Method for preventing session hijacking, server and terminal

Abstract

The embodiment of the application discloses a method for preventing session hijacking, a server and a terminal, which are used for preventing an attacker from maliciously acquiring identity authentication information between the terminal and the server, and improving the session information security level between the terminal and the server. The method according to one embodiment of the inventionincludes: automatically creating a session identifier by the server, randomly creating value of the token as a unique identifier, and constantly changing the value of the token, then, inputting the dynamic value into the data packets used for information exchange between the server and the terminal, and encrypting the data packets in an encrypted manner, so that the information security of the information exchange between the terminal and the server is doubly protected.

Description

technical field [0001] The present application relates to the technical field of communications, and in particular to a method, server and terminal for preventing session hijacking. Background technique [0002] Session hijacking is an attack in which an attacker, as a third party, obtains the terminal's session ID (Session ID), uses the legal session ID to log in to the user account of the target terminal, pretends to be a legitimate user, and hijacks the session between the terminal and the server. method. The heartbeat mechanism is a mechanism for the terminal to regularly send a custom heartbeat packet to let the server know that the terminal is still active, so as to ensure the validity of the connection between the terminal and the server. Before a session needs to be established between the terminal and the server, the terminal first needs to log in to the server and perform heartbeat packet detection with the server. After the terminal logs in and knows the normal c...

AI Technical Summary

Problems solved by technology

[0004] However, in the current technology, the session ID is always used as the identity credential for the session (information interaction) between the terminal and the server, and even if the session ID is stored in the cookie and has been encrypted, the attacker still Some computer security vulnerabilities can be found to maliciously obtain the session ID, masquerade as a legitimate terminal, and attack the session between the terminal and the server, seriously affecting the security of the session information between the terminal and the server, and the security level of the session information between the two needs to be improved

Images