The user control method and encryption algorithm classification of WebService, And the webservice Encryption Algorithm

The user control method and encryption algorithm classification of WebService, And the webservice Encryption Algorithm

Organization of WebService user control methods and encryption algorithm Classification

In our system, all WebSerivce is controlled by permissions. Record here for backup!

1. Example ws

@ Service @ Transactional @ WebService (endpointInterface = "com. mycompany. sms. ws. smsService ", targetNamespace =" http://www.mycompany.cn/sms ", serviceName =" ServiceInstance ") public class SmsServiceImpl implements SmsService {private SecretKey secretKey; @ Autowired private SessionManager sessionManager; // convert the hexadecimal numeric String into a byte stream [Keep 16 bits] private String hexStr = "3243456789123459"; public SmsServiceImpl () {byte [] hex = SecurityHelper. hexStrToByte (hexStr); secretKey = new SecretKeySpec (hex, "DES") ;}@ Override public String login (String account, String password) {User user User = sessionManager. login (secretKey, account, password); return user. getSessionId () ;}@ Override public void logoff (String sessionId) {sessionManager. logoff (sessionId) ;}@ Override public boolean sendMessage (String sessionId, String msgNumber, String msgContent) {sessionManager. getUser (secretKey, sessionId); do something ...; return true ;}}

Note:

1. Provide a user and password to the client during use. The user and password are related to keys in ws.
2. log on first, verify the user and password, and return sessionId.
3. If other functions are used, the sessionId must be passed in to determine whether the session has this ID and whether the secretKey is equal. It seems that this step is useless.

Ii. session management

@ Component public class SessionManager {@ Autowired private CacheProvider cacheProvider; public User login (SecretKey secretKey, String account, String password) {SecurityHelper securityHelper = new SecurityHelper (secretKey); String password2; try {password2 = SecurityHelper. byteToHexStr (securityHelper. encode (account. getBytes ("UTF-8");} catch (UnsupportedEncodingException e) {throw new LoginE Xception (e);} if (password2.equals (password) {User user = new User (account); user. setSecretKey (secretKey. getEncoded (); addSession (user); return user;} else {throw new LoginException ("Logon Failed") ;}} public void logoff (String sessionId) {removeSession (sessionId);} private void addSession (User user User) {cacheProvider. put ("webservice-session-" + user. getSessionId (), user);} private void removeSess Ion (String sessionId) {cacheProvider. remove ("webservice-session-" + sessionId);} public User getUser (SecretKey secretKey, String sessionId) {User user = (User) cacheProvider. get ("webservice-session-" + sessionId); if (user = null) {throw new WsException ("user not logged on or login timed out");} else if (! BytesEquals (secretKey. getEncoded (), user. getSecretKey () {throw new WsException ("no permission to call this interface");} else {return user;} private boolean bytesEquals (byte [] bytes1, byte [] bytes2) {for (int I = 0; I <bytes1.length; I ++) {if (bytes1 [I]! = Bytes2 [I]) {return false ;}} return true ;}}

Note:

CacheProvider is a common cache tool interface.

Iii. encryption algorithms

We can see the des above. Here we will briefly summarize the encryption algorithm:

1. HASH

MD5, SHA1, SHA256, and so on are all unidirectional HASH algorithms. The original content cannot be exported from the result. The original content has any changes and the HASH value will change. It is irreversible.

2. symmetric encryption

DES, 3DES, and AES are characterized by the same keys used for encryption and decryption. DES is old and insecure. AES is the latest.

3. asymmetric encryption

RSA and ECC (elliptic curve) features different keys, one public key and one private key. One Encrypted Key can only be decrypted by another. Public encryption can only be seen by private users. Private encryption ensures that the content is sent by the user.

4. For common https, you can use asymmetric encryption to transmit symmetric encryption keys. For normal content, use symmetric encryption.

If you have any questions, please leave a message or go to the community on this site for discussion. Thank you for reading this article. Thank you for your support!