present invention, parameter parsing is performed using an encryption proxy parser, specifically including the following steps: (1) Traverse the enhanced parser chain, call the parameter support detection logic of each parser, and locate the target encryption proxy parser that supports the client request from the enhanced parser chain; Specifically, the Spring MVC framework matches the corresponding Controller method based on the request path and begins parsing its method parameters.

[0056] For each parameter, the framework sequentially calls the `supportsParameter()` method in the enhanced resolver chain to find the first resolver that supports that parameter type. Since this resolver is proxied by `EncryptMethodArgumentResolver`, the actual method called is the `resolveArgument()` method of the proxied object.

[0057] (2) Call the parameter parsing method of the target encryption proxy parser. Inside the parameter parsing method, delegate the standard parameter binding operation to the target original parameter parser encapsulated by it to generate an unencrypted temporary parameter object. Specifically, in `EncryptMethodArgumentResolver.resolveArgument()`, the internally held target raw parameter resolver (`handlerMethodArgumentResolver`) first delegates the standard parameter binding logic to obtain a Java object `o` (which could be a POJO, String, List, etc.). Then, the private method `encrypt(parameter, o)` is immediately called to perform post-processing on this object.

[0058] (3) Intercept unencrypted temporary parameter objects and identify them as initial business parameter objects for subsequent encryption processing.

[0059] In an optional embodiment of the present invention, identifying and encrypting sensitive data items in the initial business parameter object specifically includes the following steps: (1) Check if the initial business parameter object is empty; (2) If the initial business parameter object is empty, return an empty value and terminate the encryption process; Specifically, the core logic of the encrypt() method is as follows: Null value protection and true parser identification: like Figure 3 As shown, if o == null, return directly to avoid null pointer exception.

[0060] (3) If the initial business parameter object is not empty, then identify the type of the target original parameter parser; (4) Execute the corresponding encryption logic according to the type of the target original parameter parser and the attributes of the initial business parameter object to obtain the encrypted business parameter object.

[0061] Specifically, the attributes of the initial business parameter object mentioned above include: package path (referring to the package name of the class of object o. Encryption is only performed when the object belongs to the business package (e.g., com.demo); if it is a framework class (e.g., java.lang.String itself) or a third-party library object, it is skipped), data structure type (referring to whether object o is a single object (POJO) or a collection object (List). If it is a List, each element needs to be processed in a loop; if it is a single object, the object is processed directly), parameter data type (referring to the specific Java type of simple parameters (e.g., @RequestParam). Encryption logic is only entered when the type is String; other types (e.g., Integer, Long) are not processed), and annotation status (referring to whether the parameter is explicitly annotated with @EncryptField in the Controller method declaration. This is the trigger switch. For simple type parameters, explicit annotation is required for encryption to avoid accidentally affecting ordinary string parameters).

[0062] Based on the type of the target raw parameter parser and the attributes of the initial business parameter object, the corresponding encryption logic is executed, specifically including the following steps: 41) If the type of the target original parameter parser is an object type, and the class path of the initial business parameter object belongs to the preset target business package, then perform the following object encryption operation: determine whether the initial business parameter object is a non-empty list; if it is a non-empty list, then traverse each element in the list and call the field encryption subroutine for each element; if it is not a non-empty list, then directly call the field encryption subroutine for the initial business parameter object. Specifically, the execution logic of the field encryption subroutine includes: 411) Use reflection to scan all fields of the passed-in object; 412) Filter out target fields that simultaneously meet the following conditions: the target field has an encrypted annotation declared on it, and the value of the target field is not empty; 413) For each selected target field, perform differential encryption based on its data type: If the value of the target field is a list, the list is converted into a string stream, and each element in the string stream is encrypted one by one to generate a new encrypted string list. Then, the new encrypted string list is written back to the target field through reflection. If the value of the target field is a plain string, then the plain string is directly encrypted to generate an encrypted string, and the encrypted string is written back to the target field via reflection.

[0063] Specifically, handling object type parameters (@RequestBody / @ModelAttribute) If the target original parameter resolver is RequestResponseBodyMethodProcessor or ServletModelAttributeMethodProcessor, and the parameter type belongs to the com.demo package (i.e., the classpath of the initial business parameter object belongs to the pre-defined target business package), then the object field encryption process will begin. If o is a non-empty List, then call setObjParamEncryptFieldsValue() for each element; Otherwise, call the method directly on o.

[0064] The `setObjParamEncryptFieldsValue(Object a)` method uses reflection to scan all fields of object `a` and filters out fields that simultaneously meet the following conditions: The field is annotated with @EncryptField; The field value is not null (v!=null).

[0065] For each field that meets the criteria: If the field value is of type List (such as List) <string>If the string is 'd', then convert it to a string stream, call CryptoUtils.encrypt(d) on each element to generate a new list of encrypted strings; If the field value is a regular String, then CryptoUtils.encrypt(v.toString()) is called directly; Finally, the encrypted value is written back to the corresponding field of the original object using reflection.

[0066] Ensure that all sensitive fields annotated with @EncryptField are encrypted.

[0067] This solution effectively avoids accidental operations on Spring inner classes, third-party library objects, or JDK types by restricting field scanning to classes under the com.demo package, thus improving system stability. Meanwhile, the @EncryptField annotation provides an explicit encryption declaration mechanism, allowing developers to precisely control the encryption scope.

[0068] 42) If the type of the target original parameter parser is a simple parameter type, then perform a simple parameter encryption operation: determine whether the parameter type of the initial business parameter object is a string type and whether an encryption annotation is marked at the parameter declaration; if so, call the encryption method of the encryption utility class to perform string conversion and encryption processing on the initial business parameter object; if not, skip the encryption processing.

[0069] Specifically, simple type parameter handling (@RequestParam / @PathVariable) If the target original parameter resolver is RequestParamMethodArgumentResolver or PathVariableMethodArgumentResolver, and the parameter type is String.class, and the parameter declaration is annotated with @EncryptField, then CryptoUtils.encrypt() is called directly on the parameter value o.toString(), and the result is returned.

[0070] In addition, the encryption algorithm is encapsulated by CryptoUtils.encrypt(), which can be flexibly switched to compliant algorithms such as the Chinese national cryptographic standard SM4 and AES-GCM to meet different security level requirements.

[0071] This invention establishes a unified and extensible field-level encryption interception point within the core mechanism of Spring MVC parameter parsing by proxying the Spring MVC parameter parsing mechanism. After parameter binding is complete and before business logic execution, it automatically performs unified encryption of sensitive fields, achieving a non-intrusive, fully covered, and highly secure request parameter protection mechanism. In other words, through an auto-configuration class and a custom parameter parser proxy mechanism, it achieves transparent and automatic encryption of sensitive fields annotated with `@EncryptField` without modifying any business controller code.

[0072] Figure 4 The system architecture diagram is shown, illustrating how EncryptMethodArgumentResolver is embedded as a proxy layer in the Spring MVC parameter resolution chain.

[0073] In an optional embodiment of the present invention, the raw parameter resolver includes at least one or more of the following: a request response body method processor for processing JSON request bodies, a Servlet model attribute method processor for processing form model attributes, a request parameter method resolver for processing URL query parameters, and a path variable method resolver for processing URL path variables.

[0074] The present invention has the following effects: Non-intrusive: The business controller requires no modification, and sensitive fields are automatically encrypted; Full parameter type coverage: Unified support for multiple Spring MVC parameter formats such as objects, forms, URL parameters, and path variables; Precise control: Field-level granular control is achieved through the @EncryptField annotation, supporting nested objects and string collections; High security: Filter business objects based on package name prefixes to prevent accidental encryption of system classes; Easy to integrate: Relying on Spring Boot's automatic configuration, it achieves "out-of-the-box" functionality.

[0075] This invention can support more collection types, such as Set. <string>It supports various encryption methods such as String[], and can implement dynamic encryption strategies: select different encryption algorithms (such as SM4, AES) based on field name, user role, or tenant ID; it can also adopt a failure security mechanism: record audit logs and throw security exceptions when encryption fails; it can also implement annotation enhancement: add attributes such as algorithm and keyId to @EncryptField to support fine-grained configuration; performance optimization: cache reflection field information to avoid repeated scanning.

[0076] Example 2: This invention also provides a transparent data encryption device based on a parameter parser proxy. This transparent data encryption device based on a parameter parser proxy is mainly used to execute the transparent data encryption method based on a parameter parser proxy provided in Embodiment 1 of this invention. The following is a detailed description of the transparent data encryption device based on a parameter parser proxy provided in this invention.

[0077] Figure 5 This is a schematic diagram of a transparent data encryption device based on a parameter parser proxy according to an embodiment of the present invention, such as... Figure 5 As shown, the device mainly includes: a parameter parsing unit 10, an encryption processing unit 20, and a delivery execution unit 30, wherein: The parameter parsing unit is used to receive client requests, perform parameter parsing using the cryptographic proxy parser, and obtain the initial business parameter object. The encryption processing unit is used to identify and encrypt sensitive data items in the initial business parameter object before the business logic is executed. The delivery execution unit is used to deliver the encrypted business parameter object to the business controller method for subsequent business logic execution.

[0078] This invention provides a transparent data encryption device based on a parameter parser proxy, applied to the request processing chain of a web application. The enhanced parser chain in the request processing chain includes an encryption proxy parser that encapsulates the original parameter parser. The device includes: receiving a client request; performing parameter parsing using the encryption proxy parser to obtain an initial business parameter object; identifying sensitive data items in the initial business parameter object and encrypting them before executing business logic; and delivering the encrypted business parameter object to the business controller method to execute subsequent business logic. As described above, the transparent data encryption device based on parameter parser proxy of the present invention achieves unified transparent automatic encryption of various heterogeneous request parameter types without zero intrusion into business code by constructing an encryption proxy parser that encapsulates the original parameter parser and replacing the default parser chain of Spring MVC. (Because the types of the original parameter parsers in the enhanced parser chain are diverse). This technology sinks the encryption logic from the business layer to the parameter binding stage of the framework layer, which not only completely eliminates the burden and risk of omissions for developers to manually write repetitive encryption code, ensuring that sensitive data is converted into ciphertext before entering the business logic, but also significantly improves the data security compliance and code maintainability of the system, alleviating the technical problem that traditional technologies cannot achieve transparent automatic encryption of various request parameter types in Spring MVC without modifying the business code.

[0079] Optionally, the parameter parsing unit is also used to: traverse the enhanced parser chain, call the parameter support detection logic of each parser, locate the target encryption proxy parser that supports the client request from the enhanced parser chain; call the parameter parsing method of the target encryption proxy parser, and within the parameter parsing method, delegate the standard parameter binding operation to the target original parameter parser it encapsulates to generate an unencrypted temporary parameter object; intercept the unencrypted temporary parameter object, determine it as the initial business parameter object, and perform subsequent encryption processing.

[0080] Optionally, the encryption processing unit is further configured to: detect whether the initial business parameter object is empty; if the initial business parameter object is empty, return an empty value and terminate the encryption process; if the initial business parameter object is not empty, identify the type of the target original parameter parser; and execute the corresponding encryption logic according to the type of the target original parameter parser and the attributes of the initial business parameter object to obtain the encrypted business parameter object.

[0081] Optionally, the encryption processing unit is further configured to: if the type of the target original parameter parser is an object type, and the classpath to which the initial business parameter object belongs belongs to a pre-defined target business package, then perform the following object encryption operation: determine whether the initial business parameter object is a non-empty list; if it is a non-empty list, then traverse each element in the list and call the field encryption subroutine for each element; if it is not a non-empty list, then directly call the field encryption subroutine on the initial business parameter object; if the type of the target original parameter parser is a simple parameter type, then perform a simple parameter encryption operation: determine whether the parameter type of the initial business parameter object is a string type and whether an encryption annotation is marked at the parameter declaration; if so, then call the encryption method of the encryption utility class to perform string conversion and encryption processing on the initial business parameter object; if not, then skip the encryption processing.

[0082] Optionally, the encryption processing unit is also used to: scan all fields of the incoming object using reflection; filter out target fields that simultaneously meet the following conditions, wherein the target field declares an encryption annotation and the value of the target field is not empty; for each filtered target field, perform differentiated encryption according to its data type: if the value of the target field is a list type, the list is converted into a string stream, and each element in the string stream is encrypted one by one to generate a new encrypted string list, and then the new encrypted string list is written back to the target field through reflection; if the value of the target field is a normal string type, the normal string is directly encrypted to generate an encrypted string, and the encrypted string is written back to the target field through reflection.

[0083] Optionally, the device is also configured to: in response to a web application startup command, instantiate an encrypted configuration class and inject a request mapping processor adapter component during instantiation; obtain a list of raw parameter resolvers through the request mapping processor adapter component; create a new custom parameter resolver list and iterate through each raw parameter resolver instance in the raw parameter resolver list; during the iteration, perform a type matching judgment for the current raw parameter resolver instance: if the type of the current raw parameter resolver instance belongs to a preset target type, then create an encrypted proxy resolver, encapsulate the current raw parameter resolver instance into the encrypted proxy resolver, and add the encrypted proxy resolver to the custom parameter resolver list; if the type of the current raw parameter resolver instance does not belong to the preset target type, then directly add the current raw parameter resolver instance to the custom parameter resolver list; after all raw parameter resolver instances have been iterated through, call the setting method of the request mapping processor adapter component to inject the custom parameter resolver list to replace the raw parameter resolver list, so as to use the enhanced resolver chain in subsequent request processing.

[0084] Optionally, the raw parameter parser includes at least one or more of the following: a request-response body method processor for processing JSON request bodies, a Servlet model attribute method processor for processing form model attributes, a request parameter method parser for processing URL query parameters, and a path variable method parser for processing URL path variables.

[0085] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0086] like Figure 6 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus. The processor 601 executes the machine-readable instructions to perform the steps of the transparent data encryption method based on the parameter parser proxy described above.

[0087] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the transparent data encryption method based on the parameter parser agent.

[0088] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0089] Corresponding to the above-described transparent data encryption method based on parameter parser proxy, this application embodiment also provides a computer-readable storage medium storing machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to perform the steps of the above-described transparent data encryption method based on parameter parser proxy.

[0090] The transparent data encryption device based on a parameter parser proxy provided in this application embodiment can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0091] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0092] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0093] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0094] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0095] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the transparent data encryption method based on parameter parser proxy described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0097] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.< / string> < / string> < / handlermethodargumentresolver> < / handlermethodargumentresolver> < / handlermethodargumentresolver>

Claims

1. A transparent data encryption method based on a parameter parser proxy, characterized in that, A request processing chain applied to a web application, wherein the enhanced parser chain in the request processing chain includes an encrypted proxy parser encapsulating a raw parameter parser, the method comprising: Upon receiving a client request, the encrypted proxy parser is used to perform parameter parsing to obtain an initial business parameter object; Before the business logic is executed, sensitive data items in the initial business parameter object are identified and encrypted. The encrypted business parameter object is delivered to the business controller method to execute subsequent business logic.

2. The method according to claim 1, characterized in that, The parameter parsing is performed using the encryption proxy parser, including: Traverse the enhanced parser chain, call the parameter support detection logic of each parser, and locate the target cryptographic proxy parser that supports the client request from the enhanced parser chain; The parameter parsing method of the target encryption proxy parser is invoked. Inside the parameter parsing method, the target original parameter parser encapsulated by the parser is delegated to perform standard parameter binding operations to generate an unencrypted temporary parameter object. The unencrypted temporary parameter object is intercepted and identified as the initial business parameter object for subsequent encryption processing.

3. The method according to claim 2, characterized in that, Identifying and encrypting sensitive data items in the initial business parameter object includes: Check if the initial business parameter object is empty; If the initial business parameter object is empty, return an empty value and terminate the encryption process; If the initial business parameter object is not empty, then identify the type of the target raw parameter parser; The corresponding encryption logic is executed according to the type of the target original parameter parser and the attributes of the initial business parameter object to obtain the encrypted business parameter object.

4. The method according to claim 3, characterized in that, Execute the corresponding encryption logic based on the type of the target original parameter parser and the attributes of the initial business parameter object, including: If the type of the target original parameter parser is an object type, and the class path to which the initial business parameter object belongs belongs to the preset target business package, then the following object encryption operation is performed: determine whether the initial business parameter object is a non-empty list; if it is a non-empty list, then traverse each element in the list and call the field encryption subroutine for each element; if it is not a non-empty list, then directly call the field encryption subroutine on the initial business parameter object. If the target original parameter parser is of a simple parameter type, then a simple parameter encryption operation is performed: determine whether the parameter type of the initial business parameter object is a string type and whether an encryption annotation is marked at the parameter declaration; if yes, then call the encryption method of the encryption utility class to perform string conversion and encryption processing on the initial business parameter object; if no, then skip the encryption processing.

5. The method according to claim 4, characterized in that, The execution logic of the field encryption subroutine includes: Use reflection to scan all fields of the passed-in object; Filter out target fields that simultaneously meet the following conditions: the target field has an encrypted annotation declared on it, and the value of the target field is not empty; For each selected target field, perform differential encryption based on its data type: If the value of the target field is a list type, the list is converted into a string stream, and each element in the string stream is encrypted one by one to generate a new encrypted string list. Then, the new encrypted string list is written back to the target field through reflection. If the value of the target field is a normal string, then the normal string is directly encrypted to generate an encrypted string, and the encrypted string is written back to the target field through reflection.

6. The method according to claim 1, characterized in that, Before receiving a client request, the method further includes: In response to the startup command of the web application, an encrypted configuration class is instantiated, and a request mapping processor adapter component is injected during the instantiation process; The original parameter parser list is obtained through the request mapping processor adapter component; Create a new list of custom parameter resolvers and iterate through each instance of the original parameter resolver in the original parameter resolver list; During the traversal, a type matching judgment is performed on the current original parameter parser instance: if the type of the current original parameter parser instance belongs to the preset target type, an encrypted proxy parser is created, the current original parameter parser instance is encapsulated in the encrypted proxy parser, and the encrypted proxy parser is added to the custom parameter parser list; if the type of the current original parameter parser instance does not belong to the preset target type, the current original parameter parser instance is directly added to the custom parameter parser list. After traversing all the original parameter resolver instances, the setting method of the request mapping processor adapter component is called to inject the custom parameter resolver list to replace the original parameter resolver list, so that the enhanced resolver chain can be used in subsequent request processing.

7. The method according to claim 1, characterized in that, The original parameter parser includes at least one or more of the following: a request-response body method processor for processing JSON request bodies, a Servlet model attribute method processor for processing form model attributes, a request parameter method parser for processing URL query parameters, and a path variable method parser for processing URL path variables.

8. A transparent data encryption device based on a parameter parser proxy, characterized in that, A request processing chain for a web application, wherein the enhanced parser chain in the request processing chain includes an encrypted proxy parser encapsulating a raw parameter parser, the apparatus comprising: The parameter parsing unit is used to receive client requests, perform parameter parsing using the encrypted proxy parser, and obtain an initial business parameter object. An encryption processing unit is used to identify sensitive data items in the initial business parameter object and perform encryption processing before the business logic is executed; The delivery execution unit is used to deliver the encrypted business parameter object to the business controller method for subsequent business logic execution.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program is executed by the processor to perform the method of any one of claims 1 to 7.

Images