Method and device for preventing transaction detour attacks

Abstract

The invention provides a method and device for preventing a transaction detour attack, and the method comprises the steps: configuring anti-detour configuration information according to all requests corresponding to a transaction, and the anti-detour configuration information comprises a request recognition mode and a request possibility combination flow; acquiring trail record information of thetransaction in real time; and comparing the trail record information of the transaction with the anti-detour configuration information, and processing according to a comparison result. According to the invention, the defect that the existing transaction security center is insufficient in anti-detour verification is overcome; the detour request can be intercepted and the service is refused, and thedetour attack in the transaction process can be identified and the service is refused to be provided under the conditions of transparent transaction development and low cost, so that the security ofenterprise application is ensured, and the method is more suitable for the current enterprise demand under the increasingly severe security environment.

Description

technical field [0001] The present application belongs to the field of transaction security, and in particular, relates to a method and device for preventing transaction bypass attacks. Background technique [0002] When a client involves multiple interactive requests with the enterprise application server during a transaction, transaction bypass is an attack method often used by attackers. For example, the original transaction process has three requests 1, 2, and 3, but the attacker is During the attack, request 1 can be made first, then request 2 can be bypassed, and simulated request 3 can be sent directly. The following is an illustration of a real case in which a transaction was bypassed in a production environment. In the pre-production customer transfer transaction, it was found that the funds in the card were transferred in two transfers by friends without the knowledge of the customer. After checking the log, it is found that in the normal payment process, the cust...

AI Technical Summary

Problems solved by technology

[0004] This application provides a method and device for preventing transaction bypass attacks, to at least solve the problem of insufficient anti-circumvention checks in the prior art

Images