WO2017066995A1

WO2017066995A1 - Method and device for preventing unauthorized access to server

Info

Publication number: WO2017066995A1
Application number: PCT/CN2015/092693
Authority: WO
Inventors: 刘均; 杨唐鹤; 陈明
Original assignee: 深圳还是威健康科技有限公司
Priority date: 2015-10-23
Filing date: 2015-10-23
Publication date: 2017-04-27
Also published as: CN105765941A

Abstract

A method and device for preventing unauthorized access to a server. The method comprises: an intelligent terminal obtains request parameters in a first access request to be sent to a server, generates a first digital signature string by encrypting the request parameters using a MD5 algorithm, and encapsulates the first digital signature string in the first access request, so as to send the first access request to the server; the server receives and decapsulates a second access request having the first digital signature string to obtain the request parameters, generates a second digital signature string by encrypting, using the MD5 algorithm, the request parameters in the second access request obtained by means of decapsulation, determines whether the first digital signature string is consistent with the second digital signature string, determines that the second access request is the first access request if the first digital signature string is consistent with the second digital signature string, and allows the intelligent terminal to perform access. By means of the method, whether a request is legal can be identified, thereby avoiding leakage of user information.

Description

Description: An illegal access server prevention method and device

[0001] Technical Field

[0002] The present invention relates to the field of communications, and in particular, to a method and apparatus for preventing unauthorized access to a server.

BACKGROUND

[0004] At present, most of the APP software is synthesized by a combination of a client and a server. The client mainly refers to the smart terminal APP software, and the server is mainly used to access the data of the APP interaction. Now most of the interaction between the client and the server is implemented by means of http. However, there are many capture tools, which can capture the request connection sent by the APP client and tamper with the parameter information in the request connection. The server cannot identify whether the connection request is legal after tampering, and thus responds to the falsified request, causing others to obtain the information stored by the user in the server, causing leakage of personal information.

SUMMARY OF THE INVENTION

The technical problem to be solved by the embodiments of the present invention is to provide an illegal access server prevention method and device, which can identify whether a request is legal or not, and avoid leakage of user information.

[0007] The present invention provides a method for preventing unauthorized access to a server, including:

[0008] The smart terminal acquires the request parameter, where the request parameter is a parameter carried in the first access request that the smart terminal prepares to send to the server, and the request parameter includes an interface that the smart terminal communicates with the server. Parameter

[0009] the intelligent terminal encrypts the request parameter to generate a first digital signature by using an MD5 algorithm.

String and signing the first digital signature

a string is encapsulated into the first access request to send the first access request to the server;

[0010] the server receives a second access request with the first digital signature string, and decapsulates the request parameter from the second access request;

[0011] the server encrypts the request parameter obtained by decapsulating the second access request by the MD5 algorithm to generate a second digital signature string;

[0012] the server determines the first digital signature string and the Whether the second digital signature string is consistent. If yes, determining that the second access request is the first access request, the server allows the smart terminal to perform access.

[0013] Optionally, the request parameter includes a plurality of parameters including parameters of an interface that the smart terminal communicates with the server, and the smart terminal encrypts the request parameter to generate a first number by using an MD5 algorithm. The signature string includes:

[0014] A plurality of parameters of the request parameters are connected by a preset symbol.

[0015] Optionally, the request parameter includes an application software identifier, a software version number, an international language code, and an interface parameter.

[0016] Optionally, before the connecting, by the preset symbol, the plurality of parameters of the request parameter are further included

[0017] arranging a plurality of parameters of the request parameters in a preset order.

[0018] Optionally, the multiple parameters of the request parameters are arranged in a preset order, including:

[0019] A plurality of parameters of the request parameters are arranged in alphabetical order.

[0020] An illegal access server preventing device, comprising:

[0021] an obtaining unit, configured to acquire a request parameter, where the request parameter is a parameter carried in a first access request that the smart terminal prepares to send to the server, where the request parameter includes the smart terminal and the server The parameters of the interface of the communication;

[0022] generating a packaging unit, configured to encrypt the request parameter by using an MD5 algorithm to generate a first digital signature string, and the first digital signature

a string is encapsulated into the first access request;

[0023] a sending unit, configured to send the first access request to the server;

[0024] a receiving unit, configured to receive the first digital signature

a second access request of the string, and decapsulating the request parameter from the second access request;

[0025] a decapsulation generating unit, configured to encrypt, by using the MD5 algorithm, a request parameter obtained by decapsulating the second access request to generate a second digital signature string;

a determining unit, configured to determine the first digital signature string and Whether the second digital signature string is consistent, and if yes, determining that the second access request is the first access request, and the server allows the smart terminal to perform access.

[0027] Optionally, the request parameter includes a plurality of parameters including parameters of an interface that the smart terminal communicates with the server, and the generating and packaging unit is further configured to:

[0028] A plurality of parameters of the request parameters are connected by a preset symbol.

[0029] Optionally, the request parameter includes an application software identifier, a software version number, an international language code, and an interface parameter.

[0030] Optionally, the generating and packaging unit is further configured to:

[0031] arranging a plurality of parameters of the request parameters in a preset order.

[0032] Optionally, the multiple parameters of the request parameters are arranged in a preset order, including:

[0033] A plurality of parameters of the request parameters are arranged in alphabetical order.

[0034] In the above invention, the intelligent terminal acquires the request parameter, and encrypts the request parameter by the MD5 algorithm to generate a first digital signature string, and the first digital signature is

The string is encapsulated into the first access request, and the first access request is sent to the server; the server receives the first digital signature

a second access request of the string, and decapsulating the request parameter from the second access request, and encrypting the request parameter obtained by decapsulating the second access request by the MD5 algorithm to generate a second digital signature string, and determining the first digital signature String and second digital signature

Whether the string is consistent, if yes, determining that the second access request is the first access request, and the server allows the smart terminal to access. Through the above method, it can be identified whether the request is legal or not, and the user information is prevented from being leaked.

BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only the present drawings. Some embodiments of the invention may be obtained by those of ordinary skill in the art from the drawings without departing from the scope of the invention. 1 is a flow chart of an embodiment of an illegal access server prevention method according to the present invention;

2 is a schematic structural diagram of an embodiment of an illegal access server preventing apparatus according to the present invention.

DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. example. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Please refer to FIG. 1. FIG. 1 is a flowchart of an embodiment of an illegal access server prevention method according to the present invention. The method includes:

[0042] Step S101: The smart terminal acquires the request parameter.

[0043] The interactive interface between the smart terminal and the server is mostly implemented in the http mode. There are two ways to request http.

One is the GET method, the request parameter will follow the request resource with "?" as the delimiter; the other is the POST method, and the request parameter is placed at the last position.

[0044] Specifically, the request parameter is a parameter carried in the first access request that the smart terminal prepares to send to the server.

The request parameter includes parameters of an interface that the smart terminal communicates with the server, including an application software identifier, a software version number, an international language code, an interface parameter, and the like. The application software identifier is a symbol used to represent the application software, and each application is used. The software corresponds to a unique identification number; the software version number is some English and number after the software name, which is the mark of the software version; the international language code is used to indicate the language code of the document; the interface is the channel for communication between the intelligent terminal and the server, the interface The parameter contains the user information that made the request. The smart terminal can obtain the request parameter by calling the relevant method through the request object.

[0045] Step S102: The intelligent terminal encrypts the request parameter to generate the first digital signature by using the MD5 algorithm.

String and will sign the first number

The string is encapsulated into the first access request.

[0046] A digital signature (also known as a public key digital signature, an electronic signature) is some data attached to a data unit, or a cryptographic transformation of a data unit. Such data or transformation allows the recipient of the data unit to confirm the integrity of the source and data unit of the data unit and to protect the data from being forged by others, and is also a valid proof of the authenticity of the information sent by the sender of the information. . It is a method of signing messages in electronic form, a signed message can be transmitted in a communication network. (Message Digest Algorithm 5) (Chinese name is the message digest algorithm fifth edition) is a hash function widely used in the field of computer security to provide message integrity protection. MD5 can generate an equally unique MD5 value for any file (regardless of its size, format, quantity), or it can be called "digital fingerprint". If any one can make any change to the file, MD5 The value, that is, the corresponding "digital fingerprint" will change.

[0048] Specifically, the request parameter may include multiple parameters, and the smart terminal may select some or all of the parameters, and encrypt some or all of the parameters of the request parameter to generate a first digital signature string, the first digital signature, by using the MD5 algorithm.

The string is the "digital fingerprint" of the request parameter, used to protect the integrity of the request parameters, and then, the first digital signature

The string is encapsulated into the first access request.

[0049] It should be noted that multiple parameters encrypted by the MD5 algorithm may be arranged in a preset order before encryption, for example, multiple parameters are arranged in alphabetical order of the first letter, and multiple parameters may be connected by using multiple symbols. The parameters are connected, and the connection symbol can be a specific letter, number or symbol, and the like. For example, suppose the request parameter is appID=ebcad75de0d42a844d98a755644e30 (apply unique identification number), softwareVersion=1.0.1 (software version number), lanCode= zh-cn (international language code), restKey= user.login (interface parameter), Before performing MD5 encryption, sort the parameters according to the parameters before the equal sign, and use the & symbol to get the request parameter appID= ebcad75de0d42a844d98a755644e30&lanCode=zh-cn&restKey=user.login&softwa reVersion=1.0.1, and then sort the connected The request parameter is MD5 encrypted to obtain a first digital signature string.

[0050] Step S103: The smart terminal sends a first access request to the server.

[0051] Specifically, the smart terminal may send the first access request to the server through a wired network, a wireless network, or a mobile network or the like.

[0052] Step S104: The server receives the first digital signature string.

The second access request, and decapsulation from the second access request to obtain the request parameter.

[0053] Specifically, the server cannot determine that the received first digital signature is received

Whether the second access request of the string is the first access request, The request parameter in an access request may also have been modified, the server receives the second access request with the first digital signature string, and decapsulates from the second access request to obtain the request parameters included in the second access request.

[0054] Step S105: The server encrypts the request parameter obtained by decapsulating the second access request by the MD5 algorithm to generate a second digital signature string.

[0055] Specifically, the request parameter obtained by decapsulating the second access request may include multiple parameters, and the server may select some or all of the parameters, and it is necessary to explain that some or all parameters selected by the server are in step S102. Some or all of the parameter types selected by the intelligent terminal are consistent, and some or all of the parameters in the request parameter are encrypted by the MD5 algorithm to generate a second digital signature.

It should be noted that the MD5 algorithm in step S105 is identical to the MD5 algorithm in step S102.

[0056] It should be noted that, in step S102, if multiple parameters encrypted by the MD5 algorithm are arranged in a preset order before encryption, in step S105, the server needs to follow the multiple parameters encrypted by the MD5 algorithm. The same preset order is arranged in step S102.

[0057] Step S106: The server determines whether the first digital signature string and the second digital signature string are consistent.

[0058] Specifically, the server determines whether the first digital signature string and the second digital signature string are consistent. If yes, the second access request is the first access request, and the first access request is not falsified, and is a legal request. The smart terminal is allowed to access; otherwise, the second access request is not the first access request, and the first access request has been tampered with, and is an illegal request, and the smart terminal is not allowed to access.

[0059] Specifically, the first digital signature string obtained by the smart terminal according to the request parameter in the first access request by the MD5 algorithm is unique, and the process of MD5 encryption is irreversible. After the first access request is obtained by another person and modified into a second access request, the request parameter in the second access request is inconsistent with the request parameter in the first access request, and the parameters of the interface are different. The MD5 algorithm is a digital signature generated by encrypting the content of the request parameter.

String, when the request parameters change, the digital signature string generated by the MD5 algorithm will also change. Server connection After receiving the second access request, if the request parameter in the second access request is inconsistent with the request parameter in the first access request, the second digital signature string and the first digital signature obtained according to the request parameter in the second access request The strings are inconsistent. As you can see, there are hackers who attempt to capture the request connection sent by the APP client through the packet capture tool to obtain the information stored by the user on the server.

[0060] Step S107: Allow the smart terminal to perform access.

[0061] Specifically, if the first digital signature string and the second digital signature string are consistent, the second access request is the first access request, and the first access request is not tampered with, and is a legal request, allowing the smart terminal to access. .

[0062] In the above invention, the intelligent terminal acquires the request parameter, and encrypts the request parameter by the MD5 algorithm to generate a first digital signature string, and the first digital signature is generated.

Referring to FIG. 2, FIG. 2 is a schematic structural diagram of an embodiment of an illegal access server preventing apparatus according to the present invention.

The apparatus 200 includes: an obtaining unit 201, a generating and packaging unit 202, a transmitting unit 203, a receiving unit 242, a decapsulation generating unit 205, and a determining unit 206.

The obtaining unit 201 is configured to obtain a request parameter, where the request parameter is a parameter carried in the first access request that the smart terminal prepares to send to the server, and the request parameter includes a parameter of the interface that the smart terminal communicates with the server.

[0065] The generating and packaging unit 202 is configured to encrypt the request parameter by using an MD5 algorithm to generate a first digital signature.

String, and the first digital signature The string is encapsulated into the first access request.

[0066] The sending unit 203 is configured to send the first access request to the server.

[0067] The receiving unit 204 is configured to receive the first digital signature

A second access request of the string, and decapsulating the request parameter from the second access request.

The decapsulation generating unit 205 is configured to encrypt the request parameter obtained by decapsulating the second access request by the MD5 algorithm to generate a second digital signature string.

The determining unit 206 is configured to determine whether the first digital signature string and the second digital signature string are consistent. If yes, determine that the second access request is the first access request, and the server allows the smart terminal to access.

[0070] Optionally, the request parameter includes a plurality of parameters including parameters of an interface of the smart terminal and the server, and the generating and packaging unit 202 is further configured to:

[0071] A plurality of parameters in the request parameter are connected by a preset symbol.

[0072] Optionally, the request parameters include an application software identifier, a software version number, an international language code, and an interface parameter.

[0073] Optionally, the generating package unit 202 is further configured to:

[0074] A plurality of parameters in the request parameters are arranged in a preset order.

[0075] Optionally, the plurality of parameters in the request parameter are arranged in a preset order, including:

[0076] A plurality of parameters in the request parameters are arranged in alphabetical order.

[0077] It should be noted that the obtaining unit 201, the generating and packaging unit 202, and the sending unit 203 are located at the smart terminal; the receiving unit 204, the decapsulation generating unit 205, and the determining unit 206 are located at the server.

[0078] It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, and those skilled in the art should know that the present invention is not subject to the described actions. The order is limited because certain steps may be performed in other orders or in the same manner in accordance with the present invention. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0079] In the foregoing embodiments, the descriptions of the various embodiments are different, and the parts that are not detailed in an embodiment may refer to related descriptions of other embodiments. [0080] The steps in the method of the embodiment of the present invention may be sequentially adjusted, merged, and deleted according to actual needs.

[0081] The units in the apparatus of the embodiment of the present invention may be combined, divided, and deleted according to actual needs. Those skilled in the art can combine or combine the different embodiments described in the specification and the features of the different embodiments.

[0082] Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware, firmware implementation, or a combination thereof. When implemented in software, the functions described above may be stored in or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media, including communication media including any medium that facilitates transfer of a computer program from one location to another. The storage medium can be any of the available media that the computer can access. For example, the computer readable medium may include a random access memory (RAM). Read-Only Memory (ROM). Electrically Erasable Programmable (Electrically Erasable Programmable) Read-Only Memory, EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, disk storage media or other magnetic storage devices, or capable of carrying or storing instructions or data structures The desired program code and any other medium that can be accessed by the computer. Also. Any one connectable may suitably become a computer readable medium. For example, if the software is using coaxial cable, fiber optic cable, twisted pair, digital subscriber line

(Digital Subscriber Line, DSL) or wireless technology such as infrared, radio and microwave transmission from a website, server or other remote source, then coaxial cable, fiber optic cable, twisted pair, DSL or such as infrared, wireless and microwave Wireless technologies such as those included in the fixing of the associated medium. As used in the present invention, a disk and a disc include a compact disc (CD), a laser disc, a disc, a digital versatile disc (DVD), a floppy disc, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable medium.

In summary, the above description is only a preferred embodiment of the technical solution of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

technical problem The solution to the problem is the beneficial effect of the invention

Claims

Claim

[Claim 1] A method for preventing an illegal access server, comprising:

The smart terminal acquires a request parameter, where the request parameter is a parameter carried in a first access request that the smart terminal prepares to send to the server, and the request parameter includes a parameter of an interface that the smart terminal communicates with the server;

The smart terminal encrypts the request parameter to generate a first digital signature string by using an MD5 algorithm, and encapsulates the first digital signature string into the first access request, to send the first access request to the Server sends

Receiving, by the server, a second access request having the first digital signature string, and decapsulating the request parameter from the second access request;

The server encrypts the request parameter obtained by decapsulating the second access request by the MD5 algorithm to generate a second digital signature string;

Determining, by the server, whether the first digital signature string and the second digital signature string are consistent, and if yes, determining that the second access request is the first access request, the server allowing the smart The terminal makes an access.

[Claim 2] The method according to claim 1, wherein the request parameter includes a plurality of parameters including parameters of an interface of the smart terminal and the server, and the smart terminal passes the MD5. The algorithm encrypts the request parameter to generate a first digital signature string including

A plurality of parameters of the request parameters are connected by a preset symbol.

[Claim 3] The method according to claim 2, wherein the request parameter includes an application software identifier, a software version number, an international language code, and an interface parameter.

[Claim 4] The method according to claim 3, wherein before the connecting the plurality of parameters of the request parameter by using a preset symbol, the method further includes:

A plurality of parameters of the request parameters are arranged in a preset order.

[Claim 5] The method according to claim 4, wherein the plurality of parameters in the request parameter are arranged in a preset order, including:

A plurality of parameters of the request parameters are arranged in alphabetical order. An illegal access server preventing device, comprising:

An obtaining unit, configured to acquire a request parameter, where the request parameter is a parameter carried in a first access request that the smart terminal prepares to send to the server, where the request parameter includes an interface that the smart terminal communicates with the server Parameter

Generating an encapsulation unit, configured to encrypt the request parameter by using an MD5 algorithm to generate a first digital signature string, and encapsulate the first digital signature string into the first access request; and send, by the sending unit, An access request is sent to the server;

a receiving unit, configured to receive a second access request with the first digital signature string, and decapsulate the request parameter from the second access request;

a decapsulation generating unit, configured to encrypt, by using the MD5 algorithm, a request parameter obtained by decapsulating the second access request to generate a second digital signature string;

a determining unit, configured to determine whether the first digital signature string and the second digital signature string are consistent, and if yes, determining that the second access request is the first access request, the server allows the The intelligent terminal performs access.

The device according to claim 6, wherein the request parameter comprises a plurality of parameters including parameters of an interface of the smart terminal and the server, and the generating and packaging unit is further configured to:

The apparatus according to claim 7, wherein the request parameter comprises an application software identifier, a software version number, an international language code, and an interface parameter.

The device according to claim 8, wherein the generating package unit is further used for

The apparatus according to claim 9, wherein the plurality of parameters in the request parameter are arranged in a preset order, including: