Method, device, computer device and computer readable storage medium for application security protection

Abstract

The application provides an application security protection method, device, computer equipment and computer readable storage medium. The application security protection method comprises the following steps: setting a client model white list on a gateway; sending a request by the client to the gateway; performing security verification on a running environment by the client; if the verification fails, the gateway rejects the request sent by the client; if the verification passes, the client judges whether the model is a simulation model; if yes, the client sends an illegal model label; if not, the gateway sends the request to a server for processing; the gateway judges whether the client model of the illegal model label is in the white list; if yes, the gateway sends the request to the server for processing; if not, the gateway rejects the request sent by the client. The application can avoid the misjudgment of the client on the model, avoid the complaint of the user, improve the experience of the user, and has high protection accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method and device for application security protection, computer equipment and computer readable storage medium. BACKGROUND

[0002] With the rapid development of computer and internet technology, more and more application programs of e-commerce and internet platforms need to install a client on a mobile device such as a mobile phone, and then interact with the server of the application program to carry out various businesses. In order to ensure the security of the client information and the normal and safe operation of the e-commerce and internet platform, the application program needs to be protected. At present, a third-party security product such as AhnLab, 360, etc. is usually added to the client application program. Although adding a third-party security product to the client application program can achieve a certain security protection effect, there are the following problems: 1. The protection is based on the code level of the application client, and the application code is easy to be cracked, so the protection effect is poor; 2. It cannot be protected and is easy to be misidentified, for example, some small and rare models are misidentified as emulators, so that the user cannot normally use the application program, resulting in user complaints, and the problem cannot be solved in real time.

[0003] In view of the problems existing in the prior art, it is urgent to provide a method and device for application security protection with high protection accuracy and good protection effect, computer equipment and computer readable storage medium. SUMMARY

[0004] The present application aims to provide a method and device for application security protection with high protection accuracy and good protection effect, computer equipment and computer readable storage medium, which aims to solve one of the above technical problems

[0005] In a first aspect, the present application provides a method for application security protection, comprising: setting a client model white list in a gateway; sending a request for a server by an application client to the gateway; performing security verification on a running environment of the application by the client; if the security verification fails, the gateway rejects the request sent by the client; if the security verification passes, the client further judges whether the model is an emulator; if it is an emulator, the client sends a "illegal model" label to the gateway; if it is not an emulator, the gateway sends the request sent by the client to the server for processing; the gateway judges whether the model of the client with the "illegal model" label is in the client model white list; if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0006] Preferably, the step of the application client sending a request to the server to the gateway further comprises: the application client sending client basic information to the gateway, the client basic information comprising: a download channel of the application client, a model of the client, a version of the application, identity information of a user, and CPU information of the client.

[0007] Preferably, the step of the client judging whether the model is an emulated machine after the step of the application client sending a request to the server to the gateway further comprises: c1, the client checking whether the application is an illegally published application: if yes, the gateway rejects the request sent by the client; if no, the next step is executed; c2, the client checking whether the application has a developer permission: if yes, the gateway rejects the request sent by the client; if no, the next step is executed; c3, the client checking whether the application is installed with illegal software: if yes, the gateway rejects the request sent by the client; if no, the next step is executed; c4, the client judging whether the user is an illegal user: if yes, a "illegal user" label is sent to the gateway, and the next step is executed; if no, the next step is executed; c5, the client judging whether the model is an emulated machine: if it is an emulated machine, the client sends a "illegal model" label to the gateway; if it is not an emulated machine, the gateway sends the request sent by the client to the server for processing.

[0008] Preferably, the step of the gateway setting a client model white list further comprises: the gateway setting a user white list; the step of the gateway judging whether the model of the client with the "illegal model" label is in the client model white list: if yes, the gateway sends the request sent by the client to the server for processing; if no, the step of the gateway rejecting the request sent by the client further comprises: the gateway judging whether the user of the client with the "illegal user" label is in the user white list: if yes, the next step is executed; if no, the gateway rejects the request sent by the client.

[0009] Preferably, before the step of setting the client type white list in the gateway, the method further comprises the steps of: setting a request message encryption algorithm, a key and an encryption rule in the client application and the gateway respectively; the step of sending a request to the server by the application client further comprises the steps of: encrypting the request to the server by the application client according to the request message encryption algorithm, the key and the encryption rule, and sending the encrypted request to the gateway; the step of sending the request sent by the client to the server for processing further comprises the steps of: receiving the encrypted request sent by the client by the gateway, decrypting the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judging whether the decrypted request is valid; if yes, sending the request sent by the client to the server for processing by the gateway; if no, rejecting the request sent by the client by the gateway.

[0010] Preferably, the request comprises a request method, a network address corresponding to the request, a protocol name and a version number, a message header and a message body, and the encryption rule is to encrypt all or part of the network address corresponding to the request, the message header or the message body.

[0011] Preferably, before the step of setting the request message encryption algorithm, the key and the encryption rule in the client application and the gateway respectively, the method further comprises the step of setting a user black list in the gateway; the step of receiving the encrypted request sent by the client, decrypting the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judging whether the decrypted request is valid further comprises the steps of: receiving the encrypted request sent by the client by the gateway, decrypting the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judging whether the decrypted request is valid; if no, rejecting the request sent by the client by the gateway; if yes, further judging whether the user is in the user black list by the gateway; if yes, rejecting the request sent by the client by the gateway; if no, sending the request sent by the client to the server for processing by the gateway.

[0012] In a second aspect, the embodiments of the present application provide an application security protection device, comprising: a model white list module, configured to set a client model white list on a gateway; a sending request module, configured to send a request for a server by an application client to the gateway; a security check module, configured to perform security check on a running environment of the application by the client; if the security check fails, the gateway rejects the request sent by the client; if the security check passes, the client further judges whether the model is a simulation model; if it is a simulation model, the client sends a "illegal model" label to the gateway; if it is not a simulation model, the gateway sends the request sent by the client to the server for processing; a model judging module, configured to judge whether the model of the client with the "illegal model" label is in the client model white list by the gateway; if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0013] In a third aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the application security protection method.

[0014] In a fourth aspect, the embodiments of the present application provide a computer device, comprising: one or more processors; a memory; and one or more computer programs, wherein the processor and the memory are connected through a bus, the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and the processor executes the computer program to implement the steps of the application security protection method.

[0015] The embodiments of the present application first perform security check on the running environment of the application by the client, the security check on the running environment can be the security check of the existing third-party security product, or a security check program on the basic information of the client according to the need, thereby ensuring the security of the running environment of the secure client application, and the protection effect is good.

[0016] When it is found that the running environment of the client application is not secure, the gateway directly rejects the request sent by the client; when it is found that the running environment of the client application is secure, the client further judges whether the model is a simulation model, if it is not a simulation model, the gateway sends the request sent by the client to the server for processing; if it is a simulation model, the client sends a "illegal model" label to the gateway, the gateway judges whether the model of the client with the "illegal model" label is in the client model white list; if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0017] The client model white list set by the gateway is used for judgment, whether the client model of the "illegal model" label is in the client model white list, if in the client model white list, the client application program can also send a request to the server through the gateway, and then access the server. The client model white list is a legal client model with server access permission, which can be set according to the actual business. For example, some newly developed client models, when used at the beginning, the application client will judge them as illegal simulators. In the prior art, if a simulator is found, the request will be directly rejected until the client application installer is upgraded, the running environment security check setting is changed, or the user directly gives up this model and uses other general models for operation. However, the embodiment of the present application can verify the newly developed and marketed client models according to user feedback, and after verification of the legal model, the background personnel can add the client model into the client model white list in time, and then the client model can normally access the server. Therefore, the embodiment of the present application can judge through the client model white list of the gateway, thereby avoiding the misjudgment of the client to the model, avoiding the user's complaint, improving the user's experience, and having high protection accuracy. In addition, the embodiment of the present application rejects the request sent by the client through the gateway, and does not need to authenticate the request of the client through the server, so that the security and reliability are better. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is a flowchart of an application security protection method provided by an embodiment of the present application;

[0019] Figure 2 is a flowchart of an application security protection method provided by an embodiment of the present application, in which the client performs security check on the running environment of the application program: if the security check is not passed, the gateway rejects the request sent by the client; if the security check is passed, the client further judges whether the model is a simulator: if it is a simulator, the client sends a "illegal model" label to the gateway; if it is not a simulator, the gateway sends the request sent by the client to the server for processing;

[0020] Figure 3 is a structural schematic diagram of an application security protection device provided by an embodiment of the present application;

[0021] Figure 4 is a specific structural block diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and beneficial effects of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0023] In order to illustrate the technical scheme of the present application, the following is described by specific embodiments.

[0024] In order to make the purpose, technical scheme and beneficial effects of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0025] In order to illustrate the technical scheme of the present application, the following is described by specific embodiments.

[0026] Please refer to Figure 1 , the flowchart of the application program security protection method provided by an embodiment of the present application, the present embodiment provides an application program security protection method, comprising:

[0027] S101, setting a client model white list in a gateway;

[0028] S102, the application program client sends a request to the server to the gateway;

[0029] S103, the client performs security check on the running environment of the application program: if the security check is not passed, the gateway rejects the request sent by the client; if the security check is passed, the client further judges whether the model is an emulator: if it is an emulator, the client sends an "illegal model" label to the gateway; if it is not an emulator, the gateway sends the request sent by the client to the server for processing;

[0030] S104, the gateway judges whether the model of the client with the "illegal model" label is in the client model white list: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0031] The present embodiment first performs security check on the running environment of the application program by the client, and the security check of the running environment can be the security check of the existing third-party security product, or the security check program of the basic information of the client according to the need, so as to ensure the security of the security client application program running environment, and the protection effect is good.

[0032] When it is found that the running environment of the client application is not safe, the gateway directly rejects the request sent by the client; when it is found that the running environment of the client application is safe, the client further judges whether the model is an emulator, if not, the gateway sends the request sent by the client to the server for processing; if it is an emulator, the client sends a "illegal model" label to the gateway, and the gateway judges whether the model of the client with the "illegal model" label is in the client model whitelist: if yes, the gateway sends the request sent by the client to the server for processing; if not, the gateway rejects the request sent by the client.

[0033] The client model whitelist set by the gateway is used for judgment, that is, whether the model of the client with the "illegal model" label is in the client model whitelist, if yes, the client application can also send a request to the server through the gateway to access the server. The client model whitelist is a legal client model with server access permission, which can be set according to actual business. For example, some newly developed client models are initially judged as illegal emulators by the application client. In the prior art, if an emulator is found, the request will be directly rejected until the client application installer is upgraded, the running environment security check setting is changed, or the user directly gives up this model and uses other general models for operation. However, according to the embodiment of the application, the newly developed and marketed client models can be verified according to user feedback, and after verification, the client model is a legal model, and the background personnel can add the client model into the client model whitelist in time, so that the client model can normally access the server. Therefore, the embodiment of the application can judge through the client model whitelist of the gateway, thereby avoiding the misjudgment of the client on the model, avoiding user complaints, improving user experience, and having high protection accuracy. In addition, the embodiment of the application rejects the request sent by the client through the gateway, and does not need to judge the request of the client through the server, so that the security and reliability are better.

[0034] Preferably, the step of the application client sending a request to the server to the gateway further comprises: the application client sending client basic information to the gateway. Specifically, the client basic information can include: the download channel of the application client, the model of the client, the version of the application, the identity information of the user, the CPU information of the client, and of course, other client basic information that needs to be sent to the gateway. The gateway receives these client basic information to determine the basic situation of the client and provide authentication basis for subsequent gateway security protection.

[0035] Please refer to Figure 2The client of the application security protection method provided in the embodiment of the application performs security verification on the running environment of the application: if the security verification fails, the gateway rejects the request sent by the client; if the security verification passes, the client further judges whether the machine type is an emulator: if it is an emulator, the client sends an "illegal machine type" label to the gateway; if it is not an emulator, the gateway sends the request sent by the client to the server for processing. The client of the application security protection method provided in the embodiment of the application performs security verification on the running environment of the application: if the security verification fails, the gateway rejects the request sent by the client; if the security verification passes, the client further judges whether the machine type is an emulator: if it is an emulator, the client sends an "illegal machine type" label to the gateway; if it is not an emulator, the gateway sends the request sent by the client to the server for processing, comprising the following steps:

[0036] S201, the client verifies whether the application is an illegally published application: if yes, step S207 is performed; if no, step S202 is performed;

[0037] S202, the client verifies whether the application has a developer permission: if yes, step S207 is performed; if no, step S203 is performed;

[0038] S203, the client verifies whether the application is installed with illegal software: if yes, step S207 is performed; if no, step S204 is performed;

[0039] S204, the client judges whether the user is an illegal user: if yes, step S208 is performed; if no, step S205 is performed;

[0040] S205, the client judges whether the machine type is an emulator: if yes, step S209 is performed; if no, step S206 is performed;

[0041] S206, the gateway sends the request sent by the client to the server for processing;

[0042] S207, the gateway rejects the request sent by the client;

[0043] S208, the client sends an "illegal user" label to the gateway, and step S205 is performed;

[0044] S209, the client sends an "illegal machine type" label to the gateway.

[0045] The embodiment of the application checks the running environment of the application program by the client, and specifically includes checking whether the application program is an illegally published application program, checking whether the application program has the developer permission, checking whether the application program is installed with illegal software, and judging whether the user is an illegal user. Of course, the client can set other checking items according to the need to check the running environment of the application program, and thus ensure the security of the client application program.

[0046] The client checking whether the application program is an illegally published application program can effectively avoid the illegally published application program accessing the server. The client application program requires the official software published by the developer, that is, the application program with the official signature. If the application program is illegally published, that is, the application program after illegally re-signing, the illegally published application program accessing the server can steal the data information of the user or the server, perform illegal activities, and thus damage the interests of the user and cause unnecessary loss to the server.

[0047] The client checking whether the application program has the developer permission can effectively avoid the application program with the super client permission accessing the server. The user of the client application program is usually allowed to have the client permission, and the application program has only the unique developer permission, which has the highest system permission, such as starting or stopping a process, deleting or adding a user, adding or disabling hardware, and the like. If the permission of the application program is tampered to be the developer permission, the unfair order grabbing behavior and the like can easily occur, the platform coupons are stolen, the normal operation and fairness of the application program are affected, and the platform or other users of the platform cause inestimable loss.

[0048] The client checking whether the application program is installed with illegal software can effectively avoid the application program installed with illegal software accessing the server. The illegal software usually attacks the server or tampers the program or steals the user information, violently attacks the core service, illegally obtains the core data, affects the normal operation of the application program, and causes inestimable loss to the platform or other users of the platform.

[0049] The client judging whether the user is an illegal user can identify the illegal user, set the "illegal user" label, provide the basis for judging the access permission of the illegal user in the sequence, and effectively avoid the client of the illegal user accessing the server. The illegal user can be defined according to the actual business, for example, can be the user with some input errors of the basic information of the user.

[0050] After the client performs the security check on the running environment of the application, and except for the item that the user judges whether the user is a non-legal user, when other running environments pass the security check, the client judges whether the model is a simulation model. The simulation model is a non-officially released model, which is a mobile device in the test stage and belongs to the non-legal model. The non-legal model is identified, a "non-legal model" label is set, and a basis is provided for the judgment of the access authority of the "non-legal model" in the subsequent sequence.

[0051] Preferably, the step of setting the client model white list at the gateway further comprises: setting a user white list at the gateway;

[0052] Before the step that the gateway judges whether the model of the client with the "non-legal model" label is in the client model white list, and if yes, the gateway sends the request sent by the client to the server for processing, and if not, the gateway rejects the request sent by the client, the step further comprises:

[0053] Before the step that the gateway judges whether the model of the client with the "non-legal model" label is in the client model white list, and if yes, the gateway sends the request sent by the client to the server for processing, and if not, the gateway rejects the request sent by the client, the step further comprises:

[0054] By setting the user white list at the gateway, it is judged whether the user with the "non-legal user" label is in the user white list. If the user is in the user white list, the client application can also send a request to the server through the gateway to access the server. The user white list is a legal user with server access authority, which can be set according to the actual business. The user white list can set users meeting certain conditions in the user white list according to the actual business situation, such as setting users with a certain order volume in a period of time in the user white list. These users may be misjudged as non-legal users when the client judges whether the user is a non-legal user. In the prior art, the requests of these users will be directly rejected, thereby causing unnecessary customer complaints and business losses. However, the embodiment of the application can directly set these users in the user white list, so that these users can also normally access the server. Therefore, the user white list of the gateway in the embodiment of the application can be compared and judged, which can avoid the misjudgment of the user by the client, avoid the complaints of the user, avoid the loss of business, improve the experience of the user, and has high protection accuracy.

[0055] Preferably, before the step of setting the client model white list at the gateway, the step further comprises: setting a corresponding request message encryption algorithm, key and encryption rule at the client application and the gateway, respectively;

[0056] The application program client sends a request to the server to the gateway, specifically including: the application program client encrypts the request to the server according to a request message encryption algorithm, a key and an encryption rule, and sends the encrypted request to the gateway;

[0057] The gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judges whether the decrypted request is valid: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0058] The request message encryption algorithm, the key and the encryption rule are determined, that is, the encryption method of the message is determined, and the encrypted request message can ensure that the sent request message cannot be obtained by other illegal devices, and can also prevent the message from being illegally tampered during transmission.

[0059] The request message encryption algorithm, the key and the encryption rule set by the client application program and the gateway are corresponding, the application program client encrypts the request to the server according to the request message encryption algorithm, the key and the encryption rule, and the gateway can decrypt the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and then judge whether the decrypted request is valid, that is, whether the decrypted request conforms to the logic and whether it conforms to the business rules set by the application program, and further judge whether the request is illegally tampered. If the gateway finds that the decrypted request is illegally tampered, the gateway rejects the request sent by the client, thereby protecting the server and the client of the application program, protecting the data information of the user and the background, and ensuring the security of the application program.

[0060] The request message decryption verification is performed at the gateway, avoiding the risk of easy cracking of the protection only at the code level of the application program client in the prior art, and having good protection effect.

[0061] Specifically, the request usually includes a request method, a network address corresponding to the request, a protocol name and version number, a message header and a message body, and the encryption rule is to encrypt all or part of the content of the network address corresponding to the request or the message header or the message body. That is, the encryption rule can encrypt all or part of the content of the network address corresponding to the request according to needs, or can choose to encrypt all or part of the content of the message header, or can choose to encrypt all or part of the content of the message body, and of course, other parts of the request can also be encrypted according to needs.

[0062] Preferably, the steps of setting the corresponding request message encryption algorithm, key and encryption rule in the client application program and the gateway respectively further comprise: setting a user blacklist in the gateway; the gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judges whether the decrypted request is valid: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0063] Preferably, the steps of setting the corresponding request message encryption algorithm, key and encryption rule in the client application program and the gateway respectively further comprise: setting a user blacklist in the gateway;

[0064] The gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judges whether the decrypted request is valid: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0065] The gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and judges whether the decrypted request is valid: if no, the gateway rejects the request sent by the client; if yes, the gateway further judges whether the user is in the user blacklist: if yes, the gateway rejects the request sent by the client; if no, the gateway sends the request sent by the client to the server for processing.

[0066] The user blacklist can be set according to historical business conditions, for example, some users who have performed illegal operations can be set in the user blacklist.

[0067] The embodiment of the application further judges whether the user is in the user blacklist when judging that the decrypted request is valid according to the gateway, and if the user is in the user blacklist, the gateway rejects the request sent by the client; if the user is not in the user blacklist, the gateway sends the request sent by the client to the server for processing. In this way, illegal users can be prevented from accessing the server, and the security is improved.

[0068] Please refer toFigure 3 An application security protection device 10 comprises:

[0069] A model white list module 11 is configured to set a client model white list at a gateway.

[0070] A sending request module 12 is configured to send a request for a server by an application client to the gateway.

[0071] A security check module 13 is configured to perform security check on a running environment of the application by the client; if the security check fails, the gateway rejects the request sent by the client; if the security check passes, the client further judges whether the model is a simulation model; if the model is a simulation model, the client sends a "illegal model" label to the gateway; if the model is not a simulation model, the gateway sends the request sent by the client to the server for processing.

[0072] A model judgment module 14 is configured to judge, by the gateway, whether the model of the client with the "illegal model" label is in the client model white list; if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

[0073] The application security protection device 10 provided by an embodiment of the present application belongs to the same concept as the application security protection method provided by the above-mentioned embodiments of the present application, and the specific implementation process is described in the full text of the specification, which will not be repeated here.

[0074] An embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the application security protection method provided by the above-mentioned embodiments of the present application.

[0075] Figure 4 The specific structure block diagram of the computer device provided by an embodiment of the present application is shown, a computer device 100 comprises one or more processors 101, a memory 102, and one or more computer programs, wherein the processor 101 and the memory 102 are connected through a bus, the one or more computer programs are stored in the memory 102 and are configured to be executed by the one or more processors 101, and the processor 101 executes the computer program to implement the steps of the application security protection method provided by the above-mentioned embodiments of the present application.

[0076] The computer device can be a desktop computer, a mobile terminal, etc., and the mobile terminal includes a mobile phone, a tablet computer, a notebook computer, a personal digital assistant, etc.

[0077] The embodiment of the application carries out security check on the running environment of the application program by the client, specifically including checking whether the application program is an illegally published application program, checking whether the application program has the developer permission, checking whether the application program is installed with illegal software, and judging whether the user is an illegal user. Of course, the client can set other check items according to the need to carry out security check on the running environment of the application program, and thus ensure the security of the client application program.

[0078] The client checking whether the application program is an illegally published application program can effectively avoid the illegally published application program accessing the server. The client application program requires using the official software published by the developer, that is, the application program with official signature; if it is an illegally published application program, that is, the application program illegally re-signed, the illegally published application program accessing the server can steal the information of the user or the server, carry out illegal activities, and thus damage the interests of the user and cause unnecessary loss to the server.

[0079] The client checking whether the application program has the developer permission can effectively avoid the application program with super client permission accessing the server. The user of the client application program is usually allowed to have only the client permission and the unique developer permission, and the permission has the highest system permission, such as starting or stopping a process, deleting or adding a user, adding or disabling hardware, and the like. If the permission of the application program is tampered to be the developer permission, it will affect the normal running of the application program and cause inestimable loss to the platform or other users of the platform.

[0080] The client checking whether the application program is installed with illegal software can effectively avoid the application program installed with illegal software accessing the server. The illegal software usually attacks the server or tampers the program or steals the user information, and thus affects the normal running of the application program and causes inestimable loss to the platform or other users of the platform.

[0081] The client judging whether the user is an illegal user can identify the illegal user and set the "illegal user" label, and thus provide the basis for judging the access permission of the illegal user in the sequence, and can effectively avoid the client of the illegal user accessing the server. The illegal user can be the user whose input of some basic information is wrong.

[0082] After the client completes the security check on the running environment of the application program, when the other running environments pass the security check except the item of judging whether the user is an illegal user, the client judges whether the model is a simulation model. The simulation model is an unofficially published model and is a mobile device in the test stage, and is an illegal model. The illegal model is identified and the "illegal model" label is set, and thus the basis for judging the access permission of the illegal model in the sequence is provided.

[0083] It should be understood that the various steps in the embodiments of the application need not necessarily be performed in the order indicated in the respective step labels. Unless specifically stated, the execution of the steps need not necessarily be strictly sequential, and the steps can be performed in other orders. Also, at least some of the steps in the embodiments can include multiple sub-steps or stages, which need not necessarily be performed at the same time, but can be performed at different times, and the order of the sub-steps or stages need not necessarily be sequential, but can be performed in rotation or alternation with at least some of the other steps or sub-steps or stages of other steps.

[0084] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing relevant hardware. The program can be stored in a non-volatile computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0085]

[0086] The technical features of the above embodiments can be combined in any manner. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present disclosure.

[0087] ​The above embodiments only express several implementation ways of the present application, and the description is specific and detailed, but it should not be understood as a limitation to the patent scope of the application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. An application security protection method, characterized by, The application comprises the following steps: Setting a client model white list in the gateway, the client model white list is a legal client model with server access permission; The application client sends a request to the server to the gateway; The client performs security check on the running environment of the application: if the security check fails, the gateway rejects the request sent by the client; if the security check passes, the client further judges whether the model is an emulated model: if it is an emulated model, the client sends a "illegal model" label to the gateway; if it is not an emulated model, the gateway sends the request sent by the client to the server for processing; The gateway judges whether the model of the client with the "illegal model" label is in the client model white list: if it is, the gateway sends the request sent by the client to the server for processing; If not, the gateway rejects the request sent by the client.

2. The application security protection method of claim 1, wherein, The step of sending a request to the server to the gateway by the application client further comprises: the application client sends client basic information to the gateway, the client basic information comprising: the download channel of the application client, the model of the client, the version of the application, the identity information of the user, and the CPU information of the client.

3. The application security protection method of claim 2, wherein, The client performs security check on the running environment of the application: if the security check fails, the gateway rejects the request sent by the client; if the security check passes, the client further judges whether the model is an emulated model: if it is an emulated model, the client sends a "illegal model" label to the gateway; If it is not an emulated model, the step of sending the request sent by the client to the server for processing specifically comprises: c1, the client checks whether the application is an illegally published application: if it is, the gateway rejects the request sent by the client; if not, the next step is executed; c2, the client checks whether the application has developer permission: if it does, the gateway rejects the request sent by the client; if not, the next step is executed; c3, the client checks whether the application has installed illegal software: if it does, the gateway rejects the request sent by the client; if not, the next step is executed; c4, the client judges whether the user is an illegal user: if it is, a "illegal user" label is sent to the gateway, and the next step is executed; if not, the next step is executed; c5, the client judges whether the model is an emulated model: if it is an emulated model, the client sends a "illegal model" label to the gateway; if it is not an emulated model, the gateway sends the request sent by the client to the server for processing.

4. The application security protection method of claim 3, wherein The step of setting a client model white list in the gateway further comprises setting a user white list in the gateway; The gateway determines whether the model of the client with the "illegal model" tag is in the client model white list: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway further comprises the following steps before the step of rejecting the request sent by the client: The gateway determines whether the user of the client with the "illegal user" tag is in the user white list: if yes, the next step is performed; if no, the gateway rejects the request sent by the client.

5. The application security protection method of claim 4, wherein, The step of setting the client model white list in the gateway further comprises: Respectively setting corresponding request message encryption algorithm, key and encryption rule in the client application program and the gateway; The step that the application client sends a request to the server further comprises: the application client encrypts the request to the server according to the request message encryption algorithm, the key and the encryption rule, and sends the encrypted request to the gateway; The step that the gateway sends the request sent by the client to the server for processing further comprises: the gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and determines whether the decrypted request is valid: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client.

6. The application security protection method of claim 5, wherein, The request comprises request method, request corresponding network address, protocol name and version number, message header and message body, and the encryption rule is to encrypt all or part of the contents of the request corresponding network address or the message header or the message body.

7. The application security protection method of claim 6, wherein, The step of respectively setting corresponding request message encryption algorithm, key and encryption rule in the client application program and the gateway further comprises: Setting a user black list in the gateway; The step that the gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and determines whether the decrypted request is valid: if yes, the gateway sends the request sent by the client to the server for processing; if no, the gateway rejects the request sent by the client further comprises: The step that the gateway receives the encrypted request sent by the client, decrypts the encrypted request according to the request message encryption algorithm, the key and the encryption rule, and determines whether the decrypted request is valid: if invalid, the gateway rejects the request sent by the client; if valid, the gateway further determines whether the user is in the user black list: if yes, the gateway rejects the request sent by the client; if no, the gateway sends the request sent by the client to the server for processing.

8. An application security device, characterized by, Comprise: A model white list module for setting a client model white list in the gateway, the client model white list being a legal client model with server access authority; A request sending module for sending a request to the server by the application client to the gateway; A user black list module for setting a user black list in the gateway, the user black list being a user with no server access authority. A security check module is configured to perform security check on a running environment of the application by the client, and if the security check fails, the gateway rejects the request sent by the client; if the security check passes, the client further judges whether the client is an emulator, and if yes, the client sends a "illegal model" label to the gateway; if not, the gateway sends the request sent by the client to the server for processing. A model judgment module is configured to judge whether the model of the client sending the "illegal model" label is in the client model white list by the gateway, and if yes, the gateway sends the request sent by the client to the server for processing; if not, the gateway rejects the request sent by the client. The computer program is executed by the processor to realize the steps of the application security protection method according to any one of claims 1 to 7.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8.

10. A computer device, comprising: one or more processors; a memory; and one or more computer programs, the processor and the memory being connected through a bus, wherein the one or more computer programs are stored in the memory and configured to be executed by the one or more processors, and when the processor executes the computer program, the steps of the application security protection method according to any one of claims 1 to 7 are realized. ​

Images