A method to prevent web system data migration based on asymmetric encryption algorithm

Abstract

The present invention discloses a method for preventing web system data transplantation based on an asymmetric encryption algorithm, comprising the following steps: S1, a user logs in to the system through a browser 1, and through a client fingerprint generator, reads the client's unique data, a computer machine code, and computer feature information to generate a client fingerprint, and stores the client fingerprint to bind the user and the browser; S2, the client fingerprint is combined with the current time and public key encryption to generate a string of characters, which is the client signature; S3, accessing the server interface, when the normal interface accesses the server, carrying the client signature, server private key decryption, and obtaining the fingerprint and time; S4, copying this parameter to access the server interface with a browser 2, the client fingerprint verifier fails to verify, and the service response fails. The present invention has the characteristics of anti-impersonation, identity identification, and anti-parameter tampering, and there is a timestamp comparison fingerprint comparison technology, the data of the previous timestamp is invalid, and replay attacks can be prevented.

Description

Technical Field

[0001] The invention belongs to the field of network technology, and more specifically, relates to a method for preventing web system data transplantation based on an asymmetric encryption algorithm. Background Art

[0002] Web applications are composed of dynamic scripts, compiled codes, etc. They are usually set up on a Web server. Users send requests on a Web browser. These requests use the HTTP protocol to interact with the enterprise's Web application through the Internet. The Web application communicates with the enterprise's backend database and other dynamic content. The interface is plain text, and data can be ported and reused, which is a common phenomenon in the current web system.

[0003] As network technology becomes increasingly mature, hackers have gradually shifted their attention from previous attacks on network servers to attacks on Web applications; 75% of information security attacks occur at the Web application level rather than the network level; existing Web sites have the following shortcomings: Web system interface data is in plain text, interface functions are easy to guess, request parameters are easy to tamper with, important parameters are not unique and can be copied, the server interface recognizes and consumes repeatedly, and can simulate client requests, making the Web site vulnerable to attacks; therefore, we propose a method based on asymmetric encryption algorithm to prevent web system data migration. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and propose a method for preventing web system data migration based on an asymmetric encryption algorithm. The method does not identify tampered parameters; important parameters are unique, and the server interface does not consume repeatedly; and client simulation requests fail.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The method for preventing web system data migration based on asymmetric encryption algorithm includes the following steps:

[0007] S1, the user logs in to the system through browser 1, and uses the client fingerprint generator to read the client's unique data computer machine code and computer feature information to generate the client fingerprint, and then stores the client fingerprint to bind the user and browser;

[0008] The client fingerprint generation described in step 1 is specifically performed as follows:

[0009] 1) Collecting characteristic information of network devices and processing the characteristic information to generate characteristic identifiers;

[0010] 2) Processing the characteristic identifier and combining it with the unique data calculator machine code of the client to generate a device fingerprint of the network device;

[0011] S2. The client fingerprint is combined with the current time and the public key to generate a string of characters, which is the client signature;

[0012] S3, access the server interface, carry the parameters var, token and fingerprint key, the interface responds successfully, when the normal interface accesses the server, carry the client signature, server private key decryption, obtain the fingerprint and time;

[0013] S4, copy this parameter to access the server interface with browser 2, the client fingerprint verifier fails to verify, the service response fails, and browser 2 jumps to the login interface;

[0014] If the user's fingerprints are different twice, it means that the user has changed the browser, which may be a threat. Log in again;

[0015] If the fingerprints are the same, and the signature time sent by the client differs from the current time of the server by 1 minute, it means that the client signature is not real-time and may be illegally copied and called. The server re-obtains the browser signature. If an error is reported or the signature is different, or the signature time is still the same as the last time, it means there is a threat and access is prohibited.

[0016] Preferably, the server interface is provided with a client fingerprint verifier and a client fingerprint storage, the client fingerprint verifier is used to decrypt the client signature when the normal interface accesses the server, and the client fingerprint storage is used to store the client fingerprint data.

[0017] Preferably, the characteristic information includes the clock deviation of the network device, the operating system characteristics of the network device, the communication protocol characteristics of the network device, and the clock frequency of the network device. The clock deviation of the network device is collected specifically as follows: n data packets with timestamp values ​​are sent to the network device at a preset time interval Δt; n data packet responses with timestamp values ​​sent by the network device are received, and the time values ​​of the received n data packet responses with timestamp values ​​are recorded in sequence to obtain a first time value sequence, denoted as Ti, i=1, 2, ..., n.

[0018] Preferably, the timestamp value in each data packet response with a timestamp value is measured, and the timestamp value in each data packet is divided by the system clock frequency in the corresponding data packet to obtain a second time value sequence, denoted as T'i, i = 1, 2, ..., n; the system clock frequency is obtained by subtracting the timestamp values ​​in the two received data packet responses with timestamp values ​​to obtain a difference, and then dividing the difference by the time interval between the above two data packet responses with timestamp values.

[0019] Preferably, the specific method for collecting the clock frequency is:

[0020] 1) Collect data packets from network devices at least twice and extract the timestamp value of each data packet;

[0021] 2) Calculate the difference between the timestamp value extracted from the last collected data packet and the timestamp value extracted from the first collected data packet, and divide the difference by a preset time interval to obtain a quotient value, where the interval time is the time between the last collected data packet and the first collected data packet.

[0022] Preferably, the client fingerprint generated by the client fingerprint generator is used to encrypt the IP address, computer machine code, browser identifier, and the client fingerprint is unique;

[0023] Preferably, the client fingerprint storage is used to bind and store user and client fingerprints to keep the logged-in user client unique.

[0024] Preferably, the client fingerprint verifier is also used to ensure that requests sent continuously by the user all carry the same browser fingerprint, thereby ensuring the identity of the requester.

[0025] The technical effects and advantages of the present invention are as follows: the method for preventing web system data transplantation based on an asymmetric encryption algorithm provided by the present invention has the characteristics of preventing impersonation, authenticating identity, and preventing parameter tampering compared with the traditional method. In addition, due to the existence of technologies such as timestamp comparison and fingerprint comparison, the data of the previous timestamp is invalid, which can prevent replay attacks. Furthermore, the client simulation request is invalid, and the third party cannot intercept the interface data. With confidentiality guaranteed, interception attacks will also be invalid. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a diagram of the web system access architecture of the present invention;

[0027] Figure 2 It is a principle flow chart of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0029] The present invention provides Figure 1-2 The method for preventing web system data transplantation based on asymmetric encryption algorithm includes the following steps:

[0030] S1, the user logs in to the system through browser 1, and uses the client fingerprint generator to read the client's unique data computer machine code and computer feature information to generate the client fingerprint, and then stores the client fingerprint to bind the user and browser;

[0031] The client fingerprint generation described in step 1 is specifically performed as follows:

[0032] 1) Collecting characteristic information of network devices and processing the characteristic information to generate characteristic identifiers;

[0033] 2) Processing the characteristic identifier and combining it with the unique data calculator machine code of the client to generate a device fingerprint of the network device;

[0034] Furthermore, after the device fingerprint is generated, the detection device can convert the device fingerprint of the network device into a data packet through the data transmission module and transmit it to the network device. The network device receives the data packet and parses it to obtain the device fingerprint of the network device.

[0035] The device fingerprint generated by the detection device can also be manually imported into the network device, such as copying the device fingerprint to the network device through a USB flash drive, or directly inputting the device fingerprint generated by the detection device into the network device through an input component of the network device;

[0036] The characteristic information includes the clock deviation of the network device, the operating system characteristics of the network device, the communication protocol characteristics of the network device, and the clock frequency of the network device. The clock deviation of the network device is collected by sending n data packets with timestamp values ​​to the network device at a preset time interval Δt; receiving n data packet responses with timestamp values ​​sent by the network device, and sequentially recording the time values ​​of receiving the n data packet responses with timestamp values ​​to obtain a first time value sequence, recorded as Ti, i=1, 2, ..., n;

[0037] Measure the timestamp value in each data packet response with a timestamp value, divide the timestamp value in each data packet by the system clock frequency in the corresponding data packet to obtain a second time value sequence, recorded as T'i, i = 1, 2, ..., n; the system clock frequency is obtained by subtracting the timestamp values ​​in the two received data packet responses with timestamp values ​​to obtain a difference, and then dividing the difference by the time interval between the two data packet responses with timestamp values; judge the abnormal values ​​in the first time value sequence Ti and the second time value sequence T'i respectively in order from front to back;

[0038] The judgment method may be: since the time values ​​are recorded sequentially, the time values ​​in the first time value sequence should increase proportionally. If a certain time value obviously deviates from this increasing trend, it is an abnormal value. Similarly, the abnormal value judgment method of the second time value sequence is also the same.

[0039] When it is first determined that the two time values ​​of the same order in the first time value sequence Ti and the second time value sequence T'i are not abnormal values, the time value of the order in the first time value sequence is recorded as the first time value, and the time value of the order in the second time value sequence is recorded as the second time value;

[0040] The specific method for collecting the clock frequency is:

[0041] 1) Collect data packets from network devices at least twice and extract the timestamp value of each data packet;

[0042] 2) Calculate the difference between the timestamp value extracted from the last collected data packet and the timestamp value extracted from the first collected data packet, and divide the difference by a preset time interval to obtain a quotient value, where the time interval is the time between the last collected data packet and the first collected data packet;

[0043] S2. The client fingerprint is combined with the current time and the public key to generate a string of characters, which is the client signature;

[0044] S3, access the server interface, carry the parameters var, token and fingerprint key, the interface responds successfully, when the normal interface accesses the server, carry the client signature, server private key decryption, obtain the fingerprint and time;

[0045] S4, copy this parameter to access the server interface with browser 2, the client fingerprint verifier fails to verify, the service response fails, and browser 2 jumps to the login interface;

[0046] If the user's fingerprints are different twice, it means that the user has changed the browser, which may be a threat. Log in again;

[0047] If the fingerprints are the same, and the signature time sent by the client differs from the current time of the server by 1 minute, it means that the client signature is not real-time and may be illegally copied and called. The server re-obtains the browser signature. If an error is reported or the signature is different, or the signature time is still the same as the last time, it means there is a threat and access is prohibited;

[0048] The server interface is provided with a client fingerprint verifier and a client fingerprint storage. The client fingerprint verifier is used to decrypt the client signature when the normal interface accesses the server. The client fingerprint storage is used to store the client fingerprint data. The client fingerprint generated by the client fingerprint generator is used to encrypt the IP address, the computer machine code, and the browser identifier, and the client fingerprint is unique; the client fingerprint storage is used to bind and store the user and client fingerprints, so that the logged-in user client is unique; the client fingerprint verifier is also used to ensure that the requests sent continuously by the user carry the same browser fingerprint, thereby ensuring the identity of the requester;

[0049] Network security, mainly network information security, requires corresponding security technical measures and the provision of appropriate security services; browser signature mechanism, as one of the means to ensure network information security, can solve the problems of forgery, denial, impersonation and tampering; this method has the following features:

[0050] 1. Anti-impersonation (forgery), the private key is only known by the signer himself, so it is impossible for others to construct the correct one;

[0051] 2. Identity can be identified. The receiver can clearly identify the sender's identity, and important parameters on the browser side are unique after fingerprint encryption;

[0052] 3. Anti-parameter tampering (anti-destruction of information integrity), the parameters transmitted by the client are bound to the browser fingerprint and encrypted; forming a mixed overall data that cannot be tampered with, thus ensuring the integrity of the data;

[0053] 4. Anti-replay: Because of the existence of timestamp comparison and fingerprint comparison technology, the data of the previous timestamp is invalid, which can prevent replay attacks;

[0054] 5. Confidentiality (confidentiality); client simulation requests fail, and third parties cannot intercept interface data; with confidentiality guaranteed, interception attacks become ineffective.

[0055] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for preventing web system data migration based on an asymmetric encryption algorithm, characterized in that: The steps include: S1. The user logs in to the system through the first browser, and the client fingerprint generator reads the client's unique data computer machine code and computer feature information to generate the client fingerprint, and stores the client fingerprint to bind the user and the browser; the client fingerprint generated by the client fingerprint generator is used to encrypt the IP address, computer machine code, browser identifier, and the client fingerprint is unique; the client fingerprint storage is used to bind and store user information and client fingerprints to keep the logged-in user client unique; the client fingerprint verifier is used to verify that the requests sent continuously by the user carry the same browser fingerprint, thereby ensuring the identity of the requester; The client fingerprint generation described in S1 is specifically performed as follows: 1) Collecting characteristic information of network devices and processing the characteristic information to generate characteristic identifiers; 2) Processing the characteristic identifier and combining it with the unique data calculator machine code of the client to generate a device fingerprint of the network device; S2. The client fingerprint is combined with the current time and the public key to generate a string of characters, which is the client signature; S3, access the server interface, carry the parameters var, token and fingerprint key, the interface responds successfully, when the normal interface accesses the server, carry the client signature, server private key decryption, obtain the fingerprint and time; The server interface is provided with a client fingerprint verifier and a client fingerprint storage, wherein the client fingerprint verifier is used to decrypt the client signature when the normal interface accesses the server, and the client fingerprint storage is used to store the client fingerprint data; S4, copy this parameter to access the server interface with a second browser, the client fingerprint verifier fails to verify, the service response fails, and the second browser jumps to the login interface; If the user's fingerprints are different twice, it means that the user has changed the browser, which may be a threat. Log in again; If the fingerprints are the same, and the signature time sent by the client differs from the current time of the server by 1 minute, it means that the client signature is not real-time and may be illegally copied and called. The server re-obtains the browser signature. If an error is reported or the signature is different, or the signature time is still the same as the last time, it means there is a threat and access is prohibited.

2. The method for preventing web system data migration based on asymmetric encryption algorithm according to claim 1 is characterized in that: The characteristic information includes the clock deviation of the network device, the operating system characteristics of the network device, the communication protocol characteristics of the network device, and the clock frequency of the network device. The clock deviation of the network device is collected specifically as follows: n data packets with timestamp values ​​are sent to the network device at a preset time interval △t; n data packet responses with timestamp values ​​sent by the network device are received, and the time values ​​of the received n data packet responses with timestamp values ​​are recorded in sequence to obtain a first time value sequence, recorded as Ti, i=1, 2,..., n.

3. The method for preventing web system data migration based on asymmetric encryption algorithm according to claim 2 is characterized in that: Measuring the timestamp value in each data packet response with a timestamp value, dividing the timestamp value in each data packet by the system clock frequency in the corresponding data packet to obtain a second time value sequence, denoted as T'i, i=1, 2, ..., n; The system clock frequency is obtained by subtracting the timestamp values ​​in the two received data packet responses with timestamp values ​​to obtain a difference, and then dividing the difference by the time interval between the two data packet responses with timestamp values.

4. The method for preventing web system data migration based on asymmetric encryption algorithm according to claim 3 is characterized in that: The specific method for collecting the clock frequency is: 1) Collect data packets from network devices at least twice and extract the timestamp value of each data packet; 2) Calculate the difference between the timestamp value extracted from the last collected data packet and the timestamp value extracted from the first collected data packet, and divide the difference by a preset time interval to obtain a quotient value, where the interval time is the time between the last collected data packet and the first collected data packet.

Images