Protocol security transmission method and device, electronic equipment and readable storage medium

Abstract

The present disclosure relates to the technical field of network communication security, and provides a protocol secure transmission method and device, electronic equipment and a readable storage medium. The method comprises: performing protocol authentication normalization processing on network request data to obtain security environment data; performing cross-protocol secure transparent transmission processing on the network request data based on the security environment data to obtain plaintext payload data and target protocol token data; performing cross-protocol format conversion processing on the plaintext payload data to obtain target protocol format request data; performing security delivery processing on the target protocol format request data and the target protocol token data to obtain target request data; and performing response security reverse processing on service real-time response data based on the target request data to obtain target security response data, thereby ensuring the chain continuity of the security context, improving the accuracy of format conversion and the protocol adaptation capability, enhancing the credibility and tamper-proofing capability of request transmission, and reducing the integration complexity.

Description

Technical Field

[0001] This disclosure relates to the field of network communication security technology, and in particular to a protocol-secure transmission method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] In cross-protocol communication scenarios, the security mechanisms of heterogeneous protocols such as Simple Object Access Protocol (SOAP) and JSON Remote Procedure Call (JSON-RPC) are incompatible, leading to problems such as the inability to transmit authentication information across protocols, the incompatibility of encrypted payloads, and the breakage of security contexts during system integration. This increases system complexity and security risks. Existing technologies can build independent protocol adaptation layers and write specific security conversion logic for each protocol combination, but this approach is redundant and difficult to maintain. Alternatively, clients and servers can be forced to use a unified security protocol, but this requires large-scale modifications to legacy systems, is costly to implement, and cannot handle deep security token conversions and transparent encryption / decryption of encrypted payloads, resulting in breaks in the security chain.

[0003] Existing technologies suffer from problems such as incompatibility of security mechanisms between heterogeneous protocols, redundant and difficult-to-maintain customized development of protocol adaptation layers, and breakpoints in the middleware security processing chain, resulting in difficulties in transmitting authentication information, opaque encryption payload conversion, broken security context, and high integration complexity and security risks. Summary of the Invention

[0004] In view of this, the present disclosure provides a method, apparatus, electronic device and readable storage medium for secure protocol transmission, in order to solve the problems in the prior art that are caused by the incompatibility of security mechanisms of heterogeneous protocols, the redundancy and difficulty in maintaining the customized development of protocol adaptation layers, the existence of breaks in the middleware security processing chain, resulting in the difficulty of transmitting authentication information, the lack of transparency in encrypted payload conversion, the break in security context, and the high complexity and security risks of integration.

[0005] A first aspect of this disclosure provides a protocol-secure transmission method, comprising: performing protocol authentication and normalization processing on network request data to obtain secure environment data; performing cross-protocol secure pass-through processing on the network request data based on the secure environment data to obtain plaintext payload data and target protocol token data; performing cross-protocol format conversion processing on the plaintext payload data to obtain target protocol format request data; performing secure delivery processing on the target protocol format request data and target protocol token data to obtain target request data; and performing response security reverse processing on real-time service response data based on the target request data to obtain target secure response data.

[0006] In some embodiments, cross-protocol secure pass-through processing is performed on network request data based on security environment data to obtain plaintext payload data and target protocol token data, including: performing encryption state detection processing on network request data to obtain encryption state data; performing payload transparent resolution processing on network request data based on encryption state data to obtain plaintext payload data; and performing security token conversion processing on security environment data to obtain target protocol token data.

[0007] In some embodiments, the target protocol format request data and the target protocol token data are securely delivered to obtain target request data, including: performing session key derivation processing on the target protocol format request data to obtain session key data; performing payload encryption and encapsulation processing on the target protocol format request data based on the session key data to obtain encrypted payload data; and performing secure assembly processing on the encrypted payload data and the target protocol token data to obtain target request data.

[0008] In some embodiments, protocol authentication normalization processing is performed on network request data to obtain security environment data, including: performing protocol feature parsing processing on network request data to obtain protocol feature data; performing protocol type identification processing on protocol feature data to obtain protocol type identification result data; and performing adaptive authentication verification processing on network request data based on protocol type identification result data to obtain security environment data.

[0009] In some embodiments, the real-time service response data is subjected to response security reverse processing based on the target request data to obtain target secure response data, including: performing response payload decryption processing on the real-time service response data based on the target request data to obtain decrypted response data; performing response format restoration processing on the decrypted response data to obtain format-restored response data; and performing security environment backfilling processing on the format-restored response data to obtain target secure response data.

[0010] In some embodiments, the network request data is subjected to payload transparent decryption based on encrypted state data to obtain plaintext payload data, including: extracting encrypted structure data from the network request data based on encrypted state data to obtain encrypted structure data; performing key cache location processing on the encrypted structure data to obtain location session key data; and performing payload decryption processing on the encrypted structure data based on the location session key data to obtain plaintext payload data.

[0011] In some embodiments, the process of performing session key derivation processing on the target protocol format request data to obtain session key data includes: performing request identifier parsing processing on the target protocol format request data to obtain request identifier data; performing time window calculation processing on the request identifier data to obtain time window data; and performing key derivation processing on the request identifier data and time window data to obtain session key data.

[0012] A second aspect of this disclosure provides a protocol-secure transmission apparatus, comprising: a first processing module for performing protocol authentication and normalization processing on network request data to obtain secure environment data; a second processing module for performing cross-protocol secure pass-through processing on the network request data based on the secure environment data to obtain plaintext payload data and target protocol token data; a third processing module for performing cross-protocol format conversion processing on the plaintext payload data to obtain target protocol format request data; a fourth processing module for performing secure delivery processing on the target protocol format request data and target protocol token data to obtain target request data; and a fifth processing module for performing response security reverse processing on real-time service response data based on the target request data to obtain target secure response data.

[0013] A third aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0014] A fourth aspect of this disclosure provides a readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method.

[0015] The beneficial effects of this disclosed embodiment compared with the prior art are as follows: By performing protocol authentication and normalization processing on network request data, secure environment data is obtained; based on the secure environment data, cross-protocol secure transparent transmission processing is performed on the network request data to obtain plaintext payload data and target protocol token data; cross-protocol format conversion processing is performed on the plaintext payload data to obtain target protocol format request data; secure delivery processing is performed on the target protocol format request data and target protocol token data to obtain target request data; and response security reverse processing is performed on the real-time service response data based on the target request data to obtain target secure response data, thereby ensuring the continuity of the security context chain; improving the normalization capability and compatibility of protocol layer security authentication; enhancing payload security and protocol binding reliability during data transmission; improving the accuracy of format conversion and protocol adaptation capability; enhancing the trustworthiness and anti-tampering capability of request transmission; and reducing integration complexity and security risks. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram illustrating an application scenario of an embodiment of this disclosure; Figure 2 This is a schematic flowchart of a protocol-secure transmission method provided in an embodiment of this disclosure; Figure 3 This is a flowchart illustrating another protocol-secure transmission method provided in this embodiment of the disclosure; Figure 4 This is a schematic diagram of the structure of a protocol secure transmission device provided in an embodiment of this disclosure; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0018] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, so as to provide a thorough understanding of the embodiments of this disclosure. However, those skilled in the art will understand that this disclosure may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this disclosure with unnecessary detail.

[0019] It should be noted that the user information (including but not limited to terminal device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0020] A protocol-secure transmission method and apparatus according to embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings.

[0021] Figure 1 This is a schematic diagram illustrating an application scenario of an embodiment of this disclosure. The application scenario may include terminal devices 1, 2, and 3, server 4, and network 5.

[0022] Terminal devices 1, 2, and 3 can be hardware or software. When terminal devices 1, 2, and 3 are hardware, they can be various electronic devices with displays and supporting communication with server 4, including but not limited to smartphones, tablets, laptops, and desktop computers. When terminal devices 1, 2, and 3 are software, they can be installed in the aforementioned electronic devices. Terminal devices 1, 2, and 3 can be implemented as multiple software programs or software modules, or as a single software program or software module; this disclosure does not limit this. Furthermore, various applications can be installed on terminal devices 1, 2, and 3, such as data processing applications, instant messaging tools, social platform software, search applications, shopping applications, etc.

[0023] Server 4 can be a server that provides various services, such as a backend server that receives requests sent by terminal devices with which it has established communication connections. This backend server can receive and analyze the requests sent by the terminal devices and generate processing results. Server 4 can be a single server, a server cluster consisting of several servers, or a cloud computing service center. This disclosure embodiment does not limit this.

[0024] It should be noted that server 4 can be either hardware or software. When server 4 is hardware, it can be various electronic devices that provide various services to terminal devices 1, 2, and 3. When server 4 is software, it can be multiple software programs or software modules that provide various services to terminal devices 1, 2, and 3, or it can be a single software program or software module that provides various services to terminal devices 1, 2, and 3. This disclosure does not limit the scope of the embodiments.

[0025] Network 5 can be a wired network using coaxial cable, twisted pair, and fiber optic connection, or it can be a wireless network that enables interconnection of various communication devices without wiring, such as Bluetooth, Near Field Communication (NFC), and Infrared. This disclosure does not limit the scope of the network.

[0026] Users can establish a communication connection with server 4 via network 5 through terminal devices 1, 2, and 3 to receive or send information. Specifically, server 4 can obtain network request data and real-time service response data through terminal devices 1, 2, and 3. It then performs protocol authentication and normalization processing on the network request data to obtain secure environment data; based on the secure environment data, it performs cross-protocol secure pass-through processing on the network request data to obtain plaintext payload data and target protocol token data; it performs cross-protocol format conversion processing on the plaintext payload data to obtain target protocol format request data; it performs secure delivery processing on the target protocol format request data and target protocol token data to obtain target request data; and based on the target request data, it performs response security reverse processing on the real-time service response data to obtain target secure response data.

[0027] It should be noted that the specific types, quantities, and combinations of terminal devices 1, 2, and 3, server 4, and network 5 can be adjusted according to the actual needs of the application scenario, and this disclosure embodiment does not impose any restrictions on this.

[0028] Figure 2 This is a flowchart illustrating a protocol-secure transmission method provided in an embodiment of this disclosure. Figure 2 The secure transmission method of the protocol can be provided by Figure 1 The server executes this. For example... Figure 2As shown, the secure transmission method of this protocol includes: S201 performs protocol authentication and normalization processing on network request data to obtain secure environment data.

[0029] Specifically, network request data can be raw request data containing business parameters and security credentials sent by the client to the gateway. This network request data can be used to trigger the entire protocol secure transmission process and serve as the input starting point for protocol authentication normalization processing. This network request data can include header data and payload data. The header data can include content type data, Simple Object Access Protocol (SOP) action data, and Uniform Resource Locator (URL) path data, etc., which are not limited here. This network request data can be generated by the client application and transmitted to the gateway over the network.

[0030] Furthermore, protocol authentication normalization processing can be a standardized data processing process that identifies protocol types based on protocol features and verifies multiple authentication methods using a unified framework. This protocol authentication normalization processing can be used to extract, verify, and convert authentication information from different protocol formats into a protocol-independent standard format. This protocol authentication normalization processing can also perform protocol feature parsing and type identification on network request data based on the header data of network request data to obtain security environment data.

[0031] Specifically, the security environment data can be a protocol-independent unified data object generated through protocol authentication normalization processing. This security environment data can serve as a unified information source for all subsequent security processing steps and may include authentication results and encryption parameters. The security environment data may also include subject identification data, role and permission list data, authentication method data, security level data, symmetric key identification data, and internal token data. The security environment data can be a standardized output obtained after verifying and extracting authentication credentials from network request data through protocol authentication normalization processing.

[0032] Furthermore, the protocol authentication normalization process may specifically include parsing the network request data for protocol features to obtain protocol feature data; performing protocol type identification processing on the protocol feature data to obtain protocol type identification result data; and performing adaptive authentication verification processing on the network request data based on the protocol type identification result data to obtain security environment data.

[0033] This application embodiment obtains security environment data by parsing protocol features, identifying protocol types, and performing adaptive authentication verification on network request data. This enhances the standardization capability of extracting and verifying authentication information for multi-protocol requests; improves the uniformity and scalability of security context generation in cross-protocol scenarios; and provides a protocol-independent unified information source for subsequent security processing steps.

[0034] For example, in cross-protocol enterprise system integration, a request to obtain quarterly financial reports can be initiated to the gateway via the Remote Procedure Call (RPC) protocol. The gateway can perform protocol authentication and normalization processing on the network request data. It can identify the protocol type as RPC based on its content type data and Uniform Resource Locator (URL) path data. Then, it can extract the holder's network token in the authorization header for signature verification and expiration check. After successful verification, it can extract the subject identifier and role permission list from the token to generate secure environment data containing the subject identifier as a financial user, the role permission list which can include report viewing permissions, the authentication method as the holder's network token, and the security level as authentication encryption.

[0035] S202, based on the security environment data, performs cross-protocol secure pass-through processing on the network request data to obtain plaintext payload data and target protocol token data.

[0036] Specifically, cross-protocol secure pass-through processing can be a data processing process that performs bidirectional transparent conversion of security credentials and encrypted payloads between heterogeneous protocols based on protocol-independent authentication information. This cross-protocol secure pass-through processing can be used to convert the security authentication information of the source protocol into a format recognizable by the target protocol, and can transparently decrypt the encrypted payload. This cross-protocol secure pass-through processing can also perform security token conversion and payload decryption on network request data based on authentication results and encryption parameters in the security environment data to obtain plaintext payload data and target protocol token data.

[0037] The plaintext payload data can be unencrypted business parameter data obtained by transparent decryption processing. This plaintext payload data can be used as direct input for cross-protocol format conversion processing and can be used for protocol format mapping in plaintext state. The plaintext payload data can include business parameter content and structured data elements. The plaintext payload data can be the restored result obtained by decrypting the encrypted payload part in the network request data.

[0038] The target protocol token data can be a security token conforming to the target protocol specification, obtained by converting the source protocol authentication credentials based on the security environment data. This target protocol token data can be used as an injection object for secure delivery processing, enabling the target server to identify and verify the requester's identity. The target protocol token data may include holder network token data or network service security header Extensible Markup Language fragment data. The target protocol token data can be obtained by format conversion of the authentication results in the security environment data through security token conversion processing.

[0039] Furthermore, cross-protocol secure pass-through processing may specifically include performing encryption state detection processing on network request data to obtain encrypted state data; performing payload transparent resolution processing on network request data based on encrypted state data to obtain plaintext payload data; and performing security token conversion processing on security environment data to obtain target protocol token data.

[0040] This application embodiment obtains encrypted state data by detecting the encrypted state of network request data, transparently decrypts the payload based on the encrypted state to obtain plaintext payload data, and converts the security environment data into a security token to generate target protocol token data. This enhances the ability to transparently decrypt encrypted payloads and convert the format of authentication credentials in cross-protocol scenarios; improves the bidirectional transmission efficiency of security context between heterogeneous protocols; and provides standardized input of plaintext payload and target protocol token for subsequent protocol format conversion.

[0041] For example, in cross-protocol enterprise system integration, based on security environment data containing the subject identifier of a financial user, the role permission list including report viewing permissions, the authentication method of a holder network token, and the security level of authentication encryption, cross-protocol secure pass-through processing can be performed on network request data using the Remote Procedure Call protocol. This can detect the presence of encryption markers in the payload data of the network request data, perform payload transparent decryption processing based on the encryption state data, extract key identifier data and environment identifier data from the encrypted structure data, locate session key data from the key cache data based on the key identifier data and decrypt the encrypted payload data to obtain plaintext payload data based on the session key data, and perform security token conversion processing on the security environment data to generate holder network token data containing the subject identifier of a financial user and the role permission list including report viewing permissions, and security metadata based on a hash message authentication code as target protocol token data.

[0042] S203 performs cross-protocol format conversion on the plaintext payload data to obtain the target protocol format request data.

[0043] Specifically, cross-protocol format conversion processing can be a data adaptation process that converts a data structure of one communication protocol format into a data structure of another communication protocol format based on predefined mapping rules. This cross-protocol format conversion processing can be used to achieve lossless transmission and format adaptation of business data between different protocol systems. This cross-protocol format conversion processing can perform protocol feature parsing and element recombination based on plaintext payload data to obtain the target protocol format request data.

[0044] The target protocol format request data can be a data structure that conforms to the protocol specifications expected by the target server after format conversion. The target protocol format request data can be used as a direct input for secure delivery processing and can include converted business parameters and authentication information. The target protocol format request data can include protocol header data and payload data. The target protocol format request data can be the output result obtained after parsing, extracting, reassembling and re-encoding plaintext payload data through cross-protocol format conversion processing.

[0045] Furthermore, the cross-protocol format conversion process may specifically include parsing the plaintext payload data for protocol features to obtain protocol feature data; performing element mapping based on the protocol feature data to obtain mapped element data; and performing structural reorganization on the mapped element data to obtain the target protocol format request data.

[0046] This application embodiment obtains target protocol format request data by performing cross-protocol format conversion processing on plaintext payload data; converts decrypted plaintext business parameters from the source protocol format to the target protocol format through cross-protocol format conversion processing; ensures lossless transmission of business data between heterogeneous protocols through protocol feature parsing and element mapping; and generates a data structure that conforms to the target protocol specification through structural reorganization. This improves the flexibility and compatibility of business data format adaptation between heterogeneous systems, enhances the integrity and consistency of business logic during protocol conversion, and improves the efficiency and convenience of backend services in receiving and processing cross-protocol requests.

[0047] For example, in cross-protocol enterprise system integration, plaintext payload data of Simple Object Access Protocol (SOP) containing user identity and query parameters can be converted to a cross-protocol format. The Extensible Markup Language (EXPLAIN) structure in the plaintext payload data can be parsed and business parameter elements can be extracted. The extracted elements can be mapped based on preset mapping rules to obtain mapped element data. The mapped element data can then be restructured to generate target protocol format request data that conforms to the Remote Procedure Call (RPC) protocol specification. This target protocol format request data can contain method name parameters and structured parameter objects.

[0048] S204, Securely deliver the target protocol format request data and the target protocol token data to obtain the target request data.

[0049] Specifically, secure delivery processing can be an assembly process that encrypts and encapsulates the target protocol format request data based on a dynamic key derivation mechanism and injects the target protocol token data into the corresponding position of the request. This secure delivery processing can be used to ensure the confidentiality of business data and the accurate transmission of authentication information during transmission. This secure delivery processing can also perform session key derivation and payload encryption based on the target protocol format request data to obtain the target request data.

[0050] The target request data can be a complete request data packet prepared to be sent to the target service after encryption and token injection. The target request data can serve as a direct carrier for network transmission and can be used to carry encrypted business parameters and injected security tokens. The target request data can include protocol header data, payload data, and authentication data. The target request data can be the output result obtained after assembling and encapsulating the target protocol format request data and the target protocol token data through secure delivery processing.

[0051] Furthermore, the secure delivery process may specifically include performing session key derivation processing on the target protocol format request data to obtain session key data; performing payload encryption and encapsulation processing on the target protocol format request data based on the session key data to obtain encrypted payload data; and performing secure assembly processing on the encrypted payload data and the target protocol token data to obtain the target request data.

[0052] This application embodiment obtains session key data by deriving a session key from the target protocol format request data, and then encrypts and encapsulates the payload based on the session key to obtain encrypted payload data. The encrypted payload data can then be securely assembled with the target protocol token data to obtain the target request data. This enhances the confidentiality and integrity of authentication information during the transmission of cross-protocol requests, improves the collaborative efficiency of dynamic key derivation and payload encryption, and provides a securely encapsulated data carrier for sending requests to the target service.

[0053] For example, in cross-protocol enterprise system integration, target protocol format request data conforming to the remote procedure call protocol specification and target protocol token data containing the holder's network token data can be securely delivered. Session key data can be generated by deriving session keys from the target protocol format request data. Based on the session key data, the payload data of the target protocol format request data can be encrypted and encapsulated to obtain encrypted payload data. Then, the encrypted payload data and the target protocol token data can be securely assembled, the holder's network token data can be set in the authorization header data, and the encrypted payload data can be encapsulated into parameter object data containing encryption tags to generate target request data conforming to the transport layer security protocol specification and sent to the target remote procedure call protocol service.

[0054] S205, based on the target request data, perform response security reverse processing on the real-time service response data to obtain the target security response data.

[0055] Specifically, real-time service response data can be response data returned by the target service after processing the target request data, containing processing results and status information. This real-time service response data can be used as a processing object for response security reverse processing and can be used to carry the business processing results of the target service. This real-time service response data can contain response header data and response payload data. This real-time service response data can be the return result generated after the target service performs business processing on the target request data.

[0056] Furthermore, response security reverse processing can be a process of performing reverse security operations on real-time service response data that are symmetrical to the request processing chain. This response security reverse processing can be used to restore the response data of the target protocol format to a format that the source protocol client can recognize and backfill security status information; this response security reverse processing can also decrypt and restore the format of real-time service response data based on the target request data to obtain the target security response data.

[0057] The target security response data can be the response data prepared to be returned to the source protocol client after the response security reverse processing is completed. The target security response data can serve as a return carrier for network transmission, used to carry the restored business results and complete security status information. The target security response data can include source protocol format response data and security status data. The target security response data can be the output result obtained after decrypting, restoring the format and backfilling the security information of the real-time service response data through response security reverse processing.

[0058] Furthermore, the response security reverse processing can specifically include decrypting the service real-time response data based on the target request data to obtain decrypted response data; restoring the response format of the decrypted response data to obtain format-restored response data; and backfilling the format-restored response data with a security environment to obtain the target security response data.

[0059] This application's embodiments establish a symmetric security processing mechanism between requests and responses through response security reverse processing, achieving a closed-loop security across the entire link; transparently decrypting encrypted response payloads through response payload decryption processing ensures the confidentiality and integrity of response data; restoring the target protocol format response to a source protocol client-recognizable format through response format restoration processing; and completely transmitting security status information to the client through security environment backfilling processing. This improves the consistency and closed-loop nature of security processing throughout the entire request-response lifecycle, enhances the symmetry and reliability of security policies in cross-protocol bidirectional communication, and improves the observability and auditability of the system's security status.

[0060] For example, in cross-protocol enterprise system integration, based on the target request data sent to the target remote procedure call protocol service, the real-time response data returned by the target service can be processed for security reverse engineering. This can detect the presence of encryption tags in the real-time response data, locate the session key data based on the request identifier data and time window data in the target request data, and decrypt the encrypted response payload based on the session key data to obtain decrypted response data. Furthermore, the decrypted response data can be processed to restore the response format, mapping the response result in the remote procedure call protocol format to Extensible Markup Language elements in the Simple Object Access Protocol format to obtain format-restored response data. The format-restored response data can be processed to backfill the security environment, inserting the security context identifier and authentication subject information into the response header data to generate target security response data containing business results and complete security status information, which is then returned to the source protocol client.

[0061] According to the technical solution provided in this disclosure, network request data is processed by protocol authentication and normalization. Secure environment data is obtained through protocol feature parsing, type identification, and adaptive authentication verification. Based on this secure environment data, cross-protocol secure pass-through processing is performed on the network request data. Plaintext payload data and target protocol token data are obtained through encryption state detection, payload transparent decryption, and security token conversion. Cross-protocol format conversion processing is performed on the plaintext payload data. Target protocol format request data is obtained through protocol feature parsing, element mapping, and structure reorganization. The target protocol format request data and target protocol token data are securely delivered. Target request data is obtained through session key derivation, payload encryption encapsulation, and secure assembly. Based on the target request data, services are then... Real-time response data undergoes security reverse processing. By decrypting the response payload, restoring the response format, and backfilling the security environment, the target secure response data is obtained. This enhances the standardization of authentication and the ability to generate security contexts for cross-protocol requests; improves the efficiency of transparent decryption of encrypted payloads and format conversion of authentication credentials; achieves lossless adaptation and secure encapsulation of business data between heterogeneous protocols; establishes a symmetrical security closed-loop mechanism for the entire request and response chain, ensuring the continuity of the security context chain; improves the normalization and compatibility of protocol-layer security authentication; enhances payload security and protocol binding reliability during data transmission; improves the accuracy of format conversion and protocol adaptation capabilities; enhances the trustworthiness and anti-tampering capabilities of request transmission; and reduces integration complexity and security risks.

[0062] In some embodiments, cross-protocol secure pass-through processing is performed on network request data based on security environment data to obtain plaintext payload data and target protocol token data, including: performing encryption state detection processing on network request data to obtain encryption state data; performing payload transparent resolution processing on network request data based on encryption state data to obtain plaintext payload data; and performing security token conversion processing on security environment data to obtain target protocol token data.

[0063] Specifically, the encryption state detection process can be a data processing procedure that parses the protocol structure and payload of network request data to identify its encryption state. This encryption state detection process can be used to determine whether the payload of the network request data is in an encrypted state and the type of encryption format used, so as to guide the selection of branch paths for subsequent payload transparent resolution processing. This encryption state detection process can perform pattern recognition and state determination on the protocol tags and payload features in the network request data based on preset protocol structure parsing rules to obtain the encrypted state data.

[0064] The encryption status data can be structured data that characterizes the encryption status and encryption format type of the network request data payload. This encryption status data can be used to drive the automatic selection of decryption or extraction branches. The encryption status data can include fields such as encryption status identifier and encryption parameter type marker. The encryption status data can be the judgment result obtained by parsing the protocol structure and detecting encryption features of the network request data.

[0065] Furthermore, the encryption state detection process may specifically include parsing the protocol structure of the network request data to obtain protocol feature data; identifying encryption markers in the protocol feature data to obtain encryption marker data; and performing state determination based on the encryption marker data to obtain encryption state data.

[0066] Furthermore, the transparent payload decryption process can be a data processing procedure that performs decryption operations on network request payloads in an encrypted state or extracts data from unencrypted payloads based on the encrypted state data. This transparent payload decryption process can be used to achieve transparent decryption of encrypted payloads, allowing upper-layer protocol conversion logic to process only plaintext business data without needing to concern itself with the underlying encryption details. This transparent payload decryption process can also perform decryption branch calls or directly extract branch calls on network request data based on the encryption state identifier in the encrypted state data, thereby obtaining plaintext payload data.

[0067] Furthermore, the payload transparency resolution process may specifically include performing state branch identification processing on the encrypted state data to obtain branch path data; performing encryption parameter extraction processing on the network request data based on the branch path data to obtain encrypted parameter data; performing key location processing on the encrypted parameter data to obtain session key data; performing decryption and restoration processing on the network request data based on the session key data to obtain plaintext payload data; or performing direct content extraction processing on the network request data based on the branch path data to obtain plaintext payload data.

[0068] In addition, the security token conversion process can be a data processing procedure that converts protocol-independent security environment data into a security token format that conforms to the target protocol specification. This security token conversion process can be used to achieve lossless migration and adaptation of authentication information between different protocols, ensuring that the target service can identify and verify the client identity from the source protocol. This security token conversion process can perform protocol-specific encoding conversion and format encapsulation on the security environment data based on the target protocol type identifier to obtain the target protocol token data.

[0069] Furthermore, the security token conversion process may specifically include performing protocol type identification processing on the security environment data to obtain target protocol identifier data; performing conversion logic routing processing based on the target protocol identifier data to obtain conversion policy data; and encoding and encapsulating the security environment data based on the conversion policy data to obtain target protocol token data.

[0070] For example, in heterogeneous service gateway integration, when network request data using a first protocol format is received, the network request data can be processed for encryption status detection, its protocol structure can be parsed and the encryption marker features of the payload can be identified, and encryption status data indicating that the payload is encrypted and uses a specific encryption format can be obtained. Then, based on the encryption status data, the network request data can be processed for payload transparent decryption, the encryption parameters can be extracted from the network request data and the corresponding session key can be located to perform decryption and restoration, and plaintext payload data containing business parameters can be obtained. Security token conversion processing can be performed on security environment data containing subject identifiers and role information, the target protocol type can be identified and the corresponding encoding and encapsulation logic can be called to generate target protocol token data that conforms to the target protocol specification.

[0071] According to the technical solution provided in this disclosure, encrypted state detection processing is performed on network request data. Encrypted state data is obtained through protocol structure parsing, encryption mark identification, and state determination. Based on the encrypted state data, the network request data undergoes transparent payload decryption processing. Plaintext payload data is obtained through state branch identification, encryption parameter extraction, key location, and decryption restoration, or direct content extraction. Security token conversion processing is performed on the security environment data. Target protocol token data is obtained through protocol type identification, conversion logic routing, and encoding encapsulation. This enhances the ability to transparently decrypt encrypted payloads and efficiently extract unencrypted payloads; and improves the efficiency of security credential format conversion and adaptation between different protocols.

[0072] In some embodiments, the target protocol format request data and the target protocol token data are securely delivered to obtain target request data, including: performing session key derivation processing on the target protocol format request data to obtain session key data; performing payload encryption and encapsulation processing on the target protocol format request data based on the session key data to obtain encrypted payload data; and performing secure assembly processing on the encrypted payload data and the target protocol token data to obtain target request data.

[0073] Specifically, the session key derivation process can be a data processing procedure that dynamically derives request-level symmetric encryption keys from the gateway master key based on the request identifier and time window identifier. This session key derivation process can be used to independently generate encryption keys with time window restrictions for each request, thereby achieving request-level key isolation. This session key derivation process can also perform dynamic key generation and cache management on the request identifier and time window identifier in the target protocol format request data based on preset key derivation rules to obtain session key data.

[0074] The session key data can be symmetric key data used to encrypt and decrypt the request payload. The session key data can be used to provide the key material required for encryption operations. The session key data can contain key attribute information such as key value, initialization vector, key identifier, and expiration time. The session key data can be a key record obtained by dynamically deriving and caching the request identifier and time window identifier in the target protocol format request data.

[0075] Furthermore, the session key derivation process may specifically include extracting the request identifier from the target protocol format request data to obtain request identifier data; calculating the time window identifier from the target protocol format request data to obtain time window data; concatenating the request identifier data and the time window data to obtain derived salt value data; and performing dynamic key derivation based on the derived salt value data and the preset gateway master key data to obtain session key data.

[0076] Furthermore, the payload encryption and encapsulation process can be a data processing procedure that encrypts and encapsulates the business parameters in the target protocol format request data into a structured encrypted payload using session key data. This payload encryption and encapsulation process can be used to provide confidentiality and integrity protection for the target protocol format request data, preventing the data from being stolen or tampered with during transmission. This payload encryption and encapsulation process can perform encryption operations and structured encapsulation on the target protocol format request data based on the key value and initialization vector in the session key data to obtain encrypted payload data.

[0077] The encrypted payload data can be payload data containing ciphertext and encrypted metadata obtained through encryption operations and structured encapsulation. This encrypted payload data can be used as a business parameter part in the target request. The encrypted payload data can include encrypted metadata such as ciphertext content, key identifier, algorithm identifier, initialization vector, and security context identifier. The encrypted payload data can be the encrypted result obtained by performing encryption operations and metadata encapsulation on the business parameters in the target protocol format request data.

[0078] Furthermore, the payload encryption and encapsulation process may specifically include performing a security level query on the target protocol format request data to obtain encryption decision data; performing business parameter serialization processing on the target protocol format request data based on the encryption decision data to obtain parameter byte data; performing encryption operation processing on the parameter byte data based on the session key data to obtain ciphertext data; and performing structured encapsulation processing on the ciphertext data to obtain encrypted payload data.

[0079] Furthermore, the secure assembly process can be a data processing procedure that integrates encrypted payload data and target protocol token data into a complete request structure according to the target protocol specification. This secure assembly process can be used to ensure that the target request simultaneously contains encrypted business data and transformed identity authentication information, enabling the target service to correctly verify the requester's identity and decrypt and process the business data. This secure assembly process can perform protocol-specific location orchestration and structural integration of encrypted payload data and target protocol token data based on the target protocol type identifier to obtain the target request data.

[0080] Furthermore, the secure assembly process may specifically include performing protocol location identification processing on the encrypted payload data to obtain payload location data; performing protocol location identification processing on the target protocol token data to obtain token location data; and performing structural integration processing based on the payload location data and the token location data to obtain target request data.

[0081] For example, in heterogeneous service security integration, the target protocol format request data that has undergone protocol format conversion can be securely delivered. Session key derivation can be performed on the target protocol format request data to extract the request identifier and calculate the current time window identifier. Request-level session key data can be dynamically generated based on preset key derivation rules and cached. Then, the target protocol format request data can be encrypted and encapsulated using this session key data. After querying the security level, encryption operations can be performed on the business parameters using the session key, and encrypted metadata can be encapsulated to obtain encrypted payload data. Security token conversion can be performed on security environment data containing subject identifiers and role information to generate target protocol token data. The encrypted payload data and target protocol token data can be securely assembled. According to the target protocol specification, the encrypted payload is placed in the business parameter position, and the authentication token is placed in the request header position, assembling to obtain complete target request data containing encrypted business content and identity credentials.

[0082] According to the technical solution provided in this disclosure, session key data is obtained by performing session key derivation processing on the target protocol format request data, extracting the request identifier, calculating the time window identifier, and dynamic key derivation. Based on the session key data, the target protocol format request data is encapsulated with encrypted payload. Encrypted payload data is obtained through security level query, business parameter serialization, encryption operations, and structured encapsulation. The encrypted payload data and target protocol token data are securely assembled. The target request data is obtained through protocol location identification and structure integration. This enhances the security of request-level key isolation and dynamic key derivation; improves the collaborative efficiency of business parameter encryption and authentication token injection; and provides a complete and securely encapsulated request data carrier for the target service.

[0083] In some embodiments, protocol authentication normalization processing is performed on network request data to obtain security environment data, including: performing protocol feature parsing processing on network request data to obtain protocol feature data; performing protocol type identification processing on protocol feature data to obtain protocol type identification result data; and performing adaptive authentication verification processing on network request data based on protocol type identification result data to obtain security environment data.

[0084] Specifically, protocol feature parsing can be a data processing process that parses the protocol structure and content features of network request data to extract protocol discrimination information. This protocol feature parsing can be used to transform the original request data into a structured protocol feature representation, providing key criteria for subsequent protocol type identification. Based on preset protocol feature extraction rules, this protocol feature parsing can perform pattern recognition and feature extraction on the protocol header fields and path identifiers in the network request data to obtain protocol feature data.

[0085] Among them, the protocol feature data can be structured data that characterizes the protocol attributes and discrimination features of network request data. This protocol feature data can be used to carry key criterion information to distinguish different protocols. The protocol feature data can include field information such as protocol header feature identifier, path feature identifier, and content type feature identifier. The protocol feature data can be a structured record obtained by parsing the protocol structure and extracting features from the network request data.

[0086] Furthermore, the protocol feature parsing process may specifically include extracting protocol header fields from the network request data to obtain header field feature data; parsing the path identifier from the network request data to obtain path feature data; performing content type detection on the network request data to obtain content type feature data; and performing feature aggregation on the header field feature data, the path feature data, and the content type feature data to obtain protocol feature data.

[0087] Furthermore, the protocol type identification process can be a data processing procedure that determines the protocol type of network request data based on protocol feature data and preset priority rules. This protocol type identification process can be used to map abstract protocol features to specific protocol type identifiers, providing a decision basis for subsequent adaptive authentication verification. This protocol type identification process can match and filter each feature field in the protocol feature data based on preset priority criteria rules to obtain protocol type identification result data.

[0088] Among them, the protocol type identification result data can be the determination result data that identifies the specific protocol type of the network request data. This protocol type identification result data can be used to characterize the authentication and verification rule path that should be followed in the subsequent processing flow. This protocol type identification result data can include field information such as protocol type identifier and matching confidence. This protocol type identification result data can be the determination result obtained by performing multiple criteria matching and priority filtering on protocol feature data.

[0089] Furthermore, the protocol type identification process may specifically include performing content type matching processing on the protocol feature data to obtain first matching result data; performing header field feature matching processing on the first matching result data to obtain second matching result data; performing path feature matching processing on the second matching result data to obtain third matching result data; and performing priority aggregation and determination processing on the first matching result data, the second matching result data, and the third matching result data to obtain protocol type identification result data.

[0090] Furthermore, the adaptive authentication verification process can be a data processing procedure that dynamically selects and executes the corresponding authentication verification logic based on the protocol type identification result data. This adaptive authentication verification process can be used to achieve unified security authentication across protocols, ensuring that the authentication information of different protocol requests can be correctly verified. This adaptive authentication verification process can perform protocol-specific credential extraction and verification operations on network request data based on the protocol type identifier in the protocol type identification result data to obtain security environment data.

[0091] Furthermore, the adaptive authentication verification process may specifically include performing verification path routing processing on the protocol type identification result data to obtain verification policy data; performing credential extraction processing on the network request data based on the verification policy data to obtain authentication credential data; performing verification operation processing on the authentication credential data based on the verification policy data to obtain verification result data; and performing security context construction processing on the verification result data to obtain security environment data.

[0092] For example, in heterogeneous service gateway integration, network request data can be parsed using protocol features to extract protocol header fields, path identifiers, and content type features, which are then aggregated into protocol feature data. This protocol feature data can then be used for protocol type identification. Based on preset priority rules, content type matching, header field feature matching, and path feature matching can be performed sequentially, and the results can be aggregated to obtain protocol type identification data. Based on this protocol type identification data, adaptive authentication and verification processing can be performed on the network request data. The corresponding verification strategy can be dynamically selected according to the identified protocol type to extract authentication credentials and perform verification operations. After successful verification, a security environment data containing subject identifiers and role permission lists can be constructed.

[0093] According to the technical solution provided in this disclosure, protocol feature parsing is performed on network request data. Protocol header field extraction, path identifier parsing, content type detection, and feature aggregation are used to obtain protocol feature data. Protocol type identification processing is then performed on the protocol feature data. Through content type matching, header field feature matching, path feature matching, and priority aggregation, protocol type identification result data is obtained. Based on the protocol type identification result data, adaptive authentication and verification processing is performed on the network request data. Through verification path routing, credential extraction, verification calculation, and security context construction, security environment data is obtained. This enhances the protocol type identification and adaptive authentication capabilities for multi-protocol requests; improves the standardization level of authentication information extraction and verification in cross-protocol scenarios; and provides a protocol-independent unified security context foundation for subsequent security processing.

[0094] In some embodiments, the real-time service response data is subjected to response security reverse processing based on the target request data to obtain target secure response data, including: performing response payload decryption processing on the real-time service response data based on the target request data to obtain decrypted response data; performing response format restoration processing on the decrypted response data to obtain format-restored response data; and performing security environment backfilling processing on the format-restored response data to obtain target secure response data.

[0095] Specifically, the response payload decryption process can be a data processing procedure that decrypts and restores the encrypted payload that may exist in the real-time response data of the service based on the security index information in the target request data. This response payload decryption process can be used to transparently decrypt the encrypted response payload returned by the target service into plaintext content. This response payload decryption process can also perform encryption mark detection and key location decryption on the real-time response data of the service based on the security context identifier and key identifier in the target request data to obtain decrypted response data.

[0096] The decrypted response data can be response data whose payload has been restored to plaintext after decryption processing. This decrypted response data can be used to carry transparently decrypted response service content. The decrypted response data can include elements such as plaintext response body content, response header information, and decryption status identifier. The decrypted response data can be the data result obtained by performing encryption mark detection and key location decryption on the real-time service response data, or it can be the real-time service response data directly transmitted when no encryption mark is detected.

[0097] Furthermore, the response payload decryption process may specifically include performing encryption mark detection processing on the real-time service response data to obtain encryption mark data; performing security index extraction processing on the target request data based on the encryption mark data to obtain security index data; performing key location processing on the security index data to obtain session key data; performing decryption and restoration processing on the real-time service response data based on the session key data to obtain decrypted response data; or performing direct transmission processing on the real-time service response data based on the encryption mark data to obtain decrypted response data.

[0098] Furthermore, response format restoration processing can be a data processing procedure that converts decrypted response data from the target protocol format to the client's source protocol format. This response format restoration processing can be used to ensure that the response data returned to the client is consistent with the protocol type of the client's original request, thereby achieving protocol transparency in the response chain. This response format restoration processing can perform protocol-specific format mapping and structure conversion based on the source protocol type identifier recorded in the target request data and the response structure in the decrypted response data to obtain format-restored response data.

[0099] The format restoration response data can be response data that conforms to the client source protocol specification after protocol format conversion. This format restoration response data can be used to carry the response content and structure that has been restored according to the protocol. This format restoration response data can include elements such as the response header information, response body content, and error mapping structure of the source protocol format. This format restoration response data can be the conversion result obtained by performing protocol-specific format mapping and structure conversion on the decrypted response data.

[0100] Furthermore, the response format restoration process may specifically include extracting the protocol type of the target request data to obtain source protocol identifier data; performing structural parsing on the decrypted response data based on the source protocol identifier data to obtain response structure data; performing format mapping on the response structure data based on the source protocol identifier data to obtain mapping result data; and performing structural encapsulation on the mapping result data to obtain format-restored response data.

[0101] In addition, the security environment backfilling process can be a data processing process that injects security processing metadata information into the response data after the protocol format restoration is completed. This security environment backfilling process can be used to provide the client or monitoring system with security processing status tracking information of this request-response link. This security environment backfilling process can perform response header injection and metadata encapsulation on the format restoration response data based on the security processing summary information in the security context object that runs through the processing link to obtain the target security response data.

[0102] Furthermore, the security environment backfilling process may specifically include performing security digest extraction on the security context object to obtain security digest data; performing response header construction based on the security digest data to obtain security response header data; and performing header field injection on the format-restored response data based on the security response header data to obtain the target security response data.

[0103] For example, in heterogeneous service gateway integration, the real-time service response data can be decrypted based on the target request data. The encryption markers in the response payload can be detected and the security context identifier can be extracted for key location. The decrypted response data can be obtained by performing decryption and restoration using the located session key. Then, the response format can be restored by performing response format restoration processing on the decrypted response data. The response structure of the target protocol format can be mapped to the client source protocol format according to the source protocol type identifier and encapsulated to obtain the format restored response data. The format restored response data can be backfilled with a security environment. The security processing digest information can be extracted from the security context object and a security response header can be constructed and injected into the format restored response data to obtain the target security response data containing security tracking metadata, which is then returned to the original client.

[0104] According to the technical solution provided in this disclosure, the real-time service response data is decrypted based on the target request data. Through encryption marker detection, security index extraction, key location, and decryption restoration, decrypted response data is obtained. The decrypted response data undergoes response format restoration processing, and through protocol type extraction, structure parsing, format mapping, and structure encapsulation, format-restored response data is obtained. The format-restored response data undergoes security environment backfilling processing, and through security digest extraction, response header construction, and header field injection, target secure response data is obtained. This enhances the transparent decryption capability of the encryption payload in the response chain; improves the adaptability of response data from the target protocol to the source protocol format restoration; and achieves complete transmission and traceability of the entire secure processing status.

[0105] In some embodiments, the network request data is subjected to payload transparent decryption based on encrypted state data to obtain plaintext payload data, including: extracting encrypted structure data from the network request data based on encrypted state data to obtain encrypted structure data; performing key cache location processing on the encrypted structure data to obtain location session key data; and performing payload decryption processing on the encrypted structure data based on the location session key data to obtain plaintext payload data.

[0106] Specifically, the encrypted structure extraction process can be a data processing procedure that parses and extracts the structured information of the encrypted payload in the network request data based on the encrypted state data. This encrypted structure extraction process can be used to identify and parse the structured information that identifies the encrypted state in the network request data. Based on preset protocol structure parsing rules, this encrypted structure extraction process can perform pattern recognition and parameter extraction on the encrypted markers and payload features in the network request data to obtain encrypted structure data.

[0107] The encrypted structure data can be structured data containing encryption-related parameters extracted from network request data. This encrypted structure data can be used to provide the identification information required for key retrieval and the ciphertext content required for decryption. The encrypted structure data can contain encryption parameter information such as key identifier, security context identifier, algorithm identifier, and ciphertext content. The encrypted structure data can be a structured record obtained by performing protocol structure parsing and encryption parameter extraction on the network request data.

[0108] Furthermore, the encrypted structure extraction process may specifically include performing encrypted marker detection processing on the network request data to obtain encrypted marker data; performing encrypted parameter extraction processing on the network request data based on the encrypted marker data to obtain encrypted parameter data; and performing structured encapsulation processing on the encrypted parameter data to obtain encrypted structure data.

[0109] Furthermore, the key cache location process can be a data processing procedure that retrieves the corresponding session key data by searching the key cache using the identification information in the encrypted structure data. This key cache location process can be used to ensure the accuracy and efficiency of decryption key retrieval and avoid key management chaos. This key cache location process can perform query retrieval and dynamic derivation on the key cache based on the key identifier and security context identifier in the encrypted structure data to obtain the location session key data.

[0110] The location session key data can be symmetric key data retrieved from the key cache for performing decryption operations. This location session key data can be used to provide the key material and initial vector required for the decryption operation. The location session key data can contain key attribute information such as key value, initial vector, key identifier, and expiration time. The location session key data can be a key record obtained by performing a key cache query retrieval or dynamic key derivation on the encrypted structure data.

[0111] Furthermore, the key cache location processing may specifically include extracting key identifiers from the encrypted structure data to obtain key identifier data; extracting security context identifiers from the encrypted structure data to obtain security context data; performing cache lookup processing based on the key identifier data and the security context data to obtain cache hit data; extracting key entries based on the cache hit data to obtain location session key data; or performing dynamic key derivation processing based on the security context data to obtain location session key data.

[0112] In addition, payload decryption processing can be a data processing procedure that uses location session key data to decrypt and restore the ciphertext content in the encrypted structure data. This payload decryption processing can be used to transparently decrypt the encrypted payload into plaintext business data. This payload decryption processing can perform decryption operations and format restoration on the ciphertext content in the encrypted structure data based on the key value and initial vector in the location session key data to obtain plaintext payload data.

[0113] Furthermore, the payload decryption process may specifically include extracting key material from the location session key data to obtain decryption key data; extracting ciphertext from the encrypted structure data to obtain ciphertext data; performing decryption operations on the ciphertext data based on the decryption key data to obtain decrypted byte data; and restoring the format of the decrypted byte data to obtain plaintext payload data.

[0114] For example, in heterogeneous service gateway integration, encrypted structure extraction processing can be performed on network request data based on encrypted state data. Encryption markers can be detected and encrypted parameters such as key identifier, security context identifier, algorithm identifier, and ciphertext content can be extracted and encapsulated into encrypted structure data. Then, key cache location processing can be performed on this encrypted structure data. After a key cache match is found using the key identifier and security context identifier, the corresponding session key entry can be extracted as the location session key data. Alternatively, the location session key data can be obtained by dynamic key derivation based on the security context identifier. The encrypted structure data can then be decrypted based on this location session key data. The ciphertext can be decrypted using the key value and initialization vector to restore it to plaintext format, thus obtaining plaintext payload data.

[0115] According to the technical solution provided in this disclosure, encrypted structure data is obtained by extracting encrypted structure data from network request data based on encrypted state data, through encrypted marker detection, encrypted parameter extraction, and structured encapsulation. Key cache location processing is then performed on the encrypted structure data, and the location session key data is obtained through key identifier extraction, security context identifier extraction, and cache query or dynamic derivation. Based on the location session key data, payload decryption processing is performed on the encrypted structure data, and plaintext payload data is obtained through key material extraction, ciphertext extraction, decryption operations, and format restoration. This enhances the efficiency of encrypted payload structured parsing and key location; improves the collaborative processing capability of key cache hit and dynamic derivation; and achieves transparent decryption and restoration of encrypted payload to plaintext payload.

[0116] In some embodiments, the process of performing session key derivation processing on the target protocol format request data to obtain session key data includes: performing request identifier parsing processing on the target protocol format request data to obtain request identifier data; performing time window calculation processing on the request identifier data to obtain time window data; and performing key derivation processing on the request identifier data and time window data to obtain session key data.

[0117] Specifically, the request identifier parsing process can be a data processing procedure that extracts or parses an identifier that can uniquely identify the current request from the target protocol format request data. This request identifier parsing process can be used to obtain a unique identifier that is strongly associated with the current request, so as to ensure that the derived session key has request-level isolation. This request identifier parsing process can locate and extract the identifiers of the protocol header fields and request body structure in the target protocol format request data based on preset identifier extraction rules to obtain request identifier data.

[0118] The request identification data can be structured identification data that can uniquely identify the current request. This request identification data can be used to associate the current request with its corresponding security context and session key in the time dimension. The request identification data can contain identification elements such as globally unique identifiers and request sequence information. The request identification data can be an identification record extracted by parsing the protocol header fields and traversing the request body structure of the target protocol format request data.

[0119] Furthermore, the request identifier parsing process may specifically include scanning the header fields of the target protocol format request data to obtain header field candidate data; parsing the request body structure of the target protocol format request data to obtain body field candidate data; and extracting the header field candidate data and the body field candidate data based on a preset identifier priority rule to obtain the request identifier data.

[0120] In addition, the time window calculation process can be a data processing procedure that calculates the time window identifier based on the current system time and the preset time window length. This time window calculation process can be used to divide the continuous time stream into discrete time windows, thereby introducing a time dimension for key derivation and realizing the periodic rotation of keys. This time window calculation process can perform discretization calculation and window identifier generation on the current system time based on the preset time window length parameter to obtain time window data.

[0121] The time window data can be structured data that identifies the specific time window to which the current request belongs. This time window data can be used to ensure that requests processed within the same time window can derive the same session key, while different keys are derived in different time windows. The time window data can contain time dimension information such as time window number and window start and end identifiers. The time window data can be a time dimension record obtained by performing discretization calculation and window mapping on the current system time.

[0122] Furthermore, the time window calculation process may specifically include acquiring the current time of the system time to obtain the current time data; performing discretization calculation based on the current time data and a preset time window length parameter to obtain window number data; and encapsulating the window number data with a window identifier to obtain the time window data.

[0123] Furthermore, the key derivation process can be a data processing procedure that dynamically generates request-level symmetric encryption keys using request identifier data and time window data as input parameters. This key derivation process can be used to achieve request-level encryption isolation and key rotation without relying on an external key management system. This key derivation process can perform identifier concatenation and dynamic key generation on request identifier data and time window data based on preset key derivation rules to obtain session key data.

[0124] Furthermore, the key derivation process may specifically include: performing identifier extraction processing on the request identifier data to obtain the original identifier data; performing window identifier extraction processing on the time window data to obtain the original window data; performing identifier concatenation processing on the original identifier data and the original window data to obtain the derived salt value data; and performing dynamic key generation processing based on the derived salt value data and the preset master key data to obtain the session key data.

[0125] For example, in heterogeneous service gateway integration, session key derivation processing can be performed on target protocol format request data that has undergone protocol format conversion. Request identifier parsing processing can be performed on the target protocol format request data, scanning the protocol header fields and request body structure, and extracting a globally unique identifier as request identifier data according to preset identifier priority rules. Then, time window calculation processing can be performed on the request identifier data to obtain the current system time and discretize it based on a preset time window length parameter to obtain time window data. Key derivation processing can be performed on the request identifier data and time window data, performing identifier concatenation and dynamic key generation to obtain session key data with request-level isolation and time window rotation characteristics.

[0126] According to the technical solution provided in this disclosure, request identifier parsing is performed on the target protocol format request data. Request identifier data is obtained through protocol header field scanning, request body structure parsing, and identifier priority extraction. Time window calculation is performed on the request identifier data. Time window data is obtained through current time acquisition, discretization calculation, and window identifier encapsulation. Key derivation processing is performed on the request identifier data and time window data. Session key data is obtained through identifier extraction, window identifier extraction, identifier concatenation, and dynamic key generation. This enhances the collaborative security of request-level key isolation and time window rotation; improves the binding accuracy between the key derivation process and the request identifier and time dimension; and provides an isolated and timely session key foundation for subsequent payload encryption and encapsulation.

[0127] All of the above-mentioned optional technical solutions can be combined in any way to form optional embodiments of this disclosure, and will not be described in detail here.

[0128] Figure 3This is a schematic diagram of another protocol-secure transmission method provided in an embodiment of this disclosure. For example... Figure 3 As shown, the secure transmission method of this protocol includes: This disclosure is integrated into a protocol conversion gateway using a chain-of-responsibility model and includes five core security modules: 1. Security Gateway Filter: Serving as the unified entry point for all requests (network request data), it sits at the very front of the chain of responsibility. It can automatically identify the protocol type (SOAP or JSON-RPC) based on features such as the content type (Content-Type) of the Hypertext Transfer Protocol (HTTP) request, SOAP Action Header, and Uniform Resource Locator (URL) path. It then extracts the request identifier (RequestId), calls a cross-protocol authenticator for authentication, and executes access control decisions based on the authentication result. Authentication-successful requests are allowed to proceed to subsequent modules, while failed requests return a 401 status code.

[0129] 2. Cross Protocol Authenticator: Adaptively identifies and verifies five authentication methods. For SOAP, it attempts the following in order of priority: WS-Security UsernameToken (PasswordText / PasswordDigest), WS-Security Binary SecurityToken (X.509 Certificate), and API Key. For JSON-RPC, it attempts the following in order of priority: Bearer JWT, HMAC-SHA256 RequestSignature, and API Key. Regardless of which authentication method succeeds, a unified protocol-independent security context object is output.

[0130] 3. Security Context: A protocol-independent unified security data model that carries the authentication result. It includes fields such as principalId, roles and permissions, authentication method, security level, symmetric keyId, and internal JWT token. This object persists throughout the entire processing chain, providing a unified source of authentication information for token conversion and encryption.

[0131] 4. Security Token Transformer: Responsible for converting authentication information in the security context into the target protocol format. When the source protocol is SOAP and the target protocol is JSON-RPC, it generates a Bearer JWT and injects HMAC security metadata; when the source protocol is JSON-RPC and the target protocol is SOAP, it generates WS-Security Header XML (UsernameToken-PasswordDigest Format). The converted token is injected into the appropriate location in the target request.

[0132] 5. Encrypted Payload Handler: Responsible for transparent encryption and decryption of the payload. During decryption, it detects the "encrypted data" element in the Simple Object Access Protocol (SAP) message body or the "encrypted" flag in remote procedure call parameters, extracts the key identifier and context identifier, locates the session key from the key cache, and performs Advanced Encryption Standard-256-Galois / counter mode decryption to restore the plaintext. During encryption, it dynamically derives the session key based on the second version of the cryptographic key derivation function, encrypts the plaintext payload using Advanced Encryption Standard-256-Galois / counter mode, and constructs the encrypted payload structure.

[0133] Client requests enter the system through the security gateway filter, sequentially passing through the cross-protocol authenticator (establishing a security context), the security token converter (preparing the target token), and the cryptographic payload processor (decrypting the payload). Then, they enter the protocol conversion core to complete the SOAP XML to JSON-RPC format conversion. The converted target request again passes through the cryptographic payload processor (encrypting the payload) and the security token converter (injecting the token) before finally being sent to the target service. The response (real-time service response data) returns the target security response data in reverse along the same path, ensuring that security processing covers the entire request-response lifecycle.

[0134] According to the technical solution provided in this disclosure, the system enters through a security gateway filter, sequentially passing through a cross-protocol authenticator (establishing a security context), a security token converter (preparing the target token), and an encrypted payload processor (decrypting the payload), before entering the protocol conversion core to complete the format conversion between SOAP XML and JSON-RPC. The converted target request then passes through the encrypted payload processor (encrypting the payload) and the security token converter (injecting the token) again, and is finally sent to the target service. The response (real-time service response data) returns the target security response data in reverse along the same path, ensuring that security processing covers the entire request-response lifecycle. This enhances the standardization of cross-protocol request authentication and the ability to generate security contexts; improves the efficiency of transparent decryption of encrypted payloads and format conversion of authentication credentials; achieves lossless adaptation and secure encapsulation of business data between heterogeneous protocols; establishes a symmetrical security closed-loop mechanism for the entire request and response chain, ensuring the chain continuity of security contexts; improves the normalization capability and compatibility of protocol layer security authentication; enhances payload security and protocol binding reliability during data transmission; improves the accuracy of format conversion and protocol adaptation capability; enhances the trustworthiness and anti-tampering capability of request transmission; and reduces integration complexity and security risks.

[0135] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0136] Figure 4 This is a schematic diagram of a protocol-secure transmission device provided in an embodiment of this disclosure. Figure 4 As shown, the secure transmission device for this protocol includes: The first processing module 401 is used to perform protocol authentication and normalization processing on network request data to obtain security environment data. The second processing module 402 is used to perform cross-protocol secure pass-through processing on network request data based on security environment data to obtain plaintext payload data and target protocol token data. The third processing module 403 is used to perform cross-protocol format conversion processing on the plaintext payload data to obtain the target protocol format request data. The fourth processing module 404 is used to securely deliver the target protocol format request data and the target protocol token data to obtain the target request data; The fifth processing module 405 is used to perform response security reverse processing on the real-time service response data based on the target request data to obtain the target security response data.

[0137] According to the technical solution provided in this disclosure, network request data is processed by protocol authentication and normalization. Secure environment data is obtained through protocol feature parsing, type identification, and adaptive authentication verification. Based on this secure environment data, cross-protocol secure pass-through processing is performed on the network request data. Plaintext payload data and target protocol token data are obtained through encryption state detection, payload transparent decryption, and security token conversion. Cross-protocol format conversion processing is performed on the plaintext payload data. Target protocol format request data is obtained through protocol feature parsing, element mapping, and structure reorganization. The target protocol format request data and target protocol token data are securely delivered. Target request data is obtained through session key derivation, payload encryption encapsulation, and secure assembly. Based on the target request data, services are then... Real-time response data undergoes security reverse processing. By decrypting the response payload, restoring the response format, and backfilling the security environment, the target secure response data is obtained. This enhances the standardization of authentication and the ability to generate security contexts for cross-protocol requests; improves the efficiency of transparent decryption of encrypted payloads and format conversion of authentication credentials; achieves lossless adaptation and secure encapsulation of business data between heterogeneous protocols; establishes a symmetrical security closed-loop mechanism for the entire request and response chain, ensuring the continuity of the security context chain; improves the normalization and compatibility of protocol-layer security authentication; enhances payload security and protocol binding reliability during data transmission; improves the accuracy of format conversion and protocol adaptation capabilities; enhances the trustworthiness and anti-tampering capabilities of request transmission; and reduces integration complexity and security risks.

[0138] In some embodiments, the second processing module 402 is specifically used to: perform encryption state detection processing on network request data to obtain encrypted state data; perform payload transparency resolution processing on network request data based on encrypted state data to obtain plaintext payload data; and perform security token conversion processing on security environment data to obtain target protocol token data.

[0139] In some embodiments, the fourth processing module 404 is specifically used to: perform session key derivation processing on the target protocol format request data to obtain session key data; perform payload encryption and encapsulation processing on the target protocol format request data based on the session key data to obtain encrypted payload data; and perform secure assembly processing on the encrypted payload data and the target protocol token data to obtain the target request data.

[0140] In some embodiments, the first processing module 401 is specifically used to perform protocol feature parsing processing on the network request data to obtain protocol feature data; perform protocol type identification processing on the protocol feature data to obtain protocol type identification result data; and perform adaptive authentication verification processing on the network request data based on the protocol type identification result data to obtain security environment data.

[0141] In some embodiments, the fifth processing module 405 is specifically used to: perform response payload decryption processing on the real-time service response data based on the target request data to obtain decrypted response data; perform response format restoration processing on the decrypted response data to obtain format restored response data; and perform security environment backfilling processing on the format restored response data to obtain target security response data.

[0142] In some embodiments, the process of performing payload transparent resolution on network request data based on encrypted state data to obtain plaintext payload data is specifically used for: extracting encrypted structure data from network request data based on encrypted state data to obtain encrypted structure data; performing key cache location processing on encrypted structure data to obtain location session key data; and performing payload decryption processing on encrypted structure data based on location session key data to obtain plaintext payload data.

[0143] In some embodiments, the process of performing session key derivation processing on the target protocol format request data to obtain session key data is specifically used for: performing request identifier parsing processing on the target protocol format request data to obtain request identifier data; performing time window calculation processing on the request identifier data to obtain time window data; and performing key derivation processing on the request identifier data and time window data to obtain session key data.

[0144] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this disclosure.

[0145] Figure 5 This is a schematic diagram of the electronic device 5 provided in an embodiment of this disclosure. Figure 5 As shown, the electronic device 5 of this embodiment includes: a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501. When the processor 501 executes the computer program 503, it implements the steps in the various method embodiments described above. Alternatively, when the processor 501 executes the computer program 503, it implements the functions of each module / unit in the various device embodiments described above.

[0146] Electronic device 5 can be a desktop computer, laptop, handheld computer, cloud server, or other electronic device. Electronic device 5 may include, but is not limited to, processor 501 and memory 502. Those skilled in the art will understand that... Figure 5 This is merely an example of electronic device 5 and does not constitute a limitation on electronic device 5. It may include more or fewer components than shown, or different components.

[0147] The processor 501 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0148] The memory 502 can be an internal storage unit of the electronic device 5, such as a hard disk or RAM of the electronic device 5. The memory 502 can also be an external storage device of the electronic device 5, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc., equipped on the electronic device 5. The memory 502 can also include both internal and external storage units of the electronic device 5. The memory 502 is used to store computer programs and other programs and data required by the electronic device.

[0149] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0150] If integrated modules / units are implemented as software functional units and sold or used as independent products, they can be stored in a readable storage medium (e.g., a computer-readable storage medium). Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program may include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. A computer-readable storage medium may include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0151] The above embodiments are only used to illustrate the technical solutions of this disclosure, and are not intended to limit it. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be included within the protection scope of this disclosure.

Claims

1. A protocol-secure transmission method, characterized in that, include: The network request data is processed by protocol authentication and normalization to obtain secure environment data; Based on the security environment data, the network request data is processed for cross-protocol secure pass-through to obtain plaintext payload data and target protocol token data. The plaintext payload data is subjected to cross-protocol format conversion processing to obtain the target protocol format request data; The target protocol format request data and the target protocol token data are securely delivered to obtain the target request data. Based on the target request data, the real-time service response data is processed using response security reverse engineering to obtain the target security response data.

2. The protocol-secure transmission method according to claim 1, characterized in that, The process of performing cross-protocol secure pass-through processing on the network request data based on the security environment data to obtain plaintext payload data and target protocol token data includes: The network request data is subjected to encryption status detection processing to obtain encrypted status data; Based on the encrypted state data, the network request data is subjected to payload transparent resolution processing to obtain the plaintext payload data; The security environment data is subjected to security token conversion processing to obtain the target protocol token data.

3. The protocol-secure transmission method according to claim 1, characterized in that, The step of securely delivering the target protocol format request data and the target protocol token data to obtain the target request data includes: The target protocol format request data is processed to obtain session key data. Based on the session key data, the target protocol format request data is subjected to payload encryption and encapsulation processing to obtain encrypted payload data; The encrypted payload data and the target protocol token data are securely assembled to obtain the target request data.

4. The protocol-secure transmission method according to claim 1, characterized in that, The process of performing protocol authentication and normalization on network request data to obtain secure environment data includes: The network request data is subjected to protocol feature parsing processing to obtain protocol feature data; The protocol feature data is processed for protocol type identification to obtain protocol type identification result data; Based on the protocol type identification result data, adaptive authentication and verification processing is performed on the network request data to obtain the security environment data.

5. The protocol-secure transmission method according to claim 1, characterized in that, The step of performing response security reverse processing on the real-time service response data based on the target request data to obtain target security response data includes: Based on the target request data, the real-time service response data is decrypted to obtain decrypted response data. The decryption response data is processed to restore the response format, resulting in format-restored response data. The formatted response data is then subjected to security environment backfilling processing to obtain the target security response data.

6. The protocol-secure transmission method according to claim 2, characterized in that, The process of performing payload transparency resolution on the network request data based on the encrypted state data to obtain the plaintext payload data includes: Based on the encrypted state data, the network request data is subjected to encrypted structure extraction processing to obtain encrypted structure data; The encrypted structure data is subjected to key caching and location processing to obtain the location session key data; The encrypted structure data is decrypted based on the location session key data to obtain the plaintext payload data.

7. The protocol secure transmission method according to claim 3, characterized in that, The step of performing session key derivation processing on the target protocol format request data to obtain session key data includes: The target protocol format request data is parsed to obtain request identifier data; The request identifier data is processed by time window calculation to obtain time window data; The request identifier data and the time window data are subjected to key derivation processing to obtain the session key data.

8. A protocol-secure transmission device, characterized in that, include: The first processing module is used to perform protocol authentication and normalization processing on network request data to obtain security environment data. The second processing module is used to perform cross-protocol secure pass-through processing on the network request data based on the security environment data to obtain plaintext payload data and target protocol token data. The third processing module is used to perform cross-protocol format conversion processing on the plaintext payload data to obtain target protocol format request data; The fourth processing module is used to securely deliver the target protocol format request data and the target protocol token data to obtain the target request data; The fifth processing module is used to perform response security reverse processing on the real-time service response data based on the target request data to obtain the target security response data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images