Timestamp-based API replay attack defense system and method

Abstract

The invention discloses a timestamp-based API replay attack defence system and a method, and aims to provide the defense system and the method capable of improving system security. The defense systemcomprises a client and a system server. The client is used as an API request initiator, and the client initiates API access to the system server according to service requirements; assembling interfacerequest parameters according to an established communication protocol, processing a result fed back by the server, and driving the trend of a business process; the client comprises a timestamp synchronization module, a random number generation module and a data signature and encryption module; the system server is used for receiving an API access request from a client and providing an open service; for replay attack defense, intercepting all API requests, judging whether to replay attacks according to request parameters and system records, and recording related request information to form anaudit log module; and the system server comprises a replay attack judgment module, a request record maintenance module and an audit log module.

Description

technical field [0001] The invention relates to the technical field of information system access security, in particular to a time stamp-based defense system and method for API replay attacks. Background technique [0002] With the rapid development of Internet technology, enterprise informatization has penetrated into all aspects of enterprise production, manufacturing and operation management. Different industries and different business fields have spawned many professional information systems for various fields, which have made great contributions to the production and operation of enterprises. huge contribution. These information systems are both independent and interrelated, and there is frequent information interaction between different systems. For example, the e-commerce system may rely on the administrative approval function of the OA office system to complete the approval of item procurement applications, etc. Many systems handle information interaction between sy...

AI Technical Summary

Problems solved by technology

[0004] On the premise of already having technical means such as identity authentication, core data encryption, and data integrity verification, how to prevent criminals from using replay attacks to attack the open API of the information system, resulting in system data leakage, business data abnormalities, and business failures? Problems such as process confusion are urgent problems to be solved in the process of information system construction

Images