CN113794721A - Government organization, financial institution and enterprise security direct connection method - Google Patents
Government organization, financial institution and enterprise security direct connection method Download PDFInfo
- Publication number
- CN113794721A CN113794721A CN202111078386.4A CN202111078386A CN113794721A CN 113794721 A CN113794721 A CN 113794721A CN 202111078386 A CN202111078386 A CN 202111078386A CN 113794721 A CN113794721 A CN 113794721A
- Authority
- CN
- China
- Prior art keywords
- enterprise
- data
- key
- open platform
- request
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 45
- 230000008520 organization Effects 0.000 title description 2
- 238000012797 qualification Methods 0.000 claims abstract description 15
- 238000011156 evaluation Methods 0.000 claims abstract description 4
- 238000012795 verification Methods 0.000 claims description 45
- 238000012552 review Methods 0.000 claims description 19
- 230000008569 process Effects 0.000 claims description 17
- 238000013461 design Methods 0.000 claims description 12
- 238000013500 data storage Methods 0.000 claims description 3
- 230000006870 function Effects 0.000 claims description 3
- 238000012545 processing Methods 0.000 claims description 3
- 210000000056 organ Anatomy 0.000 description 3
- 238000005336 cracking Methods 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 210000005036 nerve Anatomy 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/103—Workflow collaboration or project management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
- G06Q50/10—Services
- G06Q50/26—Government or public services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
Abstract
The invention discloses a safe direct connection method for government offices, financial institutions and enterprises, which comprises the following steps: the method comprises the following steps: the enterprise administrator performs platform registration and initialization: an enterprise administrator firstly needs to contact a data open platform, communicate enterprise requirements and provide enterprise qualification certification, because the set field belongs to a government or a bank, the access of the field to an enterprise has qualification requirements, and when qualification examination passes and an internal evaluation flow passes, a link is invited to the enterprise administrator in a short message mode; and the enterprise administrator opens the invitation link, registers and submits the related data according to the steps, and submits the data to the data open platform for pre-examination after the completion. The method for directly connecting the government, the financial institution and the enterprise is simple to operate, does not need extra U shield hardware cost, rents VPN special lines or three-party platform software use cost, is higher in safety than the traditional scheme, and is suitable for wide popularization and use.
Description
Technical Field
The invention belongs to the technical field of Internet of things, and particularly relates to a safe direct connection method for government offices, financial institutions and enterprises.
Background
The internet such as google and microsoft is very popular, and starts to compete to launch its own open platform strategy to pursue the new trend of internet development. These behaviors undoubtedly trigger the sensitive nerves of domestic internet companies, and their application platforms begin to be built in disputes. In 2010, the API of some interconnection fields such as Xinlang microblog, Baidu, Shengda, yingwan and Tengchong is tried to be opened successively, and the image of an open platform is strived to be formed for the netizens. Media review, 2011, the domestic open platform will enter the "outbreak period". But the open data platform of the government institutions and the financial institutions keeps walking because of the characteristics of the attributes of the government institutions and the financial institutions. Since the requirement for data security is much higher than that of an internet company, once an open data platform is released, higher security standards must be used to interconnect with enterprises, and thus a direct connection port between government offices and financial institutions and enterprise security is required to be established.
The existing method for directly connecting the safety of government organs, financial institutions and enterprises is complex to operate, has extra U shield hardware cost, renting VPN special lines or using cost of three-party platform software, is lower in safety compared with the traditional scheme, and is not suitable for wide popularization and use.
Disclosure of Invention
The invention aims to provide a safe direct connection method for government offices, financial institutions and enterprises, and aims to solve the problems that the existing safe direct connection method for the government offices, the financial institutions and the enterprises, which is provided in the background art, is complex to operate, has extra U shield hardware cost, leased VPN special lines or three-party platform software use cost, is lower in safety compared with the traditional scheme, and is not suitable for wide popularization and use.
In order to achieve the purpose, the invention provides the following technical scheme: a safe direct connection method for government organs, financial institutions and enterprises comprises the following steps:
the method comprises the following steps: the enterprise administrator performs platform registration and initialization: an enterprise administrator firstly needs to contact a data open platform, communicate enterprise requirements and provide enterprise qualification certification, because the set field belongs to a government or a bank, the access of the field to an enterprise has qualification requirements, and when qualification examination passes and an internal evaluation flow passes, a link is invited to the enterprise administrator in a short message mode; the enterprise administrator opens the invitation link, registers and submits related data according to the steps, submits the data to the data open platform for pre-examination after the completion, and the data open platform administrator firstly performs pre-examination according to the submitted data, checks whether the data is correct and whether the authority of applying the data is in accordance, notifies and informs the site address under the initial examination line in a short message mode after the examination is passed; after receiving the message passing the short message pre-review, the enterprise administrator needs to go to a pre-review place provided by the data open platform to complete the off-line review, and the purpose of the off-line review is to check the original document of the qualification review and the pre-review electronic version for comparison;
step two: the platform safely sets and acquires a secret key: after the platform is successfully registered, an administrator can log in a data platform enterprise end, the platform provides two dual-factor modes, the mobile phone number + the password + the mobile phone short message verification code are in a default mode, the other mode is the mobile phone number + the password + the virtual MFA, and the first login mode is the mobile phone number + the password + the mobile phone short message verification code mode; after the enterprise administrator successfully logs in, the access ID of the enterprise can be obtained on the main page; the open interface of the data open platform is encrypted (including asymmetric and symmetric encryption), the signature algorithm is variable, and an administrator can set the encryption algorithm and the signature algorithm which meet the enterprise requirements, wherein the symmetric algorithm is SM4, and the signature algorithm is SM 3; an administrator can request to generate and obtain a public key and a signature algorithm key of the asymmetric encryption algorithm at the enterprise end of the data open platform, and the data open platform stores the generated private key and the signature algorithm key of the asymmetric encryption algorithm into a database; the actual ip is a server public network ip actually produced by an enterprise;
step three: initialization of a system key: an enterprise administrator logs in a business system of an enterprise, the enterprise administrator opens a data storage open platform key page which is only authorized by the administrator, sets a signature key algorithm and symmetric and asymmetric algorithm encryption algorithms according to the page requirements, and inputs a signature key and an asymmetric algorithm public key; an enterprise administrator clicks a symmetric encryption algorithm key to reset in a business system of an enterprise, the function is generally reset when the system operates for the first time, but the symmetric encryption algorithm key has an overdue design, so that the key needs to be manually reset again before the key expires; in order to ensure data security, the key process of the system needs double-factor verification of an administrator, so the process needs a short message verification code; randomly generating a key suitable for the specific encryption algorithm, a result selected by the asymmetric encryption algorithm and an acquired symmetric encryption algorithm key generated by the public key encryption process of the asymmetric encryption algorithm according to the result selected by the symmetric encryption algorithm; the api adopts an https protocol to send data, needs to be spliced together according to a certain rule and then calculates a signature by using a signature key and a selected signature algorithm; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned;
step four: when a salesman of an enterprise needs to log in before using a business system of the enterprise, the salesman uses a user name and a password which are allocated to the salesman to log in the business system, if the login verification is successful, the business system of the enterprise needs to log in a data open platform according to the user authority, when the salesman of the enterprise needs to use data of the data open platform, the data open platform needs to log in a mode provided by an interface of an API (application program interface) or an SDK (software development kit), and the data open platform obtains a token after logging in, wherein the token is basic data required by the data open platform in an interface mode;
step five: the enterprise business system needs to judge whether the user logs in the data open platform after logging in the validity period, if not, the user needs to log in, and the logging flow logs in the data platform according to the api interface; encrypting a message of the request data open platform by using the symmetric encryption algorithm key obtained in the step three; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the IP of the request can be acquired according to the HTTP protocol, so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned; the data open platform can acquire the signature algorithm and the signature key configured by the enterprise according to the access ID, and calculate the signature according to the rule;
step six: short message sending process: clicking a page corresponding to a business system of an enterprise to obtain a mobile phone verification code, wherein the premise of entering the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, then obtains a mobile phone number of an actual user according to login data, a data open platform takes out request time from a verification http head, then comparing the current time, if the request is valid within a set threshold value, otherwise, returning an error, and the design is for data replay attack; the data open platform can acquire the asymmetric encryption algorithm type and the private key configured by the enterprise according to the access ID, then decipher the request message, check whether the access enterprise has the mobile phone number or not according to the data platform user and check the mobile phone number, and if not, report an error and return; obtaining the type of the short message, wherein the type of the short message determines how to store a short message content template to be sent and a subsequent verification code; if the value is not the value of the set interval, an error is reported and returned;
step seven: the api interface logs in the data platform: inputting a user password and a short message verification code on a page corresponding to a business system of an enterprise, and then clicking to log in, wherein the effective premise of the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, and then the mobile phone number of the actual user is obtained according to login data; the obtained login message of the asymmetric encryption algorithm type and the asymmetric public key encryption request data open platform is spliced together with http header and inside fields (such as access ID, http body size, request time, request random number, url of request and other key fields) according to a certain rule, and then a signature is calculated by using a signature key, a selected signature algorithm and the signature key; and the data open platform takes out the request time from the verification http header, compares the request time with the current time, if the request time is within a set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack.
Further, the data platform in the fourth step provides a login interface, and is designed into a double-factor authentication mode; this mode provides two modes: firstly, a mobile phone number, a password and a mobile phone short message verification code are needed; secondly, a mobile phone number, a password and a virtual MFA are needed.
Further, checking the token in the third step, and judging whether the user logs in, wherein the method firstly needs to judge the format of the token and then judges whether the token is overdue, so as to judge whether the user logs in normally; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the requested IP can be acquired according to an HTTP protocol (actually acquired by a TCP/IP protocol), so that whether the requested IP is in the white list or not can be judged, and if the requested IP is not in the white list, an error is returned; because the user has login, the mobile phone number of the login user can be obtained, and the mobile phone of the operator and the short message verification code are verified to be correct (if the two-factor mode is not the short message mode, the comparison is the virtual MFA verification code); because the user has login, whether the user is an administrator or not can be obtained, the operation can be carried out only by the administrator because the reset symmetric encryption algorithm belongs to the core operation, and an error is returned if the comparison fails; the data open platform can acquire the asymmetric encryption algorithm and the private key configured by the enterprise according to the access ID, then decrypt a symmetric encryption algorithm key by using the specified asymmetric encryption algorithm private key, store the key after decryption is completed, and finally return the result to the business system of the enterprise.
Furthermore, the data open platform in the fifth step can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm; obtaining the operation service type of the operator, judging whether the operator has the authority for the operation according to the configuration of the platform user authority, if not, reporting an error, otherwise, requesting service data according to the message requirement, thereby carrying out actual service processing; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, then encrypt the returned message by using the private key of the specified symmetric encryption algorithm, then return the message to the business system of the enterprise, and display the message to the enterprise operator according to the business requirement after decrypting the message.
Further, it is determined in the seventh step whether the size of the data packet exceeds a threshold, because the length of the encrypted packet with the largest request can be calculated, in order to prevent the problem that the computing resources of the data open platform are insufficient due to the illegal attack of the client, compared with the present process, asymmetric encryption is provided, and higher requirements are provided for both cpu and the memory, the data open platform can obtain a white list configured by the enterprise according to the access ID, and the IP of the request can be obtained according to the HTTP protocol (actually, the TCP/IP protocol is obtained), so that it can be determined whether the IP of the request is in the white list, and if not, an error is returned; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm.
Compared with the prior art, the invention has the beneficial effects that:
(1) firstly, judging the format of the token, and then judging whether the token is overdue, thereby judging whether the user normally logs in; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the IP of the request can be acquired according to the HTTP protocol, so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned, so that the method for directly connecting the government institution and the financial institution and the enterprise safely is safer, the confidentiality is high, the fault tolerance rate is reduced, and the working efficiency is improved.
(2) The problem that the computing resources of the data open platform are insufficient due to the fact that a client side is illegally attacked is solved, asymmetric encryption is carried out in the process, high requirements are placed on a cpu and a memory, other people are prevented from cracking the program, and data information in government offices and financial institutions is prevented from being embezzled.
(3) The method for directly connecting the government, the financial institution and the enterprise is simple to operate, does not need extra U shield hardware cost, rents VPN special lines or three-party platform software use cost, is higher in safety than the traditional scheme, and is suitable for wide popularization and use.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
A safe direct connection method for government organs, financial institutions and enterprises comprises the following steps:
the method comprises the following steps: the enterprise administrator performs platform registration and initialization: an enterprise administrator firstly needs to contact a data open platform, communicate enterprise requirements and provide enterprise qualification certification, because the set field belongs to a government or a bank, the access of the field to an enterprise has qualification requirements, and when qualification examination passes and an internal evaluation flow passes, a link is invited to the enterprise administrator in a short message mode; the enterprise administrator opens the invitation link, registers and submits related data according to the steps, submits the data to the data open platform for pre-examination after the completion, and the data open platform administrator firstly performs pre-examination according to the submitted data, checks whether the data is correct and whether the authority of applying the data is in accordance, notifies and informs the site address under the initial examination line in a short message mode after the examination is passed; after receiving the message passing the short message pre-review, the enterprise administrator needs to go to a pre-review place provided by the data open platform to complete the off-line review, and the purpose of the off-line review is to check the original document of the qualification review and the pre-review electronic version for comparison;
step two: the platform safely sets and acquires a secret key: after the platform is successfully registered, an administrator can log in a data platform enterprise end, the platform provides two dual-factor modes, the mobile phone number + the password + the mobile phone short message verification code are in a default mode, the other mode is the mobile phone number + the password + the virtual MFA, and the first login mode is the mobile phone number + the password + the mobile phone short message verification code mode; after the enterprise administrator successfully logs in, the access ID of the enterprise can be obtained on the main page; the open interface of the data open platform is encrypted (including asymmetric and symmetric encryption), the signature algorithm is variable, and an administrator can set the encryption algorithm and the signature algorithm which meet the enterprise requirements, wherein the symmetric algorithm is SM4, and the signature algorithm is SM 3; an administrator can request to generate and obtain a public key and a signature algorithm key of the asymmetric encryption algorithm at the enterprise end of the data open platform, and the data open platform stores the generated private key and the signature algorithm key of the asymmetric encryption algorithm into a database; the actual ip is a server public network ip actually produced by an enterprise;
step three: initialization of a system key: an enterprise administrator logs in a business system of an enterprise, the enterprise administrator opens a data storage open platform key page which is only authorized by the administrator, sets a signature key algorithm and symmetric and asymmetric algorithm encryption algorithms according to the page requirements, and inputs a signature key and an asymmetric algorithm public key; an enterprise administrator clicks a symmetric encryption algorithm key to reset in a business system of an enterprise, the function is generally reset when the system operates for the first time, but the symmetric encryption algorithm key has an overdue design, so that the key needs to be manually reset again before the key expires; in order to ensure data security, the key process of the system needs double-factor verification of an administrator, so the process needs a short message verification code; randomly generating a key suitable for the specific encryption algorithm, a result selected by the asymmetric encryption algorithm and an acquired symmetric encryption algorithm key generated by the public key encryption process of the asymmetric encryption algorithm according to the result selected by the symmetric encryption algorithm; the api adopts an https protocol to send data, needs to be spliced together according to a certain rule and then calculates a signature by using a signature key and a selected signature algorithm; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned;
step four: when a salesman of an enterprise needs to log in before using a business system of the enterprise, the salesman uses a user name and a password which are allocated to the salesman to log in the business system, if the login verification is successful, the business system of the enterprise needs to log in a data open platform according to the user authority, when the salesman of the enterprise needs to use data of the data open platform, the data open platform needs to log in a mode provided by an interface of an API (application program interface) or an SDK (software development kit), and the data open platform obtains a token after logging in, wherein the token is basic data required by the data open platform in an interface mode;
step five: the enterprise business system needs to judge whether the user logs in the data open platform after logging in the validity period, if not, the user needs to log in, and the logging flow logs in the data platform according to the api interface; encrypting a message of the request data open platform by using the symmetric encryption algorithm key obtained in the step three; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the IP of the request can be acquired according to the HTTP protocol, so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned; the data open platform can acquire the signature algorithm and the signature key configured by the enterprise according to the access ID, and calculate the signature according to the rule;
step six: short message sending process: clicking a page corresponding to a business system of an enterprise to obtain a mobile phone verification code, wherein the premise of entering the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, then obtains a mobile phone number of an actual user according to login data, a data open platform takes out request time from a verification http head, then comparing the current time, if the request is valid within a set threshold value, otherwise, returning an error, and the design is for data replay attack; the data open platform can acquire the asymmetric encryption algorithm type and the private key configured by the enterprise according to the access ID, then decipher the request message, check whether the access enterprise has the mobile phone number or not according to the data platform user and check the mobile phone number, and if not, report an error and return; obtaining the type of the short message, wherein the type of the short message determines how to store a short message content template to be sent and a subsequent verification code; if the value is not the value of the set interval, an error is reported and returned;
step seven: the api interface logs in the data platform: inputting a user password and a short message verification code on a page corresponding to a business system of an enterprise, and then clicking to log in, wherein the effective premise of the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, and then the mobile phone number of the actual user is obtained according to login data; the obtained login message of the asymmetric encryption algorithm type and the asymmetric public key encryption request data open platform is spliced together with http header and inside fields (such as access ID, http body size, request time, request random number, url of request and other key fields) according to a certain rule, and then a signature is calculated by using a signature key, a selected signature algorithm and the signature key; and the data open platform takes out the request time from the verification http header, compares the request time with the current time, if the request time is within a set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack.
Wherein, the data platform in the fourth step provides a login interface and is designed into a double-factor authentication mode; this mode provides two modes: firstly, a mobile phone number, a password and a mobile phone short message verification code are needed; secondly, a mobile phone number, a password and a virtual MFA are needed.
Checking the token in the third step, judging whether the user logs in, firstly judging the format of the token, and then judging whether the token is overdue, thereby judging whether the user logs in normally; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the requested IP can be acquired according to an HTTP protocol (actually acquired by a TCP/IP protocol), so that whether the requested IP is in the white list or not can be judged, and if the requested IP is not in the white list, an error is returned; because the user has login, the mobile phone number of the login user can be obtained, and the mobile phone of the operator and the short message verification code are verified to be correct (if the two-factor mode is not the short message mode, the comparison is the virtual MFA verification code); because the user has login, whether the user is an administrator or not can be obtained, the operation can be carried out only by the administrator because the reset symmetric encryption algorithm belongs to the core operation, and an error is returned if the comparison fails; the data open platform can acquire the asymmetric encryption algorithm and the private key configured by the enterprise according to the access ID, then decrypt a symmetric encryption algorithm key by using the specified asymmetric encryption algorithm private key, store the key after decryption is completed, and finally return the result to the business system of the enterprise.
The data open platform in the fifth step can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm; obtaining the operation service type of the operator, judging whether the operator has the authority for the operation according to the configuration of the platform user authority, if not, reporting an error, otherwise, requesting service data according to the message requirement, thereby carrying out actual service processing; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, then encrypt the returned message by using the private key of the specified symmetric encryption algorithm, then return the message to the business system of the enterprise, and display the message to the enterprise operator according to the business requirement after decrypting the message.
Judging whether the size of the data message exceeds a threshold value or not in the seventh step, wherein the length of the encrypted message with the largest request can be calculated, in order to prevent the problem that the computing resources of the data open platform are insufficient due to the fact that the client side illegally attacks, compared with the process, the asymmetric encryption exists, the requirements on both cpu and the memory are high, the data open platform can obtain a white list configured by the enterprise according to the access ID, the IP of the request can be obtained according to the HTTP protocol (actually, the IP is obtained according to the TCP/IP protocol), and therefore whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm.
When the invention works: firstly, judging the format of the token, and then judging whether the token is overdue, thereby judging whether the user normally logs in; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the IP of the request can be acquired according to the HTTP protocol, so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned, so that the method for directly connecting the government institution and the financial institution and the enterprise safely is safer, the confidentiality is high, the fault tolerance rate is reduced, and the working efficiency is improved. The problem that the computing resources of the data open platform are insufficient due to the fact that a client side is illegally attacked is solved, asymmetric encryption is carried out in the process, high requirements are placed on a cpu and a memory, other people are prevented from cracking the program, and data information in government offices and financial institutions is prevented from being embezzled. The method for directly connecting the government, the financial institution and the enterprise is simple to operate, does not need extra U shield hardware cost, rents VPN special lines or three-party platform software use cost, is higher in safety than the traditional scheme, and is suitable for wide popularization and use.
Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that changes, modifications, substitutions and alterations can be made in these embodiments without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.
Claims (5)
1. A safe direct connection method for government agencies, financial institutions and enterprises is characterized by comprising the following steps:
the method comprises the following steps: the enterprise administrator performs platform registration and initialization: an enterprise administrator firstly needs to contact a data open platform, communicate enterprise requirements and provide enterprise qualification certification, because the set field belongs to a government or a bank, the access of the field to an enterprise has qualification requirements, and when qualification examination passes and an internal evaluation flow passes, a link is invited to the enterprise administrator in a short message mode; the enterprise administrator opens the invitation link, registers and submits related data according to the steps, submits the data to the data open platform for pre-examination after the completion, and the data open platform administrator firstly performs pre-examination according to the submitted data, checks whether the data is correct and whether the authority of applying the data is in accordance, notifies and informs the site address under the initial examination line in a short message mode after the examination is passed; after receiving the message passing the short message pre-review, the enterprise administrator needs to go to a pre-review place provided by the data open platform to complete the off-line review, and the purpose of the off-line review is to check the original document of the qualification review and the pre-review electronic version for comparison;
step two: the platform safely sets and acquires a secret key: after the platform is successfully registered, an administrator can log in a data platform enterprise end, the platform provides two dual-factor modes, the mobile phone number + the password + the mobile phone short message verification code are in a default mode, the other mode is the mobile phone number + the password + the virtual MFA, and the first login mode is the mobile phone number + the password + the mobile phone short message verification code mode; after the enterprise administrator successfully logs in, the access ID of the enterprise can be obtained on the main page; the open interface of the data open platform is encrypted (including asymmetric and symmetric encryption), the signature algorithm is variable, and an administrator can set the encryption algorithm and the signature algorithm which meet the enterprise requirements, wherein the symmetric algorithm is SM4, and the signature algorithm is SM 3; an administrator can request to generate and obtain a public key and a signature algorithm key of the asymmetric encryption algorithm at the enterprise end of the data open platform, and the data open platform stores the generated private key and the signature algorithm key of the asymmetric encryption algorithm into a database; the actual ip is a server public network ip actually produced by an enterprise;
step three: initialization of a system key: an enterprise administrator logs in a business system of an enterprise, the enterprise administrator opens a data storage open platform key page which is only authorized by the administrator, sets a signature key algorithm and symmetric and asymmetric algorithm encryption algorithms according to the page requirements, and inputs a signature key and an asymmetric algorithm public key; an enterprise administrator clicks a symmetric encryption algorithm key to reset in a business system of an enterprise, the function is generally reset when the system operates for the first time, but the symmetric encryption algorithm key has an overdue design, so that the key needs to be manually reset again before the key expires; in order to ensure data security, the key process of the system needs double-factor verification of an administrator, so the process needs a short message verification code; randomly generating a key suitable for the specific encryption algorithm, a result selected by the asymmetric encryption algorithm and an acquired symmetric encryption algorithm key generated by the public key encryption process of the asymmetric encryption algorithm according to the result selected by the symmetric encryption algorithm; the api adopts an https protocol to send data, needs to be spliced together according to a certain rule and then calculates a signature by using a signature key and a selected signature algorithm; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned;
step four: when a salesman of an enterprise needs to log in before using a business system of the enterprise, the salesman uses a user name and a password which are allocated to the salesman to log in the business system, if the login verification is successful, the business system of the enterprise needs to log in a data open platform according to the user authority, when the salesman of the enterprise needs to use data of the data open platform, the data open platform needs to log in a mode provided by an interface of an API (application program interface) or an SDK (software development kit), and the data open platform obtains a token after logging in, wherein the token is basic data required by the data open platform in an interface mode;
step five: the enterprise business system needs to judge whether the user logs in the data open platform after logging in the validity period, if not, the user needs to log in, and the logging flow logs in the data platform according to the api interface; encrypting a message of the request data open platform by using the symmetric encryption algorithm key obtained in the step three; the data open platform takes out the request time from the verification http head, then compares the request time with the current time, if the request time is within the set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the IP of the request can be acquired according to the HTTP protocol, so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned; the data open platform can acquire the signature algorithm and the signature key configured by the enterprise according to the access ID, and calculate the signature according to the rule;
step six: short message sending process: clicking a page corresponding to a business system of an enterprise to obtain a mobile phone verification code, wherein the premise of entering the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, then obtains a mobile phone number of an actual user according to login data, a data open platform takes out request time from a verification http head, then comparing the current time, if the request is valid within a set threshold value, otherwise, returning an error, and the design is for data replay attack; the data open platform can acquire the asymmetric encryption algorithm type and the private key configured by the enterprise according to the access ID, then decipher the request message, check whether the access enterprise has the mobile phone number or not according to the data platform user and check the mobile phone number, and if not, report an error and return; obtaining the type of the short message, wherein the type of the short message determines how to store a short message content template to be sent and a subsequent verification code; if the value is not the value of the set interval, an error is reported and returned;
step seven: the api interface logs in the data platform: inputting a user password and a short message verification code on a page corresponding to a business system of an enterprise, and then clicking to log in, wherein the effective premise of the page is that a user must log in the business system of the enterprise, the business system of the enterprise judges whether the user logs in, and then the mobile phone number of the actual user is obtained according to login data; the obtained login message of the asymmetric encryption algorithm type and the asymmetric public key encryption request data open platform is spliced together with http header and inside fields (such as access ID, http body size, request time, request random number, url of request and other key fields) according to a certain rule, and then a signature is calculated by using a signature key, a selected signature algorithm and the signature key; and the data open platform takes out the request time from the verification http header, compares the request time with the current time, if the request time is within a set threshold value, the request is valid, otherwise, an error is returned, and the design is for data replay attack.
2. The method of claim 1, wherein the method comprises: the data platform in the fourth step provides a login interface and is designed into a double-factor authentication mode; this mode provides two modes: firstly, a mobile phone number, a password and a mobile phone short message verification code are needed; secondly, a mobile phone number, a password and a virtual MFA are needed.
3. The method of claim 1, wherein the method comprises: checking the token in the third step, judging whether the user logs in, firstly judging the format of the token, and then judging whether the token is overdue, thereby judging whether the user logs in normally; the data open platform can acquire the white list configured by the enterprise according to the access ID, and the requested IP can be acquired according to an HTTP protocol (actually acquired by a TCP/IP protocol), so that whether the requested IP is in the white list or not can be judged, and if the requested IP is not in the white list, an error is returned; because the user has login, the mobile phone number of the login user can be obtained, and the mobile phone of the operator and the short message verification code are verified to be correct (if the two-factor mode is not the short message mode, the comparison is the virtual MFA verification code); because the user has login, whether the user is an administrator or not can be obtained, the operation can be carried out only by the administrator because the reset symmetric encryption algorithm belongs to the core operation, and an error is returned if the comparison fails; the data open platform can acquire the asymmetric encryption algorithm and the private key configured by the enterprise according to the access ID, then decrypt a symmetric encryption algorithm key by using the specified asymmetric encryption algorithm private key, store the key after decryption is completed, and finally return the result to the business system of the enterprise.
4. The method of claim 1, wherein the method comprises: the data open platform in the fifth step can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm; obtaining the operation service type of the operator, judging whether the operator has the authority for the operation according to the configuration of the platform user authority, if not, reporting an error, otherwise, requesting service data according to the message requirement, thereby carrying out actual service processing; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, then encrypt the returned message by using the private key of the specified symmetric encryption algorithm, then return the message to the business system of the enterprise, and display the message to the enterprise operator according to the business requirement after decrypting the message.
5. The method of claim 1, wherein the method comprises: judging whether the size of the data message exceeds a threshold value or not, wherein the length of the encrypted message with the largest request can be calculated, and in order to prevent the problem that the computing resources of the data open platform are insufficient due to illegal attack of the client, compared with the process, the asymmetric encryption exists, the requirements on both a cpu and a memory are high, the data open platform can acquire a white list configured by the enterprise according to an access ID, and the IP of the request can be acquired according to an HTTP protocol (actually, a TCP/IP protocol), so that whether the IP of the request is in the white list or not can be judged, and if the IP of the request is not in the white list, an error is returned; the data open platform can acquire the symmetric encryption algorithm and the secret key configured by the enterprise according to the access ID, and then decrypt the requested message by using the specified symmetric encryption algorithm.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111078386.4A CN113794721A (en) | 2021-09-15 | 2021-09-15 | Government organization, financial institution and enterprise security direct connection method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111078386.4A CN113794721A (en) | 2021-09-15 | 2021-09-15 | Government organization, financial institution and enterprise security direct connection method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113794721A true CN113794721A (en) | 2021-12-14 |
Family
ID=79183366
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111078386.4A Pending CN113794721A (en) | 2021-09-15 | 2021-09-15 | Government organization, financial institution and enterprise security direct connection method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113794721A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115459929A (en) * | 2022-09-06 | 2022-12-09 | 中国建设银行股份有限公司 | Security verification method, apparatus, electronic device, system, medium, and product |
| CN115459929B (en) * | 2022-09-06 | 2024-05-10 | 中国建设银行股份有限公司 | Security verification method, security verification device, electronic equipment, security verification system, security verification medium and security verification product |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019192085A1 (en) * | 2018-04-02 | 2019-10-10 | 平安科技（深圳）有限公司 | Method, apparatus and device for direct-connected communication between bank and enterprise, and computer-readable storage medium |
| CN110348827A (en) * | 2019-05-24 | 2019-10-18 | 平安银行股份有限公司 | The direct-connected method of medium and small bank, minuscule-type-enterprise and relevant device based on third-party application |
| CN112235321A (en) * | 2020-12-11 | 2021-01-15 | 深圳市房多多网络科技有限公司 | Short message verification code anti-brushing method and device |
| CN112702168A (en) * | 2020-12-15 | 2021-04-23 | 平安银行股份有限公司 | Tax-enterprise direct connection method and system |
-
2021
- 2021-09-15 CN CN202111078386.4A patent/CN113794721A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2019192085A1 (en) * | 2018-04-02 | 2019-10-10 | 平安科技（深圳）有限公司 | Method, apparatus and device for direct-connected communication between bank and enterprise, and computer-readable storage medium |
| CN110348827A (en) * | 2019-05-24 | 2019-10-18 | 平安银行股份有限公司 | The direct-connected method of medium and small bank, minuscule-type-enterprise and relevant device based on third-party application |
| CN112235321A (en) * | 2020-12-11 | 2021-01-15 | 深圳市房多多网络科技有限公司 | Short message verification code anti-brushing method and device |
| CN112702168A (en) * | 2020-12-15 | 2021-04-23 | 平安银行股份有限公司 | Tax-enterprise direct connection method and system |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115459929A (en) * | 2022-09-06 | 2022-12-09 | 中国建设银行股份有限公司 | Security verification method, apparatus, electronic device, system, medium, and product |
| CN115459929B (en) * | 2022-09-06 | 2024-05-10 | 中国建设银行股份有限公司 | Security verification method, security verification device, electronic equipment, security verification system, security verification medium and security verification product |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111429254B (en) | Business data processing method and device and readable storage medium | |
| US9900163B2 (en) | Facilitating secure online transactions | |
| US8245030B2 (en) | Method for authenticating online transactions using a browser | |
| US20090307486A1 (en) | System and method for secured network access utilizing a client .net software component | |
| US20080022085A1 (en) | Server-client computer network system for carrying out cryptographic operations, and method of carrying out cryptographic operations in such a computer network system | |
| CN104935568A (en) | Interface authentication signature method facing cloud platform | |
| CN105357186B (en) | A kind of secondary authentication method based on out-of-band authentication and enhancing OTP mechanism | |
| CN106027501B (en) | A kind of system and method for being traded safety certification in a mobile device | |
| CN101951321B (en) | Device, system and method for realizing identity authentication | |
| CN110933078B (en) | H5 unregistered user session tracking method | |
| CN104767731A (en) | Identity authentication protection method of Restful mobile transaction system | |
| CN113301022B (en) | Internet of things equipment identity security authentication method based on block chain and fog calculation | |
| US20030135734A1 (en) | Secure mutual authentication system | |
| CN113595985A (en) | Internet of things security cloud platform implementation method based on state cryptographic algorithm security chip | |
| Karie et al. | Hardening saml by integrating sso and multi-factor authentication (mfa) in the cloud | |
| CN111935067A (en) | Enterprise user identity authentication system based on cloud computing technology | |
| CN110572392A (en) | Identity authentication method based on HyperLegger network | |
| CN113872989A (en) | Authentication method and device based on SSL protocol, computer equipment and storage medium | |
| CN111461714B (en) | Identity authentication and safe transaction method based on smart card in cloud computing | |
| CN110505199A (en) | Email safe login method based on the asymmetric identity of lightweight | |
| CN113794721A (en) | Government organization, financial institution and enterprise security direct connection method | |
| CN1394044A (en) | IP-user ID authentication mechanism (method) for Internet | |
| CN114495352A (en) | Electronic fund payment system and method based on payment terminal identity authentication control mechanism | |
| CN107786507A (en) | A kind of method for ensuring http data transmission securities | |
| CN114430329B (en) | Data authentication method, authentication side chain node and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20211214 |