CN106330931B - It is a kind of to prevent search document method towards unmanned invigilator - Google Patents

It is a kind of to prevent search document method towards unmanned invigilator Download PDF

Info

Publication number
CN106330931B
CN106330931B CN201610769072.1A CN201610769072A CN106330931B CN 106330931 B CN106330931 B CN 106330931B CN 201610769072 A CN201610769072 A CN 201610769072A CN 106330931 B CN106330931 B CN 106330931B
Authority
CN
China
Prior art keywords
client software
background service
browser
prevent
client
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201610769072.1A
Other languages
Chinese (zh)
Other versions
CN106330931A (en
Inventor
高峰
肖潇
曾黎
周文洁
邱功胜
谢剑斌
刘志强
肖艾维
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hunan Strong View Mdt Infotech Ltd
Original Assignee
Hunan Strong View Mdt Infotech Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hunan Strong View Mdt Infotech Ltd filed Critical Hunan Strong View Mdt Infotech Ltd
Priority to CN201610769072.1A priority Critical patent/CN106330931B/en
Publication of CN106330931A publication Critical patent/CN106330931A/en
Application granted granted Critical
Publication of CN106330931B publication Critical patent/CN106330931B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44Program or device authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/10Services
    • G06Q50/20Education

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Tourism & Hospitality (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Human Resources & Organizations (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Educational Administration (AREA)
  • Educational Technology (AREA)
  • Computing Systems (AREA)
  • Economics (AREA)
  • Signal Processing (AREA)
  • Marketing (AREA)
  • Primary Health Care (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

Search document method is prevented towards unmanned invigilator the invention discloses a kind of, it is related to wisdom education technical field, it is made of the client software and background service program that are located at front end, background service program mainly includes configuration module, authentication module, test modules.Before examination, administrator first logs in the configuration module of background service, by pre-defined completions such as authorized address list, examination configuration information, authentication informations.Client software operation obtains corresponding authorized address list, exam information, authentication information etc. from background service.Client software initiates the communication with background service, and background service authenticates request, if request comes from non-customer end software, backstage refusal services and provides prompt.It is used to preventing examinee from searching for locally stored data or the method in other site search data when participating in online exam.The deficiency for making up existing anti-tampering technology makes that the cheating of search data is prevented to have practicability.

Description

It is a kind of to prevent search document method towards unmanned invigilator
Technical field
The present invention relates to wisdom education technical field, refer in particular to a kind of prevent search document method towards unmanned invigilator.
Background technique
It is more more and more urgent using telecommunication network examination/online testing demand with the deep application of Internet technology, by In cannot preferably solve the problems, such as to prevent from practising fraud, the application and development of online testing are constantly subjected to restrict.
Traditional online testing cannot prevent examinee from searching locally stored data related with examination, meanwhile, it can not prevent Only examinee's online lookup data.Patent application 201510330068.0 proposes a kind of by active client window top set, covering Other program windows, to achieve the purpose that prevent cheating.Patent application 201610036508.6 proposes the screen to front end computer Curtain background color is timed acquisition, if it find that there is color change, then regards as examinee and is accessing other websites.Patent application 201410037375.5 proposing timing for the method for client window top set.These methods can prevent here under certain condition Class cheating, but there is also some problems, comprising:
It cannot prevent other programs similarly by window top set;
It cannot prevent from obtaining program operation, such as task manager using Hotkey;
It cannot prevent current browser itself from accessing other unauthorized pages;
It cannot prevent cribber from getting around client, directly the access examination page, cause front end (computer) not by client control System.
Summary of the invention
In view of the above technical problems, the present invention propose it is a kind of prevent search document method towards unmanned invigilator, be used for When participating in online exam (online testing), prevent examinee from searching for locally stored data or in other websites (such as Baidu) The method of search data.The deficiency for making up existing anti-tampering technology makes that the cheating of search data is prevented to have practicability.
The specific technical solution of the present invention is:
It is a kind of to prevent search document method towards unmanned invigilator, by the client software or the browser control that are located at front end Part and background service program composition, the background service program include configuration module, authentication module, test modules, specific packet It includes: preventing unauthorized browser from accessing examination content based on in-band information transmitting, transported in client software or browser control part After row, the communication with background service is initiated, background service detects if requested from non-customer end software or browser control Part, refusal service and provide prompt;And/or prevent examinee from accessing other programs, client software or clear based on hot key shielding Device control of looking at shields all Hotkeys, prevents examinee from starting other programs by hot key;And/or it is prevented based on what process was killed For other programs by own window top set, the system process of client software or browser control part detection front end prevents other programs By own window top set, and by client software or browser control part itself top set and window maximized;And/or based on authorization Address list prevents browser from accessing the unauthorized page, and client software or browser control part detect jumping for current browser The page prevents browser from accessing other unauthorized pages.
It is described to prevent the access of unauthorized browser from examining based on in-band information transmitting as the preferred technical solution of the present invention Try content specific implementation flow are as follows:
Step1.1 client software or browser control part generate a dynamic character string, which includes and background service Between identity information, the timing information made an appointment;
Step1.2 client software or browser control part encrypt this character string, Encryption Algorithm by developer from Row agreement;
Step1.3 client software or browser control part control front end browser, in the http protocol headers that it sends In User_Agent field (or other appropriate fields also can), this encrypted character string be added;
Step1.4 background service obtains User_Agent field from http request, and decrypts, to the identity of requestor It is authenticated.If it find that being not from the client of agreement, then failure is returned to, refusal provides subsequent examination content;
Step1.5 is browsed page transmission each time, background service by above-mentioned Step1.1 to Step1.4 step The detection of device legitimacy.
It is described to prevent examinee from accessing other programs including objective based on hot key shielding as the preferred technical solution of the present invention Family end software or browser control part intercept all keyboard inputs, are filtered to Hotkey, such as alt+tab, ctrl+alt+ Delete etc. forbids examinee to switch screen from the root, rather than current window is only maximized top set, specific implementation flow Are as follows:
Step2.1: the key information of bottom is obtained using keyboard hook;
Step2.2: judge whether the hot key or hot key combination for needing to shield, if it is shield it;
Step2.3: cancel hook when program exits.
It is described to prevent other programs from setting own window based on what process was killed as the preferred technical solution of the present invention Top, specifically includes:
Step3.1 timing detection client software or browser control part itself whether in top, be not then by its top set, The process ID of top is recorded simultaneously;
Step3.2 counts each top set process ID, in addition to client self ID, if other process IDs count Greater than some threshold value (such as 3 times), then assert that the process is the program that possible practise fraud, pressure kills this process;
The key technology " prevent unauthorized browser from accessing " of Step3.3 combination front, if cheating program first set about be By force, it is also possible to first client software or browser control part process be killed and be removed, but examinee cannot normally take an examination at this time.Therefore only It can be that client software or browser control part obtain effective top set.
It is described to prevent browser from accessing unauthorized page based on authorized address list as the preferred technical solution of the present invention Mask body includes:
Step4.1 client software or browser control part obtain authorized address relevant to examination from background service in advance List;
Step4.2 compares destination address to the page jump of browser each time, client software or browser control part, such as Fruit is the address in grant column list, then allows to access;If not then forbidding accessing, and provide prompt.
Compared with prior art, the beneficial effects of the present invention are:
(1) propose a kind of in-band information transmission method, i.e., the direct webpage transmitted using browser itself, rather than Channel is directly established and kept for a long time between client software or browser control part and background service, is loaded with reducing backstage.Needle To the connectionless characteristic of http, using the certain field in agreement as transmission channel, devolved authentication information, but not to webpage Transmission and show and generate any adverse effect.
(2) another method for preventing examinee from accessing other programs is proposed, is not from how maximizing current window The angle of top set is set about, and is avoided the window for fighting for top with other programs, but is forbidden keyboard shift window from the root.
(3) a kind of top set own window is had found to obtain the cheat method of input, and specific aim proposes prevents method. Including always top itself will be placed in, detect possible cheating program automatically, forbid its operation with guarantee client software or Browser control part is constantly in top layer.
(4) it has found that one kind is jumped by web page interlinkage, to obtain the cheat method of information, while proposing prevention Method.
Detailed description of the invention
Fig. 1 is workflow schematic diagram of the present invention.
Specific embodiment
Now in conjunction with Figure of description, specific embodiments of the present invention is described in detail:
It is a kind of to prevent search document method towards unmanned invigilator, by the client software or the browser control that are located at front end Part and background service program composition, background service program mainly includes configuration module, authentication module, test modules, described Authentication module mainly realizes the legitimacy identification to front end identity information, the test modules then complete examination content input, Output etc..
Before examination, administrator first logs in the configuration module of background service, and confidence is matched in authorized address list, examination The pre-defined completion such as breath, authentication information.
Client software or browser control part operation, from background service obtain corresponding authorized address list, exam information, Authentication information etc..
Client software or browser control part initiate the communication with background service, and background service authenticates request, such as Fruit request comes from non-customer end software or browser control part, and backstage refusal services and provides prompt.
Following three inspections of circular flow in examination process, if user has been provided with certain anti-cheating function in following three Can, it can also only check other items:
1, client software or browser control part shield all Hotkeys, prevent examinee from starting other journeys by hot key Sequence.
2, client software or the system process of browser control part detection front end, prevent other programs by its window top set, And by itself top set and window maximized;Other top set processes are recorded simultaneously, is killed and is removed.
3, the jump page of client software or browser control part detection current browser, prevents it from accessing other pages.
The check process is specific as follows:
1, prevent unauthorized browser from accessing examination content based on in-band information transmitting
It is mutually authenticated between client software or browser control part and background service, to from unauthorized browser Access, background service refusal provide examination service.It is not keep connection because background service is a Web service.It is all The access from client be based on http agreement.Specific implementation flow are as follows:
Step1.1 client software generates a dynamic character string, which includes to make an appointment between background service Identity information, timing information.
Step1.2 client software encrypts this character string, and Encryption Algorithm is voluntarily arranged by developer.
Step1.3 client software controls front end browser, in the http protocol headers User_Agent field that it sends In (or other appropriate fields also can), this encrypted character string is added.
Step1.4 background service obtains User_Agent field from http request, and decrypts, to the identity of requestor It is authenticated.If it find that being not from the client of agreement, then failure is returned to, refusal provides subsequent examination content.
Step1.5 carries out browser legitimation detection to page transmission each time, background service according to the above method.
Allow to authenticate the identity of client using the customized Encryption Algorithm of developer.
2, prevent examinee from accessing other programs based on hot key shielding
Client software intercepts all keyboard inputs, is filtered to Hotkey, such as alt+tab, ctrl+alt+ Delete etc. forbids examinee to switch screen from the root, rather than current window is only maximized top set.Specific implementation flow Are as follows:
Step2.1: the key information of bottom is obtained using keyboard hook
Step2.2: judge whether the hot key or hot key combination for needing to shield.If it is it is shielded.
Step2.3: cancel hook when program exits.
3, prevent other programs by its window top set based on what process was killed
In view of in some cases, for example the security mechanism of system does not allow to intercept keyboard.The present invention can be integrated using more Kind method, to ensure against the other windows of access.Including the window maximized top set method of use, but traditional window is maximum Change top set, there are some problems.
It is, in principle, that itself can be maximized top set by client software or browser control part, similarly other softwares one Itself can also be placed in top by sample.Thus there are problems that a contention top layer.The present invention is accomplished by the following way Ensure that client software or browser control part are in top:
Step3.1 timing detection client software or browser control part itself whether in top, be not then by its top set, The process ID of top is recorded simultaneously, is usually detected frequency and is wanted relatively high, even if so that other programs obtain top interface, Moment is covered again, and examinee is made not have time search information needed;
Step3.2 counts each top set process ID, in addition to client self ID, if other process IDs count Greater than some threshold value (such as 3 times), then assert that the process is the program that possible practise fraud, pressure kills this process;
The key technology " prevent unauthorized browser from accessing " of Step3.3 combination front, if cheating program first set about be By force, it is also possible to first client software or browser control part process be killed and be removed, but examinee cannot normally take an examination at this time.Therefore only It can be that client software or browser control part obtain effective top set.
4, prevent browser from accessing the unauthorized page based on authorized address list
There may be many links in webpage, including exam web.Therefore the browser of authorization may also can access not The page of authorization, for example, click some with examination is unrelated links, it is therefore desirable to forbid this unrelated access of examinee.
Step4.1 client software or browser control part obtain authorized address relevant to examination from background service in advance List;
Step4.2 compares destination address to the page jump of browser each time, client software or browser control part, such as Fruit is the address in grant column list, then allows to access;If not then forbidding accessing, and provide prompt.
Obviously, the above embodiment of the present invention be only to clearly illustrate example of the present invention, and not be pair The restriction of embodiments of the present invention.For those of ordinary skill in the art, may be used also on the basis of the above description To make other variations or changes in different ways.There is no necessity and possibility to exhaust all the enbodiments.It is all this Any modifications, equivalent replacements, and improvements made by the spirit of invention and the interior of principle etc., should be included in the claims in the present invention Protection scope in.

Claims (4)

1. a kind of prevent search document method towards unmanned invigilator, which is characterized in that client of the method based on front end Software and background service realize that the background service includes configuration module, authentication module and test modules;
The method specifically includes:
It prevents unauthorized browser from accessing examination content based on in-band information transmitting, after client software operation, initiates With the communication of background service;
Background service detects if requesting to refuse to service and provide prompt from non-customer end software;
Prevent examinee from accessing other programs based on hot key shielding, the client software shields all Hotkeys, prevents from examining It is raw that other programs are started by hot key;
Prevent other programs by itself mouth top set based on what process was killed, the client software detects the system process of front end, Prevent other programs by own window top set, and by client software itself top set and window maximized;
Prevent browser from accessing the unauthorized page based on authorized address list, the client software detection current browser Jump page prevents browser from accessing other unauthorized pages;
Wherein, the unauthorized browser access examination content that prevents based on in-band information transmitting includes:
Step1.1, the client software generate a dynamic character string, and the dynamic character string includes to take with the backstage The identity information and timing information made an appointment between business;
Step1.2, the client software encrypt the dynamic character string;
Step1.3, the client software control front end browser, the http request head User_ that browser is sent in front end In Agent field, encrypted dynamic character string is added;
Step1.4, the background service obtain from http request and decrypt User_Agent field, to the identity of requestor into Row certification;If it find that being not from the client of agreement, then failure is returned to, refusal provides subsequent examination content;
Step1.5, to page transmission each time, the background service press above-mentioned Step1.1 to Step1.4 process carry out it is clear Device legitimacy of looking at detection.
2. according to claim 1 prevent search document method towards unmanned invigilator, which is characterized in that described based on heat The other programs of examinee's access that prevent of key shielding include that client software intercepts all keyboards inputs, are carried out to Hotkey Filter forbids examinee to switch screen, specific implementation flow from the root are as follows:
Step2.1: the key information of bottom is obtained using keyboard hook;
Step2.2: judge the key information whether be need the hot key or hot key combination that shield, if it is, to its into Row shielding;
Step2.3: cancel keyboard hook when program exits.
3. according to claim 2 prevent search document method towards unmanned invigilator, which is characterized in that it is described based on into What journey was killed prevents other programs from specifically including own window top set:
Step3.1: whether timing detection client software itself is not while to record top then by its top set in top Process ID;
Step3.2: counting each top set process ID, in addition to client self ID, if other process IDs count If it is greater than some threshold value, then assert that other process is the program that possible practise fraud, pressure kills other process.
4. according to claim 3 prevent search document method towards unmanned invigilator, which is characterized in that described to be based on awarding Power address list prevents the browser access unauthorized page from specifically including:
Step4.1: the client software obtains authorized address list relevant to examination from the background service in advance;
Step4.2: to the page jump of browser each time, the client software compares the destination address of page jump, such as Fruit is the address in grant column list, then allows to access;If not the address in grant column list, then forbid accessing and providing mentioning Show.
CN201610769072.1A 2016-08-30 2016-08-30 It is a kind of to prevent search document method towards unmanned invigilator Active CN106330931B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610769072.1A CN106330931B (en) 2016-08-30 2016-08-30 It is a kind of to prevent search document method towards unmanned invigilator

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610769072.1A CN106330931B (en) 2016-08-30 2016-08-30 It is a kind of to prevent search document method towards unmanned invigilator

Publications (2)

Publication Number Publication Date
CN106330931A CN106330931A (en) 2017-01-11
CN106330931B true CN106330931B (en) 2019-06-25

Family

ID=57788827

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610769072.1A Active CN106330931B (en) 2016-08-30 2016-08-30 It is a kind of to prevent search document method towards unmanned invigilator

Country Status (1)

Country Link
CN (1) CN106330931B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107393364A (en) * 2017-09-05 2017-11-24 艾牛(北京)科技有限公司 A kind of the classroom method of examination and system
CN107820210B (en) * 2017-11-14 2021-07-06 Oppo广东移动通信有限公司 Sign-in method, mobile terminal and computer readable storage medium
CN111241883B (en) * 2018-11-29 2023-08-25 百度在线网络技术(北京)有限公司 Method and device for preventing cheating of remote tested personnel
CN109815819A (en) * 2018-12-25 2019-05-28 北京城市网邻信息技术有限公司 A kind of cheat detection method, device, terminal device and storage medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101179562A (en) * 2006-12-08 2008-05-14 腾讯科技(深圳)有限公司 Method and system for restraining use of network control in authorization website
CN101656684A (en) * 2008-08-21 2010-02-24 中国移动通信集团公司 Content access authentication method, equipment and system for dynamic content delivery
CN102831556A (en) * 2012-04-20 2012-12-19 曾理 Method for preventing distance learning and examination cheat by interface preposition technology
CN103729198A (en) * 2014-01-26 2014-04-16 国家电网公司 Examination client anti-cheating screen locking method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101179562A (en) * 2006-12-08 2008-05-14 腾讯科技(深圳)有限公司 Method and system for restraining use of network control in authorization website
CN101656684A (en) * 2008-08-21 2010-02-24 中国移动通信集团公司 Content access authentication method, equipment and system for dynamic content delivery
CN102831556A (en) * 2012-04-20 2012-12-19 曾理 Method for preventing distance learning and examination cheat by interface preposition technology
CN103729198A (en) * 2014-01-26 2014-04-16 国家电网公司 Examination client anti-cheating screen locking method

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
一种B/S考试系统客户端控制功能的实现;陈胜凯;《温州大学学报》;20051231;第3.1.3小节
基于客户/服务器模式考试系统的C级防作弊策略及措施;徐少波;《软件工程》;20160229;第62-63页

Also Published As

Publication number Publication date
CN106330931A (en) 2017-01-11

Similar Documents

Publication Publication Date Title
US11868039B1 (en) System and method for continuous passwordless authentication across trusted devices
JP6426189B2 (en) System and method for biometric protocol standard
CN104969231B (en) The Password-proxy of security challenge auxiliary
US11876807B2 (en) Secure online access control to prevent identification information misuse
CN106330931B (en) It is a kind of to prevent search document method towards unmanned invigilator
CN108650212A (en) A kind of Internet of Things certification and access control method and Internet of Things security gateway system
Andress Foundations of information security: a straightforward introduction
CN103813334A (en) Right control method and right control device
CN105721159A (en) Operation system identity authentication method and operation system identity authentication system
Bursztein et al. Sessionjuggler: secure web login from an untrusted terminal using session hijacking
CN108282443A (en) A kind of reptile Activity recognition method and apparatus
SHAKIR User authentication in public cloud computing through adoption of electronic personal synthesis behavior
US20240113886A1 (en) Method and System for Custom Authenticators
Karlof Human factors in web authentication
Schaffer Ontology for authentication
Howard et al. Cyber fraud trends and mitigation
Noah et al. Evaluating Privacy & Security of Online Dating Applications with a Focus on Older Adults
Braun et al. Logsec: adaptive protection for the wild wild web
Tempesta Enforcing Session Integrity in the World" Wild" Web
Ricci Cybersecurity of digital therapeutics: analysis and modelling of mobile applications
Khan Web session security: formal verification, client-side enforcement and experimental analysis
Weitmann A Secure Platform for Remote Therapy: Requirements and Practical Execution/submitted by Thomas Benjamin Weitmann
Debnath et al. A comprehensive survey on mobile browser security issues, challenges and solutions
Srinivasan Zero Trust Network Architecture
Jayasekara Privacy: A Critical Evolution of Information Security in the Digital Age

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CB03 Change of inventor or designer information

Inventor after: Gao Feng

Inventor after: Xiao Xiao

Inventor after: Zeng Li

Inventor after: Zhou Wenjie

Inventor after: Qiu Gongsheng

Inventor after: Liu Zhiqiang

Inventor after: Xiao Aiwei

Inventor before: Gao Feng

Inventor before: Xiao Xiao

Inventor before: Zeng Li

Inventor before: Zhou Wenjie

Inventor before: Qiu Gongsheng

Inventor before: Xie Jianbin

Inventor before: Liu Zhiqiang

Inventor before: Xiao Aiwei

CB03 Change of inventor or designer information