System security verification method and device, storage medium and computer equipment

Abstract

According to the system security verification method and device, the storage medium and the computer equipment, when it is detected that the user accesses the target system through the browser, the access information of the user is obtained, the browser fingerprint factor is generated, and the current timestamp and the browser fingerprint factor are encrypted into the dynamic fingerprint information in a polling mode; the dynamic nature of the dynamic fingerprint information can prevent an attacker from using hijacked information to make an illegal request. On the basis, when the user logs in the account, the account information of the user is bound with the dynamic fingerprint information at the current moment to generate safety verification data, so that the account information of the user is locked. And when the user accesses the resource, verifying the security verification data of the user by using the dynamic fingerprint information at the current moment, and intercepting the security verification data when the verification fails. Therefore, even if the security verification data of the user is hijacked and used for the illegal request, the application can also use the dynamic nature of the dynamic fingerprint information to intercept the illegal request, and the security of the system is further improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a system security verification method, device, storage medium and computer equipment. Background Art

[0002] With the rapid development of Internet technology, the security issues of cyberspace have become increasingly prominent. The traditional username and password authentication mechanism, as the first line of defense for network security, is a single authentication method based on knowledge and memory. It is relatively easy to crack or steal user account information, and it is difficult to meet the security requirements of modern systems. In this context, system security verification methods based on multiple factors such as biometrics and hardware device information have emerged.

[0003] Among them, the system security verification method based on browser fingerprint information has attracted much attention due to its uniqueness and difficulty in duplication. It generates browser fingerprints by collecting and analyzing the unique characteristics and attributes displayed by users when accessing the system through browsers. However, in the application model with front-end and back-end separation, the browser fingerprint information carried in the request initiated by the front-end is easily hijacked, allowing attackers to bypass the security verification mechanism and pose a threat to the system. Summary of the invention

[0004] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defect in the prior art that the browser fingerprint information carried in the request initiated by the front end is easily hijacked, allowing attackers to bypass the security verification mechanism and pose a threat to the system.

[0005] The present application provides a system security verification method, the method comprising:

[0006] When detecting that a user accesses the target system through a browser, obtaining the user's access information, and generating a browser fingerprint factor according to the access information;

[0007] Acquire the timestamp of the current moment according to a preset frequency, encrypt the timestamp and the browser fingerprint factor in a polling manner, generate dynamic fingerprint information, and monitor the user behavior of the user in the target system;

[0008] When the user behavior is account login, determine the account information of the user behavior, obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and bind the target fingerprint information with the account information to obtain security verification data;

[0009] When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment is obtained as the verification fingerprint information, and the verification fingerprint information is used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is failure.

[0010] Optionally, generating a browser fingerprint factor according to the access information includes:

[0011] Parsing the access information, extracting key data from the parsing result, and using canvas technology to draw a graph of the key data to generate a virtual graph;

[0012] The virtual graph and the key data are encoded using Base64, and the encoding result is irreversibly encrypted using the MD5 algorithm to obtain a browser fingerprint factor.

[0013] Optionally, encrypting the timestamp and the browser fingerprint factor in a polling manner to generate dynamic fingerprint information includes:

[0014] The timestamp and the browser fingerprint factor are encrypted in a polling manner using an asymmetric encryption algorithm to generate dynamic fingerprint information.

[0015] Optionally, the binding the target fingerprint information with the account information to obtain security verification data includes:

[0016] Submit the target fingerprint information and the account information to the target server, and log in to the system in the target server through the account information;

[0017] After the system login is successful, the target fingerprint information is bound to the account information in the target server to obtain security verification data.

[0018] Optionally, the using the verification fingerprint information to perform security verification on security verification data corresponding to the user includes:

[0019] Obtaining the user's account information and determining the security verification data corresponding to the account information;

[0020] Decrypting the verification fingerprint information and the target fingerprint information in the security verification data respectively to obtain first decrypted data of the verification fingerprint information and second decrypted data of the target fingerprint information;

[0021] The second decrypted data is verified based on the first decrypted data to obtain a verification result.

[0022] Optionally, the first decrypted data and the second decrypted data both include a browser fingerprint factor and a timestamp;

[0023] The performing data verification on the second decrypted data based on the first decrypted data to obtain a verification result includes:

[0024] Compare the browser fingerprint factor in the first decrypted data with the browser fingerprint factor in the second decrypted data to obtain a comparison result;

[0025] If the comparison results are consistent, determining the time difference between the timestamp in the first decrypted data and the timestamp in the second decrypted data, and confirming that the verification result is successful when the time difference does not exceed a preset validity period;

[0026] If the comparison results are inconsistent or the time difference exceeds the preset effective time, the verification result is confirmed to be a failure.

[0027] Optionally, the method further comprises:

[0028] When the verification result is successful, the user behavior is released.

[0029] The present application also provides a system security verification device, comprising:

[0030] A fingerprint factor generation module is used to obtain the access information of the user when it is detected that the user accesses the target system through the browser, and generate a browser fingerprint factor according to the access information;

[0031] A fingerprint information generation module, used to obtain a timestamp of the current moment according to a preset frequency, encrypt the timestamp and the browser fingerprint factor in a polling manner, generate dynamic fingerprint information, and monitor the user behavior of the user in the target system;

[0032] A verification data binding module, for determining the account information of the user behavior when the user behavior is account login, and obtaining the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and binding the target fingerprint information with the account information to obtain security verification data;

[0033] The information security verification module is used to obtain the dynamic fingerprint information of the browser at the current moment as the verification fingerprint information when the user behavior is resource access, and use the verification fingerprint information to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is failure.

[0034] The present application also provides a storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the system security verification method described in any one of the above embodiments.

[0035] The present application also provides a computer device, comprising: one or more processors, and a memory;

[0036] The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the system security verification method described in any one of the above embodiments are performed.

[0037] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0038] The system security verification method, device, storage medium and computer equipment provided by the present application obtain the user's access information when detecting that the user accesses the target system through the browser, and generate a browser fingerprint factor based on the access information, so as to reduce the risk of information being cracked by taking advantage of the high uniqueness and difficulty of forging of the browser fingerprint factor; then the timestamp of the current moment can be obtained according to the preset frequency, and the timestamp and the browser fingerprint factor are encrypted in a polling manner to generate dynamic fingerprint information. Here, through the dynamic change of the dynamic fingerprint information, it is possible to prevent the attacker from using the hijacked dynamic fingerprint information to bypass the security verification mechanism and make illegal requests. Based on this, after the user accesses the target system through the browser, the present application can also monitor the user's user behavior in the target system in real time. When the user behavior is account login, the account information of the user behavior can be determined, and the dynamic fingerprint information of the browser at the current moment can be obtained as the target fingerprint information, and the target fingerprint information is bound to the account information to obtain security verification data, so as to lock the user's account information through the target fingerprint information and improve the security of the system. When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment can be obtained as verification fingerprint information, and the verification fingerprint information can be used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is a failure. Therefore, even if the user's security verification data is hijacked and used for illegal requests, the present application can also use the dynamic nature of dynamic fingerprint information to intercept possible illegal requests, thereby further improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0040] Figure 1 A schematic diagram of a process flow of a system security verification method provided in an embodiment of the present application;

[0041] Figure 2 A flowchart of an information security verification process provided by an embodiment of the present application;

[0042] Figure 3 A flowchart of a data verification process provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of a system security verification device provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] The system security verification method based on browser fingerprint information has attracted much attention due to its uniqueness and difficulty in duplication. It generates browser fingerprints by collecting and analyzing the unique characteristics and attributes displayed by users when accessing the system through browsers. However, in the application model with front-end and back-end separation, the browser fingerprint information carried in the request initiated by the front-end is easily hijacked, allowing attackers to bypass the security verification mechanism and pose a threat to the system.

[0047] Based on this, this application proposes the following technical solutions, see below for details:

[0048] In one embodiment, Figure 1 As shown, Figure 1 A schematic diagram of a system security verification method provided in an embodiment of the present application; the present application provides a system security verification method, which specifically includes the following:

[0049] S110: When it is detected that a user accesses the target system through a browser, the user's access information is obtained, and a browser fingerprint factor is generated according to the access information.

[0050] In this step, when the computer device detects that a user accesses the target system through a browser, that is, when the user jumps to the main interface of the target system through the browser, it can obtain the user's access information, and then generate a browser fingerprint factor corresponding to the user's system access process based on the access information, so as to utilize the high uniqueness and difficulty of forging of the browser fingerprint factor to reduce the risk of information being cracked during the system access process.

[0051] It is understandable that the access information here may include browser configuration information, such as fonts, browser version information, browser plug-ins, etc., and may also include configuration information of the client where the browser is located, such as motherboard, CPU, GPU, hard disk, etc. Therefore, the browser fingerprint factor generated based on the access information can lock the client and browser used by the user, thereby improving the high uniqueness and difficulty of forging of the browser fingerprint factor, and reducing the possibility of attackers replicating the browser fingerprint factor and making illegal requests.

[0052] Specifically, the computer device can use an encryption algorithm such as a hash function to encrypt the access information and generate a unique browser fingerprint factor as the unique identifier of the user in the access environment. In order to further improve the difficulty of forging the browser fingerprint factor, the computer can also introduce random factors, such as random numbers, virtual graphics, etc., in the encryption process of the access information, which are not limited here.

[0053] S120: obtaining the timestamp of the current moment according to a preset frequency, encrypting the timestamp and the browser fingerprint factor in a polling manner, generating dynamic fingerprint information, and monitoring the user behavior in the target system.

[0054] In this step, after the browser fingerprint factor is generated through step S110, the computer device can obtain the timestamp of the current moment in the target system at a preset frequency, and then encrypt the timestamp and the browser fingerprint factor in a polling manner to generate dynamic fingerprint information. Here, the dynamic change of the dynamic fingerprint information can prevent attackers from using the hijacked dynamic fingerprint information to bypass the security verification mechanism and make illegal requests.

[0055] It is understandable that the timestamp provides a constantly changing and unpredictable variable for the dynamic fingerprint information, which makes the user request sent by the user in the target system unique and timely. Unlike traditional static fingerprint information, the dynamic nature of the timestamp means that even if an attacker hijacks the dynamic fingerprint information of a user request, he cannot use the same fingerprint information to bypass the security verification mechanism at a later time, because the timestamp will be continuously updated over time, and the dynamic fingerprint information is also continuously updated.

[0056] Specifically, when the user enters the main interface of the target system, the computer device can obtain the timestamp of the current moment in the target system, and encrypt it with the browser fingerprint factor to generate dynamic fingerprint information; and, during the user's access to the target system, the computer device can continuously update the dynamic fingerprint information by periodic polling until the user exits the main interface of the target system, and the dynamic fingerprint information becomes invalid as the browser fingerprint factor becomes invalid. Therefore, whether it is a man-in-the-middle attack or information hijacking, even if the attacker successfully obtains the dynamic fingerprint information in a request, it cannot be used for subsequent illegal requests, thereby ensuring the security of the system.

[0057] Furthermore, the computer device can also monitor the user behavior of the user in the target system in real time, that is, the user performs operations in the target system and triggers an event. When the event is triggered, the computer device can generate a user request corresponding to the event. Based on this, the computer device can monitor the user behavior by monitoring the user requests sent by the user, and then perform different security verification measures according to different types of user behavior. Among them, user behavior can include account login and resource access; however, it should be noted that account login in the target system is a necessary condition for resource access. Therefore, the user must first log in to the account before accessing resources in the target system.

[0058] S130: When the user behavior is account login, determine the account information of the user behavior, obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and bind the target fingerprint information with the account information to obtain security verification data.

[0059] In this step, when the user logs in to the target system through step S120, the computer device can determine the account information used by the user, and at the same time obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, so that after the account is successfully logged in, the target fingerprint information and the user's account information can be bound as security verification data, so that the user's account information can be locked through the target fingerprint information, thereby improving the security of the system.

[0060] Specifically, when a user logs in to the target system through a browser, the computer device can initiate a user request based on the account information entered by the user, where the account information includes the account and password; then the computer device can log in to the account based on the account and password. When the account and password are verified correctly and the login is successful, it means that the user request response is successful, and the computer device can obtain the user's account information. At the same time as the user request response is successful, the computer device can also obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information of the user during the system access process. Therefore, the target fingerprint information contains the user's account login time, so that the computer device can use the target fingerprint information to lock the user's account information, and perform validity verification on the user request sent by all user behaviors of the account information in the target system, so as to improve the security of the system.

[0061] S140: When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment is obtained as the verification fingerprint information, and the verification fingerprint information is used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is a failure.

[0062] In this step, when the user is monitored to access resources in the target system through step S120, the computer device can determine the dynamic fingerprint information of the browser at the current moment as the verification fingerprint information, and then use the verification fingerprint information to perform security verification on the security verification data corresponding to the user, and then intercept the user behavior when the verification result is a failure to maintain the security of the system.

[0063] Specifically, when a user accesses resources in a target system through a browser, the computer device can first determine the target resource to be accessed by the user, and obtain the user's account information and the target fingerprint information in the corresponding security verification data, and then generate a user request carrying the target fingerprint information in the front end according to the target resource, so that it can be sent to the back end to make a resource request. When the back end receives the user request, it can obtain the dynamic fingerprint information of the browser at the current moment as the verification fingerprint information, and use the verification fingerprint information to perform security verification on the target fingerprint information carried by the user request, and respond to the user request when the verification is successful, and return the corresponding target resource to the front end; otherwise, the user request is intercepted.

[0064] It is understandable that in the system access mode with separated front-end and back-end, user requests initiated by the front-end are easily hijacked. However, through dynamic fingerprint information, even if the user request is hijacked, after the target fingerprint information carried in the user request expires, the attacker will not be able to use the hijacked user request to make illegal requests, thereby improving the security of the system.

[0065] Furthermore, when a user accesses resources in the target system, if the access time is long, the target fingerprint information in the security verification data may expire, resulting in the failure of fingerprint information verification and the user request being intercepted. At this time, the user can re-login to the account to update the target fingerprint information in the security verification data, thereby ensuring the security of the target system.

[0066] In the above embodiment, when it is detected that a user accesses the target system through a browser, the user's access information is obtained, and a browser fingerprint factor is generated based on the access information, so as to reduce the risk of information being cracked by utilizing the high uniqueness and difficulty of forging of the browser fingerprint factor; then the timestamp of the current moment can be obtained according to the preset frequency, and the timestamp and the browser fingerprint factor are encrypted in a polling manner to generate dynamic fingerprint information. Here, through the dynamic change of the dynamic fingerprint information, it is possible to prevent attackers from using hijacked dynamic fingerprint information to bypass the security verification mechanism and make illegal requests. Based on this, after the user accesses the target system through the browser, the present application can also monitor the user's user behavior in the target system in real time. When the user behavior is account login, the account information of the user behavior can be determined, and the dynamic fingerprint information of the browser at the current moment can be obtained as the target fingerprint information, and the target fingerprint information is bound to the account information to obtain security verification data, so as to lock the user's account information through the target fingerprint information and improve the security of the system. When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment can be obtained as verification fingerprint information, and the verification fingerprint information can be used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is a failure. Therefore, even if the user's security verification data is hijacked and used for illegal requests, the present application can also use the dynamic nature of dynamic fingerprint information to intercept possible illegal requests, thereby further improving the security of the system.

[0067] In one embodiment, the process of generating the browser fingerprint factor according to the access information in step S110 may include:

[0068] S111: parse the access information, extract key data from the parsing result, and use canvas technology to draw graphics for the key data to generate virtual graphics.

[0069] S112: Base64 encode the virtual graphics and key data, and irreversibly encrypt the encoding result using the MD5 algorithm to obtain a browser fingerprint factor.

[0070] In this embodiment, after obtaining the access information, the computer device can first parse the access information to extract key data from the parsing result, and then use canvas technology to draw graphics of the key data to generate a virtual graphic. The virtual graphic and the key data can then be Base64-encoded, and the encoded result can be irreversibly encrypted using the MD5 algorithm to obtain a browser fingerprint factor with a fixed length.

[0071] Among them, Canvas technology is a technology used to dynamically draw graphics. <canvas>The element provides a programmable drawing area, in which a variety of unique graphic contents can be drawn, such as straight lines, curves, rectangles, circles, etc. Base64 encoding refers to a binary-to-text encoding method used to encode binary data (such as images, file contents) into printable ASCII characters for safe transmission or storage in a text environment. The MD5 (MessageDigest Algorithm 5) algorithm is a hash algorithm used to map input data of arbitrary length to output data of fixed length, usually a 128-bit hash value. It is irreversible and the original data cannot be deduced from the generated hash value. In addition, regardless of the length of the input data, the output hash value is always a fixed length.

[0072] It is understandable that the key data in the access information here may include browser configuration information, such as fonts, browser version information, browser plug-ins and configuration information, etc., and may also include client information, such as motherboard, CPU, GPU, hard disk and other information. Therefore, when the browser and client model used by the user have the same configuration, the key data obtained is also the same. In order to avoid the problem of repeatability of browser fingerprint factors caused by different users directly using fixed key data, the computer device can use Canvas technology to draw graphics of key data based on differences in device environments, and use the virtual graphics obtained by drawing to perform Base64 encoding on the key data, so that the browser fingerprint factor finally generated can rely on differences in device environments, making the browser fingerprint factor highly recognizable between similar devices and browsers, thereby ensuring the uniqueness and anti-counterfeiting ability of the fingerprint.

[0073] Specifically, after the computer device extracts the key data in the access information, the computer device can use the JavaScript script to run in the browser. <canvas>The element executes specific drawing instructions to obtain a virtual graphic with differences in device environments; then, the computer device can use Base64 encoding technology to encode the key data and the virtual image into character string form respectively, so that the encoded strings can be spliced ​​in a preset order, and the MD5 algorithm can be used to irreversibly encrypt the splicing results of different lengths in different scenarios to obtain a browser fingerprint factor of fixed length that is highly unique and difficult to forge.

[0074] In one embodiment, the process of encrypting the timestamp and the browser fingerprint factor in a polling manner to generate dynamic fingerprint information in step S120 may include:

[0075] S121: Encrypt the timestamp and the browser fingerprint factor using an asymmetric encryption algorithm in a polling manner to generate dynamic fingerprint information.

[0076] In this embodiment, after obtaining the browser fingerprint factor of a fixed length, the computer device can also encrypt the timestamp and the browser fingerprint factor in a polling manner using an asymmetric encryption algorithm to generate dynamic fingerprint information, thereby realizing the dynamic nature of the dynamic fingerprint information.

[0077] Among them, an asymmetric encryption algorithm refers to an encryption algorithm that uses a pair of keys (public key and private key) to encrypt and decrypt data, such as RSA, SM2, etc. In this application, the encryption mechanism of the public key and private key in the asymmetric encryption algorithm is combined with the dynamic nature of the timestamp to generate the final dynamic fingerprint information, which can greatly enhance the security of the system and prevent data from being hijacked or tampered with during transmission.

[0078] It is understandable that the computer device can encrypt the browser fingerprint factor and timestamp through the public key in the asymmetric encryption algorithm to generate the corresponding dynamic fingerprint factor. Since the timestamp is continuously updated with each polling, the dynamic fingerprint information of the present application can continuously change within the set time period and has significant dynamic characteristics. It can not only ensure that the fingerprint information generated each time is strongly associated with the current timestamp, thereby limiting its effectiveness outside a specific time range, but also enhance the system's defense capabilities against attack behaviors. Even if an attacker intercepts the dynamic fingerprint information at a certain moment, it is difficult to reuse this data at other time nodes, thereby improving the security of the system.

[0079] In one embodiment, the process of binding the target fingerprint information with the account information to obtain security verification data in step S130 may include:

[0080] S131: Submit the target fingerprint information and account information to the target server, and log in to the system in the target server through the account information.

[0081] S132: After the system login is successful, the target fingerprint information is bound to the account information in the target server to obtain security verification data.

[0082] In this embodiment, after the user enters the account information on the login page of the target system through the browser, the computer device can submit the target fingerprint information and account information at the current moment to the target server, and log in to the system through the account information in the target server. At the same time, after the system login is successful, the computer device can bind the target fingerprint information and account information in the target server to obtain the security verification data corresponding to this system access process.

[0083] It can be understood that the target system here serves as the communication hub between the front-end and the back-end. It is not only responsible for processing and transmitting user requests sent by users, but also for verifying, binding and managing security verification data, building a dynamic and difficult-to-forge security mechanism to ensure the security of data transmission and the system.

[0084] Specifically, when the user enters the account information on the login page of the target system through the browser, the computer device can integrate the target fingerprint information generated at the current moment with the account information entered by the user into a group of data packets, and submit it to the target server in a secure and encrypted manner, so that the target server can verify the account information and allow the system to log in after the verification is passed, so that the user can successfully access the system. At the same time, the target server can bind the target fingerprint information with the user's account information to generate a set of security verification data that uniquely corresponds to the user's account. This set of security verification data can not only reflect the user's account information, but also contain dynamic information about the device environment, and can accurately identify the browser and client used by the user during this system access process. Even if the attacker obtains the user's account information or the browser fingerprint factor of a certain period of time, it cannot bypass the verification process of the target server without binding information, thereby effectively avoiding potential security risks such as forged access and session hijacking.

[0085] In one embodiment, Figure 2 As shown, Figure 2 A flowchart of an information security verification process provided by an embodiment of the present application; Figure 2 In step S140, the process of performing security verification on the security verification data corresponding to the user using the verification fingerprint information may include:

[0086] S141: Obtain the user's account information and determine the security verification data corresponding to the account information.

[0087] S142: Decrypt the verification fingerprint information and the target fingerprint information in the security verification data respectively to obtain first decrypted data of the verification fingerprint information and second decrypted data of the target fingerprint information.

[0088] S143: Perform data verification on the second decrypted data based on the first decrypted data to obtain a verification result.

[0089] In this embodiment, when the computer device performs security verification on the security verification data, it can first obtain the user's account information and determine the security verification data corresponding to the account information, and then can respectively decrypt the verification fingerprint information and the target fingerprint information in the security verification data to obtain the first decrypted data of the verification fingerprint information and the second decrypted data of the target fingerprint information, so that the computer device can perform data verification on the second decrypted data based on the first decrypted data to obtain a verification result.

[0090] Specifically, the computer device can first obtain the security verification data bound to the account information used by the user as the initial data of the verification operation, which contains the target fingerprint information dynamically generated by the browser when the account information is logged in, and has the time characteristics and the uniqueness of the device characteristics and environment. Therefore, after obtaining the target fingerprint information in the security verification data, the computer device can decrypt the verification fingerprint information and the target fingerprint information respectively. In order to ensure the security of decryption and the integrity of data, the computer device can use the same asymmetric encryption algorithm as that used for encryption, and use the private key to parse the two sets of fingerprint information to obtain the first decrypted data of the verification fingerprint information and the second decrypted data of the target fingerprint information. Among them, the first decrypted data represents the device characteristics of the user at the current access time, and the second decrypted data represents the device characteristics of the user at the time of system login. Therefore, the computer device can gradually compare and verify the first decrypted data and the second decrypted data to obtain the verification result. The comparison and verification content here may include the consistency of the decrypted data, the matching of the timestamp, and the similarity of the device characteristics, which are not limited here.

[0091] In one embodiment, Figure 3 As shown, Figure 3 A flowchart of a data verification process provided in an embodiment of the present application; Figure 3 In step S143, both the first decrypted data and the second decrypted data include a browser fingerprint factor and a timestamp; wherein the process of performing data verification on the second decrypted data based on the first decrypted data to obtain a verification result may include:

[0092] S1431: Compare the browser fingerprint factor in the first decrypted data with the browser fingerprint factor in the second decrypted data to obtain a comparison result.

[0093] S1432: If the comparison results are consistent, determine the time difference between the timestamp in the first decrypted data and the timestamp in the second decrypted data, and confirm that the verification result is successful when the time difference does not exceed the preset validity period.

[0094] S1433: If the comparison results are inconsistent or the time difference exceeds the preset effective time, the verification result is confirmed as failure.

[0095] In this embodiment, after the computer device decrypts the first decrypted data and the second decrypted data, it can first compare the browser fingerprint factors in the two decrypted data to obtain a comparison result; if the comparison results are consistent, the computer device can determine the time difference between the timestamp in the first decrypted data and the timestamp in the second decrypted data, and when the time difference does not exceed the preset effective time, confirm that the verification result is successful; if the comparison results are inconsistent or the time difference exceeds the preset effective time, the computer device can confirm that the verification result is a failure.

[0096] It is understandable that if the browser fingerprint factors in the first decrypted data and the second decrypted data are consistent, it means that the browser and client currently used for system access are consistent with the browser and client bound to the current account information, and the user request for system access this time is highly credible. At this time, the computer device can further process the timestamps in the two decrypted data. The timestamps here can reflect the specific moment when the fingerprint information is generated. Therefore, the computer device can calculate the time difference between the timestamps in the two decrypted data to determine whether the user request is timely. In detail, after calculating the reverse time difference, the computer device can compare the time difference with the preset effective time length. If the time difference is within the preset effective time length, the verification result is successful.

[0097] Of course, if the comparison result shows that the browser fingerprint factors in the two encrypted data are inconsistent, it means that the client or browser currently accessed does not match the client or browser bound to the user account, or the browser environment has been tampered with. At this time, the computer device will immediately determine that the verification result is a failure. Similarly, even if the browser fingerprint factors are consistent, but the time difference between the timestamps exceeds the preset effective time range, it means that the dynamic fingerprint information currently accessed may have been hijacked or reused, lacking timeliness and reliability. In order to prevent potential security threats, the computer device will also determine the verification result as a failure.

[0098] In one embodiment, the method may further include:

[0099] S150: When the verification result is successful, the user behavior is released.

[0100] In this embodiment, after the computer device uses the verification fingerprint information to perform security verification on the security verification data corresponding to the user, if the verification result is successful, it means that the browser fingerprint factor of the user behavior is consistent with the browser fingerprint factor bound to the user account, and the timestamp is within the preset validity period, and no abnormalities are found. At this time, the computer device can release the user request initiated by the user behavior and respond to the user request to allow the user to access the resources in the target system normally.

[0101] The following is a description of a system security verification device provided in an embodiment of the present application. The system security verification device described below and the system security verification method described above can be referenced to each other.

[0102] In one embodiment, Figure 4 As shown, Figure 4 A schematic diagram of the structure of a system security verification device provided in an embodiment of the present application; the present application also provides a system security verification device, including a fingerprint factor generation module 210, a fingerprint information generation module 220, a verification data binding module 230 and an information security verification module 240, specifically including the following:

[0103] The fingerprint factor generation module 210 is used to obtain the user's access information when it is detected that the user accesses the target system through the browser, and generate a browser fingerprint factor according to the access information.

[0104] The fingerprint information generation module 220 is used to obtain the timestamp of the current moment according to a preset frequency, encrypt the timestamp and the browser fingerprint factor in a polling manner, generate dynamic fingerprint information, and monitor the user behavior in the target system.

[0105] The verification data binding module 230 is used to determine the account information of the user behavior when the user behavior is account login, and obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and bind the target fingerprint information with the account information to obtain security verification data.

[0106] The information security verification module 240 is used to obtain the dynamic fingerprint information of the browser at the current moment as the verification fingerprint information when the user behavior is resource access, and use the verification fingerprint information to perform security verification on the security verification data corresponding to the user to intercept the user behavior when the verification result is a failure.

[0107] In the above embodiment, when it is detected that a user accesses the target system through a browser, the user's access information is obtained, and a browser fingerprint factor is generated based on the access information, so as to reduce the risk of information being cracked by utilizing the high uniqueness and difficulty of forging of the browser fingerprint factor; then the timestamp of the current moment can be obtained according to the preset frequency, and the timestamp and the browser fingerprint factor are encrypted in a polling manner to generate dynamic fingerprint information. Here, through the dynamic change of the dynamic fingerprint information, it is possible to prevent attackers from using hijacked dynamic fingerprint information to bypass the security verification mechanism and make illegal requests. Based on this, after the user accesses the target system through the browser, the present application can also monitor the user's user behavior in the target system in real time. When the user behavior is account login, the account information of the user behavior can be determined, and the dynamic fingerprint information of the browser at the current moment can be obtained as the target fingerprint information, and the target fingerprint information is bound to the account information to obtain security verification data, so as to lock the user's account information through the target fingerprint information and improve the security of the system. When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment can be obtained as verification fingerprint information, and the verification fingerprint information can be used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is a failure. Therefore, even if the user's security verification data is hijacked and used for illegal requests, the present application can also use the dynamic nature of dynamic fingerprint information to intercept possible illegal requests, thereby further improving the security of the system.

[0108] In one embodiment, the fingerprint factor generation module 210 may include:

[0109] The information analysis submodule is used to analyze the access information and extract key data from the analysis results.

[0110] The data encoding submodule is used to use canvas technology to draw graphics of key data, generate virtual graphics, and Base64 encode the virtual graphics and key data to obtain the browser fingerprint factor.

[0111] In one embodiment, the fingerprint information generation module 220 may include:

[0112] The initial encryption submodule is used to perform initial encryption on the browser fingerprint factor using the MD5 algorithm to obtain initial encrypted information.

[0113] The secondary encryption submodule is used to perform secondary encryption on the timestamp and the initial encryption information in a polling manner using an asymmetric encryption algorithm to generate dynamic fingerprint information.

[0114] In one embodiment, the verification data binding module 230 may include:

[0115] The system login submodule is used to submit the target fingerprint information and account information to the target server, and log in to the system in the target server through the account information.

[0116] The information binding submodule is used to bind the target fingerprint information with the account information in the target server after the system login is successful to obtain security verification data.

[0117] In one embodiment, the information security verification module 240 may include:

[0118] The data determination submodule is used to obtain the user's account information and determine the security verification data corresponding to the account information.

[0119] The data decryption submodule is used to decrypt the verification fingerprint information and the target fingerprint information in the security verification data respectively to obtain the first decrypted data of the verification fingerprint information and the second decrypted data of the target fingerprint information.

[0120] The data verification submodule is used to perform data verification on the second decrypted data based on the first decrypted data to obtain a verification result.

[0121] In one embodiment, the first decrypted data and the second decrypted data of the data verification submodule both include a browser fingerprint factor and a timestamp; wherein the data verification submodule may further include:

[0122] The factor comparison unit is used to compare the browser fingerprint factor in the first decrypted data with the browser fingerprint factor in the second decrypted data to obtain a comparison result.

[0123] The first confirmation unit is used to determine the time difference between the timestamp in the first decrypted data and the timestamp in the second decrypted data if the comparison results are consistent, and confirm that the verification result is successful when the time difference does not exceed a preset effective time.

[0124] The second confirmation unit is used to confirm that the verification result is a failure if the comparison results are inconsistent or the time difference exceeds a preset effective time.

[0125] In one embodiment, the apparatus may further include:

[0126] The release operation module is used to release the user behavior when the verification result is successful.

[0127] In one embodiment, the present application also provides a storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the system security verification method described in any of the above embodiments.

[0128] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the system security verification method as described in any one of the above embodiments.

[0129] Indicatively, Figure 5 As shown, Figure 5 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 may be provided as a server. Figure 5 , the computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by a memory 301, for storing instructions that can be executed by the processing component 302, such as an application. The application stored in the memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 302 is configured to execute instructions to perform the system security verification method of any of the above embodiments.

[0130] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.

[0131] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0133] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0134] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.< / canvas> < / canvas>

Claims

1. A system security verification method, characterized in that: The method comprises: When detecting that a user accesses the target system through a browser, obtaining the user's access information, and generating a browser fingerprint factor according to the access information; Acquire the timestamp of the current moment according to a preset frequency, encrypt the timestamp and the browser fingerprint factor in a polling manner, generate dynamic fingerprint information, and monitor the user behavior of the user in the target system; When the user behavior is account login, determine the account information of the user behavior, obtain the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and bind the target fingerprint information with the account information to obtain security verification data; When the user behavior is resource access, the dynamic fingerprint information of the browser at the current moment is obtained as the verification fingerprint information, and the verification fingerprint information is used to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is failure.

2. The system security verification method according to claim 1, characterized in that: Generating a browser fingerprint factor according to the access information includes: Parsing the access information, extracting key data from the parsing result, and using canvas technology to draw a graph of the key data to generate a virtual graph; The virtual graph and the key data are encoded using Base64, and the encoding result is irreversibly encrypted using the MD5 algorithm to obtain a browser fingerprint factor.

3. The system security verification method according to claim 1, characterized in that: The step of encrypting the timestamp and the browser fingerprint factor in a polling manner to generate dynamic fingerprint information includes: The timestamp and the browser fingerprint factor are encrypted in a polling manner using an asymmetric encryption algorithm to generate dynamic fingerprint information.

4. The system security verification method according to claim 1, characterized in that: The step of binding the target fingerprint information with the account information to obtain security verification data includes: Submit the target fingerprint information and the account information to the target server, and log in to the system in the target server through the account information; After the system login is successful, the target fingerprint information is bound to the account information in the target server to obtain security verification data.

5. The system security verification method according to claim 1, characterized in that: The using the verification fingerprint information to perform security verification on the security verification data corresponding to the user includes: Obtaining the user's account information and determining the security verification data corresponding to the account information; Decrypting the verification fingerprint information and the target fingerprint information in the security verification data respectively to obtain first decrypted data of the verification fingerprint information and second decrypted data of the target fingerprint information; The second decrypted data is verified based on the first decrypted data to obtain a verification result.

6. The system security verification method according to claim 5, characterized in that: The first decrypted data and the second decrypted data both include a browser fingerprint factor and a timestamp; The performing data verification on the second decrypted data based on the first decrypted data to obtain a verification result includes: Compare the browser fingerprint factor in the first decrypted data with the browser fingerprint factor in the second decrypted data to obtain a comparison result; If the comparison results are consistent, determining the time difference between the timestamp in the first decrypted data and the timestamp in the second decrypted data, and confirming that the verification result is successful when the time difference does not exceed a preset validity period; If the comparison results are inconsistent or the time difference exceeds the preset effective time, the verification result is confirmed to be a failure.

7. The system security verification method according to claim 1 or 6, characterized in that: The method further comprises: When the verification result is successful, the user behavior is released.

8. A system security verification device, characterized in that: include: A fingerprint factor generation module is used to obtain the access information of the user when it is detected that the user accesses the target system through the browser, and generate a browser fingerprint factor according to the access information; A fingerprint information generation module, used to obtain a timestamp of the current moment according to a preset frequency, encrypt the timestamp and the browser fingerprint factor in a polling manner, generate dynamic fingerprint information, and monitor the user behavior of the user in the target system; A verification data binding module, for determining the account information of the user behavior when the user behavior is account login, and obtaining the dynamic fingerprint information of the browser at the current moment as the target fingerprint information, and binding the target fingerprint information with the account information to obtain security verification data; The information security verification module is used to obtain the dynamic fingerprint information of the browser at the current moment as the verification fingerprint information when the user behavior is resource access, and use the verification fingerprint information to perform security verification on the security verification data corresponding to the user, so as to intercept the user behavior when the verification result is failure.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the system security verification method as described in any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the system security verification method as described in any one of claims 1 to 7 are performed.

Images