A message verification method and related device

Abstract

The present application discloses a message verification method and related devices, which relate to the field of network security technology. In the present application, a protection device receives a target message sent by a target client and carrying a target growth factor and a factor authentication code; when the target growth factor is determined and the growth factor authentication condition associated with the factor authentication code is met, it is determined that the target message meets the first-level protection requirements, wherein the target message meeting the first-level protection requirements indicates that the target message comes from a normal client. In this way, a growth factor is embedded in the message to record the serial number of the message, which can prevent the attacker from copying normal messages and generating attack traffic. The factor authentication code is embedded in the message to verify the authenticity of the growth factor, which can further prevent the attacker from cracking the growth factor, further improving the accuracy of message verification.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a message verification method and related devices. Background Art

[0002] A distributed denial of service (DDoS) attack occurs when multiple attackers in different locations simultaneously attack one or more target servers, or when a single attacker controls multiple computers in different locations and uses them to simultaneously attack the target servers, rendering them inoperable.

[0003] Replay attacks, also known as replay attacks or playback attacks, refer to an attacker first sniffing and intercepting a message normally received by a target server in the network, and then sending the message to the target server again to achieve the purpose of attacking and deceiving the system.

[0004] A DDoS replay attack is a combination of a DDoS attack and a replay attack. The specific operation is to deploy a packet capture tool on the edge side of the enterprise where the network is transmitted, obtain normal messages in the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) interaction in advance, copy them multiple times, and use the message replay tool to send the copied normal messages to the target server in a short period of time and at a high frequency, causing the target server to exhaust its resources and be unable to respond to service requests initiated by other clients. Because the message comes from the message in the normal interaction process, its source IP, message format and message content can bypass the protection strategy configured by the DDoS protection device, so that the attack traffic can be mistakenly leaked to the server, becoming a new means in the field of DDoS attacks. When a DDoS replay attack is applied to the identity authentication process, it can destroy the correctness of the authentication, which not only affects the normal use of users, but also may cause huge economic losses.

[0005] Under related technologies, the protection technology solutions for replay attacks mainly include the following two:

[0006] Solution 1: Record random numbers

[0007] This scheme requires both parties to remember the random numbers they have used. If either party finds that a message contains a historical random number that has been used, it will consider the message to be a replay attack.

[0008] When using solution 1, both parties need to store previously used random numbers. If the recording period is long, the storage and query overhead is high. Because DDoS attacks typically involve massive influxes of normal and attack packets arriving at the server instantaneously, the number of random numbers that need to be stored reaches a very large magnitude, requiring a significant amount of storage space. Furthermore, searching and matching these random values consumes significant resources, making solution 1 more expensive in this scenario.

[0009] Solution 2: Synchronize serial number

[0010] The specific operation is that the two interacting parties add a gradually increasing integer in the message. As long as either party receives a message with a discontinuous serial number, it is considered that the message has a replay threat.

[0011] When using solution 2, as long as the attacker successfully decrypts the message, he can obtain the serial number. By incrementing the serial number in the attack message, he can achieve the purpose of deceiving the server. On the other hand, in the case of large-scale traffic transmission, there is a possibility of random packet loss due to network quality jitter, and the network transmission line may cause large messages to be fragmented. In these two cases, the serial number of normal messages will not increase, causing solution 2 to fail when deploying the application.

[0012] In view of this, it is necessary to propose a new message verification method to address the above problems. Summary of the Invention

[0013] The present application provides a message verification method and related devices to improve the accuracy of identifying normal messages and attack messages.

[0014] In a first aspect, an embodiment of the present application provides a message verification method, the method comprising:

[0015] receiving a target message sent by a target client and carrying a target growth factor and a factor authentication code, wherein the target growth factor is used to record the sequence number of the target message, and the factor authentication code is used to verify the target growth factor;

[0016] When the target growth factor is determined and the growth factor authentication condition associated with the factor authentication code is met, it is determined that the target message meets the preset first-level protection requirement, wherein the target message meeting the preset first-level protection requirement indicates that the target message comes from a normal client.

[0017] Optionally, determining a target growth factor satisfies a growth factor authentication condition associated with the factor authentication code, including:

[0018] Obtaining an authentication code verification value based on a target growth factor and a preset key;

[0019] If the factor authentication code and the authentication code check value match successfully, the target growth factor is determined and the growth factor authentication condition is met.

[0020] Optionally, after determining that the target message meets the preset first-level protection requirements, the following steps are further included:

[0021] Determine the target port for the target client to send the target message, and determine the historical growth factor carried in the last historical message sent by the target client based on the target port;

[0022] Compare the historical growth factor with the target growth factor to obtain a comparison result;

[0023] When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server; wherein, the target message meeting the preset secondary protection requirement indicates that the target message is a normal message.

[0024] Optionally, when the target client sends a message through the target port, the growth factor carried in each message is obtained by cyclically taking values from 0 to the first set threshold according to the sending order of each message;

[0025] The historical growth factor carried in the previous historical message sent by the target client is compared with the target growth factor to obtain a comparison result, including:

[0026] If the difference between the target growth factor and the historical growth factor is greater than 0 and not greater than the second set threshold, the target message meets the secondary protection requirements;

[0027] If the target growth factor is 0 and the historical growth factor is the first set threshold, it indicates that the target message meets the second-level protection requirements.

[0028] Optionally, before sending the target message to the target server, the following steps are also included:

[0029] Delete the target growth factor and factor authentication code carried in the target message.

[0030] Optionally, also include:

[0031] If the target message does not meet the first-level protection requirements, the target message will be discarded;

[0032] If the target message does not meet the secondary protection requirements, the target message will be discarded.

[0033] In a second aspect, an embodiment of the present application further provides a message verification device, the device comprising:

[0034] a receiving module, configured to receive a target message sent by a target client and carrying a target growth factor and a factor authentication code, wherein the target growth factor is used to record a sequence number of the target message, and the factor authentication code is used to verify the target growth factor;

[0035] The verification module is used to determine whether the target message meets the preset first-level protection requirement when determining the target growth factor and satisfying the growth factor authentication condition associated with the factor authentication code.

[0036] Optionally, when a target growth factor is determined and a growth factor authentication condition associated with the factor authentication code is satisfied, the verification module is configured to:

[0037] Obtaining an authentication code verification value based on a target growth factor and a preset key;

[0038] If the factor authentication code and the authentication code check value match successfully, the target growth factor is determined and the growth factor authentication condition is met.

[0039] Optionally, after determining that the target message meets the preset first-level protection requirements, the verification module is further configured to:

[0040] Determine the target port for the target client to send the target message, and determine the historical growth factor carried in the last historical message sent by the target client based on the target port;

[0041] Compare the historical growth factor with the target growth factor to obtain a comparison result;

[0042] When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server; wherein, the target message meeting the preset secondary protection requirement indicates that the target message is a normal message.

[0043] Optionally, when the target client sends a message through the target port, the growth factor carried in each message is obtained by cyclically taking values from 0 to the first set threshold according to the sending order of each message;

[0044] The historical growth factor carried in the last historical message sent by the target client is compared with the target growth factor. When the comparison result is obtained, the verification module is used to:

[0045] If the difference between the target growth factor and the historical growth factor is greater than 0 and not greater than the second set threshold, the target message meets the secondary protection requirements;

[0046] If the target growth factor is 0 and the historical growth factor is the first set threshold, it indicates that the target message meets the second-level protection requirements.

[0047] Optionally, before sending the target message to the target server, the verification module is further configured to:

[0048] Delete the target growth factor and factor authentication code carried in the target message.

[0049] Optionally, the authentication module is also used to:

[0050] If the target message does not meet the first-level protection requirements, the target message will be discarded;

[0051] If the target message does not meet the secondary protection requirements, the target message will be discarded.

[0052] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the first aspects when executing the computer program.

[0053] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any method described in the first aspect.

[0054] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when called by a computer, enables the computer to execute the method described in the first aspect.

[0055] In an embodiment of the present application, a protection device receives a target message sent by a target client and carrying a target growth factor and a factor authentication code; when the target growth factor is determined and the growth factor authentication condition associated with the factor authentication code is met, it is determined that the target message meets the preset first-level protection requirements, wherein the target message meeting the preset first-level protection requirements indicates that the target message comes from a normal client.

[0056] In this way, a growth factor is embedded in the message to record the message serial number, which can prevent the attacker from copying normal messages and generating attack traffic. A factor authentication code is embedded in the message to verify the authenticity of the growth factor, which can further prevent the attacker from cracking the growth factor and further improve the accuracy of message verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a diagram of message transmission in a normal interaction scenario;

[0058] Figure 2 This is a diagram of packet transmission in a DDoS replay attack scenario;

[0059] Figure 3 This is a schematic diagram of the system architecture in the embodiment of this application;

[0060] Figure 4This is a detailed flow chart of message verification under the system architecture in the embodiment of this application;

[0061] Figure 5 This is a schematic diagram of the structure of message p in an embodiment of the present application;

[0062] Figure 6 This is a detailed flow chart for verifying that a message meets the preset secondary protection requirements in an embodiment of the present application;

[0063] Figure 7 This is a detailed flowchart of message verification in the first application scenario provided in the embodiment of this application;

[0064] Figure 8 This is a detailed flowchart of message verification in the second application scenario provided in the embodiment of the present application;

[0065] Figure 9 This is a detailed flowchart of message verification in the third application scenario provided in the embodiment of this application;

[0066] Figure 10 A schematic diagram of a scenario in which a protection device performs message verification according to an embodiment of the present application;

[0067] Figure 11 This is a structural diagram of a message verification device in an embodiment of the present application;

[0068] Figure 12 This is a structural diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0069] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of the technical solutions of this application, but not all of them. Based on the embodiments described in this application document, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the technical solutions of this application.

[0070] The following is an introduction to some concepts involved in the embodiments of this application.

[0071] (1) Hash-based Message Authentication Code (HMAC): An algorithm based on a hash function and a key, which uses the output as an authenticator to authenticate messages of variable length.

[0072] (2) Shared key: A specified value agreed upon by the client and the protection device. The shared key is used to obtain an authentication code, enabling the receiver to authenticate that the source of the data is the same as claimed, that is, to reliably confirm that the received message is the same as the one sent.

[0073] (3) Protection device: An intermediate protection device in the communication process between the client and the server, used to protect against DDoS replay attacks. Its protection function is controlled by a switch. When the switch is turned on, the protection function of the message sent by the client to the server can be verified and judged. The message that passes the verification is then forwarded to the server.

[0074] In normal interaction scenarios, see Figure 1 As shown, the transmission messages are sent from the client in a predetermined order and transmitted to the server in sequence. In the DDoS replay attack scenario, refer to Figure 2 As shown in the figure, the attacker first obtains a normal message in the transmission process through sniffing or other means in the network, making preliminary preparations for attacking the server. Then, through the network attack, it copies m normal messages in sequence and sends them to the server at the same time, forming DDoS replay attack traffic.

[0075] Since the attack message is copied from a normal message, the Internet Protocol Address (IP address) of the attack message is also the client's real source IP address. Therefore, common DDoS protection technologies and equipment cannot identify and filter attack messages, making replay attacks difficult to protect against.

[0076] In summary, this solution designs a new message verification method that can solve the following core problems:

[0077] 1. Quickly and effectively identify and discard replay attack packets;

[0078] 2. Prevent attackers from cracking and forging the growth factor field;

[0079] 3. Prevent normal messages from being misjudged when the growth factor is at the flipping boundary;

[0080] 4. Prevent normal packets from being misjudged due to the growth factor caused by network quality jitter;

[0081] 5. Prevent normal messages from being misjudged due to the fact that the growth factor is not carried when the message is fragmented due to transmission link limitations.

[0082] The preferred implementation methods of the present application are described in detail below with reference to the accompanying drawings.

[0083] See Figure 3As shown, in an embodiment of the present application, there are three main parts: a target client 300, a protection device 301 and a target server 302. Among them, the client 300 sends a target message carrying a target growth factor and a factor authentication code to the protection device 301. The protection device 301 first determines the sending port of the target message, and then obtains the authentication code verification value based on the target growth factor and the shared key, and matches it with the factor authentication code. When the match is successful, the protection device 301 verifies the target growth factor. If the target growth factor is compared with the historical growth factor carried in the previous historical message sent by the client 300 and meets the preset message rules, the protection device 301 deletes the target growth factor and factor authentication code in the target message, and sends the target message to the server 302.

[0084] Based on the above system architecture, see Figure 4 As shown, in the embodiment of the present application, the detailed process of the protection device performing message verification is as follows:

[0085] Step 401: Receive a target message sent by a target client, which carries a target growth factor and a factor authentication code.

[0086] The target growth factor is used to record the sequence number of the target message, and the factor authentication code is used to verify the target growth factor.

[0087] Assume that client A sends a message p to the protection device and continuously embeds a 4-byte growth factor M after the Transmission Control Protocol (TCP) message format header used in the transport layer. n And the 4-byte factor authentication code w, after the protection device receives the message p, it extracts the last 4 bytes of the TCP header of the message p to obtain the growth factor M n , and extract bytes 5 to 8 of message p to obtain the factor authentication code w.

[0088] Step 402: When the target growth factor is determined and the growth factor authentication condition associated with the factor authentication code is satisfied, it is determined that the target message meets the preset first-level protection requirement.

[0089] The target message meeting the preset first-level protection requirement indicates that the target message comes from a normal client.

[0090] Specifically, in an embodiment of the present application, an authentication code verification value is obtained based on the target growth factor and a preset key. If the factor authentication code and the authentication code verification value match successfully, the target growth factor is determined and the growth factor authentication condition is met.

[0091] For example, see Figure 5 As shown, the protective equipment will increase by a factor of M nThe 4-byte shared key is XORed and then a dynamic value is calculated using the HMAC algorithm, namely the authentication code check value. The calculation formula is as follows:

[0092] Authentication code check value (4 bytes) = HMAC (shared key (4 bytes) ∧ growth factor (4 bytes));

[0093] The authentication code check value is matched with the factor authentication code w. If the two are equal, the target growth factor is determined and the growth factor authentication condition is met.

[0094] For further information, see Figure 6 As shown in the figure, after determining that the target message meets the preset first-level protection requirements, the protection device will also perform the following steps:

[0095] Step 601: Determine the target port through which the target client sends the target message, and determine the history growth factor carried in the last history message sent by the target client according to the target port.

[0096] For example, multiple sessions are established between client A and server B, and they communicate through different ports. Therefore, the protection device will detect the messages of multiple sessions at the same time and use the source IP and source port of each session as the unique identifier of the session, so that subsequent protection judgments can be made based on the order of the same session.

[0097] The protection device determines that the target port of the message sent by client A is port a, and then determines the sending order of message p in the session to which it belongs. At the same time, it obtains the historical growth factor M carried in the previous historical message sent by client A through port a. n-1 .

[0098] Furthermore, in an embodiment of the present application, when the target client sends a message through the target port, the growth factor carried in each message is obtained by cyclically taking values from 0 to a first set threshold according to the sending order of each message.

[0099] For example, when client A is communicating with server B through port a, the growth factor carried in the first message sent is 0, the growth factor carried in the second message is 1, and so on. When it increases to 2, 32 When -1, the value of the growth factor carried by the next message is flipped to 0, that is, the value range of the growth factor is [0, 2 32 -1], where 2 32 -1 is the first set threshold.

[0100] Step 602: Compare the historical growth factor with the target growth factor to obtain a comparison result.

[0101] Specifically, in the embodiment of the present application, the comparison result of the historical growth factor and the target growth factor includes the following two situations:

[0102] Case 1: If the difference between the target growth factor and the historical growth factor is greater than 0 and not greater than the second set threshold, it indicates that the target message meets the secondary protection requirements.

[0103] For example, when the growth factor M carried by the message p n Subtract the historical growth factor M n-1 When the difference is greater than 0 and less than or equal to 3, it represents the growth factor M n Comply with the preset message rules, that is, M n -M n-1 =k, 0<k≤3, the protection device determines that the message p meets the secondary protection requirements, where 3 is the second set threshold.

[0104] Furthermore, if k = 1, then the growth factor M n is the normal sequence number of message p. If 1<k≤3, it indicates that there is network quality jitter. For example, network congestion causes the data packet buffer to be full, which leads to one or two messages being discarded before the protection device receives message p. At this time, although the growth factor M n It is not the normal sequence number of message p, but the protection device still determines that message p meets the secondary protection requirements.

[0105] Case 2: If the target growth factor is 0 and the historical growth factor is the first set threshold, it indicates that the target message meets the second-level protection requirements.

[0106] For example, if the growth factor M n =0, and the historical growth factor M n-1 =2 32 -1, then represents the growth factor M n At the boundary digital flip, the protection device determines that the message p meets the secondary protection requirements.

[0107] Based on what is described in step 602, in addition to judging the messages carrying normal sequence numbers as normal messages, the messages whose growth factors increase by no more than 3, and the messages whose growth factors are on the flipping boundary, are judged as normal messages, which can reduce the misjudgment rate of the protection equipment in identifying messages.

[0108] In addition, due to the limitations of the transmission link, overly large messages will be fragmented during transmission. The protection device in the embodiment of the present application, after determining that the first fragment message is a normal message based on the growth factor and factor authentication code carried in the first fragment message, will continuously pass the next message based on the fragment identifier in the first fragment message to prevent subsequent fragment messages from being mistakenly killed due to the lack of embedded growth factor and factor authentication code.

[0109] Step 603: When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server.

[0110] The target message meeting the preset second-level protection requirement indicates that the target message is a normal message.

[0111] Specifically, in an embodiment of the present application, before the protection device sends the target message to the target server, it deletes the target growth factor and factor authentication code carried in the target message.

[0112] For example, after the protection device determines that the message p meets the secondary protection requirements, it will increase the factor M n The factor authentication code w is deleted from the message p and then forwarded to the server B.

[0113] In another embodiment, if the target message does not meet the first-level protection requirement or does not meet the second-level protection requirement, the protection device discards the target message.

[0114] For example, if the protection device executes step 402, the growth factor M carried by the message p n , and the authentication code check value calculated with the shared key is not equal to the factor authentication code w carried in the message p, then the protection device determines that the message p is an attack message, directly discards it, and no longer executes subsequent steps.

[0115] For another example, if the protection device executes step 602, the growth factor M carried by the message p is n ≠2 32 -1, and M n -M n-1 =k, k<0 or k>3, the protection device determines that the message p is an attack message and discards it.

[0116] Based on step 603, the protection device deletes the growth factor and factor authentication code carried in the message before sending it to the server, so that the server is completely unaware of the protection process and can perform business message parsing normally.

[0117] In another optional embodiment, in a DDoS replay attack scenario, the protection device executes the above-mentioned message verification method, only sends messages that meet both the first-level protection requirements and the second-level protection requirements to the server, and discards other messages, thereby achieving protection against DDoS replay attacks.

[0118] In summary, embedding a sequentially increasing growth factor in the message can prevent attackers from duplicating normal messages to generate attack traffic. At the same time, setting a factor authentication code to verify the growth factor can further prevent attackers from cracking the growth factor and forging attack messages into normal messages.

[0119] The above embodiment is further described in detail below through specific application scenarios.

[0120] Scenario 1: See Figure 7 As shown in the figure, when client C sends a normal message k to server D through port c, the specific process of message verification performed by the protection device is as follows:

[0121] Step 701: Receive a message from client C containing a growth factor k. n and factor authentication code w k Message k.

[0122] At the same time, the protection device determines that the port that sent the message k is port c, and then determines that the historical growth factor carried in the previous historical message sent by the client through port c is k. n-1 .

[0123] Step 702: Based on the growth factor k n and shared key, obtain the authentication code verification value g k , and the factor authentication code w k to match.

[0124] The matching result is g k =w k .

[0125] Step 703: The historical growth factor k carried in the last historical message sent by client C is n-1 With growth factor k n Make a comparison.

[0126] The comparison result is k n -k n-1 =1.

[0127] Step 704: Delete the growth factor k in message k n and factor authentication code w k And send message k to server D.

[0128] Scenario 2: See Figure 8 As shown in the figure, when client E is controlled by attacker X and sends attack message t to server D, the specific process of message verification performed by the protection device is as follows:

[0129] Step 801: Receive a message sent by the attacking end X controlling the client E to carry the growth factor t n and factor authentication code w t Message t.

[0130] At the same time, the protection device determines that the port that sent the message t is port e, and then determines that the historical growth factor carried in the previous historical message sent by the client through port e is tn-1 .

[0131] Step 802: Based on the growth factor t n and shared key, obtain the authentication code verification value g t , and the factor authentication code w t to match.

[0132] The matching result is g t =w t .

[0133] Step 803: The historical growth factor t carried in the last historical message sent by client E is n-1 With t n Make a comparison.

[0134] The comparison result is t n-1 =t n .

[0135] Step 804: discard message t.

[0136] Scenario 3: See Figure 9 As shown in the figure, when attacker X forges a message x and sends it to server D, the protection device verifies the message. The specific process for implementing DDoS replay attack protection is as follows:

[0137] Step 901: Receive a message from the attacker X containing a growth factor x. n and factor authentication code x x Message x.

[0138] Step 902: Based on the growth factor x n and shared key, obtain the authentication code verification value g x , and the factor authentication code x x to match.

[0139] The matching result is g x ≠x k .

[0140] Step 903: discard message x.

[0141] Based on the above three scenarios, Figure 10 Schematic diagram of the scenario of message verification for protection equipment:

[0142] After message k is sent to the protection device for identification, the protection device determines that it is a normal message and therefore sends it to the server. Regardless of whether message t is sent by a normal client controlled by the attacker or message x is forged and sent by the attacker, after being identified by the protection device, it is accurately determined to be an attack message and discarded, thus preventing the server from being attacked by traffic.

[0143] Based on the same technical concept, see Figure 11 As shown, the embodiment of the present application also provides a message verification device, which includes:

[0144] The receiving module 1101 is configured to receive a target message sent by a target client and carrying a target growth factor and a factor authentication code, wherein the target growth factor is used to record the sequence number of the target message, and the factor authentication code is used to verify the target growth factor;

[0145] The verification module 1102 is configured to determine whether the target message meets a preset first-level protection requirement when determining that the target growth factor meets a growth factor authentication condition associated with the factor authentication code.

[0146] Optionally, when the target growth factor is determined and a growth factor authentication condition associated with the factor authentication code is satisfied, the verification module 1102 is configured to:

[0147] Obtaining an authentication code verification value based on a target growth factor and a preset key;

[0148] If the factor authentication code and the authentication code check value match successfully, the target growth factor is determined and the growth factor authentication condition is met.

[0149] Optionally, after determining that the target message meets the preset first-level protection requirement, the verification module 1102 is further configured to:

[0150] Determine the target port for the target client to send the target message, and determine the historical growth factor carried in the last historical message sent by the target client based on the target port;

[0151] Compare the historical growth factor with the target growth factor to obtain a comparison result;

[0152] When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server; wherein, the target message meeting the preset secondary protection requirement indicates that the target message is a normal message.

[0153] Optionally, when the target client sends a message through the target port, the growth factor carried in each message is obtained by cyclically taking values from 0 to the first set threshold according to the sending order of each message;

[0154] The historical growth factor carried in the last historical message sent by the target client is compared with the target growth factor. When the comparison result is obtained, the verification module 1102 is used to:

[0155] If the difference between the target growth factor and the historical growth factor is greater than 0 and not greater than the second set threshold, the target message meets the preset secondary protection requirements;

[0156] If the target growth factor is 0 and the historical growth factor is the first set threshold, it indicates that the target message meets the preset secondary protection requirements.

[0157] Optionally, before sending the target message to the target server, the verification module 1102 is further configured to:

[0158] Delete the target growth factor and factor authentication code carried in the target message.

[0159] Optionally, the verification module 1102 is further configured to:

[0160] If the target message does not meet the preset first-level protection requirements, the target message will be discarded;

[0161] If the target message does not meet the preset secondary protection requirements, the target message will be discarded.

[0162] Based on the same technical concept, an embodiment of the present application also provides an electronic device, which can implement the method flow of message verification provided in the above embodiment of the present application.

[0163] In one embodiment, the electronic device may be a server, or a terminal device or other electronic device.

[0164] See Figure 12 As shown, the electronic device may include:

[0165] At least one processor 1201, and a memory 1202 connected to at least one processor 1201. The specific connection medium between the processor 1201 and the memory 1202 is not limited in the embodiment of the present application. Figure 12 In the example, the processor 1201 and the memory 1202 are connected via the bus 1200. Figure 12 The bus 1200 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 12 The diagram is represented by only one thick line, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 1201 may also be referred to as a controller, without limitation to the name.

[0166] In the embodiment of the present application, the memory 1202 stores instructions that can be executed by at least one processor 1201. The at least one processor 1201 can execute a message verification method discussed above by executing the instructions stored in the memory 1202. The processor 1201 can implement Figure 11 The functions of each module in the device shown.

[0167] Among them, the processor 1201 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 1202 and calling data stored in the memory 1202, the various functions of the device and processing data.

[0168] In one possible design, processor 1201 may include one or more processing units. Processor 1201 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into processor 1201. In some embodiments, processor 1201 and memory 1202 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0169] Processor 1201 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of a message verification method disclosed in conjunction with the embodiments of this application can be directly implemented as a hardware processor, or can be implemented using a combination of hardware and software modules in the processor.

[0170] Memory 1202 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1202 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Memory 1202 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1202 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0171] By designing and programming the processor 1201, the code corresponding to the message verification method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 4 The steps of a message verification method in the embodiment shown are as follows: How to design and program the processor 1201 is a technique well known to those skilled in the art and will not be described in detail here.

[0172] Based on the same inventive concept, an embodiment of the present application further provides a storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer executes a message verification method discussed above.

[0173] In some possible implementations, various aspects of a message verification method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a message verification method according to various exemplary implementations of the present application described above in this specification.

[0174] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, depending on the embodiment of the application, the features and functions of two or more units described above can be embodied in a single unit. Conversely, the features and functions of a single unit described above can be further divided and embodied by multiple units.

[0175] Furthermore, although the operations of the method of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0176] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0177] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0178] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0180] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A message verification method, characterized in that: include: receiving a target message sent by a target client and carrying a target growth factor and a factor authentication code, wherein the target growth factor is used to record a sequence number of the target message, and the factor authentication code is used to verify the target growth factor; When the target growth factor is determined to satisfy a growth factor authentication condition associated with the factor authentication code, determining that the target message satisfies a preset first-level protection requirement, wherein the target message satisfying the preset first-level protection requirement indicates that the target message comes from a normal client; After determining that the target message meets the preset first-level protection requirement, the method further includes: Determine a target port through which the target client sends the target message, and determine, based on the target port, a historical growth factor carried in a previous historical message sent by the target client; Comparing the historical growth factor with the target growth factor to obtain a comparison result; When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server; wherein, the target message meeting the preset secondary protection requirement indicates that the target message is a normal message.

2. The method according to claim 1, wherein The determining the target growth factor to satisfy a growth factor authentication condition associated with the factor authentication code includes: Obtaining an authentication code verification value based on the target growth factor and a preset key; If the factor authentication code successfully matches the authentication code check value, the target growth factor is determined, and the growth factor authentication condition is satisfied.

3. The method according to claim 1, wherein When the target client sends a message through the target port, the growth factor carried in each message is obtained by cyclically taking values from 0 to the first set threshold according to the sending order of each message; Then, the historical growth factor carried in the last historical message sent by the target client is compared with the target growth factor to obtain a comparison result, including: If the difference between the target growth factor and the historical growth factor is greater than 0 and not greater than a second set threshold, it indicates that the target message meets the second-level protection requirement; If the target growth factor is 0 and the historical growth factor is the first set threshold, it indicates that the target message meets the second-level protection requirement.

4. The method according to claim 3, wherein Before sending the target message to the target server, the method further includes: The target growth factor and the factor authentication code carried in the target message are deleted.

5. The method according to claim 3, wherein Also includes: If the target message does not meet the first-level protection requirement, discard the target message; If the target message does not meet the secondary protection requirement, the target message is discarded.

6. A DDoS replay attack protection method, characterized in that: include: Execute the message verification method according to any one of claims 1 to 5 to protect against DDoS replay attacks.

7. A message verification device, characterized in that: include: a receiving module, configured to receive a target message sent by a target client and carrying a target growth factor and a factor authentication code, wherein the target growth factor is used to record a sequence number of the target message, and the factor authentication code is used to verify the target growth factor; a verification module, configured to determine that the target message meets a preset first-level protection requirement when determining that the target growth factor satisfies a growth factor authentication condition associated with the factor authentication code; The verification module is further configured to determine a target port through which the target client sends the target message, and determine, based on the target port, a historical growth factor carried in a previous historical message sent by the target client; Comparing the historical growth factor with the target growth factor to obtain a comparison result; When the comparison result indicates that the target message meets the preset secondary protection requirement, the target message is sent to the target server; wherein, the target message meeting the preset secondary protection requirement indicates that the target message is a normal message.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images