MVVM前后端数据交互中安全机制的研究与实现

发布时间：2018-03-19 17:31

本文选题：MVVM　切入点：微服务　出处：《浙江理工大学》2017年硕士论文　论文类型：学位论文

【摘要】：随着互联网及Web技术的迅猛发展,前后端技术也在不断的推陈出新,目前Web应用开发中公认的开发模式是实现前后端分离,各种前端开发框架也都应用到了该思想,从最开始的MVC到MVP再到MVVM,功能越来越强大且符合实际需求,虽然MVVM前后端分离框架做到了其最初构建的目的:分离组件、降低组件之间的耦合性、组件可以独立演化,但却未对其安全性提出相应的措施,研究MVVM前后端分离框架可以发现,其存在的安全问题主要有两点:首先是后端数据全部互联,耦合性极高,部分数据的不安全会给全部数据带来安全隐患;其次,前后端是通过JSON进行数据传输的,如果JSON是明文传输,其安全性则非常低,即使使用了当前使用最广泛的AES算法进行数据加密,其安全性也还是存在很多问题的。因此本文针对MVVM前后端分离数据交互中的安全机制进行研究。本文的主要研究工作包括:(1)通过在服务端将业务数据按功能划分为不同的微服务模块,解决后端数据互联带来的安全问题。(2)针对划分为微服务后带来的细粒度服务导致的复杂性提升问题提出使用API Gateway作为统一访问接口的方式,并实现了API Gateway与前后端的通信。(3)在API Gateway中加入JWT,使用Token进行用户验证和授权,极大提高终端的数据安全性。(4)基于AES加密算法加密速度快和RSA加密算法密钥保存管理容易的特点实现混合加密。(5)利用RSA算法互换性进行改进,实现了更高安全级别的混合加密方式。(6)研究通过降低AES算法11轮密钥扩展过程中各轮密钥的相关性来提升AES密钥的安全性,研究通过加入判断模块的方法降低单轮各密钥位之间的相关性,从而在整体上提升AES密钥扩展算法的抗破解能力。(7)最后,对微服务划分的安全性进行测试分析、对AES密钥扩展原算法和改进算法的执行效率进行测试和比较、对加入本文安全机制的MVVM应用与原生MVVM应用的执行效率进行比较,验证了解决方案的可行性。
[Abstract]:With the rapid development of the Internet and Web technology, the technology of front and rear end is constantly innovating. At present, the accepted development mode of Web application development is to realize the separation of front end and front end, and all kinds of front-end development frameworks have also been applied to this idea. From the beginning of MVC to MVP and then to MVVM, the function is more and more powerful and meets the actual needs, although the MVVM front-end separation framework has achieved its original purpose: separating components, reducing the coupling between components, and components can evolve independently. But it has not put forward the corresponding measure to its security, the research on the front and rear end separation framework of MVVM can find that there are two main security problems: first, the back-end data are all interconnected, and the coupling is extremely high. Part of the data insecurity will bring security risks to all the data. Secondly, the front and rear end of the data is transmitted through JSON, if the JSON is plaintext transmission, its security is very low. Even though the most widely used AES algorithm is currently used for data encryption, There are still many problems in its security. Therefore, this paper studies the security mechanism in the data interaction between the front and rear end of MVVM. The main research work in this paper includes: 1) dividing the business data according to the function on the server side. For different microservice modules, To solve the security problem caused by back-end data interconnection, we propose to use API Gateway as the unified access interface to improve the complexity caused by fine-grained services that are divided into micro-services. In addition, the communication between API Gateway and the front and rear end is realized. (3) JWTs are added to API Gateway, and Token is used to authenticate and authorize the users. Greatly improve the data security of the terminal. 4) based on the fast encryption speed of AES encryption algorithm and the easy key preservation and management of RSA encryption algorithm, the mixed encryption. 5) is improved by using the interchangeability of RSA algorithm. In order to improve the security of the AES key, the mixed encryption method with higher security level is proposed to improve the security of the AES key by reducing the correlation of each round key in the 11-round key expansion process of the AES algorithm. In order to improve the anti-cracking ability of AES key expansion algorithm, the security of micro-service partitioning is tested and analyzed by adding judgment module to reduce the correlation between each key bit in a single round, so as to improve the anti-cracking ability of AES key expansion algorithm. The execution efficiency of the original AES key extension algorithm and the improved algorithm is tested and compared, and the execution efficiency of the MVVM application with the security mechanism is compared with that of the native MVVM application, and the feasibility of the solution is verified.
【学位授予单位】：浙江理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.09;TP309

【参考文献】