TWI729812B - Computer program product and apparatus for encrypting and verifying sensitive parameters - Google Patents

Abstract

The disclosure discloses a computer program product for encrypting sensitive parameters being loaded and executed by a processing unit of a client to include program code to: encrypt a sensitive parameter using a BCrypt algorithm so as to obtain an encrypted string; obtain a prompt index corresponding to the sensitive parameter; generate a verification string according to the prompt index and the sensitive parameter; and transmit a request at least including the verification string to an application server through a network, thereby enabling the application server to determine whether a source side is legal by checking the content of the verification string.

Description

Computer program products and devices that encrypt and verify sensitive parameters

The invention relates to a communication security technology, especially a computer program product and device for encrypting and verifying sensitive parameters.

In order to invade the application server and pretend to be a legitimate user to perform malicious actions, such as stealing confidential data, tampering with stored data, publishing false information, etc., hackers usually intercept requests sent from the client to the application server, and Observe the parameter changes in the request, and guess the function that the application server will perform in response to different request parameters. Therefore, there is a need for a computer program product and device for encrypting and verifying sensitive parameters, so as to avoid malicious behaviors made by hackers after successfully interpreting the meaning of the parameters.

In view of this, how to reduce or eliminate the deficiencies in the above-mentioned related fields is indeed a problem to be solved.

This manual relates to a computer program product used to encrypt sensitive parameters, including code that can be loaded and executed by the client's processing unit: use the BCrypt algorithm to encrypt sensitive parameters to generate encrypted strings; obtain prompts corresponding to the sensitive parameters Index; generate a verification string based on the prompt index and sensitive parameters; and send a request containing the verification string to the application server via the network, so that the application server can determine whether the source is legal by checking the content of the verification string User.

This specification also relates to a device for encrypting sensitive parameters, including a communication interface and a processing unit. The processing unit uses the BCrypt algorithm to encrypt sensitive parameters to generate an encrypted string; obtains the prompt index corresponding to the sensitive parameter; generates a verification string based on the prompt index and the sensitive parameter; and transmits a request containing the verification string via the communication interface via the network For the application server, the application server can determine whether the source is a legitimate user by checking the content of the verification string.

This manual also relates to a computer program product used to verify sensitive parameters, including code that can be loaded and executed by the processing unit of the application server: receiving a request containing a verification string from the client via the network; from the verification word String to obtain the encrypted string and prompt index; obtain sensitive parameters according to the prompt index; use the verification algorithm corresponding to the BCrpyt algorithm to determine whether the encrypted string matches the sensitive parameter; and when the encrypted string does not match the sensitive parameter, pass The network responds to the client with a parameter error message.

This specification also relates to a device for encrypting sensitive parameters, including a communication interface and a processing unit. The processing unit receives the request containing the verification string from the client via the communication interface via the network; obtains the encrypted string and prompt index from the verification string; obtains sensitive parameters according to the prompt index; uses the verification algorithm corresponding to the BCrpyt algorithm to determine Whether the encrypted string matches the sensitive parameter; and when the encrypted string does not match the sensitive parameter, reply the parameter error message to the client via the communication interface via the network.

Other advantages of the present invention will be explained in more detail with the following description and drawings.

100: Internet

110: Application server

151: Desktop Computer

153: Tablet

155: Mobile

210: Processing Unit

220: display unit

230: input device

240: storage device

250: memory

260: Communication interface

S310~S360: method steps

S410~S490: method steps

FIG. 1 is a diagram of the network system architecture according to an embodiment of the present invention.

FIG. 2 is a system architecture diagram of a computing device according to an embodiment of the present invention.

Fig. 3 is a flowchart of a method for requesting execution of a service according to an embodiment of the present invention.

Fig. 4 is a flowchart of a method for executing a service requested by a client according to an embodiment of the present invention.

The following descriptions are preferred implementations for completing the invention, and their purpose is to describe the basic spirit of the invention, but not to limit the invention. The actual content of the invention must refer to the scope of the claims that follow.

It must be understood that the words "including" and "including" used in this specification are used to indicate the existence of specific technical features, values, method steps, operations, elements, and/or components, but they do not exclude the possibility of adding More technical features, values, method steps, job processing, components, components, or any combination of the above.

Words such as "first", "second", and "third" in the claims are used to modify the elements in the claims, not to indicate that there is a priority, prerequisite relationship, or an element Prior to another element, or the chronological order of execution of method steps, is only used to distinguish elements with the same name.

It must be understood that when an element is described as being “connected” or “coupled” to another element, it can be directly connected or coupled to other elements, and intervening elements may appear. Conversely, when an element is described as being "directly connected" or "directly coupled" to another element, there are no intervening elements. Other terms used to describe the relationship between elements can also be interpreted in a similar manner, such as "between" versus "directly between", or "adjacent" versus "directly adjacent" and so on.

The embodiment of the present invention provides a network system architecture including servers and multiple clients. FIG. 1 is a diagram of the network system architecture according to an embodiment of the present invention. The application server 110, the desktop computer 151, the tablet computer 153, and the mobile phone 155 can communicate with each other through the network 100. The network 100 can be the Internet or a wired local area network (Wired Local Area Network, LAN), wireless local area network, or any combination of the above. The desktop computer 151, the tablet computer 153, and the mobile phone 155 can be called clients, which deploy applications to the application server 110 through the network 100, or execute services running on the application server 110 through the network 100 . The application is usually developed by a service provider and deployed to the application server 110. It contains a variety of business logics, including but not limited to digital bank management, online banking, and mobile customers. Services, enterprise internal process management, big data storage, big data data integration, big data data retrieval and other fields.

FIG. 2 is a system architecture diagram of a computing device according to an embodiment of the present invention. This system architecture can be implemented in any one of the application server 110, the desktop computer 151, the tablet computer 153, and the mobile phone 155, and at least includes the processing unit 210. The processing unit 210 can be implemented in a variety of ways, such as a dedicated hardware circuit or a general-purpose hardware (for example, a single processor, a multi-processor with parallel processing capabilities, a graphics processor, or other processors with computing capabilities). When running code or software, provide the functions described later. The system architecture also includes a memory 250 and a storage unit 240. The memory 250 stores data needed during the execution of the code, such as variables, data tables, etc., and the storage unit 240 stores various electronic files, such as , Web pages, documents, audio files, video files, etc. The system architecture further includes a communication interface 260, so that the processing unit 210 can communicate with other electronic devices. The communication interface 260 may be a wireless telecommunications module (Wireless Telecommunications Module), a local area network (LAN) communication module, or a wireless local area network communication module (WLAN). The Wireless Telecommunications Module can include a modem that supports any combination of 2G, 3G, 4G or above technology generations. The input device 230 may include a keyboard, a mouse, a touch panel, and so on. The user can press the hard keys on the keyboard to input characters, operate the mouse to control the mouse, or make gestures on the touch panel to control the running application. Gestures may include single-click, double-click, single-finger drag, multi-finger drag, etc., but are not limited to this. The display unit 220 may include a display panel (for example, a thin-film liquid crystal display panel, an organic light-emitting diode panel, or other panels with display capabilities) for displaying input characters, numbers, symbols, moving traces of dragging the mouse, and drawing Patterns or screens provided by applications are provided for users to watch.

The application server 110 provides an application execution environment, providing various services for each application, such as request dispatch and load balancing, digital authentication center, application programming interface (API) authorization management, and user Authorization/flow/Internet Protocol (IP) control, organizational hierarchy management, information security connection (SSL/TLS) management, digital signature verification, smart data encryption, single sign-on active directory (Single Sign-On) Active Directory, SSO AD) integration, cross-site command (Cross-Site Scripting, XSS) anti-hacking attack, API hot deployment, session fail-over (Session Fail-over), duplicate transaction prevention mechanism, VIP API priority, heterogeneous deployment/ Multi-version operation, API debugging, API track record, server monitoring/alarm, report by API/user, (Java)DC host binding management, .NET site binding management, registered host management, API service registration, API model Organize deployment, release, API assembly and design, etc. On the other hand, these functions can also be used by a variety of different applications. Therefore, the environment in which the applications are executed as described above is also called the Shared Service Platform.

In order to prevent hackers from guessing the meaning of the sensitive parameters in the request, the desktop computer 151, tablet computer 153 or mobile phone 155 can use the BCrypt algorithm to encrypt one or more sensitive parameters to generate an encrypted string, and obtain an encrypted string corresponding to one Or a prompt index of multiple sensitive parameters, and a verification string is generated based on the prompt index and the encrypted string. Then, the desktop computer 151, the tablet computer 153 or the mobile phone 155 sends a request containing the verification string to the application server 110 via the network 100, so that the application server 110 can determine the source by checking the content of the verification string Whether it is a legitimate user. Then, the application server 110 can obtain an encrypted string and a prompt index from the verification string in the request, obtain sensitive parameters according to the prompt index, and use a verification algorithm corresponding to the BCrypt algorithm to determine whether the encrypted string matches the obtained one. Sensitive parameters. If they match, it means that the verification is passed. The application server 110 executes the requested function according to the parameters and replies the execution result to the desktop computer 151, the tablet computer 153, or the mobile phone 155 via the network 100.

If an illegal device intercepts a request from a desktop computer 151, a tablet computer 153 or a mobile phone 155 to the application server 110, a verification string is faked based on the content of the request, and a request containing the verification string is sent through the network 100 To the application server 110. Since the sensitive parameters are encrypted using the BCrypt algorithm, the authentication string faked by the illegal device is returned The encrypted string and sensitive parameters returned are usually not correct and cannot be verified. When the application server 110 finds that the verification fails, it responds to the illegal device via the network 100 with a parameter error message.

3 is a flowchart of a method for requesting execution of services according to an embodiment of the present invention. The processing unit 210 (hereinafter referred to as the processing unit 210 for brevity) of the desktop computer 151, tablet computer 153 or mobile phone 155 loads and executes specific Implemented when a software module is used to request the application server 110 to complete a specific function. The detailed description is as follows:

欄位“ITEM_NO”列出敏感參數，而欄位“SORT_BY”列出用來進行排序的數值。於一些實施例中，提示索引是欄位“SORT_BY”的值。於另一些實施例中，提示索引是由小到大排序結果的紀錄編號，例如，參數“MEMBER_REG_FLAG”的提示索引是“0”，參數“API_TYPE”的提示索引是“1”，依此類推。桌上型電腦151、平板電腦153或手機155的儲存裝置240(以下簡稱儲存裝置240以求簡 明)可儲存資料庫，包含如上所述的範例資料表“TSMP_DP_ITEMS”。處理單元210可發出結構化查詢語言(Structured Query Language，SQL)命令給資料庫管理系統，用於取得範例資料表“TSMP_DP_ITEMS”中的全部或者部分內容。 Step S310: Obtain a parameter corresponding to the prompt index, which is also called a sensitive parameter. For example, Table 1 shows the sample data table "TSMP_DP_ITEMS":

The field "ITEM_NO" lists sensitive parameters, and the field "SORT_BY" lists the values used for sorting. In some embodiments, the prompt index is the value of the field "SORT_BY". In other embodiments, the prompt index is the record number of the result sorted from small to large. For example, the prompt index of the parameter "MEMBER_REG_FLAG" is "0", the prompt index of the parameter "API_TYPE" is "1", and so on. The storage device 240 of the desktop computer 151, the tablet computer 153, or the mobile phone 155 (hereinafter referred to as the storage device 240 for brevity) can store a database, including the example data table "TSMP_DP_ITEMS" as described above. The processing unit 210 may issue a structured query language (Structured Query Language, SQL) command to the database management system for obtaining all or part of the content in the sample data table "TSMP_DP_ITEMS".

Step S320: Use the BCrypt algorithm to encrypt the sensitive parameters to generate an encrypted string. In detail, the BCrypt algorithm first randomly generates a salt value (Salt) according to the current time, and then hashes the salt value and sensitive parameters to generate an encrypted string. Since the BCrypt algorithm will generate different salt values at different time points, encrypting the same sensitive parameter at different time points will generate different encrypted strings. Even if a hacker intercepts multiple requests from the desktop computer 151, tablet computer 153, or mobile phone 155 to the application server 110, it is still difficult to generalize the meaning, rules, and logic of these encrypted strings in the request.

Step S330: Use the Base64 algorithm to encode the encrypted string for generating the encoded string. The advantage of using the Base64 algorithm is that the encoded string will only contain any combination of uppercase English letters "A" to "Z", lowercase English letters "a" to "z" and numbers "0" to "9". It will not contain other characters, special symbols, etc. It should be noted that the strings encoded by the Base64 algorithm will make it more difficult for hackers to generalize the meaning, rules, and logic of these encrypted strings in the request.

Step S340: Combine the code string and the prompt index to generate a verification string. For example, the verification string can be organized into the following format: code string + "," + prompt index, where "," is used as a separator between the code string and the prompt index. In some embodiments, the separator may use any characters other than uppercase English letters "A" to "Z", lowercase English letters "a" to "z", and numbers "0" to "9". In other embodiments, the order of the code string and the prompt index can be reversed.

In some embodiments, step S330 can be omitted, and the verification string is organized into the following format: Encrypted string + "|" + prompt index Among them, "|" is used as the separator between the encrypted string and the prompt index. It should be noted here that because the Base64 algorithm is not used for further encoding, if you want to use other symbols to replace the delimiter "|", you need to specially select symbols that will not appear in the encrypted string.

Step S350: Add the verification string to the request. The request can use query string (Query String), format object (Form Object) or other equivalent format packaging.

Step S360: Send a request to the application server 110 via the network 100 through the corresponding communication interface 260 for requesting the application server 110 to perform a specific service. The processing unit 210 may use Hypertext Transfer Protocol (HTTP Request), Hypertext Transfer Protocol Secure (HTTPS Request) or other communication protocols to send the request to the application server 110.

It should be noted here that all parameters in the request do not necessarily need to be encrypted and encoded, and some parameters may be transmitted in clear code, and the present invention is not limited thereby.

4 is a flowchart of a method for executing a service requested by a client according to an embodiment of the present invention. The processing unit 210 of the application server 110 (hereinafter referred to as the processing unit 210 for brevity) loads and executes a specific software module Implementation, used to verify the request sent by the client, and perform corresponding operations based on the verification result. The client can be a legitimate client, such as any one of the desktop computer 151, the tablet computer 153, and the mobile phone 155, or an illegal device.

Step S410: Receive a request from the client via the network 100 via the communication interface 260 of the application server 110 (hereinafter referred to as the communication interface 260 for brevity). The request can be packaged in a query string, format object, or other equivalent format. The processing unit 210 may use a hypertext transfer protocol request, a hypertext transfer security protocol request, or other communication protocols to receive the request from the client.

Step S420: Take out the verification string from the request. The processing unit 210 can be based on The mentioned format parses out the verification string.

Step S430: Divide the verification string according to the preset separation symbol to obtain the code string and the prompt index.

Step S440: Use the Base64 algorithm to decode the encoded string to generate a decoded string (also called an encrypted string).

Step S450: Obtain sensitive parameters corresponding to the prompt index. The storage device 240 of the application server 110 (hereinafter referred to as the storage device 240 for brevity) can store a database, including the example data table "TSMP_DP_ITEMS" as described above. The processing unit 210 can issue a SQL command to the database management system for obtaining sensitive parameters corresponding to the prompt index.

Step S460: Use a verification algorithm corresponding to the BCrypt algorithm to verify the decoded string and parameters. The processing unit 210 can extract the salt value from the decoded string, and then use the salt value, the decoded string and the sensitive parameter to perform an operation to verify whether the decoded string matches the sensitive parameter.

In other embodiments, if the application server 110 and the client have agreed not to perform the encoding/decoding of the Base64 algorithm, the processing unit 210 may omit the processing of step S450, and in step S440 according to the preset separation The symbol separates the encrypted string and the prompt index, and in step S460, the BCrypt algorithm is used to directly verify the encrypted string and sensitive parameters.

Step S470: Determine whether the verification is passed. If the verification is passed, the process of step S480 is continued. If the verification fails, the process of step S490 is continued.

Step S480: Execute the service according to the parameters in the request and reply the execution result to the client. In other embodiments, the parameters based on it may not include the sensitive parameters that are hidden and associated with the verification string as described above, and the present invention is not limited thereby.

Step S490: Reply the parameter error message to the client.

All or part of the steps in the method of the present invention can be implemented by a computer program, such as a computer operating system, a specific hardware driver in the computer, or a software application program. In addition, it can also be implemented in other types of programs as shown above. Those with general knowledge in the technical field The method of the embodiment of the present invention can be written into a computer program, and will not be described for brevity. The computer program implemented according to the method of the embodiment of the present invention can be stored in a suitable computer readable data carrier, such as DVD, CD-ROM, USB disk, hard disk, and can also be placed on the Internet (for example, the Internet). Road, or other appropriate vehicle) to access the network server.

Although FIG. 2 includes the above-described elements, it is not excluded that, without violating the spirit of the invention, more other additional elements can be used to achieve better technical effects. In addition, although the steps in Figures 3 and 4 are executed in a specified order, those skilled in the art can modify the order of these steps on the premise of achieving the same effect without violating the spirit of the invention. Therefore, this The invention is not limited to using only the sequence described above. In addition, those skilled in the art can also integrate several steps into one step, or in addition to these steps, perform more steps sequentially or in parallel, and the present invention is not limited thereby.

Although the present invention is described using the above embodiments, it should be noted that these descriptions are not intended to limit the present invention. On the contrary, this invention covers modifications and similar arrangements that are obvious to those skilled in the art. Therefore, the scope of applied claims must be interpreted in the broadest way to include all obvious modifications and similar settings.

S310~S360: method steps

Claims (11)

A computer program product for encrypting sensitive parameters, including code that can be loaded and executed by a processing unit of a client: a BCrypt algorithm is used to encrypt a sensitive parameter to generate an encrypted string; and the corresponding sensitive parameter is obtained A prompt index; generate a verification string based on the prompt index and the encryption string; and send a request containing the verification string to an application server via a network, so that the application server can pass the inspection Verify the content of the string to determine whether the source is a legitimate user. A device for encrypting sensitive parameters includes: a communication interface; and a processing unit, coupled to the communication interface, for encrypting a sensitive parameter using a BCrypt algorithm to generate an encrypted string; and obtaining an encrypted string corresponding to the sensitive parameter A prompt index; generate a verification string based on the prompt index and the encryption string; and send a request containing the verification string to an application server via a network through the communication interface, so that the application server It can be judged whether the source end is a legitimate user by checking the content of the above verification string. The device for encrypting sensitive parameters according to claim 2, wherein the verification string includes the encrypted string, a separator, and the prompt index, and the separator is located between the encrypted string and the prompt index. The device for encrypting sensitive parameters according to claim 2, wherein the processing unit uses the Base64 algorithm to encode the encrypted string to generate an encoded string, and the verification string includes the encoded string, a separator, and the The prompt index, and the above-mentioned separator is located between the above-mentioned code string and the above-mentioned prompt index. The device for encrypting sensitive parameters according to claim 2, wherein the BCrypt algorithm first randomly generates a salt value according to the current time, and then performs a hash calculation on the salt value and the sensitive parameter to generate the encrypted string. A computer program product for verifying sensitive parameters, containing code that can be loaded and executed by a processing unit of an application server: Receiving a request including a verification string from a client via a network; Obtain an encrypted string and a prompt index from the above verification string; Obtain a sensitive parameter according to the above prompt index; Use a verification algorithm corresponding to a BCrpyt algorithm to determine whether the encrypted string matches the sensitive parameter; and When the encrypted string does not match the sensitive parameter, a parameter error message is returned to the client via the network. A device for verifying sensitive parameters, including: A communication interface; and A processing unit, coupled to the communication interface, for receiving a request including a verification string from a client through a network through the communication interface; obtaining an encrypted string and a prompt index from the verification string; The prompt index obtains a sensitive parameter; uses a verification algorithm corresponding to a BCrpyt algorithm to determine whether the encrypted string matches the sensitive parameter; and when the encrypted string does not match the sensitive parameter, through the communication The interface replies a parameter error message to the client via the network. The device for verifying sensitive parameters according to claim 7, wherein when the encrypted string matches the sensitive parameters, the service is executed according to the parameters in the request and an execution result is returned to the above via the communication interface via the network. Client. The device for verifying sensitive parameters according to claim 7, wherein the processing unit divides the verification string to obtain an encoded string and a prompt index, and uses a Base64 algorithm to decode the encoded string to obtain the encrypted string . The device for verifying sensitive parameters according to claim 7, wherein the encoded string includes the encrypted string, a separator, and the prompt index, and the separator is located between the encrypted string and the prompt index. The device for verifying sensitive parameters according to claim 7, wherein the verification algorithm extracts a salt value from the encrypted string, and uses the salt value, the encrypted string and the sensitive parameter to perform operations to verify the above Whether the encrypted string matches the above-mentioned sensitive parameters.

Images