WO2016184216A1 - 一种防止盗链的方法、防止盗链的服务器及客户端 - Google Patents

一种防止盗链的方法、防止盗链的服务器及客户端 Download PDF

Info

Publication number
WO2016184216A1
WO2016184216A1 PCT/CN2016/075229 CN2016075229W WO2016184216A1 WO 2016184216 A1 WO2016184216 A1 WO 2016184216A1 CN 2016075229 W CN2016075229 W CN 2016075229W WO 2016184216 A1 WO2016184216 A1 WO 2016184216A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
client
message
server
string
Prior art date
Application number
PCT/CN2016/075229
Other languages
English (en)
French (fr)
Inventor
曹立权
胡东旭
Original Assignee
乐视云计算有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 乐视云计算有限公司 filed Critical 乐视云计算有限公司
Publication of WO2016184216A1 publication Critical patent/WO2016184216A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/75—Media network packet handling
    • H04L65/764—Media network packet handling at the destination 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • Embodiments of the present invention relate to the field of video broadcasting, and in particular, to a method for preventing an anti-theft chain, a server for preventing a stolen chain, and a client.
  • a management mechanism is set for the user who invokes the content of the webpage.
  • the blacklist records a plurality of IP (Internet Protocol) addresses forbidding access to the webpage, and when the website providing the webpage content receives the request for accessing the content of the webpage, detecting and transmitting the Whether the requested IP address is in the blacklist, and if so, access to the content of the webpage is prohibited to prevent the stolen chain of the webpage content.
  • IP Internet Protocol
  • Method 2 judging the reference address method.
  • the method of judging the reference address is to determine whether to steal the chain by judging the value of the Referer field of the HTTP (Hyper Text Transfer Protocol) header at the time of the browser request.
  • HTTP Hyper Text Transfer Protocol
  • the above two anti-theft chain methods have defects: the first method is based on the authentication of the IP address, and the role of establishing the blacklist is limited to the scope of the pirate chain; the second method is to determine the application address to prevent theft, but Because the reference address is easily forged, resulting in incomplete anti-theft chain.
  • the embodiment of the invention provides a method for preventing chain hacking, a server for preventing hacking, and a client for solving the problem that the reliability and accuracy of the anti-theft chain are poor in the existing anti-theft chain technology.
  • An embodiment of the present invention provides a method for preventing hacking, including: obtaining, according to a received multimedia information request message, a verification string corresponding to a client that sends the multimedia information request message; and generating, according to the verification string, And verifying the message; and sending the verification message to the client; notifying the client to perform an operation on the verification string included in the verification message, generating first verification information; and receiving a verification response sent by the client a message, wherein the verification response message includes the first verification information; performing an operation on the verification string and a key corresponding to the client to generate second verification information; and when the first verification information is When the second verification information is different, the client is determined to be a hacking client, and the multimedia information requested by the multimedia information request message is refused to be sent to the client.
  • An embodiment of the present invention provides a method for preventing a hacking, including: sending a multimedia information request message to a server; and receiving a verification message generated by the server according to the multimedia information request message, where the verification message includes verification a string; performing an operation on the verification string included in the verification message to generate first verification information; generating a verification response message to the server according to the first verification information; and notifying the server to the verification character
  • the string and the locally corresponding key are operated to generate second verification information, and when the first verification information is different from the second verification information, the multimedia information returned by the server is refused to be sent to the local.
  • the embodiment of the present invention provides a server for preventing theft chain, comprising: a verification string obtaining unit, configured to obtain a verification string corresponding to the client that sends the multimedia information request message according to the received multimedia information request message; a message generating unit, configured to generate a verification message according to the verification string, a sending unit, configured to send the verification message to the client, and a notification unit, configured to notify the client to the verification message
  • the included verification string is operated to generate first verification information
  • the receiving unit is configured to receive the sending by the client a verification response message, wherein the verification response message includes the first verification information
  • the verification information generating unit is configured to perform operation on the verification string and the key corresponding to the client to generate second verification information
  • a hacking processing unit configured to: when the first verification information is different from the second verification information, determine that the client is a hacking client, and refuse to send the multimedia information requested by the multimedia information request message To the client.
  • the embodiment of the present invention provides a client for preventing theft, comprising: a sending unit, configured to send a multimedia information request message to the server; and a receiving unit, configured to receive the verification generated by the server according to the multimedia information request message a message, wherein the verification message includes a verification string; the verification information generating unit is configured to perform an operation on the verification string included in the verification message to generate first verification information; and a verification response message generating unit, configured to The first verification information, the verification response message is generated; the sending unit is further configured to send the verification response message to the server, and the notification unit is configured to notify the server to the verification string and the client The key corresponding to the operation is performed to generate the second verification information, and when the first verification information is different from the second verification information, the multimedia information returned by the server is refused to be sent to the client.
  • the server when the server receives the multimedia information request message sent by the client, the server sends the verification string corresponding to the client to the client; the client encrypts the verification string to generate the first verification information.
  • the server processes the verification string and the key corresponding to the client according to the verification string, and generates second verification information; when the first verification information and the second verification information are different, the client is determined to be The hacking client then refuses to send multimedia information to the hacking client.
  • the server authenticates the generated first verification information by using the verification string and the key corresponding to the client, and determines the client that fails the authentication as the hacking client.
  • the process of determining the stolen client depends on the authentication result, and is not limited by the IP address and the reference address.
  • FIG. 2 is a schematic diagram of signaling interaction between devices in a communication system according to an embodiment of the present invention
  • FIG. 3 is a flowchart 1 of a method for preventing hacking in an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a server for preventing hacking in an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a client for preventing stolen chains according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a communication system architecture in an embodiment of the present invention, where the communication system includes a server and a plurality of clients, wherein the server is a device capable of providing multimedia information, and the communication system includes a
  • the server is a device capable of providing multimedia information
  • the communication system includes a
  • a server and a client are taken as an example, and preferred embodiments of the embodiments of the present invention are described in detail with reference to the accompanying drawings.
  • FIG. 2 it is a signaling interaction diagram between a server and a client in the embodiment of the present invention.
  • the client generates a corresponding multimedia information request message according to the user indication;
  • the server generates a verification message and sends the verification message to the client according to the received multimedia information request message;
  • the client generates a verification response message according to the verification message;
  • the server generates the verification response message according to the verification response message.
  • the content contained in the client authenticates the client.
  • the multimedia information requested by the client is sent to the client. Otherwise, the multimedia information is refused to be sent to the client.
  • the process of preventing theft on the server side includes:
  • Step 300 Acquire, according to the received multimedia information request message, a verification string corresponding to the client that sends the multimedia information request message.
  • the server receives the multimedia information request message sent by the client, where the multimedia information request message includes multiple message attributes, such as: the multimedia information requested by the client, the IP address of the client, and the network port number, and the The multimedia information request message may be implemented by using an HTTP message; the multimedia information may be picture information, video information or audio information.
  • the multiple message attributes included in the server acquiring the multimedia information request message at least include: the IP address and the network port number of the client, and the IP address and the network port number are arranged according to a preset rule to generate a verification string.
  • the preset rule may be preset according to the preset The order is arranged in order, or it may be arranged in an out-of-order manner.
  • the message attribute included in the multimedia information request message further includes: acquiring the time when the multimedia information request message is received (indicated as T1), and the server may also generate a random number locally (denoted as RN); the server may use the foregoing IP address.
  • the network port number and the T1 are arranged according to a preset rule to generate a verification string.
  • the server arranges the IP address and the network port number and the RN according to a preset rule to generate a verification string.
  • the server arranges the IP address and the network port number included in the RN, the multimedia information request message, and the T1 in a preset order to form a verification string (denoted as CH), for example, the preset sequence is RN.
  • the out-of-order combination forms a verification string.
  • the IP address is (ABC) and the network port number is P.
  • the default method is to add the network port number to the second character of the IP address, and then the RN and the sorted IP address.
  • the server generates different verification strings for each client according to the relevant attributes of the client. Even if the same client requests multimedia information from the server at different time points, the server generates different verification strings. It avoids the problem that the server generates the same verification string for all clients or the authentication string that is inconvenient for the same client, which causes poor security and ensures the reliability of the anti-theft chain process.
  • Step 310 Generate a verification message according to the verification string.
  • the server adds the above verification string to the specified field in the verification message.
  • the server sends the foregoing verification message including the verification string to the client.
  • Step 330 Notifying the client to perform an operation on the verification string included in the verification message. Generate first verification information.
  • the client after receiving the verification request sent by the server, the client obtains the verification string included in the verification request; the client responds to the verification request by using a preset white box encryption function locally (denoted as WB), encrypting the above verification string, and processing the encrypted verification string by using a preset digital signature algorithm to generate first verification information (denoted as DG).
  • WB white box encryption function
  • the white box encryption function is an encryption function generated according to a preset encryption algorithm and a key, and the preset encryption algorithm may be set according to a specific application scenario; when the client generates a white box encryption function, the foregoing is deleted. Key.
  • the first verification information obtained by the client satisfies the following formula:
  • DG represents the first verification information
  • SHA-1 Secure Hash Algorithm
  • WB white box encryption function
  • CH is a verification string.
  • the client generates a white box encryption function locally according to the preset encryption function and the key, and the generated verification string is processed by the white box encryption function, and the client does not include the key locally, and the chain is stolen. No matter whether through static tracking or dynamic tracking, the key cannot be obtained. Even if the hacker knows the above-mentioned default encryption algorithm, the brute force method is needed to obtain the key, thereby implementing the hacking, which will greatly improve the duration of the hacking. The cost of stealing chains increases the reliability of the anti-theft chain.
  • Step 340 Receive a verification response message sent by the client, where the verification response message includes the foregoing first verification information.
  • the server when the server receives the verification response message sent by the client, the server obtains the first verification information included in the verification response message.
  • the verification string corresponding to the client is deleted, and correspondingly, the verification response message sent by the client to the server may further include a verification string.
  • the server clears the verification string from the local, which reduces the occupation of the server storage space by the verification string.
  • Step 350 Perform an operation on the verification string and the key corresponding to the client to generate second verification information.
  • the server locally stores a peer function (denoted as ENC), the peer function is a general function, which corresponds to a white box encryption function; the server locally includes a key corresponding to each client, or The server locally includes a key corresponding to each client type, and the server may obtain a key corresponding to the client according to the client identifier or the client type; and use the peer function to verify the string and the key corresponding to the client. Performing an operation; and encrypting the verification string after the operation by using a preset encryption algorithm to generate second verification information (denoted as DGS).
  • ENC peer function
  • DGS second verification information
  • the server before the verification string and the key corresponding to the client are operated, the server also needs to verify whether the IP address and the network port number are correct; wherein the server determines that the IP address and the network port number are correct, that is, the server determines the verification string.
  • the IP address contained in the server is the same as the IP address of the current TCP (Transmission Control Protocol) connection detected by the server, and the network port number included in the verification string and the current TCP detected by the server.
  • the network port number of the connection is the same.
  • the server needs to acquire T1 and receive the second verification information (ie, T2), and calculate The duration between T1 and T2 (ie, T2-T1); the server determines that the above (T2-T1) has not reached the preset duration, and the above IP address and the network port number are correct.
  • the server determines that (T2-T1) reaches the preset duration, or the above IP address, or the network port number is incorrect, the client is prompted to resend the verification response message.
  • the second verification information generated by the server satisfies the following formula:
  • DGS represents the first verification information
  • SHA-1 represents a preset digital signature algorithm
  • ENC is a peer-to-peer function, optionally, the ENC may be (Advanced Encryption Standard; short for Advanced Encryption Standard Algorithm); CH is verification String.
  • Step 360 When the first verification information is different from the second verification information, determine that the client is a hacking client, and refuse to send the multimedia information requested by the multimedia information request message to the client.
  • the server compares the first verification information with the second verification information, and determines, according to the comparison result, whether the client is a chain stealing client.
  • the server determines that the first verification information is the same as the second verification information, determining that the client is a non-hacking client, sending the multimedia information requested by the multimedia information request message to the Client, where multimedia information can be carried over HTTP messages.
  • the server determines that the first verification information is different from the second verification information, it is determined that the client is a hacking client, and the multimedia information requested by the multimedia information request message is refused to be sent to the client.
  • the server determines that the client is a hacking client, the identifier of the client is added to the locally saved blacklist, and when the multimedia information request message sent by the client is received again, the client identifier is black. The identifiers in the list are matched and the server will directly reject the delivery of multimedia information to the client.
  • the server adopts an authentication method to verify whether the client is a hacking client, and the authentication reliability and accuracy are higher through the encryption function than the IP address verification method.
  • a process for preventing illegal client stealing includes:
  • Step 400 Send a multimedia information request message to the server.
  • the client when the client receives the user indication and determines the multimedia information to be acquired, the client sends a multimedia information request message to the server according to the multimedia information that needs to be acquired.
  • the multimedia information request message includes the multimedia information requested by the client, the IP address of the client, and the network port number, and the multimedia information request message may be implemented by using an HTTP message; the multimedia information may be picture information, video information, or Audio information.
  • the server after the client sends the multimedia information to the server, the server generates a verification string according to the information contained in the multimedia information request message; and the server adds the verification string to the verification message and sends the verification string to the client. end.
  • Step 410 Receive a verification message generated by the server according to the multimedia information request message, where the verification message includes a verification string.
  • the client receives the verification message sent by the server, and obtains the verification string included in the verification message.
  • Step 420 Perform an operation on the verification string included in the verification message to generate first verification information.
  • the client uses a preset white box encryption function to encrypt the verification string included in the verification message, and processes the encrypted verification string by using a preset digital signature algorithm to generate the first A verification message.
  • the white box encryption function is an encryption function generated according to a preset encryption algorithm and a key, and the preset encryption algorithm may be set according to a specific application scenario; when the client generates a white box encryption function, the foregoing is deleted. Key.
  • the first verification information obtained by the client satisfies the formula 1.
  • the client generates a white box encryption function locally according to the preset encryption function and the key, and the generated verification string is processed by the white box encryption function, and the client does not include the key locally, and the chain is stolen. No matter whether through static tracking or dynamic tracking, the key cannot be obtained. Even if the hacker knows the above-mentioned default encryption algorithm, the brute force method is needed to obtain the key, thereby implementing the hacking, which will greatly improve the duration of the hacking. The cost of stealing chains increases the reliability of the anti-theft chain.
  • Step 430 Send a verification response message to the server according to the first verification information.
  • Step 440 The notification server performs operation on the verification string and the key corresponding to the client, generates second verification information, and refuses to send the multimedia information returned by the server to the first verification information when the first verification information is different from the second verification information.
  • Client performs operation on the verification string and the key corresponding to the client, generates second verification information, and refuses to send the multimedia information returned by the server to the first verification information when the first verification information is different from the second verification information.
  • the server locally saves the peer function, and the peer function corresponds to the white box encryption function, and uses the peer function to perform the operation on the verification string; and uses the preset encryption algorithm to perform the above operation.
  • the verification string is encrypted to generate second verification information.
  • the server determines that the first verification information is the same as the second verification information, it is determined that the client is a non-hacking client, and the multimedia information requested by the multimedia information request message is sent to the client. End, wherein the multimedia information can be carried by an HTTP message.
  • the server determines that the first verification information is different from the second verification information, it is determined that the client is a hacking client, and the multimedia information requested by the multimedia information request message is refused to be sent to the client.
  • the key needs to be changed periodically.
  • the client determines that the key has changed, it generates the latest white-box encryption function according to the changed key and the preset algorithm; replaces the locally saved white-box encryption function with the latest white-box encryption function.
  • the peer function remains the same as the key change in the client.
  • the server verifies the current client, the server sends the key command to the client, and sends the changed key to the client, and the client generates the latest white-box encryption function by itself; or The server locally generates the latest white-box encryption function based on the changed key and preset algorithm, and sends it to the corresponding client.
  • a server for preventing theft chain including a verification string obtaining unit 50, a verification message generating unit 51, a sending unit 52, and a notification unit 53, receiving Unit 54, verification information generating unit 55, and chain breaking processing unit 56, wherein:
  • the verification message generating unit 51 is configured to generate a verification message according to the verification string
  • a sending unit 52 configured to send the verification message to the client
  • the notification unit 53 is configured to notify the client to perform an operation on the verification string included in the verification message to generate first verification information.
  • the receiving unit 54 is configured to receive the verification response message sent by the client, where the verification response message includes the first verification information
  • the verification information generating unit 55 is configured to perform operation on the verification string to generate second verification information.
  • the hacking processing unit 56 is configured to: when the first verification information is different from the second verification information, determine that the client is a hacking client, and refuse to send the multimedia information requested by the multimedia information request message To the client.
  • the verification string obtaining unit 50 is configured to: acquire a plurality of message attributes included in the multimedia information request message, and arrange the acquired plurality of message attributes according to a preset rule to form Verify the string.
  • the plurality of message attributes include at least: an IP address of the client, a network port number,
  • the message attribute included in the multimedia information request message further includes: acquiring the time when the multimedia information request message is received, where the verification string obtaining unit 50 is further configured to acquire the content included in the multimedia information request message.
  • Message attributes such as: the Internet Protocol IP address of the client, the network port number, and the time of receiving the multimedia information request message; generating a random number locally; the random number, the IP address, and the network port number And receiving the multimedia information request message at a time, and arranging according to a preset rule to form a verification string.
  • processing unit 57 is further configured to: determine that the IP address and the network port number are correct before performing the operation on the verification string.
  • a client for preventing theft chain including a sending unit 60, a receiving unit 61, a verification information generating unit 62, and a verification response message generating unit 63. And a notification unit 64, wherein:
  • the sending unit 60 is configured to send a multimedia information request message to the server;
  • the receiving unit 61 is configured to receive the verification message that is generated by the server according to the multimedia information request message, where the verification message includes a verification string;
  • the verification information generating unit 62 is configured to perform verification string included in the verification message Computing to generate first verification information
  • the verification response message generating unit 63 is configured to generate a verification response message according to the first verification information
  • the sending unit 60 is further configured to send the verification response message to the server;
  • the notification unit 64 is configured to notify the server to perform operation on the verification string and the key corresponding to the client, generate second verification information, and when the first verification information is different from the second verification information, , refuse to send the multimedia information returned by the server to the client.
  • the verification information generating unit 62 is specifically configured to: perform a calculation on the verification string included in the verification message by using a preset white box encryption function; and encrypt the verified verification string by using a preset encryption algorithm. Generating the first verification information;
  • the notification unit 64 is configured to: notify the server to use a peer function corresponding to the white box encryption function, perform operation on the verification string and the key corresponding to the client, and generate a second verification. information.
  • the client further includes an updating unit 65, configured to: when determining that the key is changed, generate the latest white-box encryption function according to the changed key and the preset algorithm; replace the locally saved white-box encryption function with The latest white box encryption function.
  • the client sends a multimedia information request message to the server; the server obtains the verification string corresponding to the client according to the multimedia information request message sent by the client; the server generates a verification message according to the verification string.
  • the client uses a preset white box encryption function to encrypt the verification string included in the verification message to generate first verification information; the server adopts a peer function corresponding to the white box encryption function, The verification string and the key corresponding to the client are operated to generate second verification information.
  • the server determines that the client is a hacking client, and rejects the multimedia information request message.
  • the requested multimedia information is sent to the client.
  • the white box encryption algorithm can more reliably prevent the stolen chain behavior; and, the first verification information generated by the peer function is authenticated, and the client whose authentication fails is determined as the stolen client End, the thief-chain client is indeed The process depends on the authentication result, and is not limited by the IP address and the reference address. On the basis of further ensuring the reliability of the anti-theft chain, the scope of application and the reliability of the anti-theft chain are effectively improved.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without deliberate labor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种防止盗链的方法、防止盗链的服务器及客户端，方法为，当服务器将客户端对应的验证字符串发送至客户端；由客户端对该验证字符串进行加密，生成第一验证信息发送至服务器；服务器根据上述验证字符串，对该验证字符串和客户端对应的密钥进行处理，生成第二验证信息；当第一验证信息和第二验证信息不同时，拒绝将多媒体信息发送至该客户端。采用本发明实施例技术方案，服务器通过对验证字符串和客户端对应的密钥，对生成的第一验证信息进行鉴权，并将鉴权不通过的客户端确定为盗链客户端，对盗链客户端的确定过程不受限于IP地址和引用地址，在进一步保证防盗链可靠性的基础上，有效提高了适用范围以及防盗链可靠性。

Description

一种防止盗链的方法、防止盗链的服务器及客户端 技术领域
本发明实施例涉及视频播放领域，尤其涉及一种防盗链的方法、防止盗链的服务器及客户端。
背景技术
随着互联网技术的发展，互联网的安全性也越来越重要。在互联网中，存在一种盗链技术，有时也称为外链技术，该技术是一种非法的网页内容获取行为，指的非法网站利用各种手段，将其他网站的页面内容设置在自己非法网站提供的网页中，从而在未授权的情况下使用其他网站提供的网页内容，获取利益。
采用盗链技术非法将其他网页内容承载在自身网页上，如果其他网页内容为视频或诸如搜索功能的服务提供网页内容，采用的盗链技术直接影响其他提供网页内容的网站经营，这成为了影响互联网安全的重要问题。非法网站，通过盗链技术，不仅可以利用其他网页的内容及服务，而且在一定程度上还可以对其他网页提供网页挂马和网页钓鱼等黑客攻击手段。
为了防止网页内容被盗链，目前可以采用以下几种方式防止盗链：
方式一，对调用网页内容的用户设置管理机制。通过设置网页内容的访问黑名单，该黑名单中记录了多个禁止访问网页的IP(Internet Protocol；网际协议)地址，当提供网页内容的网站接收对该网页内容访问的请求后，检测发送该请求的IP地址是否在黑名单中，如果在，则禁止对网页内容的访问，以防止对网页内容的被盗链。
方式二，判断引用地址法。判断引用地址法是通过判断浏览器请求时HTTP(Hyper Text Transfer Protocol；超文本传输协议)头的Referer字段的值来确定是否盗链。
上述两种防盗链方法均存在缺陷：方式一建立在对IP地址进行认证的基础上，而建立黑名单的作用对盗链的防御范围十分有限；方式二采用判断应用地址方式防止盗链，但是由于引用地址容易被伪造，从而造成防盗链的不彻底。
由此可见，在现有的防盗链的技术中，存在防盗链的可靠性和准确性较差的问题。
发明内容
本发明实施例提供一种防止盗链的方法、防止盗链的服务器及客户端，用以解决在现有的防盗链的技术中，存在防盗链的可靠性和准确性较差的问题。
本发明实施例提供的具体技术方案如下：
本发明实施例提供一种防止盗链的方法，包括：根据接收到的多媒体信息请求消息，获取发送所述多媒体信息请求消息的客户端对应的验证字符串；并根据所述验证字符串，生成验证消息；并将所述验证消息发送至所述客户端；通知所述客户端对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；接收所述客户端发送的验证响应消息；其中，所述验证响应消息中包含所述第一验证信息；对所述验证字符串和所述客户端对应的密钥进行运算，生成第二验证信息；当所述第一验证信息与所述第二验证信息不同时，确定所述客户端为盗链客户端，拒绝将所述多媒体信息请求消息所请求的多媒体信息发送至所述客户端。
本发明实施例提供一种防止盗链的方法，包括：向服务器发送多媒体信息请求消息；接收所述服务器发送的根据所述多媒体信息请求消息生成的验证消息，其中，所述验证消息中包含验证字符串；对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；根据所述第一验证信息，生成验证响应消息发送至所述服务器；通知所述服务器对所述验证字符串和本地对应的密钥进行运算，生成第二验证信息，并当所述第一验证信息与所述第二验证信息不同时，拒绝将服务器返回的多媒体信息发送至所述本地。
本发明实施例提供一种防止盗链的服务器，包括：验证字符串获取单元，用于根据接收到的多媒体信息请求消息，获取发送所述多媒体信息请求消息的客户端对应的验证字符串；验证消息生成单元，用于根据所述验证字符串，生成验证消息；发送单元，用于将所述验证消息发送至所述客户端；通知单元，用于通知所述客户端对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；接收单元，用于接收所述客户端发送的 验证响应消息，其中，所述验证响应消息中包含所述第一验证信息；验证信息生成单元，用于对所述验证字符串和所述客户端对应的密钥进行运算，生成第二验证信息；盗链处理单元，用于当所述第一验证信息与所述第二验证信息不同时，确定所述客户端为盗链客户端，拒绝将所述多媒体信息请求消息所请求的多媒体信息发送至所述客户端。
本发明实施例提供一种防止盗链的客户端，包括：发送单元，用于向服务器发送多媒体信息请求消息；接收单元，用于接收所述服务器发送的根据所述多媒体信息请求消息生成的验证消息，其中，所述验证消息中包含验证字符串；验证信息生成单元，用于对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；验证响应消息生成单元，用于根据所述第一验证信息，生成验证响应消息；所述发送单元，还用于将所述验证响应消息发送至所述服务器；通知单元，用于通知所述服务器对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息，并当所述第一验证信息与所述第二验证信息不同时，拒绝将服务器返回的多媒体信息发送至本客户端。
本发明实施例中，当服务器接收到客户端发送的多媒体信息请求消息时，即将客户端对应的验证字符串发送至客户端；由客户端对该验证字符串进行加密，生成第一验证信息发送至服务器；服务器根据上述验证字符串，对该验证字符串和客户端对应的密钥进行处理，生成第二验证信息；当第一验证信息和第二验证信息不同时，即确定该客户端为盗链客户端，进而拒绝将多媒体信息发送至该盗链客户端。采用本发明实施例技术方案，服务器通过对验证字符串和客户端对应的密钥，对生成的第一验证信息进行鉴权，并将鉴权不通过的客户端确定为盗链客户端，对盗链客户端的确定过程依赖于鉴权结果，而不受限于IP地址和引用地址，在进一步保证防盗链可靠性的基础上，有效提高了适用范围以及防盗链可靠性。
附图说明
图1为本发明实施例中通信系统结构示意图；
图2为本发明实施例中通信系统中各个设备之间的信令交互示意图；
图3为本发明实施例中防止盗链的方法流程图一；
图4为本发明实施例中防止盗链的方法流程图二；
图5为本发明实施例中防止盗链的服务器结构示意图；
图6为本发明实施例中防止盗链的客户端结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参阅图1所示，为本发明实施例中通信系统架构示意图，其中，该通信系统中包含服务器，以及多个客户端，其中，服务器为能够提供多媒体信息的设备，下面以通信系统中包含一个服务器和一个客户端为例，结合附图对本发明实施例优选的实施方式进行详细说明。
参阅图2所示，为本发明实施例中，服务器和客户端之间的信令交互图。客户端根据用户指示，生成相应的多媒体信息请求消息；服务器根据接收到的多媒体信息请求消息，生成验证消息发送至客户端；客户端响应于该验证消息，生成验证响应消息；服务器根据验证响应消息中包含的内容，对客户端进行鉴权，确定客户端为合法客户端时，将客户端请求的多媒体信息发送至该客户端，否则，拒绝将上述多媒体信息发送至客户端。
下面结合说明书附图，对本发明实施例作进一步详细描述。
参阅图3所示，本发明实施例中，服务器侧防止盗链的过程，包括：
步骤300：根据接收到的多媒体信息请求消息，获取发送该多媒体信息请求消息的客户端对应的验证字符串。
本发明实施例中，服务器接收客户端发送的多媒体信息请求消息，该多媒体信息请求消息中包含多个消息属性，如：客户端所请求的多媒体信息、客户端的IP地址和网络端口号，且该多媒体信息请求消息可以通过HTTP报文实现；上述多媒体信息可以为图片信息，视频信息或者音频信息。
可选的，服务器获取多媒体信息请求消息中包含的多个消息属性至少包括：客户端的IP地址和网络端口号，并将IP地址和网络端口号按照预设规则进行排列，生成验证字符串。其中，上述预设规则可以为按照预设 顺序依次排列，也可以为乱序排列。
进一步的，该多媒体信息请求消息中包含的消息属性还包括获取接收到该多媒体信息请求消息的时间(记为T1)，服务器还可以在本地生成随机数(记为RN)；服务器将上述IP地址和网络端口号、T1按照预设规则排列，生成验证字符串；或者，服务器将上述IP地址和网络端口号、RN按照预设规则排列，生成验证字符串。
较佳的，服务器将上述RN、多媒体信息请求消息中包含的IP地址和网络端口号，以及T1，按照预设顺序依次排列，组成验证字符串(记为CH)，例如，预设顺序为RN、IP地址、网络端口号、T1，则验证字符串为(CH＝RN+IP地址+网络端口号+T1)；或者，将RN、IP地址、网络端口号，以及T1，按照预设方法进行乱序组合，组成验证字符串，例如，IP地址为(A-B-C)，网络端口号为P，预设方法为将网络端口号加入IP地址的第二个字符之后，将RN、排序后的IP地址和网络端口号，T1，则验证字符串为(CH＝RN+A-B-P-C+T1)。
除了采用上述方式生成验证字符串以外，服务器还可以对该多媒体信息请求消息中包含的多个消息属性，如：上述客户端的IP地址，网络端口号，RN和T1执行预设运算，如服务器为分别上述客户端的IP地址，网络端口号，RN和T1赋予不同的权重，并将所有参数的加权求和作为验证字符串。
采用上述技术方案，服务器根据客户端的相关属性，为每一个客户端生成不同的验证字符串，即使是同一个客户端，不同时间点向服务器请求多媒体信息时，服务器也会生成不同的验证字符串，避免了服务器针对所有的客户端均生成同一个验证字符串或者对同一个客户端使用不便的验证字符串，造成的安全性差的问题，保证了后期防盗链过程的可靠性。
步骤310：根据上述验证字符串，生成验证消息。
本发明实施例中，服务器将上述验证字符串添加至验证消息中的指定字段中。
步骤320：将上述验证消息发送至客户端。
本发明实施例中，服务器将上述包含验证字符串的验证消息发送至客户端。
步骤330：通知上述客户端对验证消息中包含的验证字符串进行运算， 生成第一验证信息。
本发明实施例中，当客户端接收到服务器发送的验证请求之后，获取该验证请求之中包含的验证字符串；客户端响应于上述验证请求，通过本地预设的白盒加密函数(记为WB)，对上述验证字符串进行加密，并采用预设的数字签名算法对加密后的验证字符串进行处理，生成第一验证信息(记为DG)。其中，上述白盒加密函数是根据预设的加密算法和密钥，生成的加密函数，该预设的加密算法可以根据具体应用场景进行设置；当客户端生成白盒加密函数之后，即删除上述密钥。
可选的，客户端得到的第一验证信息满足如下公式：
DG＝SHA-1(WB(CH))公式一
其中，DG表示第一验证信息；SHA-1(Secure Hash Algorithm；安全哈希算法)表示预设的数字签名算法，该数字签名算法算法用于将加密后的验证字符串进行缩短化处理，使加密后的字符串长度小于20字节，使加密后的验证字符串在传输过程中占用更少的带宽资源；WB为白盒加密函数；CH为验证字符串。
采用上述技术方案，客户端根据预设的加密函数和密钥，在本地生成白盒加密函数，由该白盒加密函数对生成的验证字符串进行处理，客户端本地不包含密钥，盗链者不论通过静态跟踪或者动态跟踪，均无法获取密钥，即使盗链者获知上述预设的加密算法，也需要通过暴力破解法获取密钥，进而实现盗链，将大大提高盗链的时长以及盗链成本，进而提高了防盗链的可靠性。
步骤340：接收客户端发送的验证响应消息；其中，该验证响应消息中包含上述第一验证信息。
本发明实施例中，服务器接收到客户端发送的验证响应消息时，获取该验证响应消息中包含的第一验证信息。
可选的，服务器在将验证消息发送至客户端后，即删除该客户端对应的验证字符串，相应的，客户端发送至服务器的验证响应消息中还可以包含验证字符串。采用该技术方案，服务器将验证字符串从本地清除，减少了验证字符串对服务器存储空间的占用。
步骤350：对上述验证字符串和客户端对应的密钥进行运算，生成第二验证信息。
本发明实施例中，服务器在本地保存对等函数(记为ENC)，该对等函数为通用函数，其与白盒加密函数相对应；服务器本地包含每一个客户端对应的密钥，或者，服务器本地包含每一种客户端类型对应的密钥，服务器可以根据客户端标识或者客户端类型，获取上述客户端对应的密钥；采用该对等函数对验证字符串和客户端对应的密钥进行运算；并采用预设的加密算法对上述运算后的验证字符串进行加密，生成第二验证信息(记为DGS)。
进一步的，对验证字符串和客户端对应的密钥进行运算之前，服务器还需要验证IP地址和网络端口号是否正确；其中，服务器确定IP地址和网络端口号正确，即为服务器确定验证字符串中包含的IP地址和服务器检测到的客户端的本次TCP(Transmission Control Protocol；传输控制协议)连接的IP地址相同，且验证字符串中包含的网络端口号和服务器检测到的客户端的本次TCP连接的网络端口号相同。
进一步的，当验证字符串是根据T1生成时，对验证字符串和客户端对应的密钥进行运算之前，服务器还需要获取T1以及接收到第二验证信息的时间(即为T2)，计算自T1至T2之间的时长(即T2-T1)；服务器确定上述(T2-T1)未达到预设时长，且上述IP地址和该网络端口号正确。
进一步的，当服务器判定(T2-T1)达到预设时长，或者上述IP地址，或者网络端口号不正确，将提示客户端重新发送验证响应消息。
可选的，服务器所生成的第二验证信息满足如下公式：
DGS＝SHA-1(ENC(CH，KEY))公式二
其中，DGS表示第一验证信息；SHA-1表示预设的数字签名算法；ENC为对等函数，可选的，该ENC可以为(Advanced Encryption Standard；高级加密标准算法的简称)；CH为验证字符串。
步骤360：当第一验证信息与第二验证信息不同时，确定客户端为盗链客户端，拒绝将上述多媒体信息请求消息所请求的多媒体信息发送至客户端。
本发明实施例中，服务器对第一验证信息和第二验证信息进行比较，根据比较结果，确定客户端是否为盗链客户端。
可选的，当服务器判定第一验证信息与第二验证信息相同时，确定客户端为非盗链客户端，将多媒体信息请求消息所请求的多媒体信息发送至 客户端，其中，多媒体信息可以通过HTTP消息进行承载。当服务器判定第一验证信息与第二验证信息不同时，确定客户端为盗链客户端，拒绝将多媒体信息请求消息所请求的多媒体信息发送至客户端。
进一步的，当服务器确定客户端为盗链客户端时，即将该客户端的标识添加至本地保存的黑名单列表中，当再次接收到客户端发送的多媒体信息请求消息时，由于客户端标识和黑名单列表中的标识相匹配，服务器将直接拒绝将多媒体信息发送至该客户端。
采用上述技术方案，服务器采用鉴权方式，验证客户端是否为盗链客户端，相较于IP地址验证法，通过加密函数鉴权可靠性和准确度更高。
参阅图4所示，本发明实施例中，防止非法客户端盗链的过程，包括：
步骤400：向服务器发送多媒体信息请求消息。
本发明实施例中，当客户端接收到用户指示，确定需要获取的多媒体信息时，将根据需要获取的多媒体信息，生成多媒体信息请求消息发送至服务器。其中，该多媒体信息请求消息中包含客户端所请求的多媒体信息，客户端的IP地址和网络端口号，且该多媒体信息请求消息可以通过HTTP报文实现；上述多媒体信息可以为图片信息，视频信息或者音频信息。
本发明实施例中，客户端将上述多媒体信息发送至服务器后，服务器根据该多媒体信息请求消息中包含的信息，生成验证字符串；并且，服务器将该验证字符串添加至验证消息中发送至客户端。
步骤410：接收服务器发送的根据所述多媒体信息请求消息生成的验证消息；其中，该验证消息中包含验证字符串。
本发明实施例中，客户端接收服务器发送的验证消息，并获取该验证消息中包含的验证字符串。
步骤420：对上述验证消息中包含的验证字符串进行运算，生成第一验证信息。
本发明实施例中，客户端采用预设的白盒加密函数，对该验证消息中包含的验证字符串进行加密；并采用预设的数字签名算法对加密后的验证字符串进行处理，生成第一验证信息。其中，上述白盒加密函数是根据预设的加密算法和密钥，生成的加密函数，该预设的加密算法可以根据具体应用场景进行设置；当客户端生成白盒加密函数之后，即删除上述密钥。可选的，客户端得到的第一验证信息满足公式一。
采用上述技术方案，客户端根据预设的加密函数和密钥，在本地生成白盒加密函数，由该白盒加密函数对生成的验证字符串进行处理，客户端本地不包含密钥，盗链者不论通过静态跟踪或者动态跟踪，均无法获取密钥，即使盗链者获知上述预设的加密算法，也需要通过暴力破解法获取密钥，进而实现盗链，将大大提高盗链的时长以及盗链成本，进而提高了防盗链的可靠性。
步骤430：根据上述第一验证信息，生成验证响应消息发送至服务器。
步骤440：通知服务器对上述验证字符串和客户端对应的密钥进行运算，生成第二验证信息，并当第一验证信息与第二验证信息不同时，拒绝将上述服务器返回的多媒体信息发送至客户端。
本发明实施例中，服务器在本地保存对等函数，该对等函数与白盒加密函数相对应，采用该对等函数对验证字符串进行运算；并采用预设的加密算法对上述运算后的验证字符串进行加密，生成第二验证信息；当服务器判定第一验证信息与第二验证信息相同时，确定客户端为非盗链客户端，将多媒体信息请求消息所请求的多媒体信息发送至客户端，其中，多媒体信息可以通过HTTP消息进行承载。当服务器判定第一验证信息与第二验证信息不同时，确定客户端为盗链客户端，拒绝将多媒体信息请求消息所请求的多媒体信息发送至客户端。
进一步的，为了保证防盗链的可靠性，需要定期更改密钥。当客户端确定密钥发生更改时，根据更改后的密钥和预设算法，生成最新的白盒加密函数；将本地保存的白盒加密函数替换为该最新的白盒加密函数。对应于客户端中密钥的更改，对等函数保持不变。具体实施时，服务器在对当前客户端验证通过后，向客户端发送更该密钥指令，并发送更改后的密钥至客户端，由客户端自行生成最新的白盒加密函数；或者，在服务器本地根据更改后的密钥和预设算法，生成最新的白盒加密函数，并发送至相应的客户端。
基于上述技术方案，参阅图5所示，本发明实施例中，还提供一种防止盗链的服务器，包括验证字符串获取单元50，验证消息生成单元51，发送单元52，通知单元53，接收单元54，验证信息生成单元55，以及盗链处理单元56，其中：
验证字符串获取单元50，用于根据接收到的多媒体信息请求消息，获 取发送所述多媒体信息请求消息的客户端对应的验证字符串；
验证消息生成单元51，用于根据所述验证字符串，生成验证消息；
发送单元52，用于将所述验证消息发送至所述客户端；
通知单元53，用于通知所述客户端对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；
接收单元54，用于接收所述客户端发送的验证响应消息，其中，所述验证响应消息中包含所述第一验证信息；
验证信息生成单元55，用于对所述验证字符串进行运算，生成第二验证信息；
盗链处理单元56，用于当所述第一验证信息与所述第二验证信息不同时，确定所述客户端为盗链客户端，拒绝将所述多媒体信息请求消息所请求的多媒体信息发送至所述客户端。
可选的，所述验证字符串获取单元50，具体用于：获取所述多媒体信息请求消息中包含的多个消息属性，将获取的所述多个消息属性，按照预设规则进行排列，组成验证字符串。所述多个消息属性至少包括：所述客户端的IP地址，网络端口号，
可选的，该多媒体信息请求消息中包含的消息属性还包括获取接收到该多媒体信息请求消息的时间，所述验证字符串获取单元50，还用于获取所述多媒体信息请求消息中包含的多个消息属性，如：所述客户端的网际协议IP地址，网络端口号，并获取接收到所述多媒体信息请求消息的时间；在本地生成随机数；将所述随机数、IP地址、网络端口号，以及接收到所述多媒体信息请求消息的时间，按照预设规则进行排列，组成验证字符串。
进一步的，还包括处理单元57，用于：对所述验证字符串进行运算之前，确定所述IP地址和所述网络端口号正确。
基于上述技术方案，参阅图6所示，本发明实施例中，还提供一种防止盗链的客户端，包括发送单元60，接收单元61，验证信息生成单元62，验证响应消息生成单元63，以及通知单元64，其中：
发送单元60，用于向服务器发送多媒体信息请求消息；
接收单元61，用于接收所述服务器发送的根据所述多媒体信息请求消息生成的验证消息，其中，所述验证消息中包含验证字符串；
验证信息生成单元62，用于对所述验证消息中包含的验证字符串进行 运算，生成第一验证信息；
验证响应消息生成单元63，用于根据所述第一验证信息，生成验证响应消息；
所述发送单元60，还用于将所述验证响应消息发送至所述服务器；
通知单元64，用于通知所述服务器对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息，并当所述第一验证信息与所述第二验证信息不同时，拒绝将服务器返回的多媒体信息发送至本客户端。
所述验证信息生成单元62，具体用于：采用预设的白盒加密函数，对所述验证消息中包含的验证字符串进行运算；采用预设的加密算法对运算后的验证字符串进行加密，生成所述第一验证信息；
所述通知单元64，具体用于：通知所述服务器采用与所述白盒加密函数相对应的对等函数，对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息。
所述客户端还包括更新单元65，用于：当确定密钥发生更改时，根据更改后的密钥和预设算法，生成最新的白盒加密函数；将本地保存的白盒加密函数替换为所述最新的白盒加密函数。
综上所述，客户端向服务器发送多媒体信息请求消息；服务器根据接收到客户端发送的多媒体信息请求消息，获取该客户端对应的验证字符串；服务器根据上述验证字符串，生成验证消息发送至上述客户端；客户端采用预设的白盒加密函数，对验证消息中包含的验证字符串进行加密，生成第一验证信息；服务器采用与上述白盒加密函数相对应的对等函数，对上述验证字符串和客户端对应的密钥进行运算，生成第二验证信息；当第一验证信息与第二验证信息不同时，服务器确定客户端为盗链客户端，拒绝将上述多媒体信息请求消息所请求的多媒体信息发送至客户端。采用本发明实施例技术方案，在客户端本地和服务器本地分别保存白盒加密函数和对等函数，且该白盒加密函数和对等函数为相对应的函数，通过该白盒加密函数对验证字符串进行加密，生成第一验证信息，由于盗链者对多媒体信息进行盗链需要获取加密算法以及密钥，本发明实施例在整个鉴权过程中不涉及密钥，使得盗链者无法获取密钥，因此，通过白盒加密算法能够更加可靠地防止盗链行为；并且，通过对等函数对生成的第一验证信息进行鉴权，并将鉴权不通过的客户端确定为盗链客户端，对盗链客户端的确 定过程依赖于鉴权结果，而不受限于IP地址和引用地址，在进一步保证防盗链可靠性的基础上，有效提高了适用范围以及防盗链可靠性。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本发明实施例的技术方案，而非对其限制；尽管参照前述实施例对本发明实施例进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明实施例各实施例技术方案的精神和范围。

Claims (12)

  1. 一种防止盗链的方法，其特征在于，包括：
    根据接收到的多媒体信息请求消息，获取发送所述多媒体信息请求消息的客户端对应的验证字符串；并
    根据所述验证字符串，生成验证消息；并
    将所述验证消息发送至所述客户端；
    通知所述客户端对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；
    接收所述客户端发送的验证响应消息，其中，所述验证响应消息中包含所述第一验证信息；
    对所述验证字符串和所述客户端对应的密钥进行运算，生成第二验证信息；
    当所述第一验证信息与所述第二验证信息不同时，确定所述客户端为盗链客户端，拒绝将所述多媒体信息请求消息所请求的多媒体信息发送至所述客户端。
  2. 根据权利要求1所述的方法，其特征在于，根据接收到的多媒体信息请求消息，获取发送所述多媒体信息请求消息的客户端对应的验证字符串，具体包括：
    获取所述多媒体信息请求消息中包含的多个消息属性，所述多个消息属性至少包括：所述客户端的网际协议IP地址，网络端口号；
    将获取的所述多个消息属性，按照预设规则进行排列，组成验证字符串。
  3. 根据权利要求2所述的方法，其特征在于，对所述验证字符串和所述客户端对应的密钥进行运算之前，还包括：
    确定所述IP地址和所述网络端口号正确。
  4. 一种防止盗链的方法，其特征在于，包括：
    向服务器发送多媒体信息请求消息；
    接收所述服务器发送的根据所述多媒体信息请求消息生成的验证消息，其中，所述验证消息中包含验证字符串；
    对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；
    根据所述第一验证信息，生成验证响应消息发送至所述服务器；
    通知所述服务器对所述验证字符串和本地对应的密钥进行运算，生成第二验证信息，并当所述第一验证信息与所述第二验证信息不同时，拒绝将服务器返回的多媒体信息发送至本地。
  5. 根据权利要求4所述的方法，其特征在于，对所述验证消息中包含的验证字符串进行运算，生成第一验证信息，具体包括：
    采用预设的白盒加密函数，对所述验证消息中包含的验证字符串进行运算；
    采用预设的加密算法对运算后的验证字符串进行加密，生成所述第一验证信息；
    通知所述服务器对所述验证字符串和本地对应的密钥进行运算，具体包括：
    通知所述服务器采用与所述白盒加密函数相对应的对等函数，对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息。
  6. 如权利要求5所述的方法，其特征在于，所述方法还包括：
    当确定密钥发生更改时，根据更改后的密钥和预设算法，生成最新的白盒加密函数；
    将本地保存的白盒加密函数替换为所述最新的白盒加密函数。
  7. 一种防止盗链的服务器，其特征在于，包括：
    验证字符串获取单元，用于根据接收到的多媒体信息请求消息，获取发送所述多媒体信息请求消息的客户端对应的验证字符串；
    验证消息生成单元，用于根据所述验证字符串，生成验证消息；
    发送单元，用于将所述验证消息发送至所述客户端；
    通知单元，用于通知所述客户端对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；
    接收单元，用于接收所述客户端发送的验证响应消息，其中，所述验证响应消息中包含所述第一验证信息；
    验证信息生成单元，用于对所述验证字符串和所述客户端对应的密钥进行运算，生成第二验证信息；
    盗链处理单元，用于当所述第一验证信息与所述第二验证信息不同时，确定所述客户端为盗链客户端，拒绝将所述多媒体信息请求消息所请求的多媒体信息发送至所述客户端。
  8. 根据权利要求7所述的服务器，其特征在于，所述验证字符串获取单元，具体用于：
    获取所述多媒体信息请求消息中包含的多个消息属性，所述多个消息属性至少包括：所述客户端的网际协议IP地址，网络端口号；将获取的所述多个消息属性，按照预设规则进行排列，组成验证字符串。
  9. 根据权利要求8所述的服务器，其特征在于，还包括处理单元，用于：
    对所述验证字符串进行运算之前，确定所述IP地址和所述网络端口号正确。
  10. 一种防止盗链的客户端，其特征在于，包括：
    发送单元，用于向服务器发送多媒体信息请求消息；
    接收单元，用于接收所述服务器发送的根据所述多媒体信息请求消息生成的验证消息，其中，所述验证消息中包含验证字符串；
    验证信息生成单元，用于对所述验证消息中包含的验证字符串进行运算，生成第一验证信息；
    验证响应消息生成单元，用于根据所述第一验证信息，生成验证响应消息；
    所述发送单元，还用于将所述验证响应消息发送至所述服务器；
    通知单元，用于通知所述服务器对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息，并当所述第一验证信息与所述第二验证信息不同时，拒绝将服务器返回的多媒体信息发送至本客户端。
  11. 根据权利要求10所述的客户端，其特征在于，所述验证信息生成单元，具体用于：采用预设的白盒加密函数，对所述验证消息中包含的验证字符串进行运算；采用预设的加密算法对运算后的验证字符串进行加密，生成所述第一验证信息；
    所述通知单元，具体用于：通知所述服务器采用与所述白盒加密函数相对应的对等函数，对所述验证字符串和本客户端对应的密钥进行运算，生成第二验证信息。
  12. 如权利要求11所述的客户端，其特征在于，还包括更新单元，用于：
    当确定密钥发生更改时，根据更改后的密钥和预设算法，生成最新的 白盒加密函数；将本地保存的白盒加密函数替换为所述最新的白盒加密函数。
PCT/CN2016/075229 2015-05-15 2016-03-01 一种防止盗链的方法、防止盗链的服务器及客户端 WO2016184216A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510251430.5A CN105721411A (zh) 2015-05-15 2015-05-15 一种防止盗链的方法、防止盗链的服务器及客户端
CN201510251430.5 2015-05-15

Publications (1)

Publication Number Publication Date
WO2016184216A1 true WO2016184216A1 (zh) 2016-11-24

Family

ID=56144723

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/075229 WO2016184216A1 (zh) 2015-05-15 2016-03-01 一种防止盗链的方法、防止盗链的服务器及客户端

Country Status (2)

Country Link
CN (1) CN105721411A (zh)
WO (1) WO2016184216A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111030805A (zh) * 2019-10-31 2020-04-17 苏州浪潮智能科技有限公司 一种防盗链的方法及装置
CN113329242A (zh) * 2021-05-27 2021-08-31 北京沃东天骏信息技术有限公司 一种资源管理的方法和装置
CN114650175A (zh) * 2022-03-21 2022-06-21 网宿科技股份有限公司 一种验证方法及装置

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108282451A (zh) * 2017-01-20 2018-07-13 广州市动景计算机科技有限公司 数据劫持判断方法、装置及用户终端
CN106993201A (zh) * 2017-03-17 2017-07-28 武汉斗鱼网络科技有限公司 视频播放的权限校验方法及装置
CN107426589B (zh) * 2017-03-31 2018-08-10 武汉斗鱼网络科技有限公司 一种视频请求、视频播放方法及装置
CN107135408B (zh) * 2017-03-31 2020-06-12 武汉斗鱼网络科技有限公司 一种视频流地址的鉴权方法及装置
CN107181733B (zh) * 2017-03-31 2019-12-13 北京奇艺世纪科技有限公司 一种登录验证方法及装置
CN106941496B (zh) * 2017-03-31 2019-12-13 北京奇艺世纪科技有限公司 一种登录验证方法及装置
CN108737854A (zh) * 2017-04-21 2018-11-02 武汉斗鱼网络科技有限公司 一种视频流播放的权限验证方法及装置
CN108965205A (zh) * 2017-05-18 2018-12-07 武汉斗鱼网络科技有限公司 请求视频流地址、对视频流地址请求鉴权的方法和装置
CN107172461B (zh) * 2017-06-19 2019-12-03 武汉斗鱼网络科技有限公司 一种视频流鉴权方法及装置
CN107294985A (zh) * 2017-06-30 2017-10-24 北京小米移动软件有限公司 信息验证方法、装置及系统
CN109218773B (zh) * 2017-06-30 2021-07-30 武汉斗鱼网络科技有限公司 一种视频流地址的鉴权方法及装置
CN107483987B (zh) * 2017-06-30 2020-02-07 武汉斗鱼网络科技有限公司 一种视频流地址的鉴权方法及装置
CN107333151B (zh) * 2017-06-30 2019-07-09 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法及装置
CN107579968B (zh) * 2017-08-30 2018-07-06 武汉斗鱼网络科技有限公司 视频流地址检测方法、装置及服务器
CN110012319B (zh) * 2018-01-04 2021-07-23 武汉斗鱼网络科技有限公司 一种视频流地址的鉴权方法及装置
CN110012301B (zh) * 2018-01-04 2022-01-04 武汉斗鱼网络科技有限公司 一种视频流地址的鉴权方法及装置
CN108307211B (zh) * 2018-01-05 2020-02-07 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法、存储介质、设备及系统
CN108322449B (zh) * 2018-01-09 2021-11-26 武汉斗鱼网络科技有限公司 一种防止视频流被盗用的方法、存储介质、设备及系统
CN111726325B (zh) * 2019-03-20 2021-12-03 华为技术有限公司 一种确定网络设备状态的方法、相关设备及系统
CN110166425B (zh) * 2019-04-09 2021-08-20 北京奇艺世纪科技有限公司 数据处理方法、装置、系统及计算机可读存储介质
CN111988644B (zh) * 2020-08-11 2022-08-16 乐视新生代(北京)文化传媒有限公司 网络视频的防盗链方法、装置、设备和存储介质
CN112953724B (zh) * 2021-02-22 2022-11-29 广州虎牙科技有限公司 防盗链的鉴权方法以及相关装置、设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6950413B1 (en) * 2000-07-20 2005-09-27 Jenn-Chorng Liou Mutually-assisted proximity informer system and method with wireless devices
CN102025749A (zh) * 2011-01-18 2011-04-20 中国联合网络通信集团有限公司 移动流媒体业务防盗用方法
CN103067409A (zh) * 2013-01-21 2013-04-24 中国科学院信息工程研究所 一种web盗链防护方法及其网关系统
CN105187397A (zh) * 2015-08-11 2015-12-23 北京思特奇信息技术股份有限公司 一种web系统页面集成防盗链方法及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103036924B (zh) * 2011-09-29 2017-02-22 深圳市云帆世纪科技有限公司 一种链接处理方法及系统
CN103067156B (zh) * 2012-12-28 2016-01-20 北京移数通电讯有限公司 移动互联网用户资源访问的url加密、验证方法和装置
CN104135507B (zh) * 2014-06-30 2018-01-16 北京奇艺世纪科技有限公司 一种防盗链的方法和装置
CN104320377B (zh) * 2014-09-25 2017-07-07 华为技术有限公司 一种流媒体文件的防盗链方法及设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6950413B1 (en) * 2000-07-20 2005-09-27 Jenn-Chorng Liou Mutually-assisted proximity informer system and method with wireless devices
CN102025749A (zh) * 2011-01-18 2011-04-20 中国联合网络通信集团有限公司 移动流媒体业务防盗用方法
CN103067409A (zh) * 2013-01-21 2013-04-24 中国科学院信息工程研究所 一种web盗链防护方法及其网关系统
CN105187397A (zh) * 2015-08-11 2015-12-23 北京思特奇信息技术股份有限公司 一种web系统页面集成防盗链方法及系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111030805A (zh) * 2019-10-31 2020-04-17 苏州浪潮智能科技有限公司 一种防盗链的方法及装置
CN111030805B (zh) * 2019-10-31 2022-12-27 苏州浪潮智能科技有限公司 一种防盗链的方法及装置
CN113329242A (zh) * 2021-05-27 2021-08-31 北京沃东天骏信息技术有限公司 一种资源管理的方法和装置
CN114650175A (zh) * 2022-03-21 2022-06-21 网宿科技股份有限公司 一种验证方法及装置
CN114650175B (zh) * 2022-03-21 2024-04-02 网宿科技股份有限公司 一种验证方法及装置

Also Published As

Publication number Publication date
CN105721411A (zh) 2016-06-29

Similar Documents

Publication Publication Date Title
WO2016184216A1 (zh) 一种防止盗链的方法、防止盗链的服务器及客户端
CN107517179B (zh) 一种鉴权方法、装置和系统
CN107135073B (zh) 接口调用方法和装置
US8275984B2 (en) TLS key and CGI session ID pairing
EP2884716B1 (fr) Mécanisme d'authentificaiton par jeton
US8156333B2 (en) Username based authentication security
US20160119291A1 (en) Secure communication channel with token renewal mechanism
US20070179905A1 (en) Stateless Human Detection For Real-Time Messaging Systems
US20120284506A1 (en) Methods and apparatus for preventing crimeware attacks
CN104869102B (zh) 基于xAuth协议的授权方法、装置和系统
CN108259406B (zh) 检验ssl证书的方法和系统
CN106453361B (zh) 一种网络信息的安全保护方法及系统
US10348701B2 (en) Protecting clients from open redirect security vulnerabilities in web applications
Kaur et al. A secure two-factor authentication framework in cloud computing
CN110933078B (zh) 一种h5未登录用户会话跟踪方法
CN110662091B (zh) 第三方直播视频接入方法、存储介质、电子设备及系统
CN109040079A (zh) 直播链接地址的组建和验证方法及相应装置
CN111786996B (zh) 一种跨域同步登录态的方法、装置及跨域同步登录系统
US10122755B2 (en) Method and apparatus for detecting that an attacker has sent one or more messages to a receiver node
WO2015158228A1 (zh) 一种服务器、用户设备以及用户设备与服务器的交互方法
CN106549757B (zh) Web服务的数据真伪识别方法、服务端和客户端
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
CN117155716B (zh) 访问校验方法和装置、存储介质及电子设备
CN110035035B (zh) 一种单点登录的二次认证方法及系统
CN106850592A (zh) 一种信息处理方法、服务器及终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16795703

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 01/03/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16795703

Country of ref document: EP

Kind code of ref document: A1