Method, device, computer equipment, medium and product for dynamic data updating

Abstract

The present application relates to a method, apparatus, computer equipment, storage medium and product for dynamic data updating. After receiving a dynamic update request for regional data, the timestamp in the dynamic update request is verified. If the delay between the local reception time and the timestamp is greater than a preset delay threshold, an active detection request is sent and the communication duration for completing the active detection request is obtained. If the communication duration is greater than a network factor threshold, the dynamic update request is determined to be a suspected replay attack request, and the updated regional data is marked as a questionable version. If the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window, and the questionable version of the data is discarded to avoid contamination of the regional data by the questionable data, thereby ensuring the security of regional data updates.

Description

Technical Field

[0001] The present application relates to the field of domain name service technology, and in particular to a method, apparatus, computer equipment, storage medium and product for dynamic data updating. Background Art

[0002] During the dynamic update process of the Domain Name System (DNS), the server may be attacked by replay attacks. The DNS server that is attacked by replay attacks will cause pollution of zone data.

[0003] In traditional technology, timestamp difference is usually used to determine whether the DNS server is under replay attack. The sender sends the local time TS and data to the server. The server compares the received timestamp with the local time. If the difference between the two is within an acceptable range, it is considered a legitimate message. If it exceeds the range, it is considered to be replay attack data.

[0004] However, using only the timestamp difference for judgment requires a strict clock synchronization mechanism. Otherwise, the time between the server and the sender will be inconsistent, causing misjudgment of replay attacks and thus contaminating regional data. Summary of the Invention

[0005] Based on this, it is necessary to provide a method, device, computer equipment, storage medium and product for dynamic data update that can ensure the security of regional data update in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for dynamically updating data, the method comprising:

[0007] Receive a dynamic update request for regional data; the dynamic update request carries a timestamp;

[0008] If the delay between the local reception time and the timestamp is greater than the preset delay threshold, an active detection request is sent and the communication duration for completing the active detection request is obtained;

[0009] If the communication duration is longer than the network factor threshold, the dynamic update request is determined to be a suspected replay attack request, and the updated regional data is marked as a questionable version;

[0010] If the number of suspected replay attack requests within the current time window exceeds the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the suspected version of the data is discarded.

[0011] In one embodiment, the dynamic update request also carries a one-time password, which is obtained by encrypting target data, concatenating the data with a random number, and then encrypting the data again. The target data is used to update the regional data. The method further includes:

[0012] Verify the one-time password. If the verification is successful, obtain the delay between the local reception time and the timestamp.

[0013] In one embodiment, the method further comprises:

[0014] If the delay between the local reception time and the timestamp is less than or equal to the preset delay threshold, it is determined that no replay attack has occurred;

[0015] Update the regional data based on the target data carried in the dynamic update request, and mark the updated regional data as a safe version;

[0016] Use the secure version as the starting point version for the next time window.

[0017] In one embodiment, the method further comprises:

[0018] If the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred and the dynamic update request is directly discarded without responding.

[0019] In one embodiment, if the number of suspected replay attack requests within the current time window exceeds a suspected replay attack threshold, the method further includes: rolling back the regional data to the starting version of the current time window and discarding the suspected version of data.

[0020] Get the duration difference between the starting time of the current time window and the current time;

[0021] If the duration difference is less than or equal to the period duration of the current time window, the number of suspected replay attack requests within the current time window is obtained.

[0022] In one embodiment, the method further comprises:

[0023] If the duration difference is greater than the period duration of the current time window, the data version after the start point of the current time window is used as the new starting point version and marked as a safe version;

[0024] A new time window is obtained based on the new starting point version, and the number of suspected replay attack requests in the current time window minus one is set as the number of suspected replay attack requests in the new time window.

[0025] In a second aspect, the present application further provides a replay attack confirmation device, the device comprising:

[0026] A request receiving module, configured to receive a dynamic update request for regional data; the dynamic update request carries a timestamp;

[0027] The detection module is used to send an active detection request and obtain the communication duration for completing the active detection request if the delay between the local reception time and the timestamp is greater than a preset delay threshold;

[0028] A marking module is used to determine that the dynamic update request is a suspected replay attack request if the communication duration is greater than the network factor threshold, and mark the updated regional data as a questionable version;

[0029] The rollback module is used to roll back the regional data to the starting version of the current time window and discard the data of the suspected version if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold.

[0030] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements any one of the method steps in the first aspect when executing the computer program.

[0031] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements any one of the method steps in the first aspect when the computer program is executed by a processor.

[0032] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method steps of any one of the first aspects.

[0033] The above-mentioned method, apparatus, computer equipment, storage medium and product for dynamic data update, after receiving a dynamic update request for regional data, verify the timestamp in the dynamic update request; if the delay between the local reception time and the timestamp is greater than the preset delay threshold, send an active detection request and obtain the communication duration for completing the active detection request; if the communication duration is greater than the network factor threshold, determine that the dynamic update request is a suspected replay attack request, and mark the updated regional data as a questionable version; if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, roll back the regional data to the starting version of the current time window, and discard the data of the questionable version to avoid contamination of the regional data by the questionable data, thereby ensuring the security of regional data updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A diagram illustrating an application environment of a method for dynamically updating data in one embodiment;

[0035] Figure 2 Schematic diagram of a flow chart of a method for dynamically updating data in one embodiment;

[0036] Figure 3 Schematic diagram of a flow chart of a method for dynamically updating data in one embodiment;

[0037] Figure 4 1 is a flow chart of a method for dealing with replay attacks in one embodiment;

[0038] Figure 5 is a structural block diagram of a device for dynamically updating data in one embodiment;

[0039] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0041] The data dynamic update method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system can be integrated with server 104, or it can be located in the cloud or on another network server. Server 104 receives a dynamic update request for regional data sent by terminal 102. The dynamic update request carries a timestamp. Server 104 verifies the timestamp. If the delay between the local reception time and the timestamp exceeds a preset delay threshold, server 104 sends an active probe request and obtains the communication duration required to complete the active probe request. Server 104 is also configured to determine that the dynamic update request is a suspected replay attack request if the communication duration exceeds a network factor threshold, and mark the updated regional data as a questionable version. If the number of suspected replay attack requests within the current time window exceeds the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the questionable version of the data is discarded. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, and tablet computers. Server 104 can be implemented as a standalone server or a server cluster consisting of multiple servers.

[0042] In one embodiment, Figure 2 As shown, a method for dynamically updating data is provided, which is applied to Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0043] S202: Receive a dynamic update request for regional data; the dynamic update request carries a timestamp.

[0044] Among them, the regional data refers to the regional data in the dynamic update of the Domain Name System (DNS). During the use of DNS, it is often necessary to provide functions for dynamically adding and deleting records for different hosts. This function allows authorized updaters to add and delete resource records on the authoritative name server in the region. Specifically, the updater can find the authoritative name server of the region by retrieving the NS record of the region. If the name server receives an authorized update message and it is not the master server of the region, then it will forward the update message up to its master server. This process is called update forwarding. If the next name server is a slave server of the region, then it will still forward the update message up because in a region, only the master name server has a copy of the regional data that can be changed. The dynamic update request represents the authorized update message.

[0045] During the dynamic update process of the DNS server, a replay attack on the server may be received, and the timestamp is an effective method to verify whether it is a replay attack. Specifically, the terminal sends the local time TS and the data to the server together. The server compares the received timestamp TS with the local time TR. If the difference DeltT = TR - TS is within an acceptable range (DeltT < t, where t is an acceptable network delay), it is considered a normal request. If it is greater, it is considered a replay attack request.

[0046] S204: If the delay between the local reception time and the timestamp is greater than the preset delay threshold, send an active detection request and obtain the communication duration for completing the active detection request.

[0047] Among them, after receiving the dynamic update request, the server will first judge the difference DeltT = TR - TS between the local time TR and the terminal timestamp TS to obtain the delay of the dynamic update request. If this delay is less than or equal to the t1 (acceptable delay) preset by the server, it is certified that this dynamic update is not affected by a replay attack and is safe. If this difference is greater than the t1 set by the local server, a detection request is sent to the terminal by means of active detection. The purpose of sending the detection request is to eliminate the influence of the network environment on the dynamic update. The difference between the time when the detection request is sent and the time when the feedback message of the detection request is received is used as the communication duration for completing the active detection request.

[0048] S206: If the communication duration is greater than the network factor threshold, determine that this dynamic update request is a suspected replay attack request, and mark the regional data of this update as a suspicious version.

[0049] The communication duration required to complete the active probe request is recorded as TT. If TT is less than or equal to the network factor threshold t2, the network environment has little impact on the determination of a replay attack. Therefore, the timestamp check failure is due to a replay attack. The server determines that this dynamic update request is a replay attack and directly discards the request without updating the regional data. If TT is greater than the network factor threshold t2, the network environment may have an impact on the determination of a replay attack. Therefore, the server defines this dynamic update request as a suspected replay attack.

[0050] S208: If the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window, and the suspected version of data is discarded.

[0051] The server maintains a linked list of replay attack credibility. Each node in the linked list records a zone that will undergo dynamic updates. Each node has a time window that stores a count of suspected replay attacks. The starting point of the time window is the time of the zone record version defined as safe in the most recent dynamic update. Each time the time window is refreshed, the replay attack count is recorded as 0. If the number of suspected replay attack requests exceeds the suspicious version threshold within the window time, the dynamic update during that period is considered untrustworthy. The server rolls back the zone data to the starting version of the current time window and discards the suspicious version data within that period.

[0052] In the above-mentioned method for dynamic data update, after receiving a dynamic update request for regional data, the timestamp in the dynamic update request is verified. If the delay between the local reception time and the timestamp is greater than the preset delay threshold, an active detection request is sent and the communication time for completing the active detection request is obtained. If the communication time is greater than the network factor threshold, it is determined that this dynamic update request is a suspected replay attack request, and the updated regional data is marked as a questionable version. If the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window, and the questionable version of the data is discarded to avoid the suspected data from polluting the regional data, thereby ensuring the security of regional data updates.

[0053] In one embodiment, the dynamic update request also carries a one-time password, which is obtained by encrypting the target data and concatenating a random number and then encrypting it again. The target data is used to update the regional data. The method also includes: verifying the one-time password, and if the verification is successful, obtaining the delay between the local reception time and the timestamp.

[0054] A one-time password is a password that can only be used once. In practice, when a terminal sends a dynamic update request, it must perform an MD5 calculation on the data it sends. The calculated ciphertext is then concatenated with a random number (sufficiently random, with a near-zero probability of being the same number generated continuously within a short period of time). The concatenated data is then subjected to an MD5 calculation to obtain the one-time password. The server verifies the one-time password in the dynamic update request. A replay blacklist is pre-set on the server. If a terminal is on the replay blacklist, it is immediately identified as a replay attack, the entire time window is discarded, and the regional data is not updated.

[0055] MD5 calculation refers to the server performing irreversible string transformation calculations on the entire file or string to generate the MD5 hash value of the file or string.

[0056] In this embodiment, by verifying the one-time password, if the verification is successful, the delay between the local reception time and the timestamp is obtained, which can avoid the replay attack judgment error caused by only checking the timestamp, and further ensure the security of regional data updates.

[0057] In one embodiment, Figure 3 As shown, the method further includes:

[0058] S302: If the delay between the local receiving time and the timestamp is less than or equal to the preset delay threshold, it is determined that no replay attack occurs.

[0059] Among them, if the delay between the local reception time and the timestamp is less than or equal to the preset delay threshold, the server determines that the dynamic update request is safe and no replay attack occurs.

[0060] S304: Update the regional data based on the target data carried in the dynamic update request, and mark the updated regional data as a safe version.

[0061] The server uses the target data carried in the dynamic request as the new data version to update the regional data. At this time, the regional data version is a secure version.

[0062] S306: Use the safe version as the starting version of the next time window.

[0063] Among them, the regional data marked as a safe version in the current time window will be used as the starting version of the next time window by the server. After entering the next time window, when the number of suspected replay attack requests exceeds the suspicious version threshold of the window time, the server will roll back to the starting version.

[0064] In this embodiment, if the delay between the local reception time and the timestamp is less than or equal to the preset delay threshold, it is determined that no replay attack has occurred, and the regional data is updated based on the target data carried in the dynamic update request. The updated regional data is marked as a secure version, and the secure version is used as the starting version of the next time window. This can ensure the security of the regional data at the starting point of the next time window, thereby ensuring the accuracy of replay attack identification within the next time window.

[0065] In one embodiment, the method further includes: if the communication duration is less than or equal to the network factor threshold, determining that a replay attack has occurred, and directly discarding the current dynamic update request without responding.

[0066] Among them, if the communication duration is less than or equal to the network factor threshold, it proves that the network environment has little impact on the determination of replay attack. Therefore, the failure of the timestamp check is affected by the replay attack. The server determines that this dynamic update request is a replay attack, and directly discards the request without updating the regional data.

[0067] In this embodiment, if the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred, and the dynamic update request at that time is directly discarded without response. This can accurately determine whether a replay attack has occurred based on network factors, thereby ensuring regional data security.

[0068] In one embodiment, if the number of suspected replay attack requests within the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window, and before the data of the suspected version is discarded, the method also includes: obtaining the time difference between the starting moment of the current time window and the current moment; if the time difference is less than or equal to the period length of the current time window, obtaining the number of suspected replay attack requests within the current time window.

[0069] If the number of suspected replay attack requests within the current time window is less than or equal to the suspected replay attack threshold, a replay attack has not occurred, and the server uses the regional data within the current time window for updates. If the difference between the start time of the current time window and the current time is less than or equal to the cycle length of the current time window, dynamic regional data updates are still being performed within the current time window. The server determines whether a replay attack has occurred based on the number of suspected replay attack requests within the current window.

[0070] In this embodiment, by obtaining the time difference between the starting time of the current time window and the current time, if the time difference is less than or equal to the cycle time of the current time window, the number of suspected replay attack requests in the current time window is obtained, which can accurately determine whether a replay attack occurs and ensure regional data security.

[0071] In one embodiment, the method further includes: if the duration difference is greater than the period duration of the current time window, taking the data version after the starting point of the current time window as the new starting point version and marking it as a safe version; obtaining a new time window based on the new starting point version, and setting the number of suspected replay attack requests in the current time window minus one as the number of suspected replay attack requests in the new time window.

[0072] If the difference between the starting time of the current time window and the current time is greater than the cycle length of the current time window, the server obtains the data version after the starting time of the current time window and uses this data version as the new starting version, which is a safe version. The server decrements the number of suspected replay attack requests in the current time window by one, minus the number occupied by the starting version of the current time window. The server then starts with the new starting version, obtains a new time window, and sets the number of suspected replay attack requests in the current time window minus one as the number of suspected replay attack requests in the new time window. In the new time window, it again determines whether the number of suspected replay attack requests is greater than the suspected replay attack threshold.

[0073] In this embodiment, if the duration difference is greater than the cycle duration of the current time window, the data version after the starting point of the current time window is used as the new starting point version and marked as a safe version. Then, a new time window is obtained based on the new starting point version, and the number of suspected replay attack requests in the new time window is reduced by one. Replay attack identification is performed again in the new time window to ensure the accuracy of replay attack identification.

[0074] In one embodiment, Figure 4 As shown, a method for counteracting replay attacks in dynamic updates of a DNS server is provided. Taking a client loaded on a terminal and a server as an example, the client generates a local timestamp TS and a one-time password according to the request, and adds them to a message and sends them to the server to perform a DNS dynamic update request. The method includes the following steps:

[0075] Step 1: The DNS server verifies the one-time password and calculates the difference between the local time TR and the client timestamp TS (DeltT=TR-TS), and then proceeds to step 2.

[0076] Step 2: The DNS server compares DeltT, a parameter used to determine the authenticity of the zone file after dynamic update, with t (acceptable latency) set by the local server. If the difference between DeltT and t is less than 0, the process proceeds to Step 3; otherwise, it proceeds to Step 4.

[0077] Step 3: The DNS server believes that this dynamic update is not affected by the replay attack. The DNS server records the zone data of the time window and marks it as a safe version. It updates the version to the starting point of the time window, sets the reference count of the zone to 0, and ends the server process for the dynamic update request.

[0078] Step 4: The DNS server initiates an active probe to the client, calculates the communication time TT required to complete the probe, and proceeds to step 5.

[0079] Step 5: The DNS server determines whether the communication duration TT is greater than the network factor threshold t2 and analyzes the impact of the network environment on the replay attack determination during dynamic updates. If it is less than t2, the network environment has little impact on the replay attack determination, and the process proceeds to Step 6. If it is greater than t2, the network environment may have an impact on the replay attack determination, and the process proceeds to Step 7.

[0080] Step 6: The DNS server determines that this request is a replay attack and directly discards the request without any further processing, and ends the server process for this dynamic update request.

[0081] Step 7: The DNS server determines that this dynamic update may be affected by a replay attack. It records the latest updated zone data version and marks it as a suspect version. The DNS server also increments the number of suspected replay attack requests for this zone data. The process then proceeds to Step 8.

[0082] Step 8: The DNS server determines whether the time difference between the start point of the time window and the current time is greater than the cycle length of the current time window. If so, the process proceeds to step 11. If not, the process proceeds to step 9.

[0083] Step 9: The DNS server determines whether the number of suspected replay attack requests exceeds the suspected replay attack threshold. If so, it assumes that the zone has been affected by a replay attack during that time window and proceeds to step 10. If not, it indicates that the zone has not been affected by a replay attack and the DNS server updates the zone data within that time window as safe data.

[0084] Step 10: The DNS server rolls back the zone data to the starting point of the time window, that is, the last zone data version certified as safe, and then completes the server process for the dynamic update request.

[0085] Step 11: The DNS server updates the version generated by the next request for the secure version at the start of the current time window to the new start version and marks it as a secure version. The DNS server uses the time of this new start version as the start time of the new time window, decrements the number of suspected replay attack requests within the new time window by 1, and then proceeds to Step 9 to determine whether the number of suspected replay attack requests within the time window exceeds the suspected replay attack threshold.

[0086] In this embodiment, the receiver compares the difference between the received timestamp TS and the local time TR as the basis for judging replay attacks. At the same time, the communication time between the current client and the server is obtained through detection to consider the impact of the network environment on the replay attack judgment, and a domain name version management mechanism is established based on the detection results. If multiple requests suspected of replay attacks are received within the time window, the zone data version is rolled back to ensure the security of regional data updates.

[0087] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0088] Based on the same inventive concept, the present application also provides a data dynamic update device for implementing the aforementioned data dynamic update method. The implementation solution provided by this device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more data dynamic update device embodiments provided below can be found in the above-mentioned limitations of the data dynamic update method and will not be repeated here.

[0089] In one embodiment, Figure 5 As shown, a data dynamic update device is provided, comprising: a request receiving module 10, a detection module 20, a marking module 30 and a rollback module 40, wherein:

[0090] The request receiving module 10 is used to receive a dynamic update request for regional data; the dynamic update request carries a timestamp;

[0091] The detection module 20 is configured to send an active detection request and obtain the communication duration required to complete the active detection request if the delay between the local reception time and the timestamp is greater than a preset delay threshold;

[0092] A marking module 30 is configured to determine that the dynamic update request is a suspected replay attack request if the communication duration is greater than the network factor threshold, and mark the updated regional data as a questionable version;

[0093] The rollback module 40 is configured to roll back the regional data to the starting version of the current time window and discard the suspected version of data if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold.

[0094] In one embodiment, the dynamic update request also carries a one-time password. The one-time password is obtained by encrypting the target data and concatenating a random number and then encrypting it again. The target data is used to update the regional data. The detection module is also used to verify the one-time password. If the verification is successful, the delay between the local reception time and the timestamp is obtained.

[0095] In one embodiment, the rollback module 40 is also used to determine that no replay attack has occurred if the delay between the local reception time and the timestamp is less than or equal to a preset delay threshold; update the regional data based on the target data carried in the dynamic update request, and mark the updated regional data as a safe version; and use the safe version as the starting version of the next time window.

[0096] In one embodiment, the rollback module 40 is further configured to determine that a replay attack has occurred if the communication duration is less than or equal to a network factor threshold, and directly discard the current dynamic update request without responding.

[0097] In one embodiment, if the number of suspected replay attack requests within the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window, and before the data of the suspected version is discarded, the marking module 30 is also used to obtain the time difference between the starting moment of the current time window and the current moment; if the time difference is less than or equal to the period length of the current time window, the number of suspected replay attack requests within the current time window is obtained.

[0098] In one embodiment, the marking module 30 is also used to use the data version after the starting point of the current time window as the new starting point version and mark it as a safe version if the time difference is greater than the period length of the current time window; obtain a new time window based on the new starting point version, and set the number of suspected replay attack requests in the current time window minus one as the number of suspected replay attack requests in the new time window.

[0099] Each module in the above-mentioned dynamic data update device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0100] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store dynamically updated area data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for dynamically updating data is implemented.

[0101] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0102] In one embodiment, a computer device is provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: receiving a dynamic update request for regional data; the dynamic update request carries a timestamp; if the delay between the local reception time and the timestamp is greater than a preset delay threshold, sending an active detection request and obtaining the communication duration for completing the active detection request; if the communication duration is greater than a network factor threshold, determining that the dynamic update request is a suspected replay attack request, and marking the updated regional data as a questionable version; if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, rolling back the regional data to the starting version of the current time window, and discarding the data of the questionable version.

[0103] In one embodiment, the dynamic update request involved when the processor executes the computer program also carries a one-time password. The one-time password is obtained by encrypting the target data, concatenating a random number, and then encrypting it again. The target data is used to update the regional data. When the processor executes the computer program, the following steps are also implemented: verifying the one-time password, and if the verification is successful, obtaining the delay between the local reception time and the timestamp.

[0104] In one embodiment, when the processor executes the computer program, it further implements the following steps: if the delay between the local reception time and the timestamp is less than or equal to a preset delay threshold, it is determined that no replay attack has occurred; the regional data is updated based on the target data carried in the dynamic update request, and the updated regional data is marked as a secure version; and the secure version is used as the starting version of the next time window.

[0105] In one embodiment, when the processor executes the computer program, the following steps are further implemented: if the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred, and the current dynamic update request is directly discarded without response.

[0106] In one embodiment, when a processor executes a computer program, if the number of suspected replay attack requests in a current time window is greater than a suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the data of the suspected version is discarded. Before the processor executes the computer program, the processor also implements the following steps: obtaining the duration difference between the starting moment of the current time window and the current moment; if the duration difference is less than or equal to the period duration of the current time window, obtaining the number of suspected replay attack requests in the current time window.

[0107] In one embodiment, when the processor executes the computer program, the following steps are also implemented: if the duration difference is greater than the period duration of the current time window, the data version after the starting point of the current time window is used as the new starting point version and marked as a safe version; a new time window is obtained based on the new starting point version, and the number of suspected replay attack requests in the current time window is reduced by one as the number of suspected replay attack requests in the new time window.

[0108] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: receiving a dynamic update request for regional data; the dynamic update request carries a timestamp; if the delay between the local reception time and the timestamp is greater than a preset delay threshold, sending an active detection request and obtaining the communication duration for completing the active detection request; if the communication duration is greater than a network factor threshold, determining that the dynamic update request is a suspected replay attack request, and marking the updated regional data as a questionable version; if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, rolling back the regional data to the starting version of the current time window, and discarding the data of the questionable version.

[0109] In one embodiment, the dynamic update request involved when the computer program is executed by the processor also carries a one-time password. The one-time password is obtained by encrypting the target data, concatenating a random number, and then encrypting it again. The target data is used to update the regional data. When the computer program is executed by the processor, the following steps are also implemented: verifying the one-time password, and if the verification is successful, obtaining the delay between the local reception time and the timestamp.

[0110] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the delay between the local reception time and the timestamp is less than or equal to a preset delay threshold, it is determined that no replay attack has occurred; the regional data is updated based on the target data carried in the dynamic update request, and the updated regional data is marked as a secure version; and the secure version is used as the starting version of the next time window.

[0111] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred, and the current dynamic update request is directly discarded without response.

[0112] In one embodiment, when a computer program is executed by a processor, if the number of suspected replay attack requests in a current time window is greater than a suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the data of the suspected version is discarded. Before the computer program is executed by the processor, the following steps are also implemented: obtaining the time difference between the starting moment of the current time window and the current moment; if the time difference is less than or equal to the period of the current time window, obtaining the number of suspected replay attack requests in the current time window.

[0113] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the duration difference is greater than the period duration of the current time window, the data version after the starting point of the current time window is used as the new starting point version and marked as a safe version; a new time window is obtained based on the new starting point version, and the number of suspected replay attack requests in the current time window is reduced by one as the number of suspected replay attack requests in the new time window.

[0114] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0115] Receive a dynamic update request for regional data; the dynamic update request carries a timestamp; if the delay between the local reception time and the timestamp is greater than the preset delay threshold, send an active detection request and obtain the communication duration for completing the active detection request; if the communication duration is greater than the network factor threshold, determine that this dynamic update request is a suspected replay attack request, and mark the updated regional data as a questionable version; if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold, roll back the regional data to the starting version of the current time window, and discard the questionable version of the data.

[0116] In one embodiment, the dynamic update request involved when the computer program is executed by the processor also carries a one-time password. The one-time password is obtained by encrypting the target data, concatenating a random number, and then encrypting it again. The target data is used to update the regional data. When the computer program is executed by the processor, the following steps are also implemented: verifying the one-time password, and if the verification is successful, obtaining the delay between the local reception time and the timestamp.

[0117] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the delay between the local reception time and the timestamp is less than or equal to a preset delay threshold, it is determined that no replay attack has occurred; the regional data is updated based on the target data carried in the dynamic update request, and the updated regional data is marked as a secure version; and the secure version is used as the starting version of the next time window.

[0118] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: if the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred, and the current dynamic update request is directly discarded without response.

[0119] In one embodiment, when a computer program is executed by a processor, if the number of suspected replay attack requests in a current time window is greater than a suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the data of the suspected version is discarded. Before the computer program is executed by the processor, the following steps are also implemented: obtaining the time difference between the starting moment of the current time window and the current moment; if the time difference is less than or equal to the period of the current time window, obtaining the number of suspected replay attack requests in the current time window.

[0120] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: if the duration difference is greater than the period duration of the current time window, the data version after the starting point of the current time window is used as the new starting point version and marked as a safe version; a new time window is obtained based on the new starting point version, and the number of suspected replay attack requests in the current time window is reduced by one as the number of suspected replay attack requests in the new time window.

[0121] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0122] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above embodiments merely illustrate several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for dynamically updating data, characterized in that: The method comprises: receiving a dynamic update request for regional data; the dynamic update request carries a timestamp; If the delay between the local reception time and the timestamp is greater than a preset delay threshold, an active detection request is sent and the communication duration for completing the active detection request is obtained; If the communication duration is longer than the network factor threshold, the dynamic update request is determined to be a suspected replay attack request, and the updated regional data is marked as a questionable version; If the number of suspected replay attack requests within the current time window is greater than the suspected replay attack threshold, the regional data is rolled back to the starting version of the current time window and the data of the suspected version is discarded.

2. The method according to claim 1, characterized in that The dynamic update request also carries a one-time password, which is obtained by encrypting target data, adding a random number, and then encrypting it again. The target data is used to update the regional data. The method further includes: The one-time password is verified, and if the verification is successful, a time delay between a local reception time and the timestamp is obtained.

3. The method according to claim 1, characterized in that The method further comprises: If the delay between the local reception time and the timestamp is less than or equal to the preset delay threshold, it is determined that no replay attack has occurred; Updating the regional data based on the target data carried in the dynamic update request, and marking the updated regional data as a safe version; The secure version is used as the starting point version of the next time window.

4. The method according to claim 1, wherein The method further comprises: If the communication duration is less than or equal to the network factor threshold, it is determined that a replay attack has occurred, and the current dynamic update request is directly discarded without responding.

5. The method according to claim 1, wherein If the number of suspected replay attack requests within the current time window is greater than the suspected replay attack threshold, the method further includes: rolling back the regional data to the starting version of the current time window and discarding the suspected version of data. Get the duration difference between the starting time of the current time window and the current time; If the duration difference is less than or equal to the period duration of the current time window, the number of suspected replay attack requests within the current time window is obtained.

6. The method according to claim 5, characterized in that The method further comprises: If the duration difference is greater than the period duration of the current time window, the data version after the starting point of the current time window is used as the new starting point version and marked as a safe version; A new time window is obtained according to the new starting point version, and the number of suspected replay attack requests in the current time window minus one is set as the number of suspected replay attack requests in the new time window.

7. A device for dynamically updating data, characterized in that: The device comprises: A request receiving module, configured to receive a dynamic update request for regional data; the dynamic update request carries a timestamp; A detection module, configured to send an active detection request and obtain a communication duration for completing the active detection request if the delay between the local reception time and the timestamp is greater than a preset delay threshold; a marking module configured to determine that the dynamic update request is a suspected replay attack request if the communication duration is greater than a network factor threshold, and mark the updated regional data as a questionable version; The rollback module is configured to roll back the regional data to the starting version of the current time window and discard the data of the suspected version if the number of suspected replay attack requests in the current time window is greater than the suspected replay attack threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images