Security defense method and system based on cookie encryption

Abstract

The invention relates to the technology of the network security, and aims to provide a security defense method and a system based on the cookie encryption. The system comprises an encryption and decryption device and a security engine deployed on a WEB application protection device between a client and a server. The encryption and decryption device is used for performing a cookie encryption on a response sent by the server to the client, and performing a cookie decryption on a request sent by the client to the server. As the intermediary of all data transmission between the client and the server, the security engine is used for ensuring that the client normally access and performing operations such as dropping, intercepting or alerting for requests that fail to be decrypted by the cookie.There is no need to store a key on the client, and the attacker fails because the protection device cannot be decrypted. In the case of complex and high-cost rule set maintenance and performance bottlenecks of traditional protection equipment, the present invention can be widely used as a lightweight and low-cost solution, and can be used as a lightweight and low-cost solution.

Description

technical field [0001] The invention relates to network security technology, in particular to a security defense method and system based on Cookie encryption. Background technique [0002] With the rapid development of the Internet, the security of WEB applications has become a hot topic in today's society. WEB sites are usually composed of application programs, which can provide various services and have very powerful functions. However, the services or displayed content provided by WEB websites to users are dynamically formed and can meet the individual needs of users. This personalized demand also brings security risks to WEB websites, such as SQL injection attacks, cross-site Scripting attacks, etc. At the same time, the popularity of AJAX technology has made the threat of XSS attacks more and more serious. XSS attacks rank third in the OWASP TOP 2018 distributed by the OWASP organization, which shows the great threat caused by XSS attacks. [0003] XSS attack is an ...

AI Technical Summary

Problems solved by technology

Moreover, the feature codes of XSS attacks are flexible and changeable, which brings difficulties to XSS vulnerability defense, because it is impossible to summarize all XSS attacks with a single feature

In order to improve the XSS defense capability of the WEB application protection device, this makes it complicated to maintain the feature library of the rule set, and at the same time increases the cost

Images