A transform-based implicit protection method and apparatus

Abstract

The application discloses a kind of implicit protection method and device based on transformation, comprising: in response to client to server sends data request, and data request includes target field, first processing is carried out to target field, and first data field is obtained;In response to server receives the data request including first data field, second processing is carried out to first data field, and second data field is obtained;If second data field and the original field corresponding to client match, obtain the target data corresponding to data request;Third processing is carried out to second data field to obtain third data field, and target data including third data field is sent to client, wherein, third processing is the processing matched with first processing.The application provides the target field corresponding to each client for access by server, and carries out transformation processing, so that attacker cannot bypass, and then effectively protects relevant vulnerability attack.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a transformation-based implicit protection method and device. BACKGROUND

[0002] The serialization and deserialization of JAVA is essentially the mutual conversion between JAVA objects and byte sequences, and the main purpose is to facilitate the storage and transmission of JAVA objects. However, since the type of the generated object is not reasonably limited during the deserialization process, an attacker can construct malicious input, thereby causing arbitrary code execution.

[0003] ApacheShiro is a JAVA security framework, and its main function is to perform authentication, authorization, cryptography and session management, and it is a powerful security framework. It provides a "remember me" function (rememberMe), and after a user logs in successfully, encrypted and encoded cookie information is generated. The key of the cookie is rememberMe, and its value is first converted into a byte sequence after serialization, and then encrypted by AES and encoded by Base64 to form it. In the actual access process, when the server receives the cookie value, it first retrieves the value of rememberMe, and then performs the reverse operation, namely Base64 decryption, AES decryption, and deserialization. However, during the deserialization process, there is no filtering condition, which will cause a remote code execution vulnerability, which may further cause the server to be controlled.

[0004] The protection method for the deserialization vulnerability mainly detects the vulnerability attack or abnormal request first, and then performs targeted protection such as discarding the request after detecting the obvious attack payload. The protection methods mainly include white list, black list, and targeted protection according to the detection results of the customized detection system. The white list protection method mainly determines whether the client IP address is a trusted IP address by pre-setting the IP white list, to prevent the deserialization vulnerability attack as much as possible; the black list method mainly compares the target object of the deserialization operation with the black list configuration file which carries a malicious code object, and if they are the same, the deserialization operation of the target object is terminated; the protection method combined with the detection results of the customized detection system mainly performs targeted protection through the results of the detection system, discards the unsafe request, and processes the safe request. The detection system can be deployed in the application server or the reverse proxy server.

[0005] Since the current protection means needs to carry out the vulnerability attack detection first, the detection means whether is using the professional detection system or the self-defined rule and the like method, all can exist the situation of unable to detect successfully, the protection condition is serious and depends on the detection effect, and then causes unable to carry out the effective protection. The main technical defects include: first, the detection result is seriously depended on, whether the traditional detection method or the customized detection system, all depend on the detection result to make the protection measure, if the detection fails, then the protection effect is poor, and the security risk is increased;Second, since there is a time difference between the disclosure of the vulnerability and the official upgrade, before the official patch appears, the system is easy to be attacked, and it is difficult to completely cover all attack modes through the white list, the black list and the like protection method, and it is easy to be bypassed, and a large amount of manpower is needed to maintain the black and white list, and the black and white list is updated, and then the protection effect is poor. SUMMARY

[0006] In view of the above problems, the application provides a transformation-based implicit protection method and device, which realizes effective and timely protection of data and improves data security.

[0007] In order to achieve the above purpose, the application provides the following technical scheme:

[0008] A transformation-based implicit protection method, the method comprises:

[0009] In response to the client sending a data request to the server, and the data request comprising a target field, the target field is first processed to obtain a first data field;

[0010] In response to the server receiving a data request comprising the first data field, the first data field is second processed to obtain a second data field;

[0011] If the second data field matches the original field corresponding to the client, the target data corresponding to the data request is obtained;

[0012] The third data field is obtained by third processing the second data field, and the target data comprising the third data field is sent to the client, wherein the third processing is the processing matched with the first processing.

[0013] A transformation-based implicit protection device, the device comprises:

[0014] The first processing unit is used for responding to the client sending a data request to the server, and the data request comprising a target field, the target field is first processed to obtain a first data field;

[0015] a second processing unit, configured to perform a second processing on the first data field to obtain a second data field in response to the server receiving the data request including the first data field;

[0016] an obtaining unit, configured to obtain target data corresponding to the data request if the second data field matches an original field corresponding to the client;

[0017] a third processing unit, configured to perform a third processing on the second data field to obtain a third data field, and send the target data including the third data field to the client, wherein the third processing is matched with the first processing.

[0018] A storage medium, having stored thereon executable instructions that, when executed by a processor, implement the transformation-based implicit protection method according to any one of the preceding embodiments.

[0019] An electronic device, comprising:

[0020] a memory, configured to store a program;

[0021] a processor, configured to execute the program, wherein the program is configured to implement the transformation-based implicit protection method according to any one of the preceding embodiments.

[0022] Compared with the prior art, the present application provides a transformation-based implicit protection method and device, comprising: in response to a client sending a data request to a server, and the data request including a target field, performing a first processing on the target field to obtain a first data field; in response to the server receiving the data request including the first data field, performing a second processing on the first data field to obtain a second data field; if the second data field matches an original field corresponding to the client, obtaining target data corresponding to the data request; performing a third processing on the second data field to obtain a third data field, and sending the target data including the third data field to the client, wherein the third processing is matched with the first processing. The present application provides the target field corresponding to each client for the server to access, first performs transformation on the target field, and then performs reverse transformation after receiving the request, so that an attacker cannot bypass, and the process is automatically completed at the time of program compilation, solving the problems of manual access and easy bypass, and effectively protecting against related vulnerability attacks. BRIEF DESCRIPTION OF DRAWINGS

[0023] The above and other features, advantages, and aspects of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, like reference numerals identify like elements. It will be understood that the drawings are diagrammatic and schematic and are not drawn to scale nor to precise proportions.

[0024] Figure 1 A flowchart of a transformation-based implicit protection method provided for an embodiment of the present application is shown in FIG. 1.

[0025] Figure 2 A principle diagram of protection against deserialization vulnerabilities provided for an embodiment of the present application is shown in FIG. 2.

[0026] Figure 3 A flowchart of a processing procedure when a normal user accesses for the first time provided for an embodiment of the present application is shown in FIG. 3.

[0027] Figure 4 A flowchart of a processing procedure of a protection method when an attacker attacks provided for an embodiment of the present application is shown in FIG. 4.

[0028] Figure 5 A structural diagram of a transformation-based implicit protection device provided for an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0029] Embodiments of the present disclosure will be described in more detail with reference to the drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms, and should not be interpreted as being limited to the embodiments set forth herein, but rather, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes, and are not intended to limit the scope of protection of the present disclosure.

[0030] The term "comprising" and variations thereof as used herein are open-ended, that is, "comprising but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related definitions of other terms will be given in the description below.

[0031] It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not intended to limit the order or interdependence of the functions performed by these devices, modules or units. The modifier "one", "multiple" mentioned in the present disclosure is illustrative and not limiting, and those skilled in the art should understand that, unless otherwise explicitly stated in the context, it should be understood as "one or more".

[0032] Generally, the protection against deserialization vulnerability attacks depends on detection results, for example, including: base64 decoding of a target field (such as a rememberMe field); AES decryption according to a common key; judging whether the data is serialized, if not, the detection fails, if yes, the next step is performed; judging whether a common deserialization exploit chain is used, if not, the detection fails, if yes, the detection succeeds, the real data is obtained, and further judgment is performed on the attack statement. It can be seen that the detection method is relatively cumbersome, the common key and the deserialization exploit chain need to be understood, when the two cannot be determined, the detection cannot be successful, and thus the vulnerability exploit attack cannot be effectively protected. Therefore, in order to solve the defects of the current deserialization vulnerability attack protection method, an implicit protection method based on transformation is provided in the embodiment of the present application, which is mainly applied to the following cases: the server issues an encrypted target field (such as a cookie), and the target field carried by the client is verified when the client accesses again, and is especially suitable for the protection of ApacheShiro deserialization vulnerabilities.

[0033] Referring to Figure 1 A flowchart of an implicit protection method based on transformation provided in the embodiment of the present application, the method can include:

[0034] S101, in response to a client sending a data request to a server, and the data request including a target field, performing first processing on the target field to obtain a first data field.

[0035] In the embodiment of the present application, the server issues a target field corresponding to each client (which can also be referred to as a user end) (such as a rememberMe field in cookie information, and the cookie is data stored in a terminal device by a server or other electronic device for the purpose of identifying user identity and performing session tracking), and the client stores the target field after receiving the target field issued by the server.

[0036] When a user initiates a data request to the server through the client, the client needs to carry the locally stored target field (such as the rememberMe field in cookie information) in the data packet corresponding to the data request, for example, the value of the rememberMe field in the cookie information is rememberMe=D4bi....b.

[0037] Correspondingly, if it is detected that the user corresponding to the client or the client itself is first accessing the server, the server generates a target field corresponding thereto. In an implementation of the embodiment of the application, further comprising: in response to the client sending a data request to the server, detecting whether the target field is included in the data request; if not, controlling the server to generate a target field matched with the client and storing the target field to the server.

[0038] Further comprising: transforming the field value of the target field to obtain a transformed target field; and if the server generates response information corresponding to the data request, sending the response information carrying the transformed target field to the client, so that the client carries the target field when accessing the server again.

[0039] It should be noted that the application architecture of the embodiment of the application includes an intermediate processing component, that is, the client and the server are not directly in data interaction, but are realized through the intermediate processing component, that is, the intermediate processing component acts between the user request and the server received request, mainly for field transformation and reverse transformation, which can be deployed on the server side or on the reverse proxy in the actual deployment process, and can only realize transformation and reverse transformation.

[0040] When the data request including the target field passes through the intermediate processing component, it is recognized that it contains the target field, and the first processing is performed on it, that is, a transformation operation such as simple string transformation. In an implementation of the embodiment of the application, the first processing of the target field to obtain a first data field comprises: obtaining the last character of the target field; and based on the type of the last character, converting the target field to obtain a first data field.

[0041] Specifically, the simple string transformation, if the last character is a letter, the case conversion is performed thereon, and if the last character is a number, the operation of subtracting 1 is performed thereon. For example, rememberMe=D4bi....b, the last character of the field is converted to uppercase, which becomes: rememberMe=D4bi....B, and the processed field is continuously transmitted to the server.

[0042] S102, in response to the server receiving a data request including the first data field, performing second processing on the first data field to obtain a second data field.

[0043] S103, if the second data field matches the original field corresponding to the client, obtaining target data corresponding to the data request.

[0044] The second processing includes decoding, decryption and deserialization of the field value. Specifically, the first data field is the transformed target field. When the server receives a user request containing the rememberMe field in the cookie, the value of the rememberMe field is decoded, decrypted and deserialized, and compared with the stored information. If the comparison is consistent, the result of the user request is returned to the user.

[0045] S104, the third data field is obtained by performing a third processing on the second data field, and target data including the third data field is sent to the client.

[0046] The third processing is matched with the first processing. When the target data on the server side, such as a response packet, passes through the intermediate processing component, it is identified that it contains the rememberMe field and has been simply transformed, i.e. the last character of the rememberMe field is converted to lowercase: rememberMe=D4bi....b. After processing, it is transmitted to the user. The user receives the response packet to obtain the corresponding response data.

[0047] The above process is the operation of the entire protection method when the user accesses for the first time under normal circumstances. During the protection process, the server side and the user side maintain normal communication because of the normal operation of the user.

[0048] When an attacker attacks using the ApacheShiro deserialization vulnerability, according to the characteristics of the attacker, the attacker will directly add the rememberMe field in the cookie of the attack request, and the value of the rememberMe field is the attack payload constructed by the attacker, with attack load. It will follow the ApacheShiro framework processing flow to perform serialization, AES encryption and Base64 encoding. When the request is initiated, in response to the client sending a data request to the server side, and the data request including a target field, the first processing is performed on the target field to obtain a first data field; in response to the server receiving a data request including the first data field, the second processing is performed on the first data field to obtain a second data field; if the second data field does not match the original field corresponding to the client, the data request of the target field is sent to the server side, so that the server side does not send data corresponding to the data request to the client.

[0049] Normally, when the server issues the rememberMe encrypted field, it will be transformed by the intermediate processing component, the target field stored by the user (such as rememberMe in the cookie) is processed, rather than the actual server issued; when the user accesses again, the rememberMe field is reversely transformed, that is, the first processing, so that it recovers to the value of the field actually issued by the server, and is decoded, decrypted and deserialized, that is, the second processing, so that the identity of the normal user can be accurately identified; however, the attacker does not know the transformation process of the intermediate processing component, and it will be serialized, encrypted and encoded according to the actual processing flow of ApacheShiro, at this time, the attack request will be transformed into an invalid rememberMe field value when passing through the intermediate processing component, then the server cannot perform the reverse serialization operation, so it will not be attacked by the attacker, and the attack behavior is effectively protected.

[0050] The application flow is used to illustrate the transformation-based implicit protection method of the embodiment of the application. Taking ApacheShiro deserialization exploit attack as an example, ApacheShiro provides the RememberMe function, which remembers who you are when you open the browser next time, and you can access without logging in next time, which encrypts the rememberMe cookie, serializes, AES encrypts and Base64 encodes the field content, and when identifying the identity, the rememberMe field in the cookie needs to be reversely operated, that is, Base64 decoding, AES decryption and deserialization. Since the AES encryption key is hard-coded in the code, it means that everyone can get the AES encryption key through the source code, therefore, the attacker constructs a malicious object, serializes, AES encrypts and base64 encodes it, and sends it as the rememberMe field of the cookie. Shiro decrypts and deserializes rememberMe, and finally causes the deserialization vulnerability.

[0051] Referring to Figure 2 The principle diagram of the protection against the deserialization vulnerability provided by the embodiment of the application. The process includes:

[0052] 1. When the user accesses for the first time, the rememberMe function is selected to be turned on (rememberMe=on), at this time, the rememberMe field is not carried in the cookie requested by the user;

[0053] 2、User request through the intermediate processing component, the intermediate processing component to determine whether its cookie contains rememberMe field, at this time due to the first access of the user, the cookie of the user request does not contain rememberMe field, the intermediate processing component does not operate it;

[0054] 3、User request through the intermediate processing component, to the server side, at this time the server judges that the cookie of the user request does not contain rememberMe field, the server will allocate a rememberMe field value to the user, and store the value in the server side;

[0055] 4、The server returns the response package with the rememberMe field in the cookie to the user, at this time through the intermediate processing component, the intermediate processing component identifies that the response package cookie contains the rememberMe field, at this time the value of the rememberMe field is transformed, and after processing, it is transmitted to the user;

[0056] 5、User receives the response package, and stores the cookie information to the local, for the next access;

[0057] 6、User access for the second time, at this time the user sends the request package with the local stored cookie information to the server side;

[0058] 7、Through the intermediate processing component, the intermediate processing component identifies that the cookie of the user request contains rememberMe field, at this time the rememberMe field is reversely transformed to restore it to the rememberMe field that the server can identify;

[0059] 8、The server side receives the user request processed by the intermediate processing component, and performs decoding, decryption and deserialization operations according to the process, and compares with the information stored in the server side, finds that the user is not the first access, and is consistent with the information stored in the server side, the server responds to the user request, and returns the result and the cookie information with rememberMe field as the response package to the user side;

[0060] 9、At this time, through the intermediate processing component, it is identified that the cookie in the response package contains rememberMe field, and after transformation operation, it is continuously sent to the user side;

[0061] 10、User accepts the response package and gets the corresponding response data. After that, each access will carry the same cookie information until the cookie information is invalid, and a new cookie is allocated.

[0062] This invention can simulate two scenarios: normal user access and attacks exploiting a vulnerability in Apache Shiro deserialization. It assumes that the intermediate processing component performs a simple string transformation, specifically a case conversion operation on the last character of the `rememberMe` field. (See [link to relevant documentation]). Figure 3 This is a schematic diagram of a processing flow provided by an embodiment of the present invention when a normal user accesses the site for the first time. The process may include:

[0063] 1. The user sends a request to the server and includes locally stored cookie information in the request packet. The value of the rememberMe field in the cookie information is: rememberMe = D4bi....b;

[0064] 2. When a user request passes through the intermediate processing component, it is recognized that the request contains the rememberMe field and a simple transformation operation is performed on it (simple string transformation: if the last character is a letter, it is converted to uppercase and lowercase; if the last character is a number, it is decremented by 1). That is, the last character of the rememberMe field is converted to uppercase, becoming: rememberMe=D4bi....B. After processing, it is continued to be transmitted to the server.

[0065] 3. The server receives a user request containing the rememberMe field in the cookie, decodes, decrypts, and deserializes the value of the rememberMe field, compares it with the stored information, and returns the result of the user request to the user after the comparison is consistent.

[0066] 4. When the server-side response packet passes through the intermediate processing component, it is recognized that it contains the rememberMe field and a simple transformation operation is performed on it, that is, the last character of the rememberMe field is converted to lowercase, becoming: rememberMe=D4bi....b, and then it is transmitted to the user after processing;

[0067] 5. The user receives the response packet and obtains the corresponding response data.

[0068] The above process is the operation of the entire protection method when the user accesses for the first time under normal circumstances. During the protection process, the server side and the user side maintain normal communication because it is the normal operation of the user. When an attacker attacks using the ApacheShiro deserialization vulnerability, according to the characteristics of the attacker, the attacker will directly add a rememberMe field in the cookie of the attack request. The value of the rememberMe field is the attack payload constructed by the attacker, with the attack payload, and will be serialized, AES encrypted and Base64 encoded according to the ApacheShiro framework processing flow. See Figure 4 A processing flow diagram of a protection method for an attacker attack provided by an embodiment of the application. The process can include:

[0069] 1. The attacker initiates an attack request using the ApacheShiro vulnerability. The cookie of the attack request contains a rememberMe field. The value of the field is the value obtained by serializing, AES encrypting and Base64 encoding the attack payload by the attacker. The value is: rememberMe = 27Mb...A. The attack request is sent to the server side to obtain the result data in the attack payload;

[0070] 2. When the attack request passes through the intermediate processing component, the intermediate processing component identifies that the request contains the rememberMe field, and performs simple transformation processing on the value of the field, that is, the last character of the rememberMe field is changed to lowercase, which becomes: rememberMe = 27Mb...a, and is continuously transmitted to the server side;

[0071] 3. The server side receives the attack request processed by the intermediate processing component, and performs decoding, AES decryption and deserialization operations. However, because the value of the rememberMe field in the attack request is constructed by the attacker and is not the encrypted information issued by the server, it is not processed by the intermediate processing component when sent to the user side. Therefore, after the attack request is processed by the inverse transformation of the intermediate processing component, it does not become the value of the rememberMe field that the server can recognize. Therefore, the decoding, AES decryption and deserialization operations fail in the server side, the server returns a 404 response code, and the rememberMe in the cookie is deleted, that is, Set-Cookie: rememberMe = deleteMe;

[0072] 4. The response packet of the server side passes through the intermediate processing component, and because the cookie does not contain the rememberMe field, the intermediate processing component does not process it, and directly transmits it to the attacker;

[0073] 5, the attacker receives the 404 response packet sent by the server end, and deletes the rememberMe field.

[0074] In the embodiment of the application, the detection step is not required, normally, when the rememberMe encrypted field is issued by the server, the transformation operation is performed by the intermediate processing component, the rememberMe field in the cookie stored by the user is processed, rather than the actual field issued by the server; when the user accesses again, the rememberMe field is reversely transformed, so that the value of the field issued by the server is restored, and the rememberMe field is decoded, decrypted and deserialized, so that the identity of the normal user can be accurately identified; however, the attacker does not know the transformation process of the intermediate processing component, and the attacker will perform serialization, encryption and encoding according to the actual processing flow of ApacheShiro, at this time, when the attack request passes through the intermediate processing component, the rememberMe field value is transformed into an invalid value, the server end cannot perform the deserialization operation and the like, and the attack behavior is effectively protected.

[0075] The main function of the embodiment of the application is to effectively avoid the ApacheShiro deserialization vulnerability attack without detection and manual intervention, decouple the detection and protection, improve the protection effect, and specifically includes:

[0076] The user end and the server end do not need to perform any operation, and only need to increase a new intermediate processing component, so as to decouple the business code;

[0077] The transformation method can be customized, and there is no fixed mode, which is difficult to bypass by the attacker;

[0078] The transformation method is written into the code, and is automatically executed by the program during the compilation, without human intervention, and the user side and the server side are not aware of it.

[0079] It should be noted that in the implementation, the flowcharts and block diagrams in the drawings refer to the system, method and computer program product of the various embodiments of the present disclosure, which illustrate the possible implementation architecture, function and operation. In this regard, each block in the flowchart or block diagram can represent a module, program segment or part of code, which includes one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order from that noted in the drawings. For example, two blocks indicated in succession can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the function involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0080] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information. Although the operations are described in a certain order, this should not be understood as requiring the operations to be performed in the specific order shown or in a sequential order. In certain circumstances, multi-tasking and parallel processing can be advantageous. It should be understood that each step in the method embodiments of the present disclosure can be performed in a different order and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the execution of the steps shown. The scope of the present disclosure is not limited in this respect.

[0081] Referring to Figure 5 In the embodiments of the present disclosure, a transformation-based implicit protection device is also provided, which comprises:

[0082] The first processing unit 501 is configured to, in response to a client sending a data request to a server, and the data request including a target field, perform first processing on the target field to obtain a first data field;

[0083] The second processing unit 502 is configured to, in response to the server receiving the data request including the first data field, perform second processing on the first data field to obtain a second data field;

[0084] The acquisition unit 503 is configured to, if the second data field matches an original field corresponding to the client, obtain target data corresponding to the data request;

[0085] The third processing unit 504 is configured to perform third processing on the second data field to obtain a third data field, and send target data including the third data field to the client, wherein the third processing is processing matched with the first processing.

[0086] Optionally, the apparatus further includes:

[0087] The detection unit is configured to, in response to the client sending a data request to the server, detect whether the target field is included in the data request.

[0088] The control unit is configured to, if not, control the server to generate the target field matched with the client, and store the target field to the server.

[0089] Optionally, the apparatus further includes:

[0090] The conversion unit is configured to perform conversion on a field value of the target field to obtain a converted target field.

[0091] The sending unit is configured to, if the server generates response information corresponding to the data request, send the response information carrying the converted target field to the client, so that the client carries the target field to access the server again.

[0092] Further, the first processing unit is specifically configured to:

[0093] Obtain a last character of the target field.

[0094] Perform conversion on the target field based on a type of the last character to obtain a first data field.

[0095] The second processing includes decoding, decryption and deserialization processing on a field value.

[0096] Optionally, the apparatus further includes:

[0097] The deletion unit is configured to, if the second data field does not match the original field corresponding to the client, send a data request with the target field deleted to the server, so that the server does not send data corresponding to the data request to the client.

[0098] The embodiment of the present application provides a kind of based on transformation implicit protection device, in response to client to server sends data request, and data request includes target field, first processing is carried out to target field, obtains first data field;In response to server receives the data request including first data field, second processing is carried out to first data field, obtains second data field;If second data field and the original field corresponding to client match, obtain the target data corresponding to data request;Third processing is carried out to second data field and obtains third data field, and the target data including third data field is sent to client, wherein, third processing is the processing matched with first processing.The present application provides the target field corresponding to each client for access by server, first processing is carried out to the target field, after receiving request, reverse transformation is carried out again, so that attacker cannot bypass, and by program is automatically completed at compile time, solve the problem of manual access and easy bypass, further effectively protect the attack to relevant vulnerability.

[0099] The units described in the embodiments of the present disclosure can be implemented in software or hardware. In some cases, the name of the unit does not constitute a limitation on the unit itself.

[0100] In the embodiments of the present application, a storage medium is also provided, and the storage medium stores executable instructions. When the instructions are executed by a processor, the method for implicit protection based on transformation according to any one of the above embodiments is implemented.

[0101] The embodiments of the present application also provide an electronic device, which includes:

[0102] A memory is configured to store a program.

[0103] A processor is configured to execute the program, and the program is specifically configured to implement the method for implicit protection based on transformation according to any one of the above embodiments.

[0104] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0105] According to one or more embodiments of the present disclosure, a transformation-based implicit protection method, device, electronic device, and storage medium are provided.

[0106] A transformation-based implicit protection method, the method comprising:

[0107] In response to a client sending a data request to a server, and the data request including a target field, performing first processing on the target field to obtain a first data field;

[0108] In response to the server receiving a data request including the first data field, performing second processing on the first data field to obtain a second data field;

[0109] If the second data field matches the original field corresponding to the client, obtaining target data corresponding to the data request;

[0110] Performing third processing on the second data field to obtain a third data field, and sending target data including the third data field to the client, wherein the third processing is processing matched with the first processing.

[0111] A transformation-based implicit protection device, the device comprising:

[0112] A first processing unit configured to, in response to a client sending a data request to a server, and the data request including a target field, perform first processing on the target field to obtain a first data field;

[0113] A second processing unit configured to, in response to the server receiving a data request including the first data field, perform second processing on the first data field to obtain a second data field;

[0114] The acquisition unit is configured to acquire target data corresponding to the data request if the second data field matches the original field corresponding to the client.

[0115] The third processing unit is configured to perform third processing on the second data field to obtain a third data field, and send target data including the third data field to the client, wherein the third processing is processing matched with the first processing.

[0116] A storage medium having stored thereon executable instructions that, when executed by a processor, implement the transformation-based implicit protection method according to any one of the preceding embodiments.

[0117] An electronic device, comprising:

[0118] A memory configured to store a program;

[0119] A processor configured to execute the program, wherein the program is configured to implement the transformation-based implicit protection method according to any one of the preceding embodiments.

[0120] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0121] While several inventive embodiments have been discussed above, it should be appreciated that many modifications can be made by those skilled in the art that this application might encompass within its scope. The disclosures of the various publications are incorporated by reference herein. It is therefore contemplated to cover any and all modifications, variations or equivalents that fall within the scope of the present application. Accordingly, the application is to be construed as limited only by the spirit and scope of the appended claims, including all equivalents thereof.

[0122] The above description is merely exemplary of the present disclosure and the application made use of the principles of the technology. It is to be understood that the disclosure is not limited to the above-described technical features and the specific combination thereof, and should also encompass other technical solutions formed by any combination of the above technical features or equivalent features, without departing from the concept of the disclosure. For example, the above technical features can be replaced with other technical features disclosed in the disclosure (but not limited to) having similar functions to form technical solutions.

Claims

1. A transformation-based implicit protection method, characterized in that, The method includes: In response to the client's first data request to the server, detect whether the data request includes the target field; If not, control the server to generate a target field that matches the client, and store the target field on the server; The field value of the target field is transformed to obtain the transformed target field; If the server generates response information corresponding to the data request, the intermediate processing component sends the response information carrying the transformed target field to the client, so that the client can access the server again with the target field. In response to a client sending a data request to the server that is not the first time, and the data request includes a target field, when the data request passes through an intermediate processing component, the target field is processed by the intermediate processing component to obtain a first data field, and the first data field is transmitted to the server by the intermediate processing component. The intermediate processing component is used for data interaction between the client and the server, and is used to transform and reverse transform the target field. The first processing is a transformation operation. In response to the server receiving a data request including the first data field, the first data field is processed to obtain a second data field. The second processing includes decoding, decryption and deserialization of the field value. If the second data field matches the original field corresponding to the client, the target data corresponding to the data request is obtained; When the target data passes through the intermediate processing component, the intermediate processing component performs a third processing on the second data field to obtain a third data field, and then sends the target data including the third data field to the client through the intermediate processing component. The third processing is the reverse of the first processing.

2. The method according to claim 1, characterized in that, The first processing of the target field to obtain the first data field includes: Get the last character of the target field; Based on the type of the last character, the target field is converted to obtain the first data field.

3. The method according to claim 1, characterized in that, The method further includes: If the second data field does not match the original field corresponding to the client, a data request to delete the target field will be sent to the server so that the server will not send the data corresponding to the data request to the client.

4. A transformation-based implicit protection device, characterized in that, The device includes: The detection unit is used to detect whether the target field is included in the data request in response to the client's first data request to the server. A control unit, configured to, if not, control the server to generate a target field that matches the client and store the target field in the server; A transformation unit is used to transform the field value of the target field to obtain the transformed target field; The sending unit is configured to send the response information carrying the transformed target field to the client through an intermediate processing component if the server generates response information corresponding to the data request, so that the client can access the server again with the target field. The first processing unit is configured to respond to a client sending a data request to the server for the first time, wherein the data request includes a target field. When the data request passes through an intermediate processing component, the intermediate processing component performs a first processing on the target field to obtain a first data field, and transmits the first data field to the server through the intermediate processing component. The intermediate processing component is used for data interaction between the client and the server, and is used to perform transformation and inverse transformation on the target field. The first processing is a transformation operation. The second processing unit is configured to respond to the server receiving a data request including the first data field, perform a second processing on the first data field to obtain a second data field, wherein the second processing includes decoding, decryption and deserialization of the field value; The acquisition unit is configured to obtain target data corresponding to the data request if the second data field matches the original field corresponding to the client. The third processing unit is configured to, when the target data passes through the intermediate processing component, perform a third processing on the second data field to obtain a third data field through the intermediate processing component, and send the target data including the third data field to the client through the intermediate processing component, wherein the third processing is the reverse of the first processing.

5. The apparatus according to claim 4, characterized in that, The first processing unit is specifically used for: Get the last character of the target field; Based on the type of the last character, the target field is converted to obtain the first data field.

Images