Method, device and system for preventing services from being attacked

Abstract

The invention discloses a method, device and system for preventing services from being attacked, which belong to the technical field of information security. The method comprises the following steps: receiving a service request sent by a client, and issuing verification information to the client, wherein the verification information at least comprises plaintexts generated randomly and user identifications encrypted by private keys; receiving a signature which is returned by the client and encrypted by a public key for verification information; and verifying the legality of the client according to the signature returned by the client, if passing the verification, continuing to serve the client, otherwise, determining that the client is an illegal client, and discarding a data packet sent by the illegal client. The method, device and system disclosed by the invention have the advantages that because the client is subjected to legality verification before being provided with services, no excessive spending is added in the process of verification, and the secret key interaction between a server and a client is not required, the risk vulnerabilities existing in secret key interaction can be avoided, and then the effect of preventing services from being attacked can be achieved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a method, device and system for preventing services from being attacked. Background technique [0002] In order to facilitate users' access, many servers are directly exposed to the public network, so they are vulnerable to attacks by hackers. Hackers generally attack servers by constructing or tampering with data packets after scanning the ports of network services. When the server is attacked, the source of the data packets cannot be identified, resulting in incorrect services to illegal users, causing the system to be busy. [0003] In order to enable the server to effectively identify the source of the data packet when receiving the data packet, so as to protect the normal service of the server. The first approach taken by the prior art to prevent services from being attacked is to encrypt data packets and use a secure data channel to transmit the encry...

AI Technical Summary

Problems solved by technology

[0005] The entire encryption system of the first method is very strict, and is suitable for transmission occasions with high security requirements. Because establishing a secure channel requires more consumption in identity verification and key interaction, it does not have special security requirements. In the high case, this method is too complicated and consumes too much, and it is generally applicable to the verification of the server side; the second way to verify the legitimacy of the client by adding a digital signature to the data packet requires the client's public key Publish to where the server can query it, and there are dangerous loopholes in this process

Images