CN105407102A - Http request data reliability verification method - Google Patents

Abstract

The invention relates to a data reliability verification technology, discloses an http request data reliability verification method, and aims to realize efficient verification of http user identity information and data integrity. According to the scheme, the http request data reliability verification method comprises the following steps: a, resolving a header of http request data by a server to find an authorization element and an expect element; b, verifying whether authorization is matched with a stored user token or not, if so, indicating that the user identity information is correct, and otherwise prompting a verification error; and c, verifying whether a transmitted expect parameter is matched with a signature of transmitted content or not, if so, indicating that data integrity verification is passed, and otherwise discarding a data packet. The http request data reliability verification method is suitable for verifying the reliability of http data.

Description

Http request data reliability verifying method

Technical field

The present invention relates to data reliability verification technique, be specifically related to a kind of http request data reliability verifying method.

Background technology

The use of cell-phone customer terminal occupies a very large proportion in present Mobile Development, what present cell-phone customer terminal used frequently also brings huge challenge to the safety issue of data, therefore how to verify that the reliability of the data received also becomes problem demanding prompt solution in the current network communications field.

Summary of the invention

Technical problem to be solved by this invention is: propose a kind of http request data reliability verifying method, realizes the efficient verification to http subscriber identity information and data integrity.

The present invention solves the problems of the technologies described above adopted technical scheme, and http request data reliability verifying method, comprises the following steps:

A. the head of server parses http request data finds out authorization element and expect element;

B. verify whether authorization mates with the user token stored, if coupling, shows that subscriber identity information is errorless, if do not mate, points out authentication error;

C. the expect parameter verifying transmission whether with the signatures match of transferring content, if coupling, then show that data integrity validation passes through, if do not mate, then abandon this packet.

Further, in step a, server, when resolving the head of http request data, if do not find authorization element, then adopts following processing mode:

Judge whether this http request comes from login interface and call, if, then generate user token at server end and return to client, authorization when client is using this token as subsequent calls, call if come from non-login interface, then judge that this http request is invalidation request, then abandon this request.

Further, in step c, whether mate with the signature of transferring content according to the client public key checking expect parameter that server end is deposited.

The invention has the beneficial effects as follows: the implementation employing overstepping one's bounds symmetric cryptography and the dynamic token of user verifies data security for http request and user information safety, avoid physical equipment expense and avoid the repeatedly transmission of user name password.

Embodiment

The present invention is intended to propose a kind of http request data reliability verifying method, realizes the efficient verification to http subscriber identity information and data integrity.The present invention utilizes MVC framework to complete before entering service logic the checking whether identity of user judges and be modified http message, finally utilizes technique to realize the service logic of Data Encryption Transmission and user rs authentication.

First brief introduction is done to http data format:

1.http encapsulation format: following data format is that mobile phone sends to the http head form of server end and the parameter of correspondence, we use such form to be different position in order to the parameter of difference in functionality be placed in request message, make service logic more clear like this.

1.1 data formats:

POSThttp://localhost:21815/api/NewLoginHTTP/1.1

Connection:Keep-Alive

Content-Length:467

Content-Type:application/json

Content-Encoding:utf-8

Accept:application/json

Expet:6e56e5ebeebad5bbf46c0a4d2bfcf852

Authorization:360539e753eff58a1cc5ad625358a27b

Host:localhost:21815

User-Agent:Apache-HttpClient/UNAVAILABLE(java1.4)

{

"newUserName":"yh7fdzzTwkt29rU9CSf+HTftTHyefKyJAZC7PjDR74bYb",

"newPassWord":"yh7fdzzTwkt29rU9CSf+HTftTHyefKyJAZC7PjDR74bYb"

}

1.2 data formats illustrate:

The signature verification of what 1.2.1Expect field passed over is body element content, for guaranteeing that data are not tampered;

1.2.2Authorization field deposits the mark (token) of user, and this mark does authentication for the password and login name substituting user;

1.2.3{ " newUserName ": " ", " newPassWord ": " " } body part, the data namely transmitted, username and password is the ciphertext using rivest, shamir, adelman encryption.

2. the generation of data format and storage:

2.1Expect field uses rivest, shamir, adelman or agreement cryptographic algorithm, by comparison ciphertext, server end and terminal, respectively to body content-encrypt, know whether that data are tampered.

2.2Authorization is user ID (token), is generated the client passing to and initiate logging request by server when logging in.Every log in after request necessarily bring this field, otherwise this request is invalid.This record is deposited in the internal memory of database or server and is associated with in corresponding user account information.

Based on above-mentioned data format, http request data reliability verifying method of the present invention comprises the following steps:

A. the head of server parses http request data finds out authorization element and expect element;

Server, when resolving the head of http request data, if do not find authorization element, then adopts following processing mode:

Judge whether this http request comes from login interface and call, if, then generate user token at server end and return to client, authorization when client is using this token as subsequent calls, call if come from non-login interface, then judge that this http request is invalidation request, then abandon this request.

B. verify whether authorization mates with the user token stored, if coupling, shows that subscriber identity information is errorless, if do not mate, points out authentication error;

C. the expect parameter verifying transmission whether with the signatures match of transferring content, if coupling, then show that data integrity validation passes through, if do not mate, then abandon this packet.

Whether the client public key checking expect parameter deposited according to server end in this step mates with the signature of transferring content.

Claims (3)

1.http request msg reliability verification method, is characterized in that, comprise the following steps:

A. the head of server parses http request data finds out authorization element and expect element;

B. verify whether authorization mates with the user token stored, if coupling, shows that subscriber identity information is errorless, if do not mate, points out authentication error;

C. the expect parameter verifying transmission whether with the signatures match of transferring content, if coupling, then show that data integrity validation passes through, if do not mate, then abandon this packet.

2. http request data reliability verifying method as claimed in claim 1, is characterized in that, in step a, server, when resolving the head of http request data, if do not find authorization element, then adopts following processing mode:

Judge whether this http request comes from login interface and call, if, then generate user token at server end and return to client, authorization when client is using this token as subsequent calls, call if come from non-login interface, then judge that this http request is invalidation request, then abandon this request.

3. whether http request data reliability verifying method as claimed in claim 1, is characterized in that, in step c, mate with the signature of transferring content according to the client public key checking expect parameter that server end is deposited.