WAF man-machine authentication method and device for same IP different access request

Abstract

The application discloses a WAF man-machine authentication method and device for same IP different access requests, and comprises the following steps: after receiving an access request of a client, if the traffic corresponding to the access request meets a preconfigured protection rule, the following man-machine authentication process is executed: generating authentication data, taking a man-machine authentication interface corresponding to the authentication data as a response message of the access request, and sending the response message to the client; receiving and analyzing an authentication request of the client, verifying the client; based on the verification result, sending a redirection message to the client; receiving a reinitiated access request of the client, and completing authentication based on the authentication status in the access request. The WAF does not need to check all traffics, only detects the number of messages of each connection, needs to extract fields, and can solve the access request of different clients with the same IP.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a WAF human-computer authentication method and device for different access requests from the same IP address. Background Technology

[0002] For the same intranet user accessing the internet, the outbound gateway IP is the same, so intermediate devices, including WAF products, see the same source IP. For access requests from the same intranet user, after passing through the WAF, simply looking at the source IP address is insufficient for accurate protection. Currently, most vendors use session management functions to configure the location of session tokens, enabling the differentiation and identification of different users' access behavior under the same IP, allowing for precise handling of users with abnormal access behavior without affecting other users. This method can handle user requests with session tokens, but without session tokens, it cannot distinguish users. Summary of the Invention

[0003] This application provides a WAF human-machine authentication method and device for different access requests from the same IP address, in order to solve the problem of distinguishing different users from the same IP address when there is no session tag.

[0004] This application provides a WAF human authentication method for different access requests from the same IP address, including:

[0005] Using the WAF, after receiving a client's access request for a target page, if the access request conforms to the pre-configured protection rules, the following human-machine authentication process is executed:

[0006] Using the WAF, authentication data is generated, and the human-machine authentication interface corresponding to the authentication data is sent to the client as a response message for the access request, so that the client can perform verification. After verification, the client returns an authentication message to the WAF. The header of the response message is configured with a cookie whose value includes the hit protection rule ID, and the returned authentication message contains the cookie.

[0007] The WAF receives and parses the client's authentication request to verify the client;

[0008] Based on the verification result, a redirection message is sent to the client so that the client re-initiates an access request to the target page, and the re-initiated access request carries the client's authentication status.

[0009] The WAF is used to receive the access request re-initiated by the client and to complete the authentication based on the authentication status therein.

[0010] Optionally, before generating authentication data using the WAF, the method further includes: updating the user authentication status of the client to a first status, wherein the KEY of the user authentication status in the first status is internal data plus the hit protection rule ID.

[0011] Optionally, the human-machine authentication interface corresponding to the authentication data is sent to the client as a response message to the access request via the HTTP protocol;

[0012] After receiving the response message, the client parses the response message, renders the human-machine authentication interface, performs verification based on the human-machine authentication interface, and stores the cookie in the message header of the response message in the client.

[0013] Optionally, receiving and parsing the client's authentication request using the WAF to verify the client includes:

[0014] The WAF is used to parse the authentication data in the authentication request, as well as the message header cookie;

[0015] The generated authentication data is compared with the parsed authentication data to verify the client; and

[0016] If the client authentication is successful, the complete KEY is constructed based on the KEY part of the user authentication status in the cookie in the message header to update the user authentication status.

[0017] Optionally, after updating the user authentication status, the method further includes: using the WAF to send a redirect message to the client, wherein the URL address of the redirect message is the URL address of the target page.

[0018] Optionally, using the WAF, receiving the client's re-initiated access request and performing authentication based on the authentication status therein includes:

[0019] If the client's authentication status is successful in the re-initiated access request, then the client is allowed to proceed to the origin server.

[0020] If the client's authentication status is authentication failure, the message is discarded and a preset response code is sent to the client.

[0021] Optionally, after receiving an access request from a client using the WAF, if the traffic corresponding to the access request does not conform to the pre-configured protection rules, the client can be directly allowed to the origin server.

[0022] This application also proposes a computer device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, it implements the steps of the aforementioned WAF human-machine authentication method for different access requests from the same IP.

[0023] This application also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned WAF human-machine authentication method for different access requests from the same IP.

[0024] The WAF in this application embodiment does not need to inspect all traffic; it only checks the number of packets and the fields that need to be extracted for each connection, which can solve access requests from different clients with the same IP.

[0025] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0026] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0027] Figure 1 This is a basic flowchart of the WAF human-machine authentication method according to an embodiment of this application;

[0028] Figure 2 This is an example of the WAF human-machine authentication process in an embodiment of this application. Detailed Implementation

[0029] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0030] This application provides a WAF human-machine authentication method for different access requests from the same IP address, such as... Figure 1 As shown, it includes the following steps:

[0031] In step S101, after receiving the client's access request using the WAF, the access request traffic is checked and analyzed. The client's access request can be based on the HTTP protocol. In some embodiments, after receiving the client's access request using the WAF, if the access request does not conform to the pre-configured protection rules, that is, the pre-configured protection rules are not hit, the client is directly allowed to the origin server. If the access request conforms to the pre-configured protection rules, the system switches to the authentication page and performs the following human-machine authentication process, such as... Figure 2 As shown:

[0032] In step S102, authentication data is generated using the WAF, and the human-machine authentication interface corresponding to the authentication data is sent to the client as a response message to the access request. The client performs verification, and after verification, the client returns an authentication message to the WAF. The response message header contains a cookie with a value including the hit protection rule ID, and the returned authentication message includes the cookie. In this example, the generated authentication data can be randomly generated. The client can use the generated authentication data to complete authentication, and the WAF can verify the client based on the authentication result.

[0033] After generating authentication data randomly, the WAF can send the corresponding human-machine authentication interface as a response message to the access request to the client. The client then performs verification and returns an authentication message to the WAF. The response message header cookie is configured with a cookie value containing the hit protection rule ID. Specifically, the cookie value can be set using `set-cookie`. In some embodiments, before generating authentication data using the WAF, the method further includes updating the client's user authentication status to a first state. This first state can be, for example, "authenticating," and the key for the user authentication status in the first state is internal data plus the hit protection rule ID.

[0034] In some embodiments, the human-machine authentication interface corresponding to the comparison result is sent to the client as a response message to the access request via the HTTP protocol. After receiving the response message, the client parses the response message, renders the human-machine authentication interface, performs verification based on the human-machine authentication interface, and stores the message header cookie of the response message in the client.

[0035] Specifically, the client-side verification process includes receiving an HTTP response message, parsing the response message, and rendering an authentication page, such as a CAPTCHA or a slider. Simultaneously, the client stores the cookie in the message header. After the user enters the CAPTCHA or moves the slider, the client sends the data and the cookie value to the WAF.

[0036] In step S103, the WAF receives and parses the client's authentication request to verify the client. Specifically, the authentication result using the WAF can be either successful or unsuccessful. In some embodiments, receiving and parsing the client's authentication request using the WAF to verify the client includes: parsing the client's authentication request and the cookie in the message header using the WAF; if the client authentication is successful, constructing a complete KEY based on the KEY field of the user authentication status in the cookie in the message header to update the user authentication status.

[0037] In step S104, based on the verification result, a redirection message is sent to the client, causing the client to re-initiate the access request. The re-initiated access request carries the client's authentication status, which includes authentication success or failure. In some embodiments, after updating the user authentication status, the method further includes: using the WAF to send a redirection message to the client, where the URL address of the redirection message is the URL address of the target page. Specifically, based on the updated user authentication status, such as successful or failed verification, the WAF sends a 302 redirection message to the client, with the redirection URL address being the original target page accessed by the client. After receiving the redirection message from the WAF, the client re-initiates the request.

[0038] In step S105, the WAF is used to receive the client's re-initiated access request and complete authentication based on the authentication status therein. In some embodiments, using the WAF to receive the client's re-initiated access request and complete authentication based on the authentication status therein includes: if the client's authentication status in the re-initiated access request is successful, then the client is allowed to proceed to the origin server; if the client's authentication status is unsuccessful, then the message is discarded and a preset response code is sent to the client.

[0039] Specifically, when the WAF receives a new access request from a client to the original URL, it determines the request based on the authentication status. If authentication is successful, the request is allowed to proceed to the origin server. If authentication fails, the message is discarded, and a 403 response code is sent to the client. After successful authentication by the WAF, the client's request is allowed to proceed to the origin server. This method can resolve access requests from different clients with the same IP address in scenarios without session characteristics.

[0040] This application also proposes a computer device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, it implements the steps of the aforementioned WAF human-machine authentication method for different access requests from the same IP.

[0041] This application also proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned WAF human-machine authentication method for different access requests from the same IP.

[0042] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0043] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0044] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0045] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A WAF human authentication method for different access requests from the same IP address, characterized in that, include: Using the WAF, after receiving a client's access request for a target page, if the access request conforms to the pre-configured protection rules, the following human-machine authentication process is executed: Using the WAF, authentication data is generated, and the human-machine authentication interface corresponding to the authentication data is sent to the client as a response message for the access request, so that the client can perform verification. After verification, the client returns an authentication message to the WAF. The header of the response message is configured with a cookie whose value includes the hit protection rule ID, and the returned authentication message contains the cookie. After receiving the response message, the client parses the response message, renders the human-machine authentication interface, performs verification based on the human-machine authentication interface, and stores the cookie in the message header of the response message in the client. The WAF receives and parses the client's authentication request to verify the client; Based on the verification result, a redirection message is sent to the client so that the client re-initiates an access request to the target page, and the re-initiated access request carries the client's authentication status. Using the WAF, the client re-initiates the access request, and the authentication is completed based on the authentication status therein; The process of receiving and parsing the client's authentication request using the WAF to verify the client includes: The WAF is used to parse the authentication data in the authentication request, as well as the message header cookie; The generated authentication data is compared with the parsed authentication data to verify the client; and If the client authentication is successful, the complete KEY is constructed based on the KEY part of the user authentication status in the cookie in the message header to update the user authentication status. Before generating authentication data using the WAF, the method further includes: updating the user authentication status of the client to a first status, wherein the KEY of the user authentication status in the first status is internal data plus the hit protection rule ID.

2. The WAF human-machine authentication method for different access requests from the same IP as described in claim 1, characterized in that, Sending the human-machine authentication interface corresponding to the authentication data as a response message to the access request to the client is implemented via the HTTP protocol.

3. The WAF human-machine authentication method for different access requests from the same IP as described in claim 1, characterized in that, After updating the user authentication status, the process also includes: using the WAF to send a redirect message to the client, wherein the URL address of the redirect message is the URL address of the target page.

4. The WAF human-machine authentication method for different access requests from the same IP as described in claim 1, characterized in that, Using the WAF, receiving the client's re-initiated access request and completing authentication based on the authentication status therein includes: If the client's authentication status is successful in the re-initiated access request, then the client is allowed to proceed to the origin server. If the client's authentication status is authentication failure, the message is discarded and a preset response code is sent to the client.

5. The WAF human-machine authentication method for different access requests from the same IP as described in claim 1, characterized in that, Using the WAF, after receiving the client's access request, if the traffic corresponding to the access request does not conform to the pre-configured protection rules, the client is directly allowed to the origin server.

6. A computer device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, which, when executed by the processor, implements the steps of the WAF human-machine authentication method for different access requests from the same IP as described in any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the WAF human-machine authentication method for different access requests from the same IP as described in any one of claims 1 to 5.

Images