Web page security control method and its device, equipment, medium, and product

Abstract

The present application relates to a webpage security control method and its device, equipment, medium, and product, the method comprising: displaying a target webpage, starting a pre-installed monitoring module therein; obtaining terminal feature data corresponding to the target webpage by the monitoring module; responding to a specific operation event triggered in the target webpage, submitting the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token assigned to the target webpage; after obtaining the communication token, submitting it and the business data of the specific operation event to the business server, so that the business server queries the risk control server for the operator type of the target webpage holding the communication token and processes the business data according to the operator type. The present application decouples the identification of the operator type of the operation event on the target webpage from the processing of the business data, and processes the business data according to the operator type, which can ensure that the data communication process is more secure.

Description

Technical Field

[0001] The present application relates to network security technology, and in particular to a web page security control method and its device, equipment, medium, and product. Background Art

[0002] In e-commerce platforms, the use of automatic machine programs to place fake orders on web pages or the use of platform vulnerabilities to perform automated operations on web pages pose security threats to the normal operation of e-commerce platforms. With the rise of e-commerce platforms based on independent stations, since merchants on independent stations are technically weak and rely on platform control, illegal users have more frequent attacks on independent stations. For e-commerce platforms, maintaining the security of web page access behavior in independent stations is a long way to go.

[0003] Usually, the business logic of an e-commerce platform is deployed in a distributed manner, and each independent site is also deployed and operated in a decentralized manner. In such an architecture where multiple resources are widely distributed, how to centrally maintain similar security issues for a large number of independent sites is something that the platform needs to focus on. Summary of the invention

[0004] The purpose of the present application is to solve the above-mentioned problems and to provide a webpage security control method and its corresponding device, equipment, non-volatile readable storage medium, and computer program product.

[0005] According to one aspect of the present application, a webpage security control method is provided, comprising the following steps:

[0006] Displaying a target webpage and starting a monitoring module preset in the target webpage;

[0007] The monitoring module acquires terminal characteristic data corresponding to the target webpage, wherein the terminal characteristic data includes operation characteristic data corresponding to an operation event acting on the target webpage;

[0008] In response to a specific operation event triggered in the target webpage, submitting the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage;

[0009] After obtaining the communication token, it and the business data of the specific operation event are submitted to the business server, so that the business server queries the risk control server for the type of operator of the target web page holding the communication token and processes the business data according to the operator type.

[0010] Optionally, submitting the terminal feature data to a risk control server so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage, including:

[0011] Encrypting the terminal feature data into confidential data and sending it to the risk control server;

[0012] The risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification passes;

[0013] The risk control server generates the communication token with unique characteristics according to the terminal characteristic data, and returns the communication token;

[0014] The risk control server uses a preset machine operation behavior detection model to detect the operator type corresponding to the terminal feature data, and the operator type is a human operation type or a machine operation type.

[0015] Optionally, encrypting the terminal feature data into confidential data and sending the encrypted data to the risk control server includes:

[0016] Randomly generate a symmetric key, and use the symmetric key to encrypt the terminal feature data collected by the monitoring module to obtain a feature ciphertext;

[0017] Encrypting the symmetric key using a public key in the asymmetric key pre-allocated by the risk control server to obtain a corresponding key ciphertext;

[0018] The public key, characteristic ciphertext, and key ciphertext are constructed into confidential data and sent to the risk control server.

[0019] Optionally, the risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification, including:

[0020] The risk control server parses the confidential data to obtain the public key, feature ciphertext, and key ciphertext therein;

[0021] Check whether the public key exists in the key library, and if the public key exists, obtain the private key that matches the public key; otherwise, trigger the exception handling procedure;

[0022] Decrypting the key ciphertext using the private key, obtaining the symmetric key therein when the decryption is successful, and triggering an exception handling program when the decryption fails;

[0023] The characteristic ciphertext is decrypted using the symmetric key, and the terminal characteristic data therein is obtained when the decryption is successful, and an exception handling program is triggered when the decryption fails.

[0024] Optionally, the risk control server uses a preset machine operation behavior detection model to detect the operator type corresponding to the terminal feature data, including:

[0025] The risk control server vectorizes the terminal feature data to obtain a corresponding encoding feature vector;

[0026] Inputting the encoded feature vector into a preset machine operation behavior detection model to determine the classification probability corresponding to each classification in a preset classification space, wherein the classification space includes classifications corresponding to human operation types and classifications corresponding to machine operation types;

[0027] The operation type represented by the classification with the largest classification probability is determined to be the operator type corresponding to the terminal feature data, and is stored as mapping relationship data with the terminal feature data and the communication token.

[0028] Optionally, enabling the business server to query the risk control server for the type of operator of the target webpage holding the communication token and processing the business data according to the operator type includes:

[0029] After receiving the business data and the communication token, the business server queries the risk control server to obtain the operator type of the target webpage holding the communication token;

[0030] When it is determined that the obtained operator type belongs to the human operation type, the business data is processed using conventional business logic, otherwise the business data is processed using abnormal business logic.

[0031] Optionally, in response to a specific operation event of the target webpage, after submitting the business data corresponding to the specific operation event and the communication token to the business server, the method further includes:

[0032] The network resources returned by the business server after processing the business data using conventional business logic are obtained, and the network resources are loaded into the browser.

[0033] According to another aspect of the present application, a webpage security control device is provided, comprising:

[0034] A webpage loading module, configured to display a target webpage and start a monitoring module preset in the target webpage;

[0035] A data acquisition module, configured to obtain terminal characteristic data corresponding to the target webpage through the monitoring module, wherein the terminal characteristic data includes operation characteristic data corresponding to an operation event acting on the target webpage;

[0036] a security identification module, configured to respond to a specific operation event triggered in the target webpage, submit the terminal feature data to the risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage;

[0037] The business processing module is configured to submit the communication token and the business data of the specific operation event to the business server after obtaining the communication token, so that the business server queries the risk control server for the type of operator of the target web page holding the communication token and processes the business data according to the operator type.

[0038] According to another aspect of the present application, a webpage security control device is provided, comprising a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the webpage security control method described in the present application.

[0039] According to another aspect of the present application, a non-volatile readable storage medium is provided, which stores a computer program implemented according to the webpage security control method in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the method are executed.

[0040] According to another aspect of the present application, a computer program product is provided, including a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the steps of the method described in any one of the embodiments of the present application are implemented.

[0041] Compared with the prior art, this application has many advantages, including but not limited to:

[0042] First, the present application pre-sets a monitoring module in the target web page, and after the monitoring module is started, the terminal feature data on the target web page is obtained and sent to the risk control server. On the one hand, the risk control server can centrally detect the operator type of the target web page according to the terminal feature data, and on the other hand, the communication token generated by the risk control server for the target web page can be obtained accordingly. Then, the target web page uses the communication token to send the business data to the business server that is decoupled from the risk control server. The business server obtains the operator type according to the communication token, and then processes the business data accordingly according to the operator type. Thus, secure data communication can be ensured between various nodes such as the terminal device where the target web page is located, the risk control server, and the business server, and secure decoupling between operator type identification and business data processing can be achieved. That is, the risk control server can be responsible for centrally identifying the operator type, and the business server can determine the processing strategy of the business data by querying the risk control server for the operator type corresponding to the communication token held by the business data, thereby ensuring that network access behavior based on the target web page is safer.

[0043] Secondly, since the risk control server has the ability to centrally implement operator type identification, it can provide security identification services for one or more of the business servers, so that a large number of business servers can be deployed in a decentralized manner, but network security access can be achieved through the same risk control server, which is conducive to platform deployment. In particular, for e-commerce platforms based on independent stations, each of the business servers can be an independent station server that deploys a corresponding online store, and the risk control server can be a centralized server additionally deployed by the e-commerce platform. Therefore, the risk control server can provide a large number of independent stations with security identification services for web page operation behaviors, helping to improve the security performance of each independent station.

[0044] Furthermore, by first sending the terminal feature data to the risk control server, the risk control server quickly returns the corresponding communication token and identifies the operator type corresponding to the terminal feature data. Then, the risk control server uses the communication token to send the business data to the business server, and the business server obtains the operator type corresponding to the communication token from the risk control server. This achieves asynchronous identification of whether the operation on the target web page is a human operation or a machine operation, so that the business server can make compliant processing of the business data according to the operator type. Compared with the business server identifying the operator type by itself, this asynchronous mechanism can improve the overall data communication efficiency.

[0045] In addition, the present application drives the implementation of the entire technical solution by pre-setting a monitoring module on the target web page, without the need to install additional software on the terminal device, thereby reducing the difficulty of technical implementation, achieving more efficient technical implementation results, and lowering the implementation cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A schematic diagram of a network architecture corresponding to an exemplary operating environment of the present application;

[0048] Figure 2 A flowchart of an embodiment of a webpage security control method of the present application;

[0049] Figure 3 This is a flow chart of the communication process between the terminal device and the risk control server and the business server in the embodiment of the present application;

[0050] Figure 4 A schematic diagram of a process for constructing confidential data by a terminal device in an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the process of decrypting confidential data by the risk control server in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of a flow chart of detecting the operator type of terminal feature data in an embodiment of the present application;

[0053] Figure 7 This is a principle block diagram of the webpage security control device of the present application;

[0054] Figure 8 This is a schematic diagram of the structure of a webpage security control device used in this application. DETAILED DESCRIPTION

[0055] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0056] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0057] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0058] It will be understood by those skilled in the art that the "client", "terminal" and "terminal device" used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capabilities, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers, tablet computers, which have single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which may include a radio frequency receiver, pager, Internet / intranet access, web browser, notepad, calendar and / or GPS (Global Positioning System, global positioning system) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with and / or including a radio frequency receiver. The "client", "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or suitable for and / or configured to run locally, and / or in a distributed form, at any other location on the earth and / or in space. The "client", "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playing terminal, for example, a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playing function, or a smart TV, a set-top box and other devices.

[0059] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0060] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0061] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0062] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0063] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0064] See also Figure 1 , Figure 1 It is a network architecture corresponding to the exemplary operating environment of the webpage security control method of the present application, which includes a terminal device 80, a risk control server 81 and a business server 82. The terminal device is used to run the target webpage of the present application, the risk control server 81 is used to implement operator type identification and generate corresponding communication tokens for the terminal device 80, and the business server 82 can be used to deploy independent sites in the e-commerce platform, that is, independent stations, and the independent stations are used to implement an online store, thereby providing multiple webpages. The monitoring module of the present application can be preset in the webpage through preset codes. When any of the webpages is loaded as a target webpage by the browser of the terminal device, in the process of the browser parsing the target webpage, the preset code corresponding to the monitoring module is run, so that the terminal device constructs the monitoring module, thereby, the monitoring module is used to monitor the operation events acting on the target webpage.

[0065] In one embodiment, the risk control server 81 can serve a large number of business servers 82 at the same time, and any web page of an online store provided by any business server can be loaded in the terminal device as the target web page. The risk control server 81 can refer to a front-end server in a service cluster, and similarly, the business server 82 can also refer to a front-end server in a service cluster. The terminal device can be any device such as a smart phone, a personal computer, a tablet computer, etc. The browser running in the terminal device can be either an independently running browser or a built-in browser implemented in an independent application, such as a browser implemented using a WebView control in an Android operating system.

[0066] See also Figure 2 According to a webpage security control method provided by the present application, in one embodiment thereof, the method comprises the following steps:

[0067] Step S1100, displaying a target webpage, and starting a monitoring module preset in the target webpage;

[0068] When the browser in the terminal device starts to load a web page in the online store of the independent station implemented by the business server, the web page is regarded as the target web page, and the page content of the target web page is gradually loaded and displayed by obtaining the code resources of the target web page and parsing it.

[0069] The target webpage is pre-installed with code resources corresponding to the monitoring module, so that when the target webpage is parsed, each line of code in the code resource is executed accordingly, so that the monitoring module can be started and run. The monitoring module is implemented by pre-writing codes to be suitable for collecting terminal feature data of the target webpage so as to provide it to the risk control server.

[0070] The target web page can be any web page of an online store. In an exemplary embodiment, the target web page can be a key page such as a login page, an order page, a checkout page, etc. of the online store. Of course, it can also be any other page as long as the code corresponding to the business logic implemented according to the method of the present application is preset in it.

[0071] In one embodiment, the browser may be an independently-running browser, in which a user enters the URL of a target web page in its address bar to load the target web page, or a user touches a link on a displayed web page to jump to and load the target web page pointed to by the link.

[0072] In another embodiment, the browser may also be an application program with a built-in browser control. After the application program is running, a target web page can be automatically loaded through the browser control according to the default settings of the application program without the user inputting a URL.

[0073] Step S1200: The monitoring module acquires terminal characteristic data corresponding to the target webpage, wherein the terminal characteristic data includes operation characteristic data corresponding to an operation event acting on the target webpage;

[0074] After the monitoring module is running, it starts to collect terminal feature data for the target web page. In one embodiment, the terminal feature data includes operation feature data corresponding to operation events occurring in the target web page and environmental feature data of the current terminal device. In other optional embodiments, it may also only include the operation feature data.

[0075] The operation characteristic data is mainly used to describe the characteristics of the operation behavior acting on the target web page, including but not limited to the operation characteristic data on the page of the target web page generated by actual human operation input or machine simulation input. The operation characteristic data is extracted from the operation data generated by corresponding any input device. The input device includes but is not limited to any hardware device such as keyboard, mouse, touch screen, etc. Correspondingly, the generated operation characteristic data also has the data format corresponding to these different input devices.

[0076] For example, when a user moves the mouse in the target web page, a series of operation data is generated corresponding to the mouse movement event. These operation data contain the coordinate information corresponding to each position in the mouse movement path. Based on these operation data, a series of coordinate information can be extracted as operation feature data. Taking the mouse operation as an example, it is not difficult to understand that the corresponding operation feature information can be used to determine whether the movement path is straight. If it is a straight path, it can be identified as a machine operation behavior. If it is a path with bending or shaking characteristics, it can be identified as a human operation behavior.

[0077] For example, although the monitoring module can obtain operation data, if the attribute data corresponding to the mouse trajectory and keyboard events in the system are all null values, then in theory it can also be determined that the current behavior is a machine behavior, so that the operation feature data can be extracted from the operation data and the attribute data for constructing the terminal feature data.

[0078] The environmental characteristic data includes, but is not limited to, information with environmental characteristics such as the browser information, network address, device fingerprint information, etc. used by the current terminal device. The browser information may include the browser's kernel version, engine type, etc., and the device fingerprint information may be the UUID of the terminal device, etc. The environmental characteristic data is mainly used to uniquely identify the current terminal device.

[0079] In one embodiment, the monitoring module is configured to continuously monitor and collect the operation characteristic data and environment characteristic data generated by any operation event on the target webpage after loading, so as to construct the terminal characteristic data under the current environment as needed and submit it to the risk control server. In other embodiments, the monitoring module can also be configured to only monitor some specified operation events to obtain the corresponding operation characteristic data, which can be flexibly implemented by those skilled in the art.

[0080] Step S1300: In response to a specific operation event triggered in the target webpage, the terminal feature data is submitted to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage;

[0081] There are various operation events acting on the target web page, and the risk control mechanism of the present application can be enabled as needed for a single or multiple specific operation events. For example, the risk control mechanism of the present application can be activated in response to a specific operation event triggered by touching a specific control in the target web page, or in response to a specific operation event triggered by entering data into a text box in the target web page. The risk control mechanism can be activated as needed.

[0082] In order to achieve the response to the specific operation event, in one embodiment, the response process of the present application can be pre-implemented in the monitoring module. In another embodiment, the response process can be achieved by loading an event interceptor in the browser and using an instruction set pre-implemented in the event interceptor. Regardless of the implementation, the specific operation event triggered in the target web page can be responded to and a corresponding network access request can be triggered for it, so as to achieve coordinated data communication with the risk control server and the business server.

[0083] In one embodiment, the specific operation event is pre-designated as an operation event corresponding to a network access request for triggering submission of business data to the business server. For example, when the target web page is a user login page, a user name input box and a password input box are provided in the user login page, and a verification code input box may be further added, and a confirmation control is provided. When the user enters the user name, password and verification code, the user name and password, and even the verification code, constitute the business data of the target web page. When the user clicks the confirmation control, it triggers a network access request for submitting the business data to the business server, thereby triggering the corresponding specific operation event.

[0084] In response to the specific operation event, the present application first calls the risk control mechanism to identify the operator type in the terminal device, and then submits the business data corresponding to the specific operation event to the business server. To this end, all the terminal feature data that has been collected by the monitoring module is first sent to the risk control server, and the communication token returned by the risk control server corresponding to the terminal feature data is waited for, and the business data is submitted to the business server after the communication token is obtained.

[0085] After receiving the terminal characteristic data, the risk control server obtains the operation characteristic data therein. In one embodiment, it can also obtain the environmental characteristic data therein. Therefore, all or part of the terminal characteristic data can be used to generate a communication token with unique characteristics, and the communication token is used as a pass identity credential in the interaction process generated based on the target web page and returned to the terminal device.

[0086] In one embodiment, the risk control server may use a hash function, for example, to calculate a hash value for the operation feature data and / or the environment feature data in the terminal feature data, and use the hash value as the communication token. The risk control server may also set up a database to store the mapping relationship data between the communication token and its corresponding terminal feature data, and also establish a mapping relationship with the communication token for storage of the result data subsequently generated based on part or all of the terminal feature data.

[0087] The operation feature data in the terminal feature data has the ability to describe the operation process of the operation event acting on the target web page, and thus can be used to determine the operator type of the corresponding operation process, that is, whether the operator who generates the operation process is an actual human or a machine program, and thus, the operator type can be represented as a human operation type and a machine operation type corresponding to the above two situations. In another embodiment improved accordingly, in the process of using the operation feature data to determine the operator type, the environmental feature data in the terminal feature data can also be referenced to provide reference information, that is, the entire terminal feature data is used as input information to identify the corresponding operator type.

[0088] The process of identifying the corresponding operator type according to the terminal feature data can be implemented by using a pre-modeled machine learning model, and the machine learning model can be a traditional machine learning model or a deep learning model. It is not difficult to understand that by using a sufficient amount of training samples to pre-train the machine learning model to a convergence state, so that it can learn the ability to predict the mapping to different operator types based on the input information in the corresponding format, it can be used to predict the operator type of the terminal feature data, and can be deployed in the risk control server to provide special services to serve the identification of the operator type corresponding to the target web page. Correspondingly, according to the input requirements when modeling the machine learning model, the input information required can be either the operation feature data in the terminal feature data, or it can further include the environmental feature data in the terminal feature data on the basis of the operation feature data.

[0089] It can be seen that after receiving the terminal feature data, the risk control server adapts to the input requirements of the machine learning model, constructs the operation feature data in the terminal feature data, and even the environmental feature data therein, as corresponding input information, calls the interface provided by the service corresponding to the machine learning model to pass parameters to the machine learning model, and then obtains the machine learning model's recognition result of the corresponding operator type, that is, it characterizes whether the operator type corresponding to the terminal feature data is a human operation type or a machine operation type.

[0090] At this point, the risk control server further obtains the operator type corresponding to the terminal feature data of the target webpage, and as mentioned above, this data is associated with the communication token and mapped and stored.

[0091] It is not difficult to see that when the terminal device submits the terminal feature data, the risk control server only returns a communication token to it, and does not directly return the operator type to it. The process of the risk control server determining the operator type has no direct relationship with the terminal device, so there is no risk of being intercepted and cracked in the middle, which is very safe.

[0092] Step S1400: after obtaining the communication token, submit it and the business data of the specific operation event to the business server, so that the business server queries the risk control server for the type of operator of the target web page holding the communication token and processes the business data according to the operator type.

[0093] After the terminal device receives the communication token, it can combine the communication token with the business data corresponding to the specific operation event, such as the user name and password in the previous example, encapsulate them in the same network access request, and submit them to the business server of this application.

[0094] After the business server obtains the business data parsed from the network access request, it can call the query interface provided by the risk control server and directly submit the communication token to the risk control server. The risk control server can then query the operator type mapped to the communication token from the database and return it to the business server. The business server then obtains the operator type data corresponding to the target web page of the terminal device.

[0095] The business server can perform different corresponding processing according to the operator type data obtained from the query, depending on whether the operator type belongs to a human operation type or a machine operation type. For example, in the above example, if the business data includes a user name and a password, when the operator type is a human operation type, the user name and password can be directly verified; when the operator type is a machine operation type, the user name and password can be discarded and a verification failure message can be returned.

[0096] It can be seen from this that the business server does not need to be responsible for analyzing the terminal feature data generated by the target web page running on the terminal device. Instead, it can obtain the corresponding operator type by querying the risk control server with the communication token submitted by the terminal device, and then perform different corresponding processing on the business data according to the different operator types. While achieving decoupling from the risk control server, it ensures that the data communication process with the terminal device is more secure.

[0097] According to the above embodiments, the implementation of this application can obtain many advantages, including but not limited to:

[0098] First, the present application pre-sets a monitoring module in the target web page, and after the monitoring module is started, the terminal feature data on the target web page is obtained and sent to the risk control server. On the one hand, the risk control server can centrally detect the operator type of the target web page according to the terminal feature data, and on the other hand, the communication token generated by the risk control server for the target web page can be obtained accordingly. Then, the target web page uses the communication token to send the business data to the business server that is decoupled from the risk control server. The business server obtains the operator type according to the communication token, and then processes the business data accordingly according to the operator type. Thus, secure data communication can be ensured between various nodes such as the terminal device where the target web page is located, the risk control server, and the business server, and secure decoupling between operator type identification and business data processing can be achieved. That is, the risk control server can be responsible for centrally identifying the operator type, and the business server can determine the processing strategy of the business data by querying the risk control server for the operator type corresponding to the communication token held by the business data, thereby ensuring that network access behavior based on the target web page is safer.

[0099] Secondly, since the risk control server has the ability to centrally implement operator type identification, it can provide security identification services for one or more of the business servers, so that a large number of business servers can be deployed in a decentralized manner, but network security access can be achieved through the same risk control server, which is conducive to platform deployment. In particular, for e-commerce platforms based on independent stations, each of the business servers can be an independent station server that deploys a corresponding online store, and the risk control server can be a centralized server additionally deployed by the e-commerce platform. Therefore, the risk control server can provide a large number of independent stations with security identification services for web page operation behaviors, helping to improve the security performance of each independent station.

[0100] Furthermore, by first sending the terminal feature data to the risk control server, the risk control server quickly returns the corresponding communication token and identifies the operator type corresponding to the terminal feature data. Then, the risk control server uses the communication token to send the business data to the business server, and the business server obtains the operator type corresponding to the communication token from the risk control server. This achieves asynchronous identification of whether the operation on the target web page is a human operation or a machine operation, so that the business server can make compliant processing of the business data according to the operator type. Compared with the business server identifying the operator type by itself, this asynchronous mechanism can improve the overall data communication efficiency.

[0101] In addition, the present application drives the implementation of the entire technical solution by pre-setting a monitoring module on the target web page, without the need to install additional software on the terminal device, thereby reducing the difficulty of technical implementation, achieving more efficient technical implementation results, and lowering the implementation cost.

[0102] Based on any embodiment of this application, please refer to Figure 3 , submitting the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage, including:

[0103] Step S1310: Encrypt the terminal feature data into confidential data and send it to the risk control server;

[0104] Before the terminal device sends the terminal feature data corresponding to the target webpage to the risk control server, it can first encrypt the data. To this end, after the target webpage is loaded with the monitoring module, the monitoring module can apply to the risk control server for a public key in an asymmetric key in advance. Before the terminal feature data needs to be sent to the risk control server, the public key can be used to encrypt the terminal feature data, or the terminal feature data can be first encrypted into ciphertext and then the key of the ciphertext can be encrypted. Then, the public key, the ciphertext corresponding to the terminal feature data, and even the ciphertext corresponding to the encryption key of the ciphertext, etc., are uniformly packaged as confidential data and sent to the risk control server.

[0105] Step S1320: The risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification passes;

[0106] After the risk control server receives the confidential data, since the confidential data contains all the information required for decryption, it can be decrypted using a preset decryption mechanism. The decryption process is also a data verification process, and decryption is used to determine whether the data communication process is secure.

[0107] For example, the risk control server uses the private key that matches the public key to decrypt the terminal feature data encrypted with the public key, or uses the private key to decrypt the encryption key used to encrypt the terminal feature data, and then uses the encryption key to decrypt the ciphertext of the terminal feature data to obtain the original terminal feature data. In this way, the corresponding decryption processing can be flexibly implemented by those skilled in the art to adapt to the encryption process.

[0108] If decryption fails at any stage in the decryption process, it means that there is a risk of data tampering during the entire data communication process. Therefore, the data communication process can be terminated or even an alarm message can be input to avoid attacks.

[0109] Step S1330: the risk control server generates the communication token with unique characteristics according to the terminal characteristic data, and returns the communication token;

[0110] After the risk control server successfully decrypts the terminal feature data, it can generate a communication token corresponding to the terminal feature data. In one embodiment, for example, all the data in the terminal feature data, including the operation feature data and the environment feature data, can be used to calculate a hash value using a hash function. The hash value is used as the corresponding communication token, so that the communication token has a unique feature and can play a role in index query. In other embodiments, based on the principle that the communication token is unique, other methods can also be used to obtain the communication token. In another embodiment, the communication token can be generated simply based on the environment feature data in the terminal feature data, especially the device fingerprint information such as UUID. In this regard, those skilled in the art can flexibly select a variety of known methods to implement it according to the principles disclosed herein.

[0111] After the risk control server generates the communication token, it can establish a mapping relationship between the communication token and the terminal feature data and store it in a database for later use.

[0112] Step S1340: The risk control server uses a preset machine operation behavior detection model to detect the operator type corresponding to the terminal feature data, where the operator type is a human operation type or a machine operation type.

[0113] The risk control server can call a machine operation behavior detection model that has been pre-trained to a convergence state. The model can perform inference based on the terminal feature data (selecting specific data to construct the input information of the model based on the input requirements of the model) to predict whether the corresponding operator type is a human operation type or a machine operation type, and then map the operator type with the communication token and store it in the database for future reference.

[0114] In one embodiment, step S1340 may be executed in parallel with step S1330 to implement asynchronous processing of communication token generation return and operator type identification.

[0115] It can be seen that the process of the risk control server returning its corresponding communication token to the terminal device does not depend on the process of the risk control server determining the operator type of the target web page. The two are consistent and can ensure that the application of the risk control mechanism basically does not affect the data communication efficiency between the terminal device and the business server.

[0116] According to the above embodiments, it is not difficult to understand that the risk control server is responsible for encrypted communication, security verification of encrypted data, and generation of communication tokens required for multi-party communication, and is responsible for identity identification of the operator type corresponding to the terminal feature data for subsequent calls by the business server. This effectively decouples the risk control server from the business server, allowing a single risk control server to serve multiple business servers, while ensuring the security of data communication during multi-party interactions between terminal devices and risk control servers and business servers, thereby comprehensively improving the security of web-based data communication processes in a platform deployment environment.

[0117] Based on any embodiment of this application, please refer to Figure 4 , encrypting the terminal feature data into confidential data and sending it to the risk control server, including:

[0118] Step S1311: randomly generate a symmetric key, and use the symmetric key to encrypt the terminal feature data collected by the monitoring module to obtain a feature ciphertext;

[0119] In this embodiment, when the terminal device encrypts the terminal feature data collected by the monitoring module, it can first use a symmetric key to encrypt. The symmetric key can be implemented using various known algorithms, such as using the AES algorithm to randomly generate a symmetric key in the local memory. Then, the terminal feature data is encrypted using the symmetric key to generate a corresponding feature ciphertext. It is not difficult to understand that the feature ciphertext needs to be decrypted with the symmetric key to obtain the original text of the terminal feature data.

[0120] Step S1312: encrypt the symmetric key using the public key in the asymmetric key pre-assigned by the risk control server to obtain a corresponding key ciphertext;

[0121] As mentioned above, the target webpage can obtain the public key in the asymmetric key assigned by the risk control server to the target webpage in advance, and thus use the public key to encrypt the symmetric key generated locally in the previous step, thereby obtaining the ciphertext of the symmetric key, i.e., the key ciphertext. After becoming the key ciphertext, it is not easy to be cracked when transmitted in the network.

[0122] Step S1313: construct the public key, characteristic ciphertext, and key ciphertext into confidential data and send them to the risk control server.

[0123] After completing the above encryption process, the terminal device can construct the public key, characteristic ciphertext, and key ciphertext together as confidential data and send it to the risk control server, which will perform corresponding decryption.

[0124] Based on the above embodiments, it is not difficult to understand that the terminal feature data has undergone multiple layers of encryption before being submitted to the risk control server, including a symmetric encryption method with higher computing efficiency and an asymmetric encryption method with higher security. The multiple layers are nested to ensure the high security of data during transmission, which can meet the data communication security requirements of large platforms.

[0125] Based on any embodiment of this application, please refer to Figure 5 , the risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification, including:

[0126] Step S1321: The risk control server parses the confidential data to obtain the public key, feature ciphertext, and key ciphertext therein;

[0127] On the basis of the transmission of confidential data by the terminal device, the risk control server receives the confidential data and parses it, thereby obtaining the public key, characteristic ciphertext and key ciphertext carried therein.

[0128] Step S1322: Check whether the public key exists in the key library, and if the public key exists, obtain the private key that matches the public key; otherwise, trigger an exception handling procedure;

[0129] The risk control server pre-builds a key library dedicated to storing the asymmetric keys generated by it. For the public keys contained in the confidential data, it can verify whether they exist in the key library. If they do not exist, it indicates that the public key is illegal, which can trigger the exception handling program, such as terminating the response to the terminal device, stopping the processing of the confidential data, etc.

[0130] The asymmetric key generated by the risk control server can be generated using any asymmetric key algorithm, such as the RSA algorithm.

[0131] If the public key in the confidential data exists in the key library, it should be a legitimate public key. Correspondingly, the corresponding private key also exists in the key library, so the private key can be called and obtained.

[0132] Step S1323: decrypt the key ciphertext using the private key, obtain the symmetric key therein when the decryption is successful, and trigger an exception handling procedure when the decryption fails;

[0133] Since the key ciphertext is obtained by encrypting the symmetric key, the private key is used to decrypt the key ciphertext. If the decryption fails, it indicates that the key ciphertext has been tampered with, thereby triggering an exception handling procedure, such as terminating the response to the terminal device, stopping processing the confidential data, etc.

[0134] If the decryption is successful, the symmetric key can be obtained. As mentioned above, the symmetric key can be used to decrypt the characteristic ciphertext to obtain the terminal characteristic data.

[0135] Step S1324: Decrypt the characteristic ciphertext using the symmetric key, obtain the terminal characteristic data therein when the decryption is successful, and trigger an exception handling program when the decryption fails.

[0136] After obtaining the symmetric key, the symmetric key can be used to decrypt the characteristic ciphertext. Similarly, if the decryption fails, it indicates that the characteristic ciphertext may have been tampered with, thereby triggering an exception handling procedure, such as terminating the response to the terminal device, stopping processing the confidential data, etc.

[0137] If the decryption is successful, the terminal feature data can be obtained smoothly, which can be used to generate a communication token and identify the corresponding operator type, etc.

[0138] According to the above embodiments, after obtaining the confidential data submitted by the terminal device, the risk control server performs multiple checks on the validity of the data during the decryption process to ensure that the data is not tampered with and completes the identity confirmation of the terminal device. In this case, it is safer to implement subsequent business processes.

[0139] Based on any embodiment of this application, please refer to Figure 6 , the risk control server uses a preset machine operation behavior detection model to detect the operator type corresponding to the terminal feature data, including:

[0140] Step S1341: The risk control server vectorizes the terminal feature data to obtain a corresponding encoding feature vector;

[0141] The exemplary machine operation behavior detection model of the present application can be constructed by using a backbone network suitable for processing serialized data followed by a classifier. The backbone network can be implemented using any recurrent neural network (RNN) suitable for extracting text semantic features, such as a long short-term memory network (LSTM) which is a typical representative thereof. This type of network has the characteristic of extracting semantic features according to contextual semantics; the classifier can preferably be a binary classifier, which can be constructed using functions such as Softmax or Sigmoid. After constructing the machine operation behavior detection model, according to the input parameter specification, a sufficient amount of training samples whose corresponding operator types are pre-labeled as human operation types or machine operation types are used to train the detection model. After training it to a convergence state, it can be put into use in the present application.

[0142] The training samples may be collected manually, and terminal feature data generated by machine operation and terminal feature data generated by actual human operation may be collected respectively to construct training samples corresponding to different operator types.

[0143] As for the terminal feature data selected by the machine operation behavior detection model, in one embodiment, only the operation feature data may be used, and in another embodiment, both the operation feature data and the environment feature data may be used at the same time, as long as the consistency of the input parameter construction used in the training and reasoning stages of the detection model is ensured.

[0144] In order to facilitate semantic reasoning of the machine operation behavior detection model, when the terminal feature data is provided as input information to the detection model, it is necessary to first vectorize it, use a preset encoding layer, convert the terminal feature data into a corresponding encoding feature vector and then input it.

[0145] Step S1342: input the encoded feature vector into a preset machine operation behavior detection model to determine the classification probability corresponding to each classification in the preset classification space, wherein the classification space includes classifications corresponding to human operation types and classifications corresponding to machine operation types;

[0146] The encoded feature vector is directly input into the backbone network of the machine operation behavior detection model to extract semantic features, thereby obtaining corresponding deep semantic information, which is then output to a preset classifier. The fully connected layer in the classifier maps it to the output layer. The output layer uses the Sigmoid function to calculate the classification probability of the deep semantic information mapped to the two categories of human operation type and machine operation type in the preset classification space, obtain the corresponding classification results, and complete the reasoning and prediction process.

[0147] Step S1343: determine that the operation type represented by the classification with the largest classification probability is the operator type corresponding to the terminal feature data, and store it together with the terminal feature data and the communication token as mapping relationship data.

[0148] It is not difficult to understand that, of the two categories in the classification space, the category with the largest classification probability is the actual operator type. For example, when the category corresponding to the manual operation type is the largest, the operator type corresponding to the terminal feature data is the manual operation type, otherwise it is the machine operation type. Based on this, the operator type corresponding to the terminal feature data can be identified.

[0149] After obtaining the operator type corresponding to the terminal feature data, it can be mapped with the communication token and the terminal feature data and stored in the database, so that the business server can query it with the communication token.

[0150] According to the above embodiments, the use of a pre-trained machine operation behavior detection model can intelligently and quickly determine whether there is machine operation behavior on the target web page, thereby providing a decision-making basis for the business server when processing business data. Since the deployment of the machine operation behavior detection model is decoupled from the business server, it is convenient for the risk control server to call it. Therefore, it can provide services for online stores on massive business servers in a centralized manner, thereby achieving economies of scale.

[0151] On the basis of any embodiment of the present application, the business server queries the risk control server for the type of operator of the target webpage holding the communication token and processes the business data according to the operator type, including:

[0152] Step S1410: After receiving the business data and the communication token, the business server queries the risk control server to obtain the operator type of the target webpage holding the communication token;

[0153] After the terminal device obtains the communication token from the risk control server, it can use the communication token as a communication identity credential, add the business data corresponding to the specific operation event, such as the user name and password in the aforementioned example, to the communication token and submit it to the business server that provides the target web page. After the business server parses the business data and communication token, it calls the query interface provided by the risk control server and passes in the communication token. The risk control server can then be driven to execute a query to obtain the operator type corresponding to the communication token, that is, the operator type represented by the terminal feature data corresponding to the target web page of the terminal device, and return the operator type to the business server.

[0154] Step S1420: When it is determined that the obtained operator type belongs to the human operation type, the business data is processed using conventional business logic; otherwise, the business data is processed using abnormal business logic.

[0155] The business server then reads the operator type returned by the risk control server corresponding to the communication token, and processes the business data accordingly according to the different contents contained in the operator type. Specifically, when the operator type belongs to the manual operation type, it can be confirmed that the data communication process is safe, so the business data can be processed according to the conventional business logic preset on the business server. For example, for the user name and password in the previous example, the corresponding user identity verification process can be executed. When the operator type belongs to the machine operation type, it can be determined that there are unsafe factors in the data communication process. In this case, the business data can be processed according to the abnormal business logic preset by the business server, such as terminating the response to the terminal device or outputting an alarm message.

[0156] According to the above embodiments, the business server of the present application realizes lightweight deployment and does not need to be responsible for in-depth analysis of terminal feature data. It can realize secure data communication with terminal devices only through the services provided by the risk control server. For the sites deployed therein, the security of data access of the sites is effectively maintained.

[0157] Based on any embodiment of the present application, in response to a specific operation event of the target webpage, after submitting the business data corresponding to the specific operation event and the communication token to the business server, the method includes:

[0158] Step S1500: obtaining the network resources returned by the business server after processing the business data using conventional business logic, and loading the network resources into the browser.

[0159] After the business server processes the business data using conventional business logic, it usually further returns corresponding network resources. The network resources vary depending on the specific operation events triggered by the terminal device and its business data, as well as the conventional business logic. They may include any one or more of web page code, video, audio, picture, and text. For the terminal device, after obtaining the corresponding network resources, they are loaded into the browser, thereby completing the entire human-computer interaction process.

[0160] In conjunction with the example of the user login process described above, after the business server authenticates the user based on the business data, it can return a web page, and return the code of the web page as a network resource to the terminal device, and the terminal device loads the code of the web page to implement the web page jump and complete the user login process. The same is true for other usage scenarios.

[0161] According to the above embodiments, it can be known that the terminal device communicates data between the risk control server and the business server through the target web page, ensuring the security of page access to the site in the business server without relying on independent security programs, achieving lightweight. For the business server, there is no need to deploy security services by itself, and it only needs to develop the site in accordance with the interface specifications of the risk control server, which can improve the efficiency of website construction and reduce the cost of website maintenance.

[0162] See also Figure 7According to one aspect of the present application, a webpage security control device is provided, comprising a webpage loading module 1100, a data collection module 1200, a security identification module 1300, and a business processing module 1400, wherein: the webpage loading module 1100 is configured to display a target webpage and start a pre-set listening module in the target webpage; the data collection module 1200 is configured to obtain terminal feature data corresponding to the target webpage by the listening module, and the terminal feature data includes operation feature data corresponding to an operation event acting on the target webpage; the security identification module 1300 is configured to respond to a specific operation event triggered in the target webpage, submit the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage; the business processing module 1400 is configured to submit the communication token and the business data of the specific operation event to the business server after obtaining the communication token, so that the business server queries the risk control server for the operator type of the target webpage holding the communication token and processes the business data according to the operator type.

[0163] Based on any embodiment of the present application, the security identification module 1300 includes: an encryption processing unit, configured to encrypt the terminal feature data into confidential data and send it to the risk control server; a decryption and verification unit, configured to decrypt and verify the confidential data by the risk control server, and obtain the terminal feature data therein after the verification passes; a token generation unit, configured to generate the communication token with unique characteristics according to the terminal feature data by the risk control server, and return the communication token; a type identification unit, configured to detect the operator type corresponding to the terminal feature data by the risk control server using a preset machine operation behavior detection model, and the operator type is a human operation type or a machine operation type.

[0164] Based on any embodiment of the present application, the encryption processing unit includes: a symmetric encryption subunit, which is configured to randomly generate a symmetric key, and use the symmetric key to encrypt the terminal feature data collected by the monitoring module to obtain a feature ciphertext; a public key encryption subunit, which is configured to use a public key in the asymmetric key pre-assigned by the risk control server to encrypt the symmetric key to obtain a corresponding key ciphertext; a data transmission subunit, which is configured to construct the public key, feature ciphertext, and key ciphertext into confidential data and send it to the risk control server.

[0165] Based on any embodiment of the present application, the decryption and verification unit includes: a data parsing subunit, which is configured to parse the confidential data by the risk control server to obtain the public key, feature ciphertext, and key ciphertext therein; a public key verification subunit, which is configured to query whether the public key exists in the key library, and when the public key exists, obtain the private key matching the public key, otherwise trigger an exception handling program; a private key decryption subunit, which is configured to use the private key to decrypt the key ciphertext, obtain the symmetric key therein when the decryption is successful, and trigger the exception handling program when the decryption fails; a symmetric decryption subunit, which is configured to use the symmetric key to decrypt the feature ciphertext, obtain the terminal feature data therein when the decryption is successful, and trigger the exception handling program when the decryption fails.

[0166] Based on any embodiment of the present application, the category identification unit includes: a coding processing subunit, which is configured to vectorize the terminal feature data by the risk control server to obtain a corresponding coding feature vector; an inference detection subunit, which is configured to input the coding feature vector into a preset machine operation behavior detection model to determine the classification probability corresponding to each classification in the preset classification space, wherein the classification space includes classifications corresponding to human operation types and classifications corresponding to machine operation types; a type determination subunit, which is configured to determine that the operation type represented by the classification with the largest classification probability is the operator type corresponding to the terminal feature data, and store it with the terminal feature data and the communication token as mapping relationship data.

[0167] Based on any embodiment of the present application, the business processing module 1400 includes: a type query unit, which is configured to query the risk control server to obtain the type of operator of the target web page holding the communication token after the business server receives the business data and the communication token; an identification processing unit, which is configured to use conventional business logic to process the business data when it is determined that the obtained operator type belongs to a human operation type, otherwise use abnormal business logic to process the business data.

[0168] On the basis of any embodiment of the present application, after the business processing module 1400, it includes: a resource loading module, which is configured to obtain the network resources returned after the business server uses conventional business logic to process the business data, and load the network resources into the browser.

[0169] Another embodiment of the present application also provides a webpage security control device. Figure 8As shown, a schematic diagram of the internal structure of a webpage security control device. The webpage security control device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable non-volatile storage medium of the webpage security control device stores an operating system, a database, and computer-readable instructions. The database may store an information sequence. When the computer-readable instructions are executed by the processor, the processor may implement a webpage security control method.

[0170] The processor of the webpage security control device is used to provide computing and control capabilities to support the operation of the entire webpage security control device. The memory of the webpage security control device may store computer-readable instructions, which, when executed by the processor, may enable the processor to execute the webpage security control method of the present application. The network interface of the webpage security control device is used to connect and communicate with a terminal.

[0171] Those skilled in the art will understand that Figure 8 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the web page security control device to which the scheme of the present application is applied. The specific web page security control device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0172] In this embodiment, the processor is used to execute Figure 7 The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to realize data transmission between user terminals or servers. The non-volatile readable storage medium in this embodiment stores the program code and data required to execute all modules in the webpage security control device of this application, and the server can call the program code and data of the server to execute the functions of all modules.

[0173] The present application also provides a non-volatile readable storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the webpage security control method of any embodiment of the present application.

[0174] The present application also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any embodiment of the present application when executed by one or more processors.

[0175] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0176] To summarize, the present application implants a monitoring module in a web page, and after the monitoring module is loaded, sends terminal feature data to the risk control server for the risk control server to identify non-human operation events and return a communication token, and then sends the business data and the communication token to the business server. The business server queries the corresponding operator type based on the communication token, and then processes the business data accordingly based on the operator type, thereby decoupling the security identification mechanism from the business processing mechanism, ensuring that the web-based data communication process is more secure.

Claims

1. A webpage security control method, characterized in that: include: Displaying a target webpage and starting a monitoring module preset in the target webpage; The monitoring module acquires terminal characteristic data corresponding to the target webpage, wherein the terminal characteristic data includes operation characteristic data corresponding to an operation event acting on the target webpage; In response to a specific operation event triggered in the target webpage, submitting the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage; After obtaining the communication token, it and the business data of the specific operation event are submitted to the business server, so that the business server queries the risk control server for the type of operator of the target web page holding the communication token and processes the business data according to the operator type.

2. The webpage security control method according to claim 1, characterized in that: Submitting the terminal feature data to a risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage, including: Encrypting the terminal feature data into confidential data and sending it to the risk control server; The risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification passes; The risk control server generates the communication token with unique characteristics according to the terminal characteristic data, and returns the communication token; The risk control server uses a preset machine operation behavior detection model to detect the operator type corresponding to the terminal feature data, and the operator type is a human operation type or a machine operation type.

3. The webpage security control method according to claim 2, characterized in that: Encrypting the terminal feature data into confidential data and sending it to the risk control server includes: Randomly generate a symmetric key, and use the symmetric key to encrypt the terminal feature data collected by the monitoring module to obtain a feature ciphertext; Encrypting the symmetric key using a public key in the asymmetric key pre-allocated by the risk control server to obtain a corresponding key ciphertext; The public key, characteristic ciphertext, and key ciphertext are constructed into confidential data and sent to the risk control server.

4. The webpage security control method according to claim 3, characterized in that: The risk control server decrypts and verifies the confidential data, and obtains the terminal feature data after the verification, including: The risk control server parses the confidential data to obtain the public key, feature ciphertext, and key ciphertext therein; Check whether the public key exists in the key library, and if the public key exists, obtain the private key that matches the public key; otherwise, trigger the exception handling procedure; Decrypting the key ciphertext using the private key, obtaining the symmetric key therein when the decryption is successful, and triggering an exception handling program when the decryption fails; The characteristic ciphertext is decrypted using the symmetric key, and the terminal characteristic data therein is obtained when the decryption is successful, and an exception handling program is triggered when the decryption fails.

5. The webpage security control method according to any one of claim 1, characterized in that: The risk control server detects the operator type corresponding to the terminal feature data using a preset machine operation behavior detection model, including: The risk control server vectorizes the terminal feature data to obtain a corresponding encoding feature vector; Inputting the encoded feature vector into a preset machine operation behavior detection model to determine the classification probability corresponding to each classification in a preset classification space, wherein the classification space includes classifications corresponding to human operation types and classifications corresponding to machine operation types; The operation type represented by the classification with the largest classification probability is determined to be the operator type corresponding to the terminal feature data, and is stored as mapping relationship data with the terminal feature data and the communication token.

6. The webpage security control method according to any one of claims 1 to 5, characterized in that: The process of causing the business server to query the risk control server for the type of operator of the target webpage holding the communication token and processing the business data according to the operator type includes: After receiving the business data and the communication token, the business server queries the risk control server to obtain the operator type of the target webpage holding the communication token; When it is determined that the obtained operator type belongs to the human operation type, the business data is processed using conventional business logic, otherwise the business data is processed using abnormal business logic.

7. The webpage security control method according to claim 6, characterized in that: In response to the specific operation event of the target webpage, after submitting the business data corresponding to the specific operation event and the communication token to the business server, the method includes: The network resources returned by the business server after processing the business data using conventional business logic are obtained, and the network resources are loaded into the browser.

8. A webpage security control device, characterized in that: include: A webpage loading module, configured to display a target webpage and start a monitoring module preset in the target webpage; A data acquisition module, configured to obtain terminal characteristic data corresponding to the target webpage through the monitoring module, wherein the terminal characteristic data includes operation characteristic data corresponding to an operation event acting on the target webpage; a security identification module, configured to respond to a specific operation event triggered in the target webpage, submit the terminal feature data to the risk control server, so that the risk control server determines the operator type of the target webpage according to the terminal feature data and returns a communication token allocated to the target webpage; The business processing module is configured to submit the communication token and the business data of the specific operation event to the business server after obtaining the communication token, so that the business server queries the risk control server for the type of operator of the target web page holding the communication token and processes the business data according to the operator type.

9. A webpage security control device, comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A non-volatile readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images