A method and system device for preventing network hijacking or attack on a device login platform

Abstract

The present invention discloses a method and system device for preventing network hijacking or attack when a device logs into a platform. S1, upload the key information of the device to the platform in an encrypted or deformed manner, and perform authentication on the platform; S2, after the platform receives the encrypted or deformed data, it performs authentication according to the key information. If the authentication fails, the platform does not reply to the information. If the authentication passes, the platform replies to the device with a successful login message; S3, after the device receives the successful login message, it interacts with the platform for business. After receiving the business message, both parties process the key information respectively. The uniqueness and security of the interaction between the device and the platform are guaranteed, and the security of the platform and the device is effectively improved.

Description

Technical Field

[0001] The invention belongs to the field of network data interaction, and relates to a method and system equipment for preventing network hijacking or attack on a device login platform. Background Art

[0002] With the popularity of charging piles, charging safety is becoming increasingly important. After the TCP connection is established, most platforms require the charger to log in to the platform for authentication. Only after the authentication is passed can the subsequent interactive tasks be carried out. The current authentication between the platform is relatively simple. Most of them only need to verify whether the device code exists on the platform. The device code is generally related to the QR code, so the device code is generally exposed, and the target personnel can generally easily obtain the device code. If two identical codes are connected to the platform at the same time, the two devices will continue to authenticate on the platform, and the devices will not work normally. Another problem is that after the fake platform hijacks the device data, it causes operational losses. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a method and system device for preventing network hijacking or attack on a device login platform, thereby ensuring the uniqueness and security of the interaction between the device and the platform and effectively improving the security of the platform and the device.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] A method for preventing network hijacking or attack on a device login platform, comprising the following process:

[0006] S1, upload the key information of the device to the platform in an encrypted or deformed manner and authenticate it on the platform;

[0007] S2, after receiving the encrypted or deformed data, the platform performs authentication based on the key information. If the authentication fails, the platform does not reply. If the authentication passes, the platform replies to the device with a successful login message.

[0008] S3, after receiving the successful login message, the device interacts with the platform for business. After receiving the business message, both parties process the key information respectively.

[0009] Preferably, in S1, encryption adopts DES, AES or SM4, and deformation adopts BASE64 or MD5.

[0010] Preferably, in S1, the key information includes the device code, the MAC address of the device, the number of logins defined with the platform, the negotiated fixed key and the negotiated login time.

[0011] Further, in S2, after the platform receives the encrypted or deformed data, after decryption or restoration, it first determines whether there is a binding relationship between the device code and the device's MAC address. If there is a binding relationship, it compares the carried login times to see whether they are consistent with the login times recorded by the platform. If they are consistent, a message is replied to the device side, and the authentication is successful.

[0012] Furthermore, if the authentication fails, the platform will disconnect the TCP connection and release the TCP connection resources.

[0013] Furthermore, in S3, the processing of key information includes the self-increment of the number of logins performed, the encryption or deformation of the device code and the MAC address of the device, and the renegotiated fixed key and the negotiated login time.

[0014] Preferably, when the device leaves the factory, the device code and the device MAC address are entered into the platform and the device code and the device MAC address are bound. The platform sets the default number of logins under this binding relationship to 0, and the number of logins when the device leaves the factory also defaults to 0.

[0015] A system for preventing network hijacking or attack on a device login platform, comprising:

[0016] The key information processing upload module is used to upload the key information of the device to the platform in an encrypted or deformed manner and authenticate it on the platform;

[0017] The authentication module is used for the platform to perform authentication based on key information after receiving the encrypted or deformed data. If the authentication fails, the platform will not reply. If the authentication passes, the platform will reply to the device with a successful login message.

[0018] The business interaction module is used for business interaction with the platform after the device receives a successful login message. After receiving the business message, both parties process key information.

[0019] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for preventing network hijacking or attack on a device login platform as described in any one of the above items are implemented.

[0020] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for preventing network hijacking or attack on a device login platform as described in any one of the above items.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] In the present invention, the interaction of key information in the interaction process is protected by encryption or deformation, and the uniqueness and security of the platform and the device are changed through the rules agreed upon by the key information. For example, the instability of the network status causes the change of the key information to become an unknown item, thereby increasing the randomness of the interaction, and improving the randomness, unknownness, complexity and confidentiality of each login frame. By increasing the complexity of login authentication and the change of each login authentication data, the cost of sabotage by the target personnel is increased, ensuring that the platform and the device cannot be easily attacked or hijacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flow chart of a method for preventing network hijacking or attack on a device login platform of the present invention. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0025] It should be noted that the words "front", "rear", "left", "right", "up" and "down" used in the following description refer to directions in the drawings, and the words "inside" and "outside" refer to directions toward or away from the geometric center of a specific component, respectively.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0027] like Figure 1 As shown, the method for preventing network hijacking or attack on the device login platform of the present invention includes the following process:

[0028] Step 1. When the device leaves the factory, enter the device code and the MAC address of the device into the platform and bind the device code and the MAC address. The platform sets the default login times under this binding relationship to 0, and the default login times of the device side when leaving the factory are also 0;

[0029] Step 2. When the device logs into the platform for the first time, the key information is encrypted by DES, AES, SM4, etc. or transformed by BASE64, MD5, etc., and then uploaded to the platform for authentication. Encryption or transformation of key information can protect key information from being exposed in the message.

[0030] Key information may include: device code, device MAC address, number of logins defined with the platform, negotiated fixed key, negotiated login time, etc.

[0031] DES symmetric encryption is a more traditional encryption method. Its encryption and decryption operations use the same key and is a symmetric encryption algorithm.

[0032] The AES encryption data block and key length can be any of 128b, 192b, and 256b. AES encryption has many rounds of repetition and transformation. The general steps are as follows: ① Key Expansion; ② Initial Round; ③ Repeated Rounds, each repeated round includes byte subtraction (SubBytes), row shift (ShiftRows), column mixing (MixColumns), round key addition (AddRoundKey) and other operations; ① Final Round, there is no column mixing operation (MixColumns) in the final round.

[0033] SM4 is mainly used for data encryption. Its algorithm is public. The block length and key length are both 128 bits. The encryption algorithm and key expansion algorithm both use a 32-round nonlinear iterative structure. The S-box has a fixed 8-bit input and 8-bit output.

[0034] Base64 is a method of representing binary data based on 64 printable characters.

[0035] The MD5 code processes the input information in 512-bit groups, and each group is divided into 16 32-bit sub-groups. After a series of processing, the output of the algorithm consists of four 32-bit groups. After cascading these four 32-bit groups, a 128-bit hash value will be generated.

[0036] The key information between the device and the platform can be encrypted and transformed through the above methods. There are many ways to encrypt or transform, which are mainly used to ensure that the data is not exposed in plain text.

[0037] Step 3. The platform receives the data reported by the device, and after decryption or restoration, obtains key information such as the device code, MAC address, and login times. First, determine whether there is a binding relationship between the device code and MAC address. If there is a binding relationship, compare the carried login times to see if they are the same as the login times recorded by the platform. If they are the same, reply to the device side and the authentication is successful. Otherwise, directly disconnect the TCP connection to release the TCP connection resources.

[0038] Step 4. After the device receives the successful login message, it can interact with the platform normally. After receiving the corresponding business message, the platform and the device side process the key information separately. If the two sides do not interact normally, the key information will not be processed. The platform and the device side use the same rules to process the key information to ensure the synchronization of key information so that the next login authentication is successful.

[0039] The processing of key information includes the self-increment of the number of logins, the encryption or deformation of the device code and the device MAC address, and the renegotiated fixed key and the negotiated login time.

[0040] Step 5. When the device logs in for authentication next time, it will carry these changed key information for comparison. If the key information does not match, effective business communication cannot be carried out and business cannot be done. This ensures the uniqueness and security of the platform and the device.

[0041] The interaction of key information during the interaction process is protected by encryption or deformation. The uniqueness and security of the platform and equipment are changed through the rules agreed upon by the key information. At the same time, key information such as the number of logins is uncontrollable during the entire operation process. For example, the instability of the network status makes the change of key information an unknown item, thereby increasing the randomness of the interaction. These changes and unknown factors increase the cost of destruction for the target personnel.

[0042] The randomness, unknown nature, complexity and confidentiality of each login frame ensures the uniqueness and security of the interaction between the device and the platform, thereby effectively improving the security of the platform and the device.

[0043] The following are device embodiments of the present invention, which can be used to perform method embodiments of the present invention. For details not disclosed in the device embodiments, please refer to the method embodiments of the present invention.

[0044] In another embodiment of the present invention, a system for preventing network hijacking or attacks on a device login platform is provided. The system for preventing network hijacking or attacks on a device login platform can be used to implement the above-mentioned method for preventing network hijacking or attacks on a device login platform. Specifically, the system for preventing network hijacking or attacks on a device login platform includes a key information processing upload module, an authentication module, and a business interaction module.

[0045] Among them, the key information processing upload module is used to upload the key information of the device to the platform in an encrypted or deformed manner and authenticate it on the platform.

[0046] The authentication module is used for the platform to perform authentication based on key information after receiving encrypted or deformed data. If the authentication fails, the platform will not reply with information. If the authentication passes, the platform will reply with a successful login message to the device.

[0047] The business interaction module is used for business interaction with the platform after the device receives a successful login message. After receiving the business message, both parties process key information.

[0048] In yet another embodiment of the present invention, a terminal device is provided. The terminal device includes a processor and a memory, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions to implement corresponding method processes or corresponding functions; the processor described in the embodiment of the present invention can be used for the operation of the method for preventing network hijacking or attack when a device logs on to a platform, including: S1, uploading the key information of the device to the platform in an encrypted or deformed manner, and authenticating on the platform; S2, after the platform receives the encrypted or deformed data, it authenticates according to the key information. If the authentication fails, the platform does not reply to the information. If the authentication passes, the platform replies to the device with a successful login message; S3, after the device receives the successful login message, it interacts with the platform for business, and both parties process the key information after receiving the business message.

[0049] In another embodiment, the present invention further provides a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It is understandable that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and the extended storage medium supported by the terminal device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory.

[0050] One or more instructions stored in a computer-readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the method for preventing network hijacking or attack by a device logging into the platform in the above-mentioned embodiment; one or more instructions in the computer-readable storage medium are loaded by the processor and the following steps are executed: S1, uploading the key information of the device to the platform in an encrypted or deformed manner, and authenticating it on the platform; S2, after the platform receives the encrypted or deformed data, it authenticates it according to the key information. If the authentication fails, the platform does not reply with information. If the authentication passes, the platform replies with a successful login message to the device; S3, after the device receives the successful login message, it interacts with the platform for business. After receiving the business message, both parties process the key information respectively.

[0051] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0052] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0053] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0054] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0055] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0056] It should be understood that the above description is for illustration and not for limitation. Many embodiments and many applications beyond the examples provided will be apparent to those skilled in the art upon reading the above description. Therefore, the scope of the present teachings should not be determined with reference to the above description, but rather with reference to the foregoing claims and the full scope of equivalents to which such claims are entitled. For the purpose of comprehensiveness, all articles and references, including disclosures of patent applications and publications, are incorporated herein by reference. The omission of any aspect of the subject matter disclosed herein in the foregoing claims is not intended to be a waiver of such subject matter, nor should it be considered that the applicant has not considered such subject matter to be part of the disclosed inventive subject matter.

Claims

1. A method for preventing network hijacking or attack on a device login platform, characterized in that: The process includes: S1, upload the key information of the device to the platform in an encrypted or deformed manner and authenticate it on the platform; Key information includes the device code, the device's MAC address, the number of logins defined with the platform, the negotiated fixed key, and the negotiated login time; S2, after receiving the encrypted or deformed data, the platform performs authentication based on the key information. If the authentication fails, the platform does not reply. If the authentication passes, the platform replies to the device with a successful login message. S3: After receiving the successful login message, the device interacts with the platform. After receiving the business message, both parties process the key information. The platform receives the data reported by the device, decrypts or restores it, and obtains the device code, MAC address, and login times. First, it determines whether there is a binding relationship between the device code and MAC address. If there is a binding relationship, it compares the carried login times to see if they are the same as the login times recorded by the platform. If they are the same, it replies to the device side and the authentication is successful. Otherwise, the TCP connection is disconnected directly to release the TCP connection resources; The processing of key information includes the self-increment of the number of logins, the encryption or deformation of the device code and the device MAC address, and the renegotiated fixed key and the negotiated login time.

2. The method for preventing network hijacking or attack on a device login platform according to claim 1, characterized in that: In S1, encryption uses DES, AES or SM4, and deformation uses BASE64 or MD5.

3. The method for preventing network hijacking or attack on a device login platform according to claim 1, characterized in that: If the authentication fails, the platform will disconnect the TCP connection and release the TCP connection resources.

4. The method for preventing network hijacking or attack on a device login platform according to claim 1, characterized in that: When the device leaves the factory, the device code and the device MAC address are entered into the platform and the relationship between the device code and the device MAC address is bound. The platform sets the default number of logins under this binding relationship to 0, and the number of logins when the device leaves the factory also defaults to 0.

5. A system for preventing network hijacking or attack on a device login platform, characterized in that: include: The key information processing upload module is used to upload the key information of the device to the platform in an encrypted or deformed manner and authenticate it on the platform; Key information includes the device code, the device's MAC address, the number of logins defined with the platform, the negotiated fixed key, and the negotiated login time; The authentication module is used for the platform to perform authentication based on key information after receiving the encrypted or deformed data. If the authentication fails, the platform will not reply. If the authentication passes, the platform will reply to the device with a successful login message. The business interaction module is used for the device to interact with the platform after receiving the successful login message. After receiving the business message, both parties process the key information. The platform receives the data reported by the device, decrypts or restores it, and obtains the device code, MAC address, and login times. First, it determines whether there is a binding relationship between the device code and MAC address. If there is a binding relationship, it compares the carried login times to see if they are the same as the login times recorded by the platform. If they are the same, it replies to the device side and the authentication is successful. Otherwise, the TCP connection is disconnected directly to release the TCP connection resources; The processing of key information includes the self-increment of the number of logins, the encryption or deformation of the device code and the device MAC address, and the renegotiated fixed key and the negotiated login time.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for preventing network hijacking or attack on a device login platform as described in any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the steps of the method for preventing network hijacking or attack on the device login platform as described in any one of claims 1 to 4 are implemented.

Images