CN105765941A - Illegal access server prevention method and device - Google Patents

Abstract

A method and device for preventing illegal access to a server, the method comprising: an intelligent terminal acquires a request parameter in a first access request to be sent to a server, encrypts the request parameter through an MD5 algorithm to generate a first digital signature string, and sends the Encapsulate the first digital signature string into the first access request, so as to send the first access request to the server; the server receives and encapsulates the second access request with the first digital signature string Obtaining the request parameter, encrypting the request parameter obtained from decapsulating the second access request through the MD5 algorithm to generate a second digital signature string, and judging whether the first digital signature string is consistent with the second digital signature string , if yes, judging that the second access request is the first access request, and the server allows the smart terminal to access. Through the above method, it is possible to identify whether the request is legal, and to avoid leakage of user information.

Description

Method and device for preventing illegal access to server

technical field

The invention relates to the communication field, in particular to a method and device for preventing illegal access to a server.

Background technique

At present, most APP software is developed with a structure combining client and server. The client mainly refers to the smart terminal APP software, and the server is mainly used to access the data interacted by the APP. Now most of the interactive interface between the client and the server is implemented through http. However, there are many packet capture tools that can capture the request connection sent by the APP client and tamper with the parameter information in the request connection. However, the server It cannot identify whether the tampered request connection is legal, so as to respond to the tampered request, which will cause others to obtain the information stored by the user in the server, resulting in the leakage of personal information.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a method and device for preventing illegal access to a server, which can identify whether a request is legal or not, and avoid leakage of user information.

The invention provides a method for preventing illegal access to a server, including:

The smart terminal obtains a request parameter, wherein the request parameter is a parameter carried in the first access request that the smart terminal prepares to send to the server, and the request parameter includes a parameter of an interface between the smart terminal and the server;

The smart terminal encrypts the request parameters through the MD5 algorithm to generate a first digital signature string, and encapsulates the first digital signature string into the first access request, so as to send the first access request to the Server sends;

The server receives a second access request having the first digital signature string, and decapsulates the second access request to obtain request parameters;

The server encrypts the request parameters obtained by decapsulating the second access request through the MD5 algorithm to generate a second digital signature string;

The server judges whether the first digital signature string is consistent with the second digital signature string, and if so, judges that the second access request is the first access request, and the server allows the smart Terminal access.

Optionally, the request parameters include a plurality of parameters including the parameters of the interface between the smart terminal and the server, and the smart terminal encrypts the request parameters through the MD5 algorithm to generate a first digital signature string including :

Multiple parameters in the request parameters are connected through preset symbols.

Optionally, the request parameters include application software identification, software version number, international language code, and interface parameters.

Optionally, before connecting multiple parameters in the request parameters through preset symbols, the method further includes:

Arranging multiple parameters in the request parameters according to a preset order.

Optionally, arranging multiple parameters in the request parameters according to a preset order includes:

Arranging multiple parameters in the request parameters in alphabetical order.

A device for preventing illegal access to a server, comprising:

An acquiring unit, configured to acquire a request parameter, wherein the request parameter is a parameter carried in the first access request that the smart terminal prepares to send to the server, and the request parameter includes an interface through which the smart terminal communicates with the server parameters;

Generating an encapsulation unit, configured to encrypt the request parameters through the MD5 algorithm to generate a first digital signature string, and encapsulate the first digital signature string into the first access request;

a sending unit, configured to send the first access request to the server;

a receiving unit, configured to receive a second access request having the first digital signature string, and decapsulate the second access request to obtain request parameters;

A decapsulation generating unit, configured to encrypt the request parameters obtained by decapsulating the second access request through the MD5 algorithm to generate a second digital signature string;

A judging unit, configured to judge whether the first digital signature string is consistent with the second digital signature string, and if so, judge that the second access request is the first access request, and the server allows the access to the smart terminal mentioned above.

Optionally, the request parameters include a plurality of parameters including the parameters of the interface between the smart terminal and the server, and the generation and encapsulation unit is further configured to:

Multiple parameters in the request parameters are connected through preset symbols.

Optionally, the request parameters include application software identification, software version number, international language code, and interface parameters.

Optionally, the generating encapsulation unit is also used to:

Arranging multiple parameters in the request parameters according to a preset order.

Optionally, arranging multiple parameters in the request parameters according to a preset order includes:

Arranging multiple parameters in the request parameters in alphabetical order.

In the above invention, the smart terminal obtains the request parameters, encrypts the request parameters through the MD5 algorithm to generate the first digital signature string, encapsulates the first digital signature string into the first access request, and sends the first access request to the server; the server receives a second access request having the first digital signature string, and decapsulating the request parameters from the second access request, and encrypting the request parameters obtained from the decapsulating the second access request through the MD5 algorithm to generate a second digital signature string, Judging whether the first digital signature string is consistent with the second digital signature string, if yes, judging that the second access request is the first access request, and the server allows the smart terminal to access. Through the above method, it is possible to identify whether the request is legal, and to avoid leakage of user information.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is a flow chart of an embodiment of a method for preventing illegal access to a server in the present invention;

Fig. 2 is a schematic structural diagram of an embodiment of an illegal access server prevention device according to the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Please refer to FIG. 1 . FIG. 1 is a flow chart of an embodiment of a method for preventing illegal access to a server in the present invention. The method includes:

Step S101: the smart terminal acquires request parameters.

Most of the interactive interfaces between the smart terminal and the server are implemented in the form of http. There are two http request methods, one is the GET method, and the request parameters will be followed by the request resource with "?" as a separator; the other is the POST method, and the request parameters will be placed at the end.

Specifically, the request parameter is the parameter carried in the first access request that the smart terminal prepares to send to the server. The request parameter includes the parameters of the interface between the smart terminal and the server, including application software identification, software version number, international language code, interface The parameters of the application software, etc., the application software identification is a symbol used to represent the application software, each application software corresponds to a unique identification number; the software version number is some English and numbers behind the software name, which is the sign of the software version; international language code It is used to represent the language code of the document; the interface is the communication channel between the smart terminal and the server, and the parameters of the interface include the information of the user who sent the request. Smart terminals can call related methods through the request object to obtain request parameters.

Step S102: The smart terminal encrypts the request parameters using the MD5 algorithm to generate a first digital signature string, and encapsulates the first digital signature string into the first access request.

A digital signature (also known as a public key digital signature, electronic signature) is some data attached to a data unit, or a cryptographic transformation of a data unit. This kind of data or transformation allows the receiver of the data unit to confirm the source of the data unit and the integrity of the data unit and protect the data from being forged by others. It is also an effective proof of the authenticity of the information sent by the sender of the information. It is a method of signing messages in electronic form so that a signed message can be transmitted over a communication network.

MD5 (MessageDigestAlgorithm5) (Chinese name is the fifth edition of Message Digest Algorithm) is a hash function widely used in the field of computer security to provide message integrity protection. MD5 can generate an equally unique MD5 value for any file (regardless of its size, format, and quantity), which can also be called a "digital fingerprint". If anyone makes any changes to the file, its MD5 value is also the corresponding " "digital fingerprint" will change.

Specifically, the request parameter may contain multiple parameters, and the smart terminal may select some or all of the parameters, and encrypt some or all of the parameters in the request parameter through the MD5 algorithm to generate a first digital signature string, which is the first digital signature string. The "digital fingerprint" of the request parameter is used to protect the integrity of the request parameter, and then encapsulate the first digital signature string into the first access request.

It should be noted that multiple parameters encrypted by the MD5 algorithm can be arranged in a preset order before encryption, for example, multiple parameters can be arranged in alphabetical order according to the first letter, or multiple parameters can be connected with a connection symbol In general, the connection symbol can be a specific letter, number or symbol and so on. For example, assuming that appID=ebcad75de0d42a844d98a755644e30 (application unique identification number), softwareVersion=1.0.1 (software version number), lanCode=zh-cn (international language code), restKey=user.login (interface parameter) in the request parameter, in Before MD5 encryption, sort the parameters in alphabetical order according to the parameters before the equal sign, and use the & symbol to connect to get the request parameter appID=ebcad75de0d42a844d98a755644e30&lanCode=zh-cn&restKey=user. The parameters are encrypted with MD5 to obtain the first digital signature string.

Step S103: the smart terminal sends a first access request to the server.

Specifically, the smart terminal may send the first access request to the server through a wired network, a wireless network, or a mobile network.

Step S104: the server receives the second access request with the first digital signature string, and decapsulates the second access request to obtain request parameters.

Specifically, the server cannot determine whether the received second access request with the first digital signature string is the first access request, and the request parameters in the first access request may have been modified. The server receives the second access request with the first digital signature string. the second access request, and decapsulate the second access request to obtain the request parameters included in the second access request.

Step S105: The server encrypts the request parameters obtained by decapsulating the second access request through the MD5 algorithm to generate a second digital signature string.

Specifically, the request parameters obtained by decapsulating in the second access request may contain multiple parameters, and the server may select some or all of the parameters. Some or all of the parameter types are the same, and the MD5 algorithm is used to encrypt some or all of the parameters in the request parameters to generate a second digital signature string. It should also be noted that the MD5 algorithm in step S105 is consistent with the MD5 algorithm in step S102.

It should also be noted that in step S102, if the multiple parameters encrypted by the MD5 algorithm are arranged in a preset order before encryption, then in step S105, the server also needs to follow the same sequence as in step S102 before the multiple parameters encrypted by the MD5 algorithm. Arranged in the same preset order.

Step S106: The server judges whether the first digital signature string is consistent with the second digital signature string.

Specifically, the server judges whether the first digital signature string is consistent with the second digital signature string. If yes, the second access request is the first access request. The first access request has not been tampered with and is a legal request, allowing the smart terminal to otherwise, the second access request is not the first access request, and the first access request has been tampered with, which is an illegal request, and the smart terminal is not allowed to access.

Specifically, the first digital signature string obtained by the smart terminal through the MD5 algorithm according to the request parameters in the first access request is unique, and the MD5 encryption process is irreversible. After the first access request is acquired by others and modified into a second access request, the request parameters in the second access request are inconsistent with those in the first access request, and the parameters of their interfaces are different. The MD5 algorithm is a digital signature string generated by encrypting the content of the request parameters. When the request parameters change, the digital signature string generated by the MD5 algorithm will also change. After the server receives the second access request, if the request parameter in the second access request is inconsistent with the request parameter in the first access request, then the second digital signature string obtained according to the request parameter in the second access request is the same as the first digital signature string. The signature strings are inconsistent. It can be known that a hacker intends to capture the request connection sent by the APP client through the packet capture tool to obtain the information stored by the user in the server.

Step S107: Allow the smart terminal to access.

Specifically, if the first digital signature string is consistent with the second digital signature string, the second access request is the first access request, the first access request has not been tampered with, is a legal request, and the smart terminal is allowed to access.

In the above invention, the smart terminal obtains the request parameters, encrypts the request parameters through the MD5 algorithm to generate the first digital signature string, encapsulates the first digital signature string into the first access request, and sends the first access request to the server; the server receives a second access request having the first digital signature string, and decapsulating the request parameters from the second access request, and encrypting the request parameters obtained from the decapsulating the second access request through the MD5 algorithm to generate a second digital signature string, Judging whether the first digital signature string is consistent with the second digital signature string, if yes, judging that the second access request is the first access request, and the server allows the smart terminal to access. Through the above method, it is possible to identify whether the request is legal, and to avoid leakage of user information.

Please refer to FIG. 2. FIG. 2 is a schematic structural diagram of an embodiment of an illegal access server prevention device of the present invention. The device 200 includes: an acquisition unit 201, a generating and encapsulating unit 202, a sending unit 203, a receiving unit 204, and an unpacking generating unit 205 and a judging unit 206 .

The obtaining unit 201 is configured to obtain request parameters, wherein the request parameters are parameters carried in the first access request that the smart terminal prepares to send to the server, and the request parameters include parameters of an interface for communication between the smart terminal and the server.

The generation encapsulation unit 202 is configured to encrypt the request parameters through the MD5 algorithm to generate a first digital signature string, and encapsulate the first digital signature string into the first access request.

The sending unit 203 is configured to send the first access request to the server.

The receiving unit 204 is configured to receive the second access request with the first digital signature string, and decapsulate the second access request to obtain request parameters.

The decapsulation generating unit 205 is configured to encrypt the request parameters obtained by decapsulating the second access request through the MD5 algorithm to generate a second digital signature string.

The judging unit 206 is configured to judge whether the first digital signature string is consistent with the second digital signature string, and if so, judge that the second access request is the first access request, and the server allows the smart terminal to access.

Optionally, the request parameters include a plurality of parameters including the parameters of the interface between the smart terminal and the server, and the generating encapsulation unit 202 is also used to:

Connect multiple parameters in the request parameters through preset symbols.

Optionally, the request parameters include application software identification, software version number, international language code, and interface parameters.

Optionally, generating encapsulation unit 202 is also used to:

Arrange multiple parameters in the request parameters in a preset order.

Optionally, multiple parameters in the request parameters are arranged in a preset order including:

Arrange multiple parameters in request parameters in alphabetical order.

It should be noted that the acquiring unit 201, generating encapsulation unit 202, and sending unit 203 are located in the smart terminal; the receiving unit 204, decapsulating generating unit 205, and judging unit 206 are located in the server.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence. Because according to the present invention, certain steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

The steps in the methods of the embodiments of the present invention can be adjusted, combined and deleted according to actual needs.

The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. Those skilled in the art may combine or combine different embodiments and features of different embodiments described in this specification.

Through the above description of the implementation manners, those skilled in the art can clearly understand that the present invention can be implemented by hardware, firmware, or a combination thereof. When implemented in software, the functions described above may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. Take this as an example but not limited to: the computer-readable medium may include Random Access Memory (Random Access Memory, RAM), Read-Only Memory (Read-Only Memory, ROM), Electrically Erasable Programmable Read-Only Memory (Electrically Erasable Programmable Read-Only Memory, EEPROM) , CD-ROM (Compact Disc Read-Only Memory, CD-ROM) or other optical disk storage, magnetic disk storage medium or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can be stored by a computer any other medium. also. Any connection can suitably be a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair wire, Digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave, then the same Coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave are included in the fixation of the respective media. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disc, and Blu-ray disc, where discs usually reproduce data magnetically, and discs Lasers are used to optically reproduce the data. Combinations of the above should also be included within the scope of computer-readable media.

In a word, the above descriptions are only preferred embodiments of the technical solutions of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. a unauthorized access server prevention method, it is characterised in that including:

Intelligent terminal obtains required parameter, and wherein, described required parameter is that described intelligent terminal prepares to service The parameter carried in the first access request that device sends, described required parameter comprises described intelligent terminal with described The parameter of the interface of server communication；

The encryption of described required parameter is generated the first digital signature string by MD5 algorithm by described intelligent terminal, and Described first digital signature string is encapsulated in described first access request, with by described first access request to Described server sends；

Described server receives second access request with described first digital signature string, and from described second In access request, decapsulation obtains required parameter；

Described server will decapsulate, from described second access request, the request obtained by described MD5 algorithm Parameter encryption generates the second digital signature string；

Described server judges that described first digital signature string is the most consistent with described second digital signature string, as Fruit is, then judge to be described first access request according to described second access request, and described server allows Described intelligent terminal conducts interviews.

Method the most according to claim 1, it is characterised in that described required parameter includes comprising described Intelligent terminal passes through at interior multiple parameters, described intelligent terminal with the parameter of the interface of described server communication The encryption of described required parameter is generated the first digital signature string and includes by MD5 algorithm:

Multiple parameters in described required parameter are coupled together by predetermined symbol.

Method the most according to claim 2, it is characterised in that described required parameter includes application software Mark, software version number, International Language coding, the parameter of interface.

Method the most according to claim 3, it is characterised in that described by many in described required parameter Individual parameter is also included before being coupled together by predetermined symbol:

Multiple parameters in described required parameter are arranged according to preset order.

Method the most according to claim 4, it is characterised in that the multiple parameters in described required parameter Include according to preset order arrangement:

Multiple parameters in described required parameter are arranged in alphabetical order.

6. the anti-locking apparatus of unauthorized access server, it is characterised in that including:

Acquiring unit, is used for obtaining required parameter, and wherein, described required parameter is that described intelligent terminal prepares The parameter carried in the first access request that server sends, described required parameter comprises described intelligent terminal Parameter with the interface of described server communication；

Generate encapsulation unit, for the encryption of described required parameter being generated the first digital signature by MD5 algorithm String, and described first digital signature string is encapsulated in described first access request；

Transmitting element, for sending described first access request to described server；

Receive unit, for receiving second access request with described first digital signature string, and from described In second access request, decapsulation obtains required parameter；

Deblocking signal generating unit, for will decapsulate by described MD5 algorithm from described second access request The required parameter encryption arrived generates the second digital signature string；

Judging unit, is used for judging that described first digital signature string is the most consistent with described second digital signature string, If it is, judge to be described first access request according to described second access request, described server is permitted Permitted described intelligent terminal to conduct interviews.

Device the most according to claim 6, it is characterised in that described required parameter includes comprising described The parameter of the interface of intelligent terminal and described server communication is at interior multiple parameters, described generation encapsulation unit It is additionally operable to,

Multiple parameters in described required parameter are coupled together by predetermined symbol.

Device the most according to claim 7, it is characterised in that described required parameter includes application software Mark, software version number, International Language coding, the parameter of interface.

Device the most according to claim 8, it is characterised in that described generation encapsulation unit is additionally operable to,

Multiple parameters in described required parameter are arranged according to preset order.

Device the most according to claim 9, it is characterised in that the multiple ginsengs in described required parameter Number includes according to preset order arrangement:

Multiple parameters in described required parameter are arranged in alphabetical order.