Network, Security, and Payment Technologies (网络、安全与支付技术)
Domain 6 combines the network path a transaction travels, the cryptographic primitives that protect it, the attacks that break it, and the settlement process behind online payment. Expect flow-ordering questions: who signs with which key, at which step.
Network basics
TCP/IP, DNS resolution, ports (80/443), HTTP versus HTTPS (TLS), NAT, firewalls and the DMZ for externally reachable servers, VPN for remote staff, load balancers and CDN at the edge.
Cryptography and identity
Symmetric encryption (AES, 3DES) is fast but needs key distribution; asymmetric (RSA) solves key exchange and signatures. Digest functions (SHA-256, MD5) give integrity only, never confidentiality. 数字签名 = hash then encrypt with the sender's private key; the receiver verifies with the sender's public key. A digital certificate binds a public key to an identity and is issued by a CA inside a PKI; TLS uses certificates so the browser can trust the server.
Attacks and defences
SQL injection → parameterised queries and least privilege; XSS → output encoding and CSP; CSRF → token plus SameSite cookies; replay → nonce and timestamps; DDoS → traffic scrubbing and rate limiting; 越权 → server-side authorisation on every object.
Worked example
A merchant must prove an order message came from it and was not altered. Reasoning: hash the message with SHA-256, encrypt the digest with the merchant's private key - that digest is the signature; send message plus signature. The platform hashes the received message, decrypts the signature with the merchant's public key from its certificate, and compares. If they match, integrity and origin both hold. Note the direction: signing uses the sender's private key, whereas encrypting to a recipient uses the recipient's public key.
Payment flow and settlement
The typical third-party payment path: 下单 → 跳转/调用支付网关 → 用户认证与授权 → 支付平台扣款 → 异步回调通知商户 → 商户验签、幂等处理 → 对账与清算分账. Know 支付网关, 清算, 二次清算, 分账, T+1 settlement and reconciliation files.
Traps that cost marks
- Reversing keys: signing with a public key, encrypting with your own private key.
- Calling MD5 an encryption algorithm.
- Believing HTTPS prevents SQL injection or XSS.
- Confusing CSRF (forged request with the user's credentials) with XSS (script injection).
- Skipping reconciliation and discovering mismatches weeks later.