KR102362031B1 - Method for preventing macro on web service and server performing the same - Google Patents

Abstract

A method of preventing macros on a web service and a server performing the same are shown. A macro operation prevention method of a macro prevention server according to one of various embodiments of the present invention includes the steps of: randomly determining positions of a plurality of input fields existing on a service interface provided to a user terminal; generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions where the plurality of input fields are displayed; In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. performing; transmitting the encrypted name and ID to the user terminal, and receiving an encrypted input value from the user terminal; decoding the input value received from the user terminal based on the session ID value and the seed value; and storing the decoded input value in a database.

Description

A method for preventing macros on web services and a server performing the same

Various embodiments of the present invention relate to a method for preventing macros on a web service and a server for performing the same.

As the Internet is closely related to real life, various actions that were performed offline are often made possible online.

One of them is related to purchasing, ordering or reservation. In the case of first-come-first-served purchase, the purchase opportunity goes to a certain number of people who have completed the purchase application on the web service preferentially. do.

In the case of purchases, orders, or reservations made on a first-come, first-served basis through a web service, competition may intensify if the number of people who want it is large. In this case, people wait at the time when a purchase, order or reservation is opened, and when that time arrives, information necessary for purchase, order or reservation (eg ID, name, phone number, payment information, etc.) Enter to try to buy, place an order, or make a reservation.

In many cases, excessive load is generated on the web server that performs purchase, order, or reservation, and accordingly, users repeatedly refresh the web page until the purchase, order or reservation is completed, and enter necessary information repeatedly. will make an attempt

Ordinary users make repeated attempts for such purchase, order, or reservation by themselves, but some users use a tool called a macro to make a purchase, order, or reservation. A macro is a program set so that a specific task can be repeatedly and automatically performed, and in the case of purchase, order, or reservation, it means a program that repeatedly tries until the purchase, order, or reservation is successful on the web service.

In relation to purchase, order, or reservation, macros can be operated in two main ways. The first is a method using a UI (User Interface), This selection is performed by a macro, and information corresponding to each input window is automatically entered. That is, in the first method, information corresponding to each input window is input by manipulating the position of an input device such as a mouse cursor and the like, and manipulating an input device such as a keyboard.

The second method related to macro operation is a method that utilizes the search within the Html (Hypertext Markup Language) source code, and uses the Dom Selector to check the positions of various input windows and to input information corresponding to each input window. will do Dom (Document Object Model) is an interface to a web page and refers to a hierarchical object-based representation of the original HTML document. The macro using the second method detects the location of the dome through the dome selector corresponding to each input window and allows information corresponding to the identified location to be input.

Therefore, in order to prevent macros on the web service, a countermeasure was needed to prevent all macros of the two types from operating normally.

Korean Patent Registration No. 10-1837726

It is an object of various embodiments of the present invention to prevent the normal operation of a macro operating through an input field position on a service interface.

It is an object of various embodiments of the present invention to prevent the normal operation of a macro operating through a search of a source code for implementing a service interface.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to one of the various embodiments of the present invention for solving the above-described problem, the method for preventing the macro operation of a service provided on the web by the macro prevention server is present on the service interface provided to the user terminal. randomly determining positions of a plurality of input fields; generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions where the plurality of input fields are displayed; In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. performing; transmitting the encrypted name and ID to the user terminal, and receiving an encrypted input value from the user terminal; decoding the input value received from the user terminal based on the session ID value and the seed value; and storing the decoded input value in a database.

The generating of the dummy input field may further include inserting a dummy code for generating the dummy input field into the source code for implementing the service interface.

The macro operation prevention method of the macro prevention server may be characterized in that the number of dummy codes inserted into the source code is randomly determined.

In the method for preventing macro operation of the macro prevention server, the dummy code is generated in the same format as a source code of an input field corresponding to a dummy input field generated through the dummy code, and only some identifiers are different from the corresponding source code It may be characterized in that it is generated to do so.

The inserting of the generated dummy input field so that it occupies a portion of the positions where the plurality of input fields are displayed may include reducing the size of the input field existing at the corresponding position before the generated dummy input field is inserted or positioning the input field. The method may further include adjusting so that there is no positionally overlapping part with the generated dummy input field by moving the .

The step of randomly determining the positions of the plurality of input fields may further include adjusting an interval between the plurality of input fields.

The method for preventing macro operation of the macro prevention server may further include calculating the frequency versus time of service requests attempted through the user terminal and determining a user to which the macro operation prevention technology is to be applied based on the calculated value. have.

The macro operation prevention method of the macro prevention server may be characterized in that the seed value is determined based on time information at which encryption is performed.

According to one of the various embodiments of the present invention for solving the above-described problems, the macro prevention server that operates to prevent macro operation for a service provided on the web exists on a service interface provided to a user terminal. a DOM structure randomizer that randomly determines positions of a plurality of input fields; a dummy field generator generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions displayed by the plurality of input fields; In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. an input field encryption unit for transmitting the encrypted name and ID to the user terminal; an input value decoding unit receiving an encrypted input value from the user terminal and decoding the input value received from the user terminal based on the session ID value and the seed value; and a communication unit that transmits the decoded input value to the database server.

According to an embodiment of the present invention, as the order, position, and interval of input fields displayed in the service interface are randomly determined and a dummy input field is inserted, a macro using the position of the input field in the service interface may not operate normally. have.

According to an embodiment of the present invention, a macro operating by utilizing a search in the source code through the encryption of the source code along with the insertion of the dummy field may not operate normally.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram schematically illustrating an environment in which a macro prevention server according to an embodiment of the present invention operates.
2 is a block diagram schematically showing the configuration of a macro prevention server according to an embodiment of the present invention.
3 is a flowchart illustrating a method of operating a macro prevention server according to an embodiment of the present invention.
4 is an exemplary view of an interface provided to a user terminal side by a macro prevention server according to an embodiment of the present invention, and is a diagram for explaining a method of preventing a macro operation by changing the position of an input field of the interface.
5 is an exemplary view of an interface provided to a user terminal side by a macro prevention server according to an embodiment of the present invention, and is a diagram for explaining a method of preventing a macro operation by changing an input field interval of the interface.
6 is a view for explaining a dummy code inserted into a source code for implementing a service interface by the macro prevention server according to an embodiment of the present invention.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components. Like reference numerals refer to like elements throughout, and "and/or" includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various elements, these elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may be the second component within the spirit of the present invention.

In the entire specification, when a part "includes" a certain element, this means that other elements may be further included, rather than excluding other elements, unless otherwise stated. In addition, terms such as "...unit" and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software. .

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram schematically illustrating an environment in which a macro prevention server 100 operates according to an embodiment of the present invention.

Referring to FIG. 1 , a general web service may be configured in a form similar to that of FIG. 1 to provide a service to a user.

In the present specification, for convenience of explanation, the macro prevention server 100 is displayed as replacing the roles of the web server and the WAS server, but in a general web service, the user terminal 200 communicates with the web server, and the web server performs communication with the WAS server, and the WAS server may communicate with the database server 300 .

The WAS server is a server that performs dynamic processing that cannot be processed by a web server, and may be a server that processes content to be converted according to a user's service request.

According to various embodiments of the present invention, the macro prevention server 100 can simultaneously perform the roles of a web server and a WAS server and simultaneously perform a macro prevention function. And it is also possible to provide a macro prevention function through communication with the WAS server.

The macro prevention server 100 may serve to provide services in a form in which it is difficult for users to utilize macros in the process of performing various orders, reservations, or applications by accessing specific web services.

To this end, the macro prevention server 100 is configured such that the positions of a plurality of input fields are randomly displayed on the interface of the web service displayed on the user terminal 200 in order to prevent macros using a UI (User Interface). You can adjust the user interface.

In addition, the macro prevention server 100 may insert a dummy input field into the source code to prevent a macro method using a dom selector and perform encryption of values related to the input field.

Such a macro prevention server 100 may include hardware such as a control unit having at least one processor, a communication module, a storage unit (eg, memory), or software for an algorithm operation.

The user terminal 200 is controlled by the user, and it can access the macro prevention server 100 through a web browser or computer software or application installed on the user terminal 200 . The user terminal 200 may exchange various data with the macro prevention server 100, and based on the data received from the macro prevention server 100, a web service through the screen (display unit) of the user terminal 200 interface can be displayed.

A user may purchase, order, or make a reservation for various products or services through the user terminal 200, which is obtained by accessing the macro prevention server 100 that the user terminal 200 provides a specific web service to. Alternatively, if an interface for a service is provided and displayed, the user may input information necessary for purchase, order, or reservation into various input fields displayed on the interface to proceed.

The user terminal 200 may include a memory for storing information necessary for operation, a central processing unit such as a CPU for performing various operations necessary for operation, an input/output device, and the like.

The user terminal 200 is a mobile phone, a smart phone, a personal digital assistant (PDA), a portable multimedia player (PMP), a tablet PC, etc. all kinds of handheld-based that can be connected to a web server through a network. It may include a wireless communication device, and among digital devices equipped with memory means and equipped with a microprocessor, such as personal computers (eg, desktop computers, notebook computers, etc.), workstations, PDA's, web pads, etc. It could be one.

The database server 300 may serve to store various data processed by the macro prevention server 100 . According to an embodiment, the database server 300 may store personal information such as a user's ID, password, name, address, and phone number, and may also store information on goods or services provided through a web service.

According to one embodiment, the database server 300 may exist separately from the macro prevention server 100 as in FIG. 1 , but according to another embodiment, the role of the database server 300 is present in the macro prevention server 100 . It may be replaced by a storage unit.

According to an embodiment of the present invention, the communication network used by the macro prevention server 100 to communicate with the user terminal 200 and the database server 300 may be configured regardless of its communication mode, such as wired and wireless, and , for example, a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN) may be implemented as various communication networks. Preferably, the communication network according to an embodiment of the present invention may be a known World Wide Web (WWW) or the like.

2 is a block diagram schematically showing the configuration of the macro prevention server 100 according to an embodiment of the present invention.

Referring to FIG. 2 , the macro prevention server 100 includes a DOM structure randomizer 110 , a dummy field generator 120 , an input field encryption unit 130 , an input value decryption unit 140 , and a macro prevention target determiner 150 , the communication unit 160 , the storage unit 170 , and the control unit 180 may be included.

For convenience of explanation, the subjects performing each role in the macro prevention server 100 are displayed in the form of ~ parts or ~ modules, but each part is a sub-program module operating in the macro prevention server 100 or The control unit 180 may be functionally classified. These program modules are a concept that encompasses routines, subroutines, programs, objects, components, data structures, etc. that perform respective operations or execute specific abstract data types, but are not limited thereto.

The DOM structure randomizer 110 may randomly determine positions of a plurality of input fields existing on a service interface provided to the user terminal 200 . For example, when there are input fields corresponding to the orderer's name, mobile phone number, email address, and delivery address on the service interface displayed on the user terminal 200, the DOM structure randomization unit 110 performs each input field item. You can change the order or position displayed in .

When the DOM structure randomization unit 110 randomly determines the positions of a plurality of input fields existing on the service interface provided to the user terminal 200, the control may be performed so that the intervals between the plurality of input fields are randomly determined. have. For example, when the input fields corresponding to the orderer's name, mobile phone number, e-mail address, and delivery address are displayed sequentially from the top to the bottom of the screen, the input field corresponding to the name of the orderer and the mobile phone number Spacing may be adjusted in such a way that the interval between the input fields is determined to be 10 pixels, the interval between the input field corresponding to the mobile phone number and the input field corresponding to the e-mail address is determined to be 20 pixels.

The DOM structure randomizer 110 may determine in which part the dummy input field generated by the dummy field generator 120, which will be described later, is located on the interface for the web service.

The dummy field generator 120 generates one or more dummy input fields, and uses the generated dummy input fields to occupy a portion of positions where a plurality of input fields existing on an interface in which the dummy input fields do not exist are displayed. can be inserted.

According to an embodiment, the position at which the dummy field is inserted may be determined by the dummy field generator 120 , or may be determined by the DOM structure randomizer 110 as described above.

When the generated dummy input field occupies a portion of the positions where other input fields are displayed, the dummy field generator 120 reduces or reduces the input field existing in the corresponding position before the generated dummy input field is inserted. By moving the input field existing in the corresponding position, the adjustment may be performed so that there is no positionally overlapping part with the generated dummy input field.

In order to generate the dummy input field, the dummy field generator 120 may insert a dummy code for generating the dummy input field into the source code for implementing the service interface.

The inserted dummy code may define various properties of the dummy input field. For example, the dummy code written in html may be generated in a format defining properties such as name, ID, and class.

The generated dummy code may be generated in the same format as the source code of the input field corresponding to the dummy input field generated through the corresponding dummy code, and may be generated such that only some identifiers are different from the corresponding source code. For example, the dummy code may be generated such that only the identifier corresponding to the name is different from the corresponding source code, and the ID or class and other identifiers are the same.

According to an embodiment, the dummy field generator 120 may randomly determine the number of dummy codes inserted into the source code for implementing the service interface. However, since the size of the service interface displayed on the user terminal 200 is limited, the dummy field generator 120 may set the number of dummy codes to be randomly determined within a limited number. For example, the dummy field generator 120 may limit the maximum number of dummy codes to be generated so that the number of generated dummy codes does not exceed three.

The input field encryption unit 130 encrypts the name (name) and ID (id) values among the properties of the input field for at least some of the plurality of input fields existing on the service interface provided to the user terminal 200 . can be done

The encryption operation of the input field encryption unit 130 may be performed based on a session ID value and a seed value that are given when a specific user terminal 200 accesses the macro prevention server 100 . That is, the session ID value and the seed value may be utilized as a key value used for encryption and decryption. The seed value may be set in various ways, and according to an embodiment, may be determined based on time information on which encryption is performed.

The input field encryption unit 130 may transmit the encrypted name and ID to the user terminal 200 .

The input value decoding unit 140 may receive, from the user terminal 200, input values input by the user into various input fields in an encrypted state. The user terminal 200 is an input value input by the user into a plurality of input fields existing on the interface of the web service in the same manner as the method in which the input field encryption unit 130 of the macro prevention server 100 performs encryption. Encryption may be performed for each, and encryption of information of an input item may also be additionally performed.

The input value decryption unit 140 may decrypt the input value received from the user terminal 200 through the session ID value and the seed value used during encryption.

According to an embodiment, the input value decoding unit 140 compares the decoded input value with the type of the input field to which the corresponding input value belongs, and confirms whether the decoded input value is normally placed in the corresponding input field. .

The input value decoding unit 140 may store the decoded input value in a database, and according to an embodiment, this may be accomplished by transmitting the input value to the external database server 300 .

According to an embodiment, the input value decoding unit 140 compares the decoded input value with the type of the input field to which the corresponding input value belongs, and confirms whether the decoded input value is normally placed in the corresponding input field. Input values can be stored in a database.

For example, if the decoded input value consists of 11 digits, it corresponds to a phone number. 100), the request may be rejected and the input value may not be stored in the database.

The macro prevention target determiner 150 may calculate the frequency versus time of service requests attempted through the user terminal 200 , and determine a user to which the macro operation prevention technology is to be applied based on the calculated value.

That is, when a user purchases, orders, or makes a reservation for a specific product or service through the web service, the macro operation prevention technology may be set to be applied only when the user repeatedly requests a service through the macro.

Due to the operation of the macro prevention target determining unit 150 , a user who normally uses a web service without using a macro may not suffer inconvenience due to an interface change.

The communication unit 160 enables the macro prevention server 100 to communicate with the user terminal 200 and the database server 300 . The communication network used by the communication unit 160 to perform communication may be configured regardless of its communication mode, such as wired and wireless, for example, a local area network (LAN), a metropolitan area network (MAN). It may be implemented in various communication networks, such as an area network) and a wide area network (WAN).

The communication unit 160 may perform a role of actually implementing the communication functions described above in the description of the input field encryption unit 130 and the input value decoding unit 140 .

The storage unit 170 serves to store information that is collected, generated, and processed in various components of the macro prevention server 100 . That is, the storage unit 170 may store interface-related information of a web page necessary for the operation of a web service, information on a product or service provided, and the like. Such information may be separately stored in the database server 300 , but a part thereof may be stored in the storage unit 170 . The storage unit 170 may include, for example, a memory, a cache, a buffer, and the like, and may be composed of software, firmware, hardware, or a combination of at least two or more thereof.

The control unit 180 includes a DOM structure randomization unit 110 , a dummy field generation unit 120 , an input field encryption unit 130 , an input value decoding unit 140 , a macro prevention target determination unit 150 , and a communication unit 160 . and a function of controlling data flow between the storage unit 170 . That is, the control unit 180 according to an embodiment of the present invention includes a DOM structure randomizer 110 , a dummy field generator 120 , an input field encryption unit 130 , an input value decryption unit 140 , and a macro prevention target. The determination unit 150 , the communication unit 160 , and the storage unit 170 may control and support to perform their own functions, respectively.

In FIG. 2 , the DOM structure randomization unit 110 , the dummy field generation unit 120 , the input field encryption unit 130 , the input value decoding unit 140 , the macro prevention target determination unit 150 , and the communication unit 160 are control units. Since 180 is functionally classified, it may be integrated as one control unit 180 .

3 is a flowchart for explaining how the macro prevention server 100 operates according to an embodiment of the present invention.

At least some of the steps of FIG. 3 may be omitted and may be performed by changing the mutual order.

Referring to FIG. 3 , the macro prevention server 100 may receive a request for a web service from the user terminal 200 ( S310 ). As described above, the request for the web service may include a request for purchase, order, reservation, etc. for a specific product or service.

After receiving the request for the web service from the user terminal 200 , the macro prevention server 100 may provide web page information for the web service to the user terminal 200 . The web page may include various interfaces for users, and according to an embodiment, the interface of the web page may be implemented through html.

The macro prevention server 100 may randomly determine the positions of a plurality of input fields existing on the interface provided to the user terminal 200 (S320). Among the interfaces provided to the user terminal 200 , a plurality of input fields to be input by a user may exist on an interface provided for a request for purchase, order, reservation, etc. of a product or service. For example, in the interface for reserving a specific service, there may be input fields for inputting the name of the reservationer, phone number, desired reservation time, etc. You can make a reservation for the service.

The macro prevention server 100 may generate a dummy input field and insert it so that the generated dummy input field occupies a part of the position of the existing input field (S330). In this case, the existing input field may be reduced or moved according to the insertion of the dummy input field so as not to overlap the dummy input field in terms of location.

The generation of such a dummy input field may be accomplished by inserting a dummy code into an html source code that implements an interface for providing a web service.

The macro prevention server 100 is based on the session ID value given when the user terminal 200 accesses the macro prevention server 100 and the seed value determined in an arbitrary manner, the name and ID of the input field Encryption may be performed on the (id) attribute (S340). According to an embodiment, the seed value may be determined according to time information at which a service request is performed.

After the encryption is completed, the macro prevention server 100 may transmit the generated interface information to the user terminal 200 (S350). Such a step may be performed in such a way that the macro prevention server 100 transmits the source code of the html method to the user terminal 200, in this case, the user terminal 200 generates an interface through the received source code and displays it It can be expressed through wealth.

Encrypted items may be decrypted on the user terminal 200 , and decryption may be performed by utilizing the session ID value and seed value used for encryption in the macro prevention server 100 .

Thereafter, the user may input information corresponding to a plurality of input fields present on the interface confirmed through the user terminal 200 , and on the user terminal 200 , the input value input by the user into the input field and the corresponding Encryption of information on which item the input value is input may be performed. Such encryption may be performed in the same manner as the encryption method performed in the macro prevention server 100 .

The user terminal 200 transmits the encrypted input value to the macro prevention server 100, and accordingly, the macro prevention server 100 may receive the encrypted input value (S360). The macro prevention server 100 may decode the received input value by using the session ID value and the seed value (S370), and may transmit the decoded input value to the database server 300 (S380).

Before transmitting the decoded input value to the database server 300 through step S380, the macro prevention server 100 compares the decoded input value with information on the type of the input field to which the input value belongs, so that the decoded input value is You can check whether the input value is properly placed in the corresponding input field, and if the input value is not correctly placed, such as the address value being placed in the input field corresponding to the phone number, error processing is processed and the input value is stored in the database server ( 300) may not be stored.

4 is an exemplary view of an interface provided to the user terminal 200 side by the macro prevention server 100 according to an embodiment of the present invention. It is a drawing.

Referring to FIG. 4A , a basic form of an interface through which a user can place an order for a specific product or service is displayed.

The macro prevention server 100 may provide the user terminal 200 with a service interface of the form as shown in FIG. It is also possible to provide a service interface of the user terminal 200 .

Comparing (a) and (b) of FIG. 4 , it can be seen that the positions of the input field corresponding to 'orderer' and the input field corresponding to 'mobile phone number' are switched.

The macro prevention server 100 may generate one or more dummy input fields and insert the generated dummy input fields to occupy a portion of positions where a plurality of input fields are displayed. This can be confirmed through (c) of FIG. 4 , and it can be seen that the input field corresponding to 'orderer' is configured in plurality, unlike in FIGS. 4 (a) and (b). In FIG. 4(c) , there are three input fields corresponding to 'orderer'. The relatively short input fields located at the left and right sides correspond to the dummy input fields, and only the input field located in the middle It can actually correspond to an input field where the user can enter information.

According to an embodiment, the actually used input field and the dummy input field may be classified by a difference in size and color, or may be displayed in an actually used input field.

Even if the user inputs information into the dummy input field or information is input into the dummy input field by a macro, this may not be normally utilized in the user's service use.

Although two dummy input fields are shown to be disposed on the left and right of the actual input field in FIG. 4C , the number and positions of the dummy input fields may be randomly determined.

5 is an exemplary view of an interface provided to the user terminal 200 by the macro prevention server 100 according to an embodiment of the present invention. It is a drawing.

Referring to FIG. 5A , a basic form of an interface through which a user can place an order for a specific product or service is displayed.

The macro prevention server 100 may provide the user terminal 200 with a service interface of the form as shown in (a) of FIG. A service interface in the form of may be provided to the user terminal 200 .

Comparing (a) and (b) of FIG. 5, the interval between the input field corresponding to 'orderer' and the input field corresponding to 'mobile phone number' is larger in (b) than in (a). can confirm that there is

In this way, the macro prevention server 100 can prevent the operation of the macro using the UI by changing the order and position between the input fields as well as the spacing between the plurality of input fields as described above with reference to FIG. 4 . .

6 is a view for explaining a dummy code inserted into the source code for implementing the service interface by the macro prevention server 100 according to an embodiment of the present invention.

Referring to FIG. 6 , a source code corresponding to an input field for an 'orderer' item on the interface shown in FIGS. 4 and 5 is displayed.

In detail, the source code shown in FIG. 6 is the source code of FIG. 4C , and the red part of the source code is a dummy code part for generating a dummy input field.

In FIG. 6 , three dummy codes are displayed, and it can be seen that the displayed dummy codes are generated in the same format as a source code of an input field corresponding to a dummy input field generated through the dummy code. Also, it can be confirmed that the dummy code is generated so that only some identifiers are different from the corresponding source code. In FIG. 6 , it can be seen that only the identifier corresponding to the name is set differently and the remaining identifiers are set the same.

According to an embodiment, at least a portion of the dummy code may be inserted in a form that is not displayed on the user interface. In this case, the dummy code is inserted on the soak code, but a corresponding dummy input field may not be displayed on the user interface. .

As described above, according to various embodiments of the present invention, it is possible to prevent the operation of the macro using the UI through the external change of the interface that provides the web service, and the macro using the dome selector in the html source code. In this case, the operation of the macro can be prevented through the insertion and encryption of dummy codes.

The steps of the method or algorithm described in relation to the embodiment of the present invention may be implemented directly in hardware, as a software module executed by hardware, or by a combination thereof. A software module may contain random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, CD-ROM, or It may reside in any type of computer-readable recording medium well known in the art to which the present invention pertains.

In the above, embodiments of the present invention have been described with reference to the accompanying drawings, but those of ordinary skill in the art to which the present invention pertains can realize that the present invention can be embodied in other specific forms without changing the technical spirit or essential features thereof. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

100: anti-macro server
200: user terminal
300: database server

Claims (10)

In the method of preventing macro action for a service provided on the web by a macro prevention server,
randomly determining positions of a plurality of input fields existing on a service interface provided to a user terminal;
generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions where the plurality of input fields are displayed;
In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. performing;
transmitting the encrypted name and ID to the user terminal, and receiving an encrypted input value from the user terminal;
decoding the input value received from the user terminal based on the session ID value and the seed value; and
storing the decrypted input value in a database;
Inserting the generated dummy input field so that it occupies a portion of the positions where the plurality of input fields are displayed includes:
The step of reducing the size or moving the position of the input field existing at the corresponding position before the generated dummy input field is inserted so that there is no positionally overlapping part with the generated dummy input field is further performed. A method for preventing macro action of a macro prevention server, including.
According to claim 1,
The step of generating the dummy input field includes:
The method for preventing macro operation of a macro prevention server further comprising inserting a dummy code for generating a dummy input field into the source code for implementing the service interface.
3. The method of claim 2,
A method for preventing macro operation of a macro prevention server, characterized in that the number of dummy codes inserted into the source code is randomly determined.
3. The method of claim 2,
The dummy code is generated in the same format as the source code of the input field corresponding to the dummy input field generated through the dummy code, and is generated so that only some identifiers are different from the corresponding source code. How to prevent macro action in .
delete According to claim 1,
The step of randomly determining the positions of the plurality of input fields includes:
Further comprising the step of adjusting an interval between the plurality of input fields, the macro operation prevention method of the macro prevention server.
In the method of preventing macro action for a service provided on the web by a macro prevention server,
randomly determining positions of a plurality of input fields existing on a service interface provided to a user terminal;
generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions where the plurality of input fields are displayed;
In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. performing;
transmitting the encrypted name and ID to the user terminal, and receiving an encrypted input value from the user terminal;
decoding the input value received from the user terminal based on the session ID value and the seed value; and
storing the decrypted input value in a database;
Calculating the frequency versus time of service requests attempted through the user terminal, and determining a user to which a macro operation prevention technology is to be applied based on the calculated value.
According to claim 1,
The seed value, characterized in that determined based on the time information on which encryption is performed, the macro operation prevention method of the macro prevention server.
In the method of preventing macro action for a service provided on the web by a macro prevention server,
randomly determining positions of a plurality of input fields existing on a service interface provided to a user terminal;
generating at least one or more dummy input fields and inserting the generated dummy input fields to occupy a portion of positions where the plurality of input fields are displayed;
In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. performing;
transmitting the encrypted name and ID to the user terminal, and receiving an encrypted input value from the user terminal;
decoding the input value received from the user terminal based on the session ID value and the seed value; and
storing the decrypted input value in a database;
The method further comprising the step of comparing the decoded input value with a type of an input field to which the corresponding input value belongs, and confirming whether the decoded input value is normally placed in a corresponding input field.
In the macro prevention server that operates to prevent macro operation for services provided on the Web,
a DOM structure randomizer for randomly determining positions of a plurality of input fields existing on a service interface provided to a user terminal;
a dummy field generator generating at least one dummy input field and inserting the generated dummy input field to occupy a portion of positions displayed by the plurality of input fields;
In performing encryption on the name and ID of the input field for at least a portion of the plurality of input fields, encryption is performed based on the session ID value and the seed value provided when the user terminal accesses the macro prevention server. an input field encryption unit for transmitting the encrypted name and ID to the user terminal;
an input value decoding unit receiving an encrypted input value from the user terminal and decoding the input value received from the user terminal based on the session ID value and the seed value; and
It includes a communication unit that transmits the decoded input value to the database server,
The dummy field generating unit reduces the size or moves the position of the input field existing at the corresponding position before the generated dummy input field is inserted, so that there is no positionally overlapping part with the generated dummy input field. Regulating, anti-macro server.

Images