WO2021008034A1

WO2021008034A1 - Method and apparatus for network request security verification, and computing device and storage medium

Info

Publication number: WO2021008034A1
Application number: PCT/CN2019/117695
Authority: WO
Inventors: 颜媛
Original assignee: 平安普惠企业管理有限公司
Priority date: 2019-07-12
Filing date: 2019-11-12
Publication date: 2021-01-21
Also published as: CN110445615B; CN110445615A

Abstract

The present application relates to the field of network monitoring, and disclosed thereby are a method and apparatus for network request security verification, a computing device and a storage medium. The method comprises: receiving a first network request; generating a first token according to the first network request and sending the first token to a sending end of the first network request, the first token containing an expiration time; determining a time during which a trigger operation of the sending end of the first network request is monitored; when the trigger operation of the sending end of the first network request is detected during said time, adjusting the expiration time of the first token according to the trigger operation so as to obtain an adjusted expiration time of the first token; when a second network request carrying the first token is received before the adjusted expiration time, determining that the second network request is legitimate. By adjusting the expiration time of the token according to the trigger operation of a user after the token is generated for the network request, dynamic optimization of the token expiration time is achieved, thereby attending to the security of the token while guaranteeing user experience.

Description

Network request security verification method, device, computing equipment and storage medium

This application is based on and claims the priority of the Chinese patent application filed on July 12, 2019, with the application number CN 201910630624.4 and the name "Network request security verification method, device, medium and electronic equipment", the entire content of which is here Incorporated as a reference.

Technical field

This application relates to the field of network monitoring technology, and in particular to a method, device, computing device, and computer non-volatile readable storage medium for verifying network request security.

Background technique

With the advent of the Internet era, various technologies including network protocols have provided a safe and orderly environment for network communication, allowing people to freely roam in the ocean of the network. Token (token) is in the era of information security An important technology. Token has a certain timeliness as a token in identity authentication. At present, most of the client or App usage process is that when a user logs in to the server or submits a form to the server, the server will return a token to the client or App. When the user logs in again or submits the form, the request submitted by the client or App will carry this token. Token, the server judges whether the user's request is legal based on the token.

The inventor of this application realizes that at present, in order to ensure the effectiveness of the token, a certain validity period is set for the token. When the token expires, the user must verify the identity when submitting the request again. At this time, the user may be using the client or App. It destroys the user experience, but if the validity period of the token is extended to ensure the user experience, the security of the token will be reduced. Therefore, it is impossible to balance the user experience and the security of the token at the same time.

Summary of the invention

In order to solve the technical problem that the expiration of the token in the related technology will destroy the user experience and ultimately cause the user to use network services inefficiently, the purpose of this application is to provide a network request security verification method, device, computing device and computer non-volatile Sexually readable storage medium.

In the first aspect, a network request security verification method is provided, including:

Receive the first network request;

Generate a first token according to the first network request and send the first token to the sender of the first network request, wherein the first token includes the expiration time of the first token ；

Determining the time for monitoring the triggering operation of the sender of the first network request;

When the trigger operation of the sender of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the adjusted expiration time of the first token;

When a second network request carrying the first token is received before the adjusted expiration time, it is confirmed that the second network request is legal.

In a second aspect, a network request security verification device is provided, including:

The receiving module is configured to receive the first network request;

A sending module, configured to generate a first token according to the first network request and send the first token to the sending end of the first network request, wherein the first token includes the first token The expiration time of a token;

The determining module is configured to determine the time for monitoring the triggering operation of the sending end of the first network request;

The adjustment module is configured to, when a trigger operation of the sending end of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the value of the first token Expiration time after adjustment;

The confirmation module is configured to confirm that the second network request is legal when the second network request carrying the first token is received before the adjusted expiration time.

In a third aspect, a computing device is provided, including a memory and a processor, the memory is used to store a program of the processor's network request security verification method, and the processor is configured to execute the network request security The program of the sexual verification method performs the following processing: receiving a first network request; generating a first token according to the first network request and sending the first token to the sender of the first network request, wherein, The first token includes the expiration time of the first token; determining the time for monitoring the triggering operation of the sending end of the first network request; when the triggering of the sending end of the first network request is monitored at the time Operation, adjust the expiration time of the first token according to the trigger operation to obtain the adjusted expiration time of the first token; when the first token is received before the adjusted expiration time The second network request confirms that the second network request is legal.

In a fourth aspect, a computer non-volatile readable storage medium storing computer readable instructions is provided, and a program for a network request security verification method is stored thereon, and the network request security verification method program is processed When the device is executed, the following processing is implemented: receiving a first network request; generating a first token according to the first network request and sending the first token to the sending end of the first network request, wherein the first network request A token includes the expiration time of the first token; determining the time to monitor the trigger operation of the sender of the first network request; when the trigger operation of the sender of the first network request is monitored at the time, according to The triggering operation adjusts the expiration time of the first token to obtain the adjusted expiration time of the first token; when the second token carrying the first token is received before the adjusted expiration time The network request confirms that the second network request is legal.

The foregoing network request security verification method, device, computing device, and computer non-volatile readable storage medium realize the token expiration time by automatically adjusting the expiration time of the token according to the trigger operation of the user after the token is generated for the network request The dynamic optimization of the expiration time greatly reduces the possibility of destroying the user experience caused by the expiration of the token, and guarantees the user experience while taking into account the security of the token.

It should be understood that the above general description and the following detailed description are only exemplary and cannot limit the application.

Description of the drawings

Fig. 1 is a schematic diagram showing an application scenario of a method for verifying network request security according to an exemplary embodiment;

Fig. 2 is a flow chart showing a method for verifying the security of a network request according to an exemplary embodiment;

FIG. 3 is a flowchart showing details of step 220 of an embodiment according to the embodiment corresponding to FIG. 2;

FIG. 4 is a flowchart showing details of step 230 of an embodiment according to the embodiment corresponding to FIG. 2;

FIG. 5 is a detailed flowchart of step 240 according to an embodiment shown in the embodiment corresponding to FIG. 2;

FIG. 6 is a flowchart showing details of step 240 in another embodiment according to the embodiment corresponding to FIG. 2;

Fig. 7 is a block diagram showing a device for verifying network request security according to an exemplary embodiment;

Fig. 8 is an exemplary block diagram showing a computing device for implementing the above-mentioned network request security verification method according to an exemplary embodiment;

Fig. 9 shows a computer non-volatile readable storage medium for implementing the above-mentioned network request security verification method according to an exemplary embodiment.

Detailed ways

Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present application. On the contrary, they are only examples of devices and methods consistent with some aspects of the application as detailed in the appended claims.

In addition, the drawings are only schematic illustrations of the application, and are not necessarily drawn to scale. The same reference numerals in the figures denote the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

This application first provides a method for verifying network request security. The network request may be any request established by sending a request message on the network, and may be a request based on various protocols, for example, a more typical request may be a request based on the HTTP protocol. The verification of the security of the network request refers to confirming whether the network request meets certain security standards or requirements. Compared with the unverified network request, the security verified network request is more secure, that is, the security verified The possibility of a network request being an illegal network request is low, so the security verification of the network request is an important part of judging whether the network request is legal. The implementation terminal of this application can be any device with computing, processing and communication functions. It can be a portable mobile device, such as a smart phone, a tablet computer, a notebook computer, etc., or a variety of fixed devices, such as computer equipment, on-site Terminals, desktop computers, servers, workstations, etc.

Fig. 1 is a schematic diagram showing an application scenario of a method for verifying network request security according to an exemplary embodiment. As shown in FIG. 1, it includes a server 110, a desktop computer 120 and a token 130. In FIG. 1, the server 110 and the desktop computer 120 are connected through a data link, and data can be transferred between each other through the communication link. After the desktop computer 120 sends a request message to the server 110 through a web page or a client, the server 110 may return the token 130 to the desktop computer 120 according to the request message. The token 130 has an expiration time. Before the expiration time of the token 130, the user can use the desktop computer 120 to perform various interactive activities that require the token 130 with the server 110 through a web page or a client; After the expiration time, the desktop computer 120 and the server 110 cannot perform various interactive activities that require the token 130 until the server 110 issues related tokens to the desktop computer 120 again. In the traditional way, the expiration time of the token is fixed. The inventor of this application realizes that the solution of using a fixed token expiration time has at least the following drawbacks: the use of a token expiration time that is too short or unreasonable will cause damage. The continuous interaction behavior of the user is interrupted, which affects the user experience, and the use of a too long token expiration time will reduce the security of the token.

Fig. 2 is a flow chart showing a method for verifying the security of a network request according to an exemplary embodiment.

As shown in Figure 2, it includes the following steps:

Step 210: Receive a first network request.

The network request may be various network requests based on the Internet protocol established by sending request messages, for example, it may be a network request based on the HTTP protocol.

In one embodiment, the first network request is generated using the POST or GET method under the HTTP protocol.

In an embodiment, the local end is the target receiving end of the first network request, that is, the local end returns a corresponding response to the sending end of the first network request according to the first network request.

In one embodiment, the target terminal other than the local end is the target receiver of the first network request, and the target terminal is used to return the corresponding terminal to the sender of the first network request according to the first network request. In response, the local end is used to generate a token and verify the security of the network request through the token, and the first network request received by the local end is forwarded to the local end by the target receiving end after receiving the first network request .

In an embodiment, after receiving the first network request, the method further includes: determining that the first network request is legal.

In one embodiment, the local end has a registration identity library, and the first network request is sent directly from the requesting end to the local end. Before sending a network request to the local end, each terminal must register with the local end and register the request. The identification of the terminal of the network is stored in the registration identification library, the first network request includes a request header, and the request header includes the identifier of the requesting end. The determining that the first network request is legal includes: obtaining the first network The identifier of the requesting end in the request header of the request; if the identifier exists in the registered identifier library, it is determined that the first network request is legal.

Step 220: Generate a first token according to the first network request and send the first token to the sender of the first network request.

Wherein, the first token includes the expiration time of the first token.

The token is a string used to verify the legitimacy of the network request.

In one embodiment, the format of the expiration time of the first token is a preset time format, for example, it may be 2019/2/15/18:00.

In one embodiment, the format of the expiration time of the first token is a timestamp.

In one embodiment, the first network request includes a uniform resource locator, system parameters, and service parameters, and the first token is a hash algorithm for uniform resource locator (URL, Uniform Resource Locator) and system parameters. Parameters and business parameters are hashed. Wherein, the uniform resource locator is the address of the resource requested to be accessed by the first network request, and the system parameter is a parameter that identifies the identity of the requester, such as the system identifier of the requester or the MAC (Media Access Control Address) address of the requester Or the IP address of the requester (Internet Protocol Address), etc. The service parameter is the identifier of the service used to initiate the request, for example, the name of the interface called by the user to initiate the request or the name of the service portal used, hash The algorithm can be multiple types of algorithms, such as SHA256, MD5, and other algorithms.

In one embodiment, a hash operation is performed on a string composed of a uniform resource locator, system parameters, and service parameters to obtain a summary of the string; the summary is combined with the expiration time of the first token The string formed by the timestamp serves as the first token.

In one embodiment, a hash operation is performed on each character string in the uniform resource locator, the system parameter, and the service parameter to obtain the summary of each character string, and the summary of each character string and the representative of the first order The character string formed by the time stamp of the expiration time of the card is used as the first token.

In an embodiment, the first network request includes the registered account of the requester, and the generating of the first token according to the first network request includes: using a hash algorithm to verify the requester's account in the first network request The registered account is hashed to obtain a digest of the registered account; a string composed of the preset token expiration time and the digest is used as the first token.

In one embodiment, the first network request includes the registration account of the requesting party. Before sending the network request, the requesting party completes the registration of the account by submitting identity information to the local end and generates the registered account for the requesting party, where the generated The registered account and the submitted identity information are correspondingly stored on the local end. The generating of the first token according to the first network request includes: obtaining the registered account of the requesting party included in the first network request; The identity information corresponding to the account; use a hash algorithm to hash the identity information to obtain a digest of the identity information; use a string consisting of a preset token expiration time and the digest as the first token.

In one embodiment, the first network request includes the registered account of the requesting party, and the generating of the first token according to the first network request includes: in response to receiving the first network request, generating a random character string, and Store the registered account of the requesting party in the first network request corresponding to the random character string locally; use a hash algorithm to hash the random character string to obtain a summary of the random character string; The time stamp of the expiration time of the first token and the character string formed by the digest serve as the first token. Among them, the form of the random string can be various, for example, it can be a string of random length, or a string of fixed length; in addition, the random string can be a string containing only numbers or letters, or both. A string containing letters and numbers.

It is understandable that the specific methods for generating the first token according to the first network request are various, and are not limited to those shown in the above embodiments. In actual applications, other first tokens can be selected based on factors such as security. Token generation method.

Step 230: Determine the time for monitoring the triggering operation of the sender of the first network request.

Determining the time to monitor the trigger operation of the sender of the first network request refers to determining when to monitor the trigger operation of the sender of the first network request.

It should be pointed out that, for monitoring the time when the sending end of the first network request triggers the operation, the time mentioned here may be a time point or a time period.

In an embodiment, after determining the time when the sender of the first network request triggers the operation, the method includes:

Monitor the trigger operation of the sender of the first network request according to the time.

The manner of monitoring the trigger operation of the sending end of the first network request may be by monitoring click events or button controls, etc., and specifically, different monitoring methods may be adopted according to different actual applications.

In an embodiment, determining the time for monitoring the triggering operation of the sender of the first network request includes: starting from sending the first token to the sender of the first network request, setting a preset interval The preset first time period before the time point obtained by the second time period is used as the time for monitoring the triggering operation of the sending end of the first network request, wherein the first time period is less than the second time period.

For example, if the time at which the first token is sent to the sender of the first network request is 2:00, and the preset first time period and second time period are 3 hours and 5 hours, respectively, the obtained first token A time point separated by 5 hours from 2:00 is 7:00, and the time at which the first sender that listens to the first network request triggers the operation is 4:00-7:00; Therefore, the second available time for monitoring the triggering operation of the sender of the first network request is 9:00-12:00.

The advantage of this embodiment is that after the local end sends the first token to the sender of the first network request, it monitors the trigger operation of the sender of the first network request in a fixed period of time to ensure In order to monitor the fairness of the trigger operation of the sender of the first network request.

In one embodiment, determining the time to monitor the triggering operation of the sender of the first network request includes: acquiring the time of sending the first token to the sender of the first network request and the first command The difference between the expiration time of the card; determining the ratio of the difference and a preset time difference reference value, the preset time difference reference value corresponding to the first reference time period and the second reference time period, the The first reference time period is less than the second reference time period; the product of the ratio and the first reference time period is obtained to be the first standard time period, and the product of the ratio and the second reference time period is obtained as The second standard time period; starting from sending the first token to the sender of the first network request, the first standard time period before the time point obtained every second standard time period is used as the monitoring of the The time at which the sender of the first network request triggered the operation. The advantage of this embodiment is that it adapts according to the length of the time period from the time when the first token is sent to the sender of the first network request to the expiration time of the first token The time for monitoring the triggering operation of the sending end of the first network request is determined so that the determined time for monitoring the triggering operation of the sending end of the first network request is more reasonable.

In one embodiment, determining the time for monitoring the triggering operation of the sender of the first network request includes: sending the first token to the sender of the first network request to the first order The time period between the expiration times of the cards is divided into the first number of time intervals; each time interval obtained by the division is divided into the second number of time sub-intervals; for each time interval, the number of time periods less than or equal to the second number is obtained Random integer; for each time interval, the time sub-intervals in the time interval are sorted into random integers corresponding to the time interval, as the time for the sender to monitor the first network request to trigger the operation. The advantage of this embodiment is that since each time interval includes the time for monitoring the triggering operation of the sender of the first network request, the fairness of the time for determining the triggering operation of the sender of the first network request is guaranteed At the same time, in each time interval, the time sub-interval as the time for monitoring the triggering operation of the sender of the first network request is random, so that the time for determining the triggering operation of the sender of the first network request has a certain Randomness can improve security.

Step 240: When the trigger operation of the sender of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the adjusted expiration of the first token time.

In one embodiment, when the trigger operation of the sender of the first network request is monitored at the time, the expiration time of the first token is adjusted according to the trigger operation to obtain the first order The adjusted expiration time of the card, including:

In response to monitoring the triggering operation of the sender of the first network request at the time, the expiration time of the first token is delayed by a preset time period as the adjusted expiration of the first token time.

In one embodiment, when the trigger operation of the sending end of the first network request is monitored at the time, the expiration time of the first token is adjusted according to the trigger operation to obtain the first token After the adjusted expiration time of the first network request, the method further includes: re-determining the time to monitor the trigger operation of the sender of the first network request and monitor the trigger operation of the sender of the first network request at the time until the first The token is invalid.

Acquire the frequency at which the trigger operation of the sender of the first network request is monitored at the time; adjust the expiration time of the first token according to the frequency of the trigger operation.

In one embodiment, adjusting the expiration time of the first token according to the frequency of the trigger operation includes: in the case that the frequency is greater than a preset frequency threshold, changing the expiration time of the first token to Postpone the preset first time period later, as the adjusted expiration time of the first token; if the frequency is not greater than the preset frequency threshold, postpone the expiration time of the first token backward The preset second time period is used as the adjusted expiration time of the first token, and the preset second time period is less than the preset first time period.

In one embodiment, adjusting the expiration time of the first token according to the frequency of the trigger operation includes: obtaining the ratio of the frequency to a preset frequency threshold; determining the sum of the ratio and 1; The product of sum and the expiration time of the first token is used as the adjusted expiration time of the first token.

The advantage of this embodiment is that by adaptively adjusting the expiration time of the first token according to the frequency of the trigger operation, the adjusted expiration time of the first token can better meet user requirements.

Step 250: When a second network request carrying the first token is received before the adjusted expiration time, confirm that the second network request is legal.

As mentioned earlier, the token is a string used to verify the legitimacy of a network request. Therefore, when a second network request carrying the first token is received, if the time of receiving the second network request is within the Before the adjusted expiration time, that is, the first token has not expired, it can be confirmed that the second network request carries a valid first token, that is, the second network request is legal.

In one embodiment, before the second network request carrying the first token is received before the adjusted expiration time, before confirming that the second network request is legal, the method includes:

Determining whether the token requested by the second network is the first token;

If yes, determine whether the time of receiving the second network request is before the adjusted expiration time, wherein when the second network request carrying the first token is received before the adjusted expiration time, confirm The second network request is legal when it is determined that the time when the second network request is received is before the adjusted expiration time.

In summary, according to the embodiment shown in Figure 2, the dynamic optimization of the expiration time of the token is realized, which greatly reduces the possibility of destroying the user experience caused by the expiration of the token, and ensures the user experience while taking account of the order. The security of the card can improve the efficiency of users when using network services that require tokens.

FIG. 3 is a flowchart showing the details of step 220 of an embodiment according to the embodiment corresponding to FIG. 2. As shown in Figure 3, it includes the following steps:

Step 221: Generate a pending first token according to the first network request.

Wherein, the pending first token does not include expiration time.

In an embodiment, the first network request includes a uniform resource locator and the identity of the sender of the first network request, and the generating of the pending first token according to the first network request includes: Perform a hash operation on a string composed of the uniform resource locator included in the first network request and the identity of the sender of the first network request to obtain a digest of the string; and use the digest as the pending The first token.

Step 222: Determine the type of the first network request.

In an embodiment, the first network request has a type identifier for identifying the type of the first network request.

Step 223: Determine the expiration time of the first token to be generated according to the type.

In one embodiment, the first network request has a type identifier, and the type identifier and the expiration time are correspondingly stored in a correspondence table. By querying the correspondence table, the type identifier in the first network request is obtained. The expiration time corresponding to the symbol is used as the expiration time of the first token to be generated.

Step 224: Add the expiration time to the pending first token to generate a first token, and send the first token to the sender of the first network request.

The advantage of the embodiment shown in FIG. 3 is that by determining the expiration time of different first tokens according to different types of the first network request, the first token generated for the network request is more reasonable.

FIG. 4 is a flowchart showing details of step 230 of an embodiment according to the embodiment corresponding to FIG. 2. As shown in FIG. 4, step 230 includes the following steps:

Step 231: Obtain the time when the first token is sent to the sender of the first network request as the first time.

In one embodiment, the local end has a built-in timer, which records the sending time of each token, and the sending of the first token to the first network request is obtained by reading the timer. End of time.

Step 232: Obtain a time period of x minutes each time from the first time as a time for monitoring the triggering operation of the sender of the first network request.

Where x is a positive integer.

In one embodiment, the time period of x minutes each time from the first time is a time period of fixed length. For example, the time period of each interval may be 5 minutes, that is, whether the sending end of the first network request has a trigger operation within 5 minutes before each acquisition.

In an embodiment, the length of the time period of x minutes each time from the first time is a preset arithmetic sequence. For example, the preset arithmetic sequence is 20, 15, 10, and 5, and if the first time is 18:00, the obtained time for the triggering operation of the sender listening to the first network request can be 18 respectively: 00-18:20, 18:20-18:35, 18:35-18:45 and 18:45-18:50.

In one embodiment, the time x minutes of each interval from the first time is determined by the following method: obtaining the first parameter value according to the expiration time of the first token; using the first parameter Value, determine the time x minutes of each interval from the first time.

In an embodiment, the obtaining the first parameter value according to the expiration time of the first token includes:

Obtain the first parameter value by the following expression:

Wherein, M is the difference between the expiration time and the effective time of the first token, and n is the time for monitoring the sending of the first network request when using x minutes as the time for the triggering operation of the sending end of the first network request to be monitored Sort the number of terminal trigger operations, y is the first parameter value;

Said using said first parameter value to determine the time x minutes of each interval starting from said first time includes:

Obtain the smallest integer greater than the first parameter value y as the number of minutes of each interval time x minutes from the first time.

From the foregoing embodiment, it can be seen that since the first token becomes effective, the frequency of monitoring the triggering operation of the sender of the first network request is getting higher and higher, that is, the triggering of the sender of the first network request is monitored. The operation time interval is getting shorter and shorter, so the advantage of this embodiment is that by setting a certain time interval at which the monitoring sender triggers the operation, resources such as computing overhead are saved, and at the same time, the monitoring is increased when the first token is about to expire. The density of triggering operations on the sending end makes user operations more unlikely to be interrupted by token expiration, which improves user experience.

FIG. 5 is a flowchart showing details of step 240 in an embodiment according to the embodiment corresponding to FIG. 2. In the embodiment shown in FIG. 5, the time when the trigger operation of the sending end of the first network request is monitored is the second time, as shown in FIG. 5, including the following steps:

Step 241: Obtain the time when the first token is sent to the sender of the first network request as the first time.

In one embodiment, the sender of the first network request has a log that records the time of each token received by the sender of the first network request, and the implementation terminal of this application has embedded Script, said acquiring the time when the first token is sent to the sender of the first network request includes: crawling the first token from the log of the sender of the first network request through a script The time when sent to the sender of the first network request.

Step 242: Determine the difference between the failure time and the first time.

Since the failure time is greater than the first time, the difference is positive.

Step 243: Obtain the sum of the difference and the second time as the adjusted expiration time of the first token.

For example, the first time is 15:00, the time to monitor the trigger operation of the sender of the first network request is 15:20, and the expiration time of the first token is 15:30, and the expiration time of the first token is The difference in the first time is 30 minutes, then when the trigger operation of the sender of the first network request is monitored at 15:20, the expiration time of the first token is adjusted to 15:20+30 minutes=15:50 .

In summary, the advantage of the embodiment shown in FIG. 5 is that the first token is adjusted by extending the expiration time of the first token according to the length of the valid time of the first token. The expiration time of the obtained first token can ensure that the adjusted expiration time of the first token will not be interrupted due to the expiration of the token to a greater extent, which improves the user experience.

FIG. 6 is a flowchart showing details of step 240 in another embodiment according to the embodiment corresponding to FIG. 2. As shown in Figure 6, step 240 includes the following steps:

Step 241', when the trigger operation of the sending end of the first network request is monitored at the time, the type of the trigger operation is acquired.

In one embodiment, each trigger operation corresponds to a service name, and the service name of the trigger operation is used as the type of the trigger operation.

For example, if each trigger operation of the sending end of the first network request is monitored, the service name corresponding to the trigger operation will be obtained, and the service name may be used as the type of the trigger operation.

Step 242': Determine an adjustment mode of the expiration time of the first token according to the type of the trigger operation.

In an embodiment, the type of the trigger operation is the risk level corresponding to each trigger operation, and the method for determining the expiration time of the first token according to the type of the trigger operation includes:

The following formula established based on the risk level corresponding to the trigger operation is used as the adjustment method of the expiration time of the first token:

Among them, α is the adjusted expiration time, β is the expiration time, M is the difference between the expiration time and the effective time of the first token, and γ is the risk level. It can be seen that the higher the risk level γ, the smaller the failure time α after adjustment, that is, the earlier the failure time after adjustment. For example, the risk level of trigger operations involving financial client, transfer, password modification, and change of bound mobile phone number can be level 3, and the risk level of trigger operations involving querying transaction records and querying personal information can be level 2, involving browsing new The risk level of news and news viewing is level 1, compared with the trigger operation with a lower risk level, the trigger operation with a higher risk level has less adjustment effect on the first token, that is, the higher the risk level of the trigger operation High, even if the expiration time of the first token has passed a delay, the final delay length is shorter, which can improve security.

The advantage of this embodiment is that by using different invalidation time adjustment methods according to the type of the monitored triggering operation, the triggering operation can delay the invalidation time of the first token while reducing high-risk triggering operations. The length of the expiration time that can be extended reduces the risk of the extension of the token expiration time to a certain extent.

Step 243': Adjust the expiration time of the first token according to the adjustment method to obtain the adjusted expiration time of the first token.

To sum up, in the embodiment shown in FIG. 6, the expiration time of the first token is adjusted by using different expiration time adjustment methods according to the type of trigger operation, so that the obtained first token The adjusted expiration time of the token is more reasonable, which improves the degree of compatibility between the adjusted expiration time of the first token and the user's trigger operation.

This application also provides a device for verifying the security of a network request. The following are device embodiments of the application.

Fig. 7 is a block diagram showing a device for verifying network request security according to an exemplary embodiment. As shown in FIG. 7, the device 700 includes:

The receiving module 710 is configured to receive the first network request.

The sending module 720 is configured to generate a first token according to the first network request and send the first token to the sender of the first network request, wherein the first token includes the The expiration time of the first token.

The determining module 730 is configured to determine the time for monitoring the triggering operation of the sender of the first network request.

The adjustment module 740 is configured to, when a trigger operation of the sending end of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the first token The adjusted expiration time.

The confirmation module 750 is configured to confirm that the second network request is legal when the second network request carrying the first token is received before the adjusted expiration time.

In an embodiment, the sending module is further configured to:

Generating a pending first token according to the first network request, wherein the pending first token does not include an expiration time;

Determining the type of the first network request;

Determine the expiration time of the first token to be generated according to the type;

The expiration time is added to the pending first token to generate a first token, and the first token is sent to the sender of the first network request.

In an embodiment, the determining module is further configured to:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Acquire a time period of x minutes each time from the first time as the time for monitoring the triggering operation of the sending end of the first network request, where x is a positive integer.

In an embodiment, the time x minutes of each interval from the first time is determined in the following manner:

Obtaining the first parameter value according to the expiration time of the first token;

Using the first parameter value, determine the time x minutes of each interval from the first time.

Obtain the first parameter value by the following expression:

In an embodiment, the time when the trigger operation of the sender of the first network request is monitored is the second time, and the adjustment module is further configured to:

Determine the difference between the failure time and the first time;

The sum of the difference and the second time is obtained as the adjusted expiration time of the first token.

In an embodiment, the adjustment module is further configured to:

When the trigger operation of the sender of the first network request is monitored at the time, acquiring the type of the trigger operation;

Determining an adjustment mode of the expiration time of the first token according to the type of the trigger operation;

According to the adjustment method, the expiration time of the first token is adjusted to obtain the adjusted expiration time of the first token.

According to the third aspect of the present application, there is also provided a computing device that executes all or part of the steps of any one of the aforementioned network request security verification methods. The computing equipment includes:

At least one processor; and

A memory communicatively connected with the at least one processor; wherein,

The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute as shown in any one of the above exemplary embodiments. The network request security verification method.

Those skilled in the art can understand that various aspects of the present application can be implemented as a system, method, or program product. Therefore, each aspect of the present application can be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as "Circuit", "Module" or "System".

The computing device 800 according to this embodiment of the present application will be described below with reference to FIG. 8. The computing device 800 shown in FIG. 8 is only an example, and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

As shown in FIG. 8, the computing device 800 is represented in the form of a general-purpose computing device. The components of the computing device 800 may include, but are not limited to: the aforementioned at least one processing unit 810, the aforementioned at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810).

Wherein, the storage unit stores program code, and the program code can be executed by the processing unit 810, so that the processing unit 810 executes the various exemplary methods described in the "Methods of Embodiments" section of this specification. Implementation steps.

The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 821 and/or a cache storage unit 822, and may further include a read-only storage unit (ROM) 823.

The storage unit 820 may also include a program/utility tool 824 having a set (at least one) program module 825. Such program module 825 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.

The bus 830 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.

The computing device 800 may also communicate with one or more external devices 1000 (such as keyboards, pointing devices, Bluetooth devices, etc.), and may also communicate with one or more devices that enable users to interact with the computing device 800, and/or communicate with Any device (eg, router, modem, etc.) that enables the computing device 800 to communicate with one or more other computing devices. This communication can be performed through an input/output (I/O) interface 850. In addition, the computing device 800 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 860. As shown in the figure, the network adapter 860 communicates with other modules of the computing device 800 through the bus 830. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the computing device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the foregoing embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which may be a personal computer, server, terminal device, or network device, etc.) execute the method according to the embodiment of the present application.

According to the fourth aspect of the present application, there is also provided a computer non-volatile readable storage medium, on which is stored a program product capable of implementing the above method of this specification. In some possible implementation manners, each aspect of the present application can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

With reference to FIG. 9, a computer non-volatile readable storage medium 900 for implementing the above method according to an embodiment of the present application is described, which may adopt a portable compact disk read-only memory (CD-ROM) and includes program code , And can run on terminal devices, such as personal computers. However, the program product of this application is not limited to this. In this document, the computer non-volatile readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device. In conjunction with.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

The program code used to perform the operations of this application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural Programming language-such as "C" language or similar programming language. The program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device can be connected to a user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using Internet service providers) Business to connect via the Internet).

In addition, the above-mentioned drawings are only schematic illustrations of the processing included in the method according to the exemplary embodiments of the present application, and are not intended for limitation. It is easy to understand that the processing shown in the above drawings does not indicate or limit the time sequence of these processings. In addition, it is easy to understand that these processes can be executed synchronously or asynchronously in multiple modules, for example.

It should be understood that the present application is not limited to the precise structure that has been described above and shown in the drawings, and various modifications and changes can be performed without departing from its scope. The scope of the application is only limited by the appended claims.

Claims

A method for verifying network request security, including:

Receive the first network request;

Generate a first token according to the first network request and send the first token to the sender of the first network request, wherein the first token includes the expiration time of the first token ；

Determining the time for monitoring the triggering operation of the sender of the first network request;

When the trigger operation of the sender of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the adjusted expiration time of the first token;

When a second network request carrying the first token is received before the adjusted expiration time, it is confirmed that the second network request is legal.
The method according to claim 1, wherein the generating a first token according to the first network request and sending the first token to the sender of the first network request comprises:

Generating a pending first token according to the first network request, wherein the pending first token does not include an expiration time;

Determining the type of the first network request;

Determine the expiration time of the first token to be generated according to the type;

The expiration time is added to the pending first token to generate a first token, and the first token is sent to the sender of the first network request.
The method according to claim 1, wherein the determining the time for monitoring the triggering operation of the sender of the first network request comprises:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Acquire a time period of x minutes each time from the first time as the time for monitoring the triggering operation of the sending end of the first network request, where x is a positive integer.
The method according to claim 3, wherein the time x minutes of each interval from the first time is determined in the following manner:

Obtaining the first parameter value according to the expiration time of the first token;

Using the first parameter value, determine the time x minutes of each interval from the first time.
The method according to claim 4, wherein the obtaining the first parameter value according to the expiration time of the first token comprises:

Obtain the first parameter value by the following expression:

Wherein, M is the difference between the expiration time and the effective time of the first token, and n is the time for monitoring the sending of the first network request when using x minutes as the time for the triggering operation of the sending end of the first network request to be monitored Sort the number of terminal trigger operations, y is the first parameter value;

Said using said first parameter value to determine the time x minutes of each interval starting from said first time includes:

Obtain the smallest integer greater than the first parameter value y as the number of minutes of each interval time x minutes from the first time.
The method according to claim 1, wherein the time when the trigger operation of the sender of the first network request is monitored is the second time, and the trigger of the sender of the first network request is monitored at the time The operation of adjusting the expiration time of the first token according to the triggering operation to obtain the adjusted expiration time of the first token includes:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Determine the difference between the failure time and the first time;

The sum of the difference and the second time is obtained as the adjusted expiration time of the first token.
The method according to claim 1, wherein when the trigger operation of the sender of the first network request is monitored at the time, the expiration time of the first token is adjusted according to the trigger operation to obtain The adjusted expiration time of the first token includes:

When the trigger operation of the sender of the first network request is monitored at the time, acquiring the type of the trigger operation;

Determining an adjustment mode of the expiration time of the first token according to the type of the trigger operation;

According to the adjustment method, the expiration time of the first token is adjusted to obtain the adjusted expiration time of the first token.
A network request security verification device, including:

The receiving module is configured to receive the first network request;

A sending module, configured to generate a first token according to the first network request and send the first token to the sending end of the first network request, wherein the first token includes the first token The expiration time of a token;

The determining module is configured to determine the time for monitoring the triggering operation of the sending end of the first network request;

The adjustment module is configured to, when a trigger operation of the sending end of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the value of the first token Expiration time after adjustment;

The confirmation module is configured to confirm that the second network request is legal when the second network request carrying the first token is received before the adjusted expiration time.
The device according to claim 8, wherein the sending module is further configured to:

Generating a pending first token according to the first network request, wherein the pending first token does not include an expiration time;

Determining the type of the first network request;

Determine the expiration time of the first token to be generated according to the type;

The expiration time is added to the pending first token to generate a first token, and the first token is sent to the sender of the first network request.
The apparatus according to claim 8, wherein the determining module is further configured to:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Acquire a time period of x minutes each time from the first time as the time for monitoring the triggering operation of the sending end of the first network request, where x is a positive integer.
The apparatus according to claim 10, wherein the time x minutes of each interval from the first time is determined in the following manner:

Obtaining the first parameter value according to the expiration time of the first token;

Using the first parameter value, determine the time x minutes of each interval from the first time.
The apparatus according to claim 11, wherein the obtaining the first parameter value according to the expiration time of the first token comprises:

Obtain the first parameter value by the following expression:

Wherein, M is the difference between the expiration time and the effective time of the first token, and n is the time for monitoring the sending of the first network request when using x minutes as the time for the triggering operation of the sending end of the first network request to be monitored Sort the number of terminal trigger operations, y is the first parameter value;

Said using said first parameter value to determine the time x minutes of each interval starting from said first time includes:

Obtain the smallest integer greater than the first parameter value y as the number of minutes of each interval time x minutes from the first time.
8. The device according to claim 8, wherein the time when the trigger operation of the sending end of the first network request is monitored is the second time, and the adjustment module is further configured to:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Determine the difference between the failure time and the first time;

The sum of the difference and the second time is obtained as the adjusted expiration time of the first token.
The device according to claim 8, wherein the adjustment module is further configured to:

When the trigger operation of the sender of the first network request is monitored at the time, acquiring the type of the trigger operation;

Determining an adjustment mode of the expiration time of the first token according to the type of the trigger operation;

According to the adjustment method, the expiration time of the first token is adjusted to obtain the adjusted expiration time of the first token.
A computing device includes a memory and a processor, the memory stores computer readable instructions, and when the computer readable instructions are executed by the processor, the processor executes:

Receive the first network request;

Generate a first token according to the first network request and send the first token to the sender of the first network request, wherein the first token includes the expiration time of the first token ；

Determining the time for monitoring the triggering operation of the sender of the first network request;

When the trigger operation of the sender of the first network request is monitored at the time, adjust the expiration time of the first token according to the trigger operation to obtain the adjusted expiration time of the first token;

When a second network request carrying the first token is received before the adjusted expiration time, it is confirmed that the second network request is legal.
The computing device according to claim 15, wherein the generating the first token according to the first network request and sending the first token to the sender of the first network request comprises:

Generating a pending first token according to the first network request, wherein the pending first token does not include an expiration time;

Determining the type of the first network request;

Determine the expiration time of the first token to be generated according to the type;

The expiration time is added to the pending first token to generate a first token, and the first token is sent to the sender of the first network request.
The computing device according to claim 15, wherein the determining the time for monitoring the triggering operation of the sender of the first network request comprises:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Acquire a time period of x minutes each time from the first time as the time for monitoring the triggering operation of the sending end of the first network request, where x is a positive integer.
The computing device according to claim 17, wherein the time x minutes of each interval from the first time is determined in the following manner:

Obtaining the first parameter value according to the expiration time of the first token;

Using the first parameter value, determine the time x minutes of each interval from the first time.
The computing device according to claim 18, wherein the obtaining the first parameter value according to the expiration time of the first token comprises:

Obtain the first parameter value by the following expression:

Wherein, M is the difference between the expiration time and the effective time of the first token, and n is the time for monitoring the sending of the first network request when using x minutes as the time for the triggering operation of the sending end of the first network request to be monitored Sort the number of terminal trigger operations, y is the first parameter value;

Said using said first parameter value to determine the time x minutes of each interval starting from said first time includes:

Obtain the smallest integer greater than the first parameter value y as the number of minutes of each interval time x minutes from the first time.
The computing device according to claim 15, wherein the time when the trigger operation of the sender of the first network request is monitored is the second time, and the time when the trigger operation of the sender of the first network request is monitored at the time The triggering operation, adjusting the expiration time of the first token according to the triggering operation to obtain the adjusted expiration time of the first token, includes:

Acquiring the time when the first token is sent to the sender of the first network request as the first time;

Determine the difference between the failure time and the first time;

The sum of the difference and the second time is obtained as the adjusted expiration time of the first token.
The computing device according to claim 15, wherein when the trigger operation of the sender of the first network request is monitored at the time, the expiration time of the first token is adjusted according to the trigger operation to Obtaining the adjusted expiration time of the first token includes:

When the trigger operation of the sender of the first network request is monitored at the time, acquiring the type of the trigger operation;

Determining an adjustment mode of the expiration time of the first token according to the type of the trigger operation;

According to the adjustment method, the expiration time of the first token is adjusted to obtain the adjusted expiration time of the first token.
A computer non-volatile readable storage medium storing computer readable instructions, which when executed by one or more processors, cause one or more processors to execute any one of claims 1 to 7 The method described in the item.