CN116668130A - A protection method, system, server and storage medium for web interaction - Google Patents

Abstract

The application discloses a protection method, system, server and storage medium for Web interaction, relates to the technical field of information security, and can improve the security of Web interaction. The specific solution includes: receiving the login request sent by the client, the login request includes the unique identification information of the browser to be logged in and the credential information of the client, the credential information is used to indicate the credential information that the client is allowed to log in to the server; and the credential information are encrypted to obtain the target credential information; the target credential information is sent to the client, so that the client uses the target credential information to log in to the server when logging in to the server later.

Description

A protection method, system, server and storage medium for web interaction

technical field

The present application relates to the technical field of information security, in particular to a protection method, system, server and storage medium for Web interaction.

Background technique

In the current information interaction, the client-server interaction mode has become the mainstream interaction mode, which plays an extremely important role in modern information systems. With the development of the web, security issues related to forms and interface requests in web interactions have become increasingly prominent. The security research and related product layout of forms and interfaces have become an important issue in various network security.

However, in the face of different business scenarios, application environments, various deployments, different protection requirements, and unique business scenarios, traditional web interaction protection strategies for forms and interfaces are insufficient. Therefore, it is necessary to strengthen the security of forms and interfaces protection.

Contents of the invention

The present application provides a protection method, system, server and storage medium for web interaction, which can improve the security of web interaction.

In order to achieve the above object, the application adopts the following technical solutions:

In the first aspect of the embodiment of the present application, a protection method for Web interaction is provided, which is characterized in that it is applied to a server, and the method includes:

Receive the login request sent by the client, the login request includes the unique identification information of the browser to log in and the credential information of the client, and the credential information is used to indicate the credential information that the client is allowed to log in to the server;

Encrypt the unique identification information and credential information to obtain the target credential information;

The target credential information is sent to the client, so that the client uses the target credential information to log in to the server when logging in to the server later.

In one embodiment, encrypting the unique identification information and credential information includes:

The unique identification information and credential information are encrypted using an asymmetric encryption method or an MD5 encryption method.

In one embodiment, after sending the target credential information to the client, the method further includes:

Receive the request information sent by the client, the request information includes the target credential information, and the request information is used to request the corresponding interface information or form information;

Execute the request information and get the execution result;

Obtain the target encryption method corresponding to the request information, encrypt the execution result according to the target encryption method and target credential information, obtain the ciphertext result, and send the ciphertext result to the client.

In one embodiment, the server pre-stores the mapping relationship between different types of request information and the importance level and the encryption level, and pre-stores the association relationship between the encryption level and the encryption method;

Obtain the target encryption method corresponding to the request information, including:

According to the mapping relationship, determine the target encryption level corresponding to the requested information;

According to the association relationship, the target encryption method corresponding to the target encryption level is obtained.

In one embodiment, the execution result is encrypted according to the target encryption method and target credential information to obtain the ciphertext result, including:

Generate an encryption function according to the encryption method and target credential information, and use the encryption function to encrypt the execution result to obtain the ciphertext result.

In one embodiment, the method further includes: the server also pre-stores the correspondence between encryption levels and obfuscation rules;

After the encryption function is generated according to the encryption method and the target credential information, the method further includes:

Generate a decryption function corresponding to the encryption function;

Obtain the target obfuscation rules corresponding to the target encryption level according to the corresponding relationship;

The decryption function is obfuscated by the target obfuscation rules, and the target decryption function is obtained.

In one embodiment, after obtaining the target decryption function, the method further includes:

Determining obfuscation values using target credential information and target obfuscation rules;

Send the ciphertext result, target decryption function, and obfuscation value to the client, so that the client can use the obfuscation value and target credential information to determine the target obfuscation rule, and use the target obfuscation rule to de-obfuscate the target decryption function to obtain the decryption function , using the decryption function to analyze the ciphertext result to obtain the execution result.

In the second aspect of the embodiment of the present application, a protection system for Web interaction is provided, and the system includes: a server and a client;

The server is configured to receive a login request sent by the client, the login request includes the unique identification information of the browser to be logged in and the credential information of the client, and the credential information is used to indicate the credential information that the client is allowed to log in to the server;

The server is further configured to encrypt the unique identification information and the credential information, obtain the target credential information, and send the target credential information to the client;

The client is used to log in to the server using the target credential information when logging in to the server later.

The third aspect of the embodiment of the present application provides a server, including a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the method for protecting Web interaction in the first aspect of the embodiment of the present application is implemented.

The fourth aspect of the embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the method for protecting Web interaction in the first aspect of the embodiment of the present application is implemented.

The beneficial effects brought by the technical solutions provided by the embodiments of the present application at least include:

The protection method for Web interaction provided by the embodiment of this application is applied to the server, and by receiving the login request sent by the client, the login request includes the unique identification information of the browser to log in and the credential information of the client, and the credential information is used to instruct the client The terminal is allowed to log in to the server's credential information; encrypt the unique identification information and credential information to obtain the target credential information; send the target credential information to the client, so that the client can use the target credential information to log in to the server when logging in to the server later . Since the existing technology uses the client's credential information to log in to the browser, and the client's credential information has nothing to do with the browser, once the credential information of a specific browser is obtained, it can be implemented in other browsers or even without a browser. There are security risks in forging requests. However, this application uses the unique identification information of the browser to be logged in and the client's credential information and regenerates the target credential information through encryption. When using the target credential information to log in to the server later, if the target credential After the browser is logged in, business interaction cannot be performed directly, and the security is higher, which avoids the security risk of using browser A to log in and using browser B or C to directly access.

Description of drawings

FIG. 1 is a flow chart 1 of a protection method for Web interaction provided by an embodiment of the present application;

FIG. 2 is a second flow chart of a method for protecting web interaction provided by an embodiment of the present application;

FIG. 3 is a structural diagram of a protection system for Web interaction provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of an internal structure of a server provided in an embodiment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

Hereinafter, the terms "first" and "second" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, a feature defined as "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.

In addition, the use of "based on" or "according to" is meant to be open and inclusive, because a process, step, calculation or other action "based on" or "according to" one or more conditions or values may in practice be based on additional conditions or value exceeded.

Fig. 1 is a flow chart of a protection method for Web interaction provided by the embodiment of the present application. The method is applied to a server and specifically includes the following steps:

Step 101, receiving a login request sent by a client.

The login request includes the unique identification information of the browser to be logged in and the credential information of the client, and the credential information is used to indicate the credential information that the client is allowed to log in to the server. Wherein, the unique identification information of the browser may be a browser primitive.

Step 102: Encrypt the unique identification information and credential information to obtain target credential information.

Wherein, the credential information may be a cookie carried when the client logs in. The cookie type is "small text file", which is the data (usually encrypted) stored on the user's local terminal by some websites in order to identify the user's identity and track the session, and the information is temporarily or permanently stored by the user's client computer.

Optionally, the process of encrypting the unique identification information and credential information may be: using an asymmetric encryption method or an MD5 encryption method to encrypt the unique identification information and credential information to obtain target credential information.

Step 103 , sending the target credential information to the client, so that the client will use the target credential information to log in to the server when logging in to the server later.

The protection method for Web interaction provided by the embodiment of this application is applied to the server, and by receiving the login request sent by the client, the login request includes the unique identification information of the browser to log in and the credential information of the client, and the credential information is used to instruct the client The terminal is allowed to log in to the server's credential information; encrypt the unique identification information and credential information to obtain the target credential information; send the target credential information to the client, so that the client can use the target credential information to log in to the server when logging in to the server later . Since the existing technology uses the client's credential information to log in to the browser, and the client's credential information has nothing to do with the browser, once the credential information of a specific browser is obtained, it can be implemented in other browsers or even without a browser. There are security risks in forging requests. However, this application uses the unique identification information of the browser to be logged in and the client's credential information and regenerates the target credential information through encryption. When using the target credential information to log in to the server later, if the target credential After the browser is logged in, business interaction cannot be performed directly, and the security is higher, which avoids the security risk of using browser A to log in and using browser B or C to directly access.

As shown in Figure 2, after the target credential information is sent to the client in step 103, the method further includes:

Step 201, receiving request information sent by the client, the request information includes target credential information, and the request information is used to request corresponding interface information or form information;

It should be noted that, after receiving the request information, the server will check the authority of the client to determine whether the current client has the authority to execute the request information. If it is determined that the authority verification is passed, step 203 will be executed. If not Permission verification, then send a prompt message to the client that the permission verification fails and the current request cannot be executed.

Step 202, execute the request information, and obtain the execution result.

Wherein, the execution result can be understood as the request result of the current requested information. The execution result at this time is plain text information.

Step 203: Obtain the target encryption method corresponding to the request information, encrypt the execution result according to the target encryption method and the target credential information, obtain the ciphertext result, and send the ciphertext result to the client.

Wherein, the server pre-stores the mapping relationship between different types of request information and the importance level and the encryption level, and pre-stores the association relationship between the encryption level and the encryption method;

For example: if the requested interface is a core business, the request for this interface will obtain a higher level of importance judgment and the corresponding encryption level.

Then, the process of obtaining the target encryption method corresponding to the request information may be: according to the mapping relationship, determining the target encryption level corresponding to the request information; according to the association relationship, obtaining the target encryption method corresponding to the target encryption level. In this way, different encryption methods are used to dynamically encrypt and protect according to the importance of the requested interface or form, so as to avoid security risks that may expand the impact threshold of static encryption due to key leakage or key guessing. At the same time, the interface or form information is divided into importance according to the preset importance, and according to different importance and protection levels, different protection methods with different degrees of difficulty and protection are used, thus effectively avoiding the problems of insufficient protection and excessive protection.

Specifically, the above-mentioned process of encrypting the execution result according to the target encryption method and target credential information to obtain the ciphertext result can be: generate an encryption function according to the encryption method and target credential information, use the encryption function to encrypt the execution result, and obtain the ciphertext result.

In addition, the server also pre-stores the correspondence between the encryption level and the obfuscation rules; correspondingly, after generating the encryption function according to the encryption method and the target credential information, the server will also generate the decryption function corresponding to the encryption function; according to the correspondence, obtain A target obfuscation rule corresponding to the target encryption level; using the target obfuscation rule to obfuscate the decryption function to obtain the target decryption function. Determine the obfuscation value by using the target credential information and the target obfuscation rules; finally, send the ciphertext result, the target decryption function and the obfuscation value to the client. After the client uses the obfuscation value and target credential information to determine the target obfuscation rule, it uses the target obfuscation rule to de-obfuscate the target decryption function to obtain the decryption function, and uses the decryption function to analyze the ciphertext result to obtain the execution result. In this way, by dynamically generating the obfuscation rules, the security risk of leaking the decryption function caused by using the same rule multiple times can be avoided.

By returning the ciphertext of the request result and the decryption function to the client, the risk of decryption after being hijacked is avoided. At the same time, the obfuscation rules need to be encrypted on the client side and the target credential information is decrypted to ensure that even if the obfuscation rules are hijacked, they cannot be cracked. The problem.

As shown in Figure 3, the embodiment of the present application provides a protection system for Web interaction, the system includes: a server 11 and a client 12;

The server 11 is configured to receive a login request sent by the client, wherein the login request includes the unique identification information of the browser to be logged in and the credential information of the client, and the credential information is used to indicate that the client is allowed to log in to the server credential information;

The server 11 is further configured to encrypt the unique identification information and the credential information, obtain the target credential information, and send the target credential information to the client;

The client 12 is configured to use the target credential information to log in to the server when logging in to the server later.

In one embodiment, the server 11 is specifically configured to: use an asymmetric encryption method or an MD5 encryption method to encrypt the unique identification information and credential information.

In one embodiment, the server 11 is also used for:

Receive the request information sent by the client 12, the request information includes target credential information, and the request information is used to request corresponding interface information or form information;

Execute the request information and get the execution result;

Obtain the target encryption method corresponding to the request information, encrypt the execution result according to the target encryption method and the target credential information, obtain the ciphertext result, and send the ciphertext result to the client 12 .

In one embodiment, the server pre-stores the mapping relationship between different types of request information and the importance level and the encryption level, and pre-stores the association relationship between the encryption level and the encryption method;

The server 11 is specifically used for:

According to the mapping relationship, determine the target encryption level corresponding to the requested information;

According to the association relationship, the target encryption method corresponding to the target encryption level is obtained.

In one embodiment, the server 11 is specifically used for:

Generate an encryption function according to the encryption method and target credential information, and use the encryption function to encrypt the execution result to obtain the ciphertext result.

In one embodiment, the server 11 also pre-stores the correspondence between encryption levels and obfuscation rules;

The server 11 is further configured to: generate a decryption function corresponding to the encryption function; obtain a target obfuscation rule corresponding to the target encryption level according to the corresponding relationship; use the target obfuscation rule to obfuscate the decryption function to obtain the target decryption function.

In one embodiment, the server 11 is further configured to: determine the obfuscation value by using the target credential information and the target obfuscation rule; send the ciphertext result, the target decryption function and the obfuscation value to the client 12;

The client 12 is also used for: after using the obfuscation value and the target credential information to determine the target obfuscation rule, use the target obfuscation rule to de-obfuscate the target decryption function to obtain the decryption function, use the decryption function to analyze the ciphertext result, and execute result.

The protection system for Web interaction provided by this embodiment can execute the above-mentioned method embodiment, and its implementation principle and technical effect are similar, so no more details are given here. For the specific limitations of the protection system for Web interaction, please refer to the limitation of the protection method for Web interaction above, and will not be repeated here.

The execution subject of the protection method for Web interaction provided in the embodiment of the present application may be a server or a server cluster, which is not specifically limited in the embodiment of the present application.

FIG. 4 is a schematic diagram of an internal structure of a server provided in an embodiment of the present application. As shown in FIG. 4, the server includes a processor and a memory connected through a system bus. Among them, the processor is used to provide calculation and control capabilities. The memory may include non-volatile storage media and internal memory. Nonvolatile storage media store operating systems and computer programs. The computer program can be executed by a processor, so as to realize the steps of the method for protecting web interaction provided by the above embodiments. The internal memory provides a cached operating environment for the operating system and computer programs in the non-volatile storage medium.

Those skilled in the art can understand that the internal structure diagram of the server shown in FIG. 4 is only a block diagram of a part of the structure related to the solution of this application, and does not constitute a limitation on the electronic equipment on which the solution of this application is applied. Specifically The server may include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.

In another embodiment of the present application, there is also provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for protecting Web interaction according to the embodiment of the present application are implemented.

In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer instructions. When the computer instructions are run on the server, the server is made to perform the protection of Web interaction in the method flow shown in the above method embodiments. The individual steps performed by the method.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using a software program, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When computer-executed instructions are loaded and executed on a computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. A computer can be a general purpose computer, special purpose computer, a computer network, or other programmable apparatus. Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g. Coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or may contain one or more data storage devices such as servers and data centers that can be integrated with the medium. The available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state disk (solid state disk, SSD)) and the like.

The technical features of the above embodiments can be combined arbitrarily. For the sake of concise description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be It is considered to be within the range described in this specification.

The above examples only express several implementation modes of the present application, and the description thereof is relatively specific and detailed, but should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the scope of protection of the patent application should be based on the appended claims.

Claims (10)

1. A method for protecting Web interactions, applied to a server, the method comprising:

receiving a login request sent by a client, wherein the login request comprises unique identification information of a browser to be logged in and credential information of the client, and the credential information is used for indicating that the client is allowed to log in the credential information of the server;

encrypting the unique identification information and the credential information to obtain target credential information;

and sending the target credential information to the client so that the client logs in the server by using the target credential information when logging in the server later.

2. The method of claim 1, wherein said encrypting said unique identification information and said credential information comprises:

and encrypting the unique identification information and the credential information by using an asymmetric encryption method or an MD5 encryption method.

3. The method of claim 1, wherein after the sending the target credential information to the client, the method further comprises:

receiving request information sent by the client, wherein the request information comprises the target credential information and is used for requesting corresponding interface information or form information;

executing the request information to obtain an execution result;

and obtaining a target encryption mode corresponding to the request information, encrypting the execution result according to the target encryption mode and the target credential information to obtain a ciphertext result, and sending the ciphertext result to the client.

4. A method according to claim 3, wherein the server prestores mapping relations between different types of request information and importance levels and encryption levels, and prestores association relations between encryption levels and encryption modes;

the obtaining the target encryption mode corresponding to the request information comprises the following steps:

determining a target encryption level corresponding to the request information according to the mapping relation;

and acquiring a target encryption mode corresponding to the target encryption level according to the association relation.

5. The method of claim 4, wherein encrypting the execution result according to the target encryption manner and the target credential information to obtain a ciphertext result comprises:

and generating an encryption function according to the encryption mode and the target credential information, and encrypting the execution result by using the encryption function to obtain the ciphertext result.

6. The method of claim 5, wherein the method further comprises: the corresponding relation between the encryption level and the confusion rule is pre-stored in the server;

after the encryption function is generated according to the encryption mode and the target credential information, the method further comprises:

generating a decryption function corresponding to the encryption function;

acquiring a target confusion rule corresponding to the target encryption level according to the corresponding relation;

and carrying out confusion processing on the decryption function by utilizing the target confusion rule to obtain a target decryption function.

7. The method of claim 6, wherein after the obtaining the target decryption function, the method further comprises:

determining a confusion value by utilizing the target credential information and the target confusion rule;

and sending the ciphertext result, the target decryption function and the confusion value to the client so that the client can determine the target confusion rule by using the confusion value and the target credential information, then performing anti-confusion processing on the target decryption function by using the target confusion rule to obtain the decryption function, and analyzing the ciphertext result by using the decryption function to obtain the execution result.

8. A Web interactive protection system, the system comprising: a server and a client;

the server is used for receiving a login request sent by the client, wherein the login request comprises unique identification information of a browser to be logged in and credential information of the client, and the credential information is used for indicating that the client is allowed to log in the credential information of the server;

the server is further configured to encrypt the unique identification information and the credential information to obtain target credential information, and send the target credential information to the client;

the client is used for logging in the server by using the target credential information when logging in the server later.

9. A server comprising a memory and a processor, the memory storing a computer program that when executed by the processor implements the Web interaction prevention method of any of claims 1-7.

10. A computer-readable storage medium, on which a computer program is stored, which computer program, when being executed by a processor, implements the method of protecting Web interactions of any of claims 1-7.