CN117579608A - Method for desensitizing HTTP protocol file content and application product - Google Patents

Abstract

The embodiment of the application provides a method for desensitizing HTTP protocol file content and an application product, wherein the method comprises the following steps: confirming that the HTTP request belongs to target request data according to a content type field of the HHTP request; acquiring file content from the target request data; desensitizing the file content to obtain a desensitized file; obtaining a target HHTP request according to the desensitization file; and sending the target HHTP request to a server side. The embodiment of the application provides a device method for desensitizing file contents based on an HTTP (hyper text transport protocol), which aims at protecting the privacy and the safety of the file contents transmitted by the HTTP.

Description

Method for desensitizing HTTP protocol file content and application product

Technical Field

The application relates to the field of big data security protection, in particular to a method for desensitizing HTTP protocol file contents and an application product.

Background

In the internet and mobile internet age, the HTTP protocol is one of the most widely used network protocols. Through the HTTP protocol, a user may browse and transfer various files over a network, possibly containing sensitive information. However, protecting the security of such sensitive information is an important task due to the risk of network attacks and data leakage.

In the HTTP protocol, file content is transferred and parsed via MIME format. MIME format may contain various types of files such as text, pictures, audio video, etc. In order to protect the security of sensitive information during transmission, desensitization of the file contents is required.

The desensitization method provided by the related technology can realize dynamic desensitization of target data requested by a requester, but with the development of the age, the HTTP protocol is more and more widely used, and a user can browse and transmit various files on a network.

Disclosure of Invention

The embodiment of the application aims to provide a method for desensitizing HTTP protocol file contents and an application product, and the application embodiment provides a device method for desensitizing HTTP protocol file contents, which aims to protect privacy and security of HTTP protocol transmitted file contents.

In a first aspect, embodiments of the present application provide a method for desensitizing HTTP protocol file content, the method comprising: confirming that the HTTP request belongs to target request data according to a content type field of the HHTP request; acquiring file content from the target request data; desensitizing the file content to obtain a desensitized file; obtaining a target HHTP request according to the desensitization file; and sending the target HHTP request to a server side.

In some embodiments, the confirming that the HTTP request belongs to the target request data according to the content type field of the HHTP request includes: acquiring the HHTP request from a client; and acquiring a value of the content type field content-type from a message header of the HTTP request, and if the content of the value is confirmed to be multi-part/form-data, confirming that the HTTP request belongs to the target request data.

In some embodiments, the HHTP request is of multipurpose internet mail extension type MIME, wherein the retrieving file content from the target request data comprises: analyzing the content of the HTTP request by using a message analysis tool gmime tool to acquire file attribute information, wherein the file attribute information comprises: a file name, a start position and an end position of the file in the HHTP request; and acquiring the file content according to the file attribute information.

In some embodiments, the desensitizing the file content to obtain a desensitized file includes: and desensitizing the sensitive information in the file content by using a desensitizing algorithm.

In some embodiments, the sensitive information includes: at least one of a bank card number, an identification card, a driver's license, a name, a contact, and an address.

In some embodiments, the desensitization algorithm is used to delete, replace, mask, virtualize, or encrypt the sensitive information.

In some embodiments, the HHTP request is multipurpose internet mail extension type MIME, wherein the obtaining the target HHTP request from the desensitized file comprises: reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request.

In some embodiments, said reassembling said desensitized file into a format of said multipurpose internet mail extension type MIME, resulting in said target HHTP request, comprises: calculating the desensitized file size; and modifying a content length field content-length in the HTTP request message header according to the desensitization file size.

In some embodiments, said reassembling said desensitized file into a format of said multipurpose internet mail extension type MIME, resulting in said target HHTP request, further comprises: and replacing the file content with the desensitized file, wherein the file content is positioned in a message body of the HTTP request.

In a second aspect, some embodiments of the present application provide an apparatus for desensitizing HTTP protocol file content, the apparatus comprising: a target request data acquisition module configured to confirm that the HTTP request belongs to target request data according to a content type field of the HHTP request; a file content acquisition module configured to acquire file content from the target request data; the desensitization processing module is configured to desensitize the file content to obtain a desensitized file; the packaging module is configured to obtain a target HHTP request according to the desensitization file; and the sending module is configured to send the target HHTP request to a server side.

In a third aspect, some embodiments of the present application provide a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs a method according to any one of the embodiments of the first aspect.

In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor is configured to implement a method according to any one of the embodiments of the first aspect when executing the program.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a system architecture diagram for desensitizing HTTP protocol file content provided in an embodiment of the present application;

FIG. 2 is a flowchart of a method for desensitizing HTTP protocol file content according to an embodiment of the present application;

FIG. 3 is a second flowchart of a method for desensitizing HTTP protocol file content according to an embodiment of the present application;

FIG. 4 is a block diagram of an apparatus for desensitizing HTTP protocol file content according to an embodiment of the present application;

fig. 5 is a schematic diagram of electronic device composition according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only to distinguish the description, and are not to be construed as indicating or implying relative importance.

Different from the related art, the application effectively protects the privacy and safety of sensitive information through the desensitization processing of the content of the HTTP protocol file, and the security of the anti-leakage product can be improved by adopting the rapid desensitization method based on the HTTP request.

Referring to fig. 1, fig. 1 is a system architecture for desensitizing HTTP protocol file contents according to some embodiments of the present application, where the architecture diagram includes: client 110, desensitization server 120, and response server 130.

Unlike the technical solution that the related art directly sends the HTTP request of the client 110 to the response server 130 for processing, in some embodiments of the present application, the desensitization server 120 is introduced to intercept the HTTP request from the client 110, so as to determine the type of the request, and when determining that the request belongs to the target type, the desensitization processing of the corresponding sensitive information is started, and the data after the desensitization processing is repackaged into a new HTTP request (i.e. the target HTTP request), so that the security of the data is significantly improved.

It should be noted that fig. 1 is only a schematic diagram of some embodiments of the present application, and those skilled in the art may design an application schematic diagram different from fig. 1.

The method performed by the desensitizing server side 120 of fig. 1 to desensitize HTTP protocol file content is exemplarily described below in conjunction with fig. 2.

As shown in fig. 2, an embodiment of the present application provides a method for desensitizing HTTP protocol file content, including: s101, confirming that the HTTP request belongs to target request data according to a content type field of the HHTP request; s102, acquiring file content from the target request data; s103, desensitizing the file content to obtain a desensitized file; s104, obtaining a target HHTP request according to the desensitization file; and S105, the target HHTP request is sent to a server side.

The implementation of the steps is exemplarily described below.

In some embodiments of the present application, S101 illustratively includes: acquiring the HHTP request from a client; and acquiring a value of the content type field content-type from a message header of the HTTP request, and if the content of the value is confirmed to be multi-part/form-data, confirming that the HTTP request belongs to the target request data.

For example, in some embodiments of the present application, the HHTP request is of the multipurpose internet mail extension type MIME, wherein S102 illustratively comprises: analyzing the content of the HTTP request by using a message analysis tool gmime tool to acquire file attribute information, wherein the file attribute information comprises: a file name, a start position and an end position of the file in the HHTP request; and acquiring the file content according to the file attribute information.

In some embodiments of the present application, S103 illustratively includes: and desensitizing the sensitive information in the file content by using a desensitizing algorithm. For example, in some embodiments of the present application, the sensitive information includes: at least one of a bank card number, an identification card, a driver's license, a name, a contact, and an address. For example, in some embodiments of the present application, the desensitization algorithm is used to delete, replace, mask, corrupt, or encrypt the sensitive information.

In some embodiments of the present application, the HHTP request is multipurpose internet mail extension type MIME, wherein S104 illustratively comprises: reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request. For example, in some embodiments of the present application, the reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request, including: calculating the desensitized file size; and modifying a content length field content-length in the HTTP request message header according to the desensitization file size. For example, in some embodiments of the present application, the reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request, further comprising: and replacing the file content with the desensitized file, wherein the file content is positioned in a message body of the HTTP request.

A method for desensitizing HTTP protocol file content provided in some embodiments of the present application is described below by way of example in connection with fig. 3.

S201, an HTTP request is acquired from the client.

S202, extracting content type content-type field information from a header of the HHTP request.

S203, judging whether the content type content-type field information is multi part/form-data, if so, executing S204, otherwise executing S208.

It should be noted that, in some embodiments of the present application, the HTTP request entering the desensitization server side is parsed, a value of content-type is obtained from the HTTP request header, and if the content is multi part/form-data, S204 is performed.

It will be appreciated that HTTP is a network communication protocol based on a request-response model, and is mainly used for data transmission in communication between a client and a server in the Web. In fact, today's Internet is built on top of HTTP. The communication mode based on the request-response mode is simple, the client sends a request to the server, and the server processes the request and responds. The HTTP can transmit various types of data, and for the client or the response server, only a proper Content-Type is set, so that the other end can understand the data. In a request, the data sent by the client to the server may be text, or may be a picture or an audio/video, etc. HTTP multipart may be used if the client wants to send multiple types of data to the server in one request. Multipart allows a client to send multiple parts (parts) of data in one HTTP request, the type between each part of data may be different. Multipart is not a specific data type, it has many subtypes, such as: multipart/mixed, multipart/form-data, etc. A Multipart message has a plurality of different types of messages, each of which is a part, each of which declares its own message Type (Content-Type). In addition to the message type, part may also append some metadata.

The use of Multipart is common in Web applications. The place with the highest frequency of using the Multipart is probably the Web form, and when the form is submitted, the uploading of the file is realized through the Multipart. Not all forms submission use multipart, and if the form contains only text-based input components (e.g., input boxes, radio boxes, etc.), the browser organizes the data in key=value using a Content-Type transmission called application/x-www-form-url. If the form contains elements such as files or pictures that cannot be encoded into text, the browser will use multi-part/form-data to transfer data to the server.

Multipart is a common data format that is commonly used to upload files and send single requests containing multiple data types. The multi-part is used correctly, so that transmission of various data can be conveniently realized, the data transmission efficiency and the use experience of a user are improved, and the request times of a server are reduced. However, when using multipart, the client must correctly set the Content-Type request header, contain the boundary parameter, and the contents of the boundary parameter cannot be repeated with the contents in the request body. After receiving the request, the server needs to parse the contents of each part of the request body according to the boundary set by the Content-Type.

S204, acquiring file attribute information in the HTTP request by using a gmime tool.

The content of the http request is parsed by a GMime tool (or GMime tool, which is a C/c++ library for parsing and creating mail according to MIME) to obtain the file name, and the starting and ending positions of the file in the http request.

S205, determining that sensitive information needs to be desensitized.

And extracting file contents according to the file attribute information, and then performing sensitive detection on the extracted file contents to confirm that the sensitive information is the information which needs to be subjected to desensitization processing.

S206, performing desensitization processing such as deletion, replacement, shielding, encryption, blurring and the like.

That is, the sensitive content to be desensitized is desensitized to lose individual characteristics and sensitive information, for example, the desensitization method can be selected according to actual requirements, such as deletion, replacement, shielding, encryption or blurring.

S207, the HTTP message is reassembled.

S208, calculating the size of the desensitized file body after desensitization, and modifying the content-length size of the content in the message header to obtain a target HTTP request.

HTTP request body reassembly. The manner of assembly includes two types. In the first way, the content of the file after desensitization is repackaged by the http request according to the start file identified in step S201. The second approach uses the functionality provided by gmime for mime reorganization. According to the size of the reassembled http body, the content-length size in the http request header is modified, so that the outside cannot judge whether the message is modified or not, and the uniqueness of the data is ensured.

S209, sending a target HTTP request to the response server, namely finally forwarding the modified HTTP request to the server.

It will be appreciated that the method of desensitizing HTTP protocol file content of some embodiments of the present application illustratively includes: 1. acquiring http complete request content in a proxy mode; 2. it is confirmed whether the http request is content-type or mime.3. Extracting file attribute information, and detecting a leakage prevention strategy; 4. for file content containing sensitive information, the server processes the file content using a desensitization algorithm, such as desensitizing sensitive information such as names, contact addresses, etc., such as substitution, masking, encryption, etc. 5. The desensitized file is reassembled into MIME format, and the proxy module forwards the reassembled http request to the true server. 6. The proxy forwards the http response responded by the server to the client. By the application of the invention, the webpage mailbox service can perform desensitization protection on the sensitive information of the mail content sent and received by the user, and effectively prevent the leakage risk of the sensitive information in the transmission and storage processes.

It is understood that MIME (Multipurpose Internet Mail Extensions) is a versatile internet mail extension type. Is a type of way to set a file of a certain extension to be opened by an application, and when the extension file is accessed, the browser automatically opens using the designated application. The method is used for designating the file names of some client users and some media file opening modes. It is an internet standard, extending the email standard, enabling it to support: non-ASCII character text; non-text format attachments (binary, sound, image, etc.); a message body consisting of multiple parts; header information (Header information) containing non-ASCII characters.

Referring to fig. 5, fig. 5 shows an apparatus for desensitizing HTTP protocol file contents provided in the embodiment of the present application, and it should be understood that the apparatus corresponds to the method embodiment of fig. 2, and is capable of executing the steps involved in the method embodiment, and specific functions of the apparatus may be referred to the description above, and detailed descriptions are omitted herein as appropriate to avoid redundancy. The device includes at least one software functional module that can be stored in memory in the form of software or firmware or cured in the operating system of the device, the device for desensitizing HTTP protocol file content comprising: a target request data acquisition module 401, a file content acquisition module 402, a desensitization processing module 403, an encapsulation module 404, and a transmission module 405.

And the target request data acquisition module is configured to confirm that the HTTP request belongs to target request data according to the content type field of the HHTP request.

And the file content acquisition module is configured to acquire file content from the target request data.

And the desensitization processing module is configured to desensitize the file content to obtain a desensitized file.

And the encapsulation module is configured to obtain a target HHTP request according to the desensitization file.

And the sending module is configured to send the target HHTP request to a server side.

It will be clear to those skilled in the art that, for convenience and brevity of description, reference may be made to the corresponding procedure in the foregoing method for the specific working procedure of the apparatus described above, and this will not be repeated here.

Some embodiments of the present application provide a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs a method as described in any one of the embodiments of the method of desensitizing HTTP protocol file content described above.

As shown in fig. 5, some embodiments of the present application provide an electronic device 700, including a memory 710, a processor 720, and a computer program stored on the memory 710 and executable on the processor 720, wherein the processor 720 can implement the method according to any one of the embodiments of the first aspect when reading the program and executing the program through a bus 730.

Processor 720 may process the digital signals and may include various computing structures. Such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of instruction sets. In some examples, processor 720 may be a microprocessor.

Memory 710 may be used for storing instructions to be executed by processor 720 or data related to execution of the instructions. Such instructions and/or data may include code to implement some or all of the functions of one or more modules described in embodiments of the present application. The processor 720 of the disclosed embodiments may be configured to execute instructions in the memory 710 to implement the method shown in fig. 2. Memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory known to those skilled in the art.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other manners as well. The apparatus embodiments described above are merely illustrative, for example, flow diagrams and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, the functional modules in the embodiments of the present application may be integrated together to form a single part, or each module may exist alone, or two or more modules may be integrated to form a single part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely exemplary embodiments of the present application and is not intended to limit the scope of the present application, and various modifications and variations may be suggested to one skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application. It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

Claims (12)

1. A method of desensitizing HTTP protocol file content, the method comprising:

confirming that the HTTP request belongs to target request data according to a content type field of the HHTP request;

acquiring file content from the target request data;

desensitizing the file content to obtain a desensitized file;

obtaining a target HHTP request according to the desensitization file;

and sending the target HHTP request to a server side.

2. The method of claim 1, wherein the confirming that the HTTP request belongs to target request data based on a content type field of an HHTP request comprises:

acquiring the HHTP request from a client;

and acquiring a value of the content type field content-type from a message header of the HTTP request, and if the content of the value is confirmed to be multi-part/form-data, confirming that the HTTP request belongs to the target request data.

3. The method of claim 2, wherein the HHTP request belongs to multipurpose Internet mail extension type MIME, wherein,

the obtaining the file content from the target request data comprises the following steps:

analyzing the content of the HTTP request by using a message analysis tool gmime tool to acquire file attribute information, wherein the file attribute information comprises: a file name, a start position and an end position of the file in the HHTP request;

and acquiring the file content according to the file attribute information.

4. The method of claim 1, wherein said desensitizing said document contents to obtain desensitized documents comprises:

and desensitizing the sensitive information in the file content by using a desensitizing algorithm.

5. The method of claim 4, wherein the sensitive information comprises: at least one of a bank card number, an identification card, a driver's license, a name, a contact, and an address.

6. The method of claim 5, wherein the desensitization algorithm is used to delete, replace, mask, impersonate, or encrypt the sensitive information.

7. The method of claim 1, wherein the HHTP request is multipurpose Internet mail extension type MIME, wherein,

the obtaining the target HHTP request according to the desensitization file comprises the following steps:

reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request.

8. The method of claim 7, wherein the reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request, comprising:

calculating the desensitization file size;

and modifying a content length field content-length in the HTTP request message header according to the desensitization file size.

9. The method of claim 8, wherein the reassembling the desensitized file into the multipurpose internet mail extension type MIME format results in the target HHTP request, further comprising:

and replacing the file content with the desensitized file, wherein the file content is positioned in a message body of the HTTP request.

10. An apparatus for desensitizing HTTP protocol file content, comprising:

a target request data acquisition module configured to confirm that the HTTP request belongs to target request data according to a content type field of the HHTP request;

a file content acquisition module configured to acquire file content from the target request data;

the desensitization processing module is configured to desensitize the file content to obtain a desensitized file;

the packaging module is configured to obtain a target HHTP request according to the desensitization file;

and the sending module is configured to send the target HHTP request to a server side.

11. A computer readable storage medium having stored thereon a computer program, which when executed by a processor, is adapted to carry out the method of any of claims 1-9.

12. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor is operable to implement the method of any one of claims 1-9 when the program is executed.