【作者】 李强；

【导师】 赵小敏；

【作者基本信息】 浙江工业大学 ， 软件工程（专业学位）， 2019， 硕士

【摘要】 随着移动互联网特别是手机app应用的快速发展,手机支付、手机商城等应用为用户提供巨大便捷,但也面临各种信息安全风险,如交易安全风险、敏感信息泄露、信誉安全风险、流程安全风险。连连众筹是集商品抢购、身份认证、银行卡在线支付、到期发货与退款等功能与一体的商品交易平台,具有金融产品属性,对数据安全要求较高,需对现有应用进行多方位安全加固。本文首先介绍了数据安全的国内外发展现状,通过对连连众筹平台在系统安全方面遇到的实际问题进行需求分析,提出一套多维度数据安全加固方案,最后设计并实现了一套数据安全加固系统。本文的主要工作包括:1、对连连众筹平台的安全性需求进行了分析,设计一种多维度数据安全加固系统,包括APP客户端与服务器端密码加密存储、客户端数据加固、身份认证、认证支付以及SQL监控与防护等多维度数据安全加固设计。2、面向连连众筹平台开发实现了多维度数据安全加固系统,主要包括对APP客户端与服务端密码进行混合加密传输存储;采用基于阿里聚安全的数据风控方案实现手机端安全加固,包括登录保护、虚假恶意注册防护、修改信息防护等;通过有盾云慧眼人脸识别方案实现客户端身份认证;使用银通认证支付方案实现银行卡在线支付;使用阿里巴巴的开源平台druid实现数据库SQL注入攻击的监控和防护。本文设计并实现的多维度数据安全加固系统通过连连众筹平台生产环境的实际运行与追踪,可有效地防御客户端密码攻击、身份欺诈、SQL注入等,保障了平台运行安全。更多还原

【Abstract】 With the rapid development of mobile internet,especially mobile app applications,mobile payment,mobile mall and other applications provide users with great convenience,but also face a variety of information security risks,such as transaction security risks,sensitive information leakage,reputation security risks,process security risks.Lianlian crowdfunding platforms is a commodity trading platform which integrates the functions of commodity snap-up,identity authentication,bank card online payment,due delivery and refund.It has the property of financial products and requires high data security.It is necessary to strengthen the existing application in many aspects.This paper first introduces the development of data security reinforcement at home and abroad,through the analysis of the actual problems encountered in the system security,puts forward a multi-dimensional data security reinforcement scheme,and finally designs and implements a data security reinforcement system.The main work of this paper includes:1.This paper analyses the security requirements of the platform,and designs a multi-dimensional data security reinforcement system,which includes the encryption and storage of passwords between APP client and server,data reinforcement of client,identity authentication,authentication payment,and SQL monitoring and protection.2.Develop and implement a multi-dimensional data security reinforcement system based on the multi-party platform,mainly including mixed encryption transmission and storage of the password of the APP client and the server;adopt the data wind control scheme based on Ali poly safety to realize the security reinforcement of the mobile phone,including login protection,false malicious registration protection,modification of information prevention Protect and so on;Realize the client’s identity authentication through the shield cloud eye face recognition scheme;Realize the bank card on-line payment by using the Yintong authentication payment scheme;Realize the database SQL injection attack monitoring and protection by using the Alibaba open source platform druid.The multi-dimensional data security reinforcement system designed and implemented in this paper can effectively defend client password attack,identity fraud,SQL injection and so on through the actual operation and tracking of the production environment of the joint public-funded platform,which ensures the security of the platform.更多还原