HTTP request smuggling defense method and device, medium

Abstract

The application relates to the field of network security, and discloses an HTTP request smuggling defense method and device and a medium, which comprise the following steps: obtaining a first data packet of an input front-end server; when the working state of the front-end server meets preset conditions, obtaining a second data packet corresponding to the first data packet and received by a back-end server, so as to subsequently judge whether the data packets obtained by the front-end server and the back-end server are the same; checking the first data packet and the second data packet to judge whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, it is determined that the server system is safe; and if the first data packet and the second data packet are inconsistent, it is determined that HTTP request smuggling exists. The application judges whether the data packets obtained by the front-end server and the back-end server are the same by checking the first data packet and the second data packet, thereby improving the security of user information and improving user experience.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and particularly relates to an HTTP request smuggling defense method and device and a medium. BACKGROUND

[0002] In order to improve the security of the server, more and more individuals or companies choose to use reverse proxy or CDN architecture. With the development of Internet technology, the security problems of reverse proxy architecture and CDN have gradually been valued by users. Among them, HTTP request smuggling is one of the problems that appear.

[0003] HTTP request smuggling refers to that, under the reverse proxy or CDN architecture, the front-end server is responsible for receiving user requests and security control, and after processing, the allowed requests are forwarded to the back-end server, and the back-end server unconditionally believes that all the requests forwarded by the front-end server are allowed, and responds to each request. However, the front-end server and the back-end server do not implement the RFC standard in the same way, so that the attacker can smuggle the request that cannot be accessed to the back-end server to obtain the response. This vulnerability takes advantage of the inconsistent definition of data packet boundaries between the front-end server and the back-end server, inserts the content of the previous data packet into the next data packet, which may cause user or administrator account theft, information leakage and other hazards.

[0004] Therefore, how to provide an HTTP request smuggling defense method to improve the security of user information is a problem that needs to be solved by those skilled in the art. SUMMARY

[0005] The purpose of the present application is to provide an HTTP request smuggling defense method to improve the security of user information.

[0006] To solve the above technical problems, the present application provides an HTTP request smuggling defense method, comprising:

[0007] obtaining a first data packet input into the front-end server;

[0008] when the working state of the front-end server meets the preset condition, obtaining a second data packet corresponding to the first data packet received by the back-end server;

[0009] verifying the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent;

[0010] if the first data packet and the second data packet are consistent, it is determined that the server system is safe;

[0011] if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling.

[0012] Preferably, the preset condition is that:

[0013] The front-end server sends the first data packet to the back-end server.

[0014] Preferably, after the step of obtaining the first data packet input to the front-end server, the method further comprises:

[0015] obtaining IP information of the server sending the first data packet;

[0016] determining whether the IP information is an abnormal IP;

[0017] if the IP information is an abnormal IP, discarding the first data packet;

[0018] if the IP information is not an abnormal IP, performing the step of obtaining a second data packet corresponding to the first data packet and received by the back-end server when the working state of the front-end server meets the preset condition.

[0019] Preferably, the first data packet and the second data packet are obtained by using a plug-in probe technology, and the first data packet and the second data packet are verified.

[0020] Preferably, the verification of the first data packet and the second data packet comprises:

[0021] calculating a first MD5 value of the first data packet and a second MD5 value of the second data packet;

[0022] determining whether the first MD5 value and the second MD5 value are consistent.

[0023] Preferably, after the step of determining that the server system is secure, the method further comprises:

[0024] controlling the back-end server to process the second data packet.

[0025] Preferably, after the step of determining that there is HTTP request smuggling, the method further comprises:

[0026] sending an alarm information to a manager.

[0027] To solve the above technical problems, the application further provides an HTTP request smuggling defense device, comprising:

[0028] a first obtaining module configured to obtain a first data packet input to a front-end server;

[0029] a second obtaining module configured to obtain a second data packet corresponding to the first data packet and received by a back-end server when a working state of the front-end server meets a preset condition.

[0030] a checking module configured to check the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent;

[0031] if the first data packet and the second data packet are consistent, it is determined that the server system is safe;

[0032] if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling.

[0033] To solve the above technical problems, the present application further provides an HTTP request smuggling defense device, comprising a memory for storing a computer program;

[0034] a processor configured to execute the computer program to implement the steps of the HTTP request smuggling defense method.

[0035] To solve the above technical problems, the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the HTTP request smuggling defense method.

[0036] The present application provides an HTTP request smuggling defense method, comprising: obtaining a first data packet of an input front-end server; when a working state of the front-end server meets a preset condition, obtaining a second data packet corresponding to the first data packet received by a back-end server, so as to subsequently determine whether the data packets obtained by the front-end server and the back-end server are the same; checking the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, it is determined that the server system is safe; and if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling. It can be seen that the technical solution provided by the present application checks the first data packet and the second data packet to determine whether the data packets obtained by the front-end server and the back-end server are the same, thereby improving the security of user information and improving user experience.

[0037] In addition, the present application further provides an HTTP request smuggling defense device and medium, which correspond to the above HTTP request smuggling defense method and have the same effects. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application, the drawings required in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0039] Figure 1 A flowchart of an HTTP request smuggling defense method provided by an embodiment of the present application;

[0040] Figure 2 A schematic diagram of an HTTP request smuggling defense system model provided by an embodiment of the present application;

[0041] Figure 3 A structural diagram of an HTTP request smuggling defense device provided by an embodiment of the present application;

[0042] Figure 4 A structural diagram of another HTTP request smuggling defense device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0044] The core of the present application is to provide an HTTP request smuggling defense method, device and medium to improve the security of user information.

[0045] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0046] Figure 1 A flowchart of an HTTP request smuggling defense method provided by an embodiment of the present application is shown in FIG. 1, and the HTTP request smuggling defense method provided by the present application includes: Figure 1

[0047] S10: obtaining a first data packet input to the front-end server;

[0048] S11: when the working state of the front-end server meets a preset condition, obtaining a second data packet corresponding to the first data packet and received by a back-end server;

[0049] S12: checking the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent;

[0050] S121: if the first data packet and the second data packet are consistent, determining that the server system is safe;

[0051] ​S122: If the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling.

[0052] In a specific implementation, the data input by the user is first transmitted to the front-end server, and then sent by the front-end server to the back-end server for processing. During the data transmission process, the specific implementation of the RFC standard of the front-end server and the back-end server may be inconsistent, so that an attacker can smuggle abnormal access requests to the back-end server, resulting in data leakage. In order to solve this problem, the technical solution provided by the present application verifies the data packets obtained by the front-end server and the back-end server to determine whether changes have occurred in the data packets during the process of sending the data packets from the front-end server to the back-end server. If changes have occurred, it indicates that there is HTTP request smuggling.

[0053] It can be understood that the first data packet and the second data packet can be verified by the parameters in the data packet, or the characteristic values of the first data packet and the second data packet can be calculated, which is not limited here.

[0054] In a specific implementation, all data packets sent by the front-end server can be verified, or data packets can be randomly selected for verification, or only data packets sent to the front-end server by a preset IP address can be verified, which is not limited here.

[0055] It can be understood that, in order to ensure the integrity of the original program logic and reduce the manpower and material resources consumed in the HTTP request smuggling defense process, the first data packet and the second data packet can be obtained by means of insertion.

[0056] The embodiment provides an HTTP request smuggling defense method, which comprises: obtaining a first data packet input to a front-end server; when a working state of the front-end server meets a preset condition, obtaining a second data packet corresponding to the first data packet and received by a back-end server, so as to subsequently determine whether the data packets obtained by the front-end server and the back-end server are the same; verifying the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, it is determined that the server system is safe; and if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling. It can be seen that the technical solution provided by the present application verifies the first data packet and the second data packet to determine whether the data packets obtained by the front-end server and the back-end server are the same, thereby improving the security of user information and improving user experience.

[0057] In a specific implementation, all data packets sent by the front-end server can be verified, or data packets can be randomly selected for verification, or only data packets sent to the front-end server by a preset IP address can be verified, which is not limited here.

[0058] On the basis of the above-mentioned embodiments, the security of all data packets is checked in this embodiment, and the preset condition is that the front-end server sends the first data packet to the back-end server. After the front-end server sends any data packet to the back-end server, the data packet and the data packet corresponding to the data packet obtained by the front-end server are checked.

[0059] Further, in order to reduce the workload of the server system, the data packets can also be screened in advance according to the IP information of the server sending the data packet. If the IP information of the server sending the data packet is an abnormal IP, the data packet is discarded, and an alarm information is sent to the administrator. If it is not an abnormal IP, the subsequent steps are normally executed.

[0060] In specific implementation, in order to ensure the integrity of the original program logic, the information generated during the program running can be collected by using the probe insertion technology.

[0061] On the basis of the above-mentioned embodiments, the first data packet and the second data packet are obtained by using the probe insertion technology, and the first data packet and the second data packet are checked.

[0062] In specific implementation, by inserting a code segment at a specific position in the program, the dynamic context information during the program running is collected to obtain the first data packet and the second data packet, and the first data packet and the second data packet are checked to determine whether the data packets obtained by the front-end server and the back-end server are consistent.

[0063] It can be understood that the purpose of checking the first data packet and the second data packet is to determine whether the first data packet and the second data packet are consistent. If they are consistent, it means that there is no HTTP access smuggling in the transmission process of the data packet. The way to determine whether the data packets are consistent can be to determine by parameters or to determine by characteristic values of the data packets. When determining by parameters, the parameters to be checked need to be determined according to different types of data packets, for example, when the data packet is user login data, the parameters to be checked are the login name and password in the data packet. When determining by characteristic values of the data packets, the MD5 value of the data packet can be calculated. By comparing whether the MD5 values of the first data packet and the second data packet are consistent, it is determined whether the first data packet and the second data packet are consistent. The latter scheme is more accurate and easier to implement, so the way of comparing MD5 values is selected to check the first data packet and the second data packet in this application file.

[0064] Based on the above embodiments, to improve server security and verification speed, the verification of the first data packet and the second data packet includes: calculating the first MD5 value of the first data packet and the second MD5 value of the second data packet; and determining whether the first MD5 value and the second MD5 value are consistent. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value to ensure the integrity and consistency of transmitted information. Alternatively, other verification algorithms can be used to verify the consistency of the first data packet and the second data packet; no limitation is made here.

[0065] In a preferred embodiment, if the first data packet and the second data packet are determined to be identical, it indicates that the server has not been attacked by HTTP smuggling and the server is currently secure. In this case, the backend server is controlled to process the second data packet to respond to the user's access request. Otherwise, an alarm message is sent to the administrator to enable them to maintain server system security in a timely manner.

[0066] Figure 2 This is a schematic diagram of an HTTP request smuggling prevention system model provided in an embodiment of this application, as shown below. Figure 2 As shown, after the front-end server receives a data packet sent by the user, it determines whether the IP address of the device sending the data packet is an IP address that has been identified as having malicious activity (i.e., whether the current IP address is on the blacklist). If so, the data packet is discarded to protect server security. If not, instrumentation probe modules set in the front-end server and back-end server respectively are used to obtain the data packets received by the front-end server and the back-end server, and their MD5 values ​​are calculated to determine if they match. If they match, the back-end server is controlled to process the second data packet in response to the user's access request. If they do not match, the data packet is discarded.

[0067] The above embodiments have described the HTTP request smuggling prevention method in detail. This application also provides embodiments corresponding to the HTTP request smuggling prevention device. It should be noted that this application describes the device embodiments from two perspectives: one based on functional modules and the other based on hardware.

[0068] Figure 3 A structural diagram of an HTTP request smuggling prevention device provided in an embodiment of this application is shown below. Figure 3 As shown, the device includes:

[0069] The first acquisition module 10 is used to acquire the first data packet input to the front-end server;

[0070] The second obtaining module 11 is configured to obtain a second data packet corresponding to the first data packet received by the backend server when the working state of the frontend server meets the preset condition.

[0071] The checking module 12 is configured to check the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent.

[0072] If the first data packet and the second data packet are consistent, it is determined that the server system is safe.

[0073] If the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling.

[0074] Since the embodiments of the device part correspond to the embodiments of the method part, the embodiments of the device part are described in the description of the embodiments of the method part, and will not be described here.

[0075] The embodiment provides an HTTP request smuggling defense device, which comprises: obtaining a first data packet input into a frontend server; when the working state of the frontend server meets a preset condition, obtaining a second data packet corresponding to the first data packet received by a backend server, so as to subsequently determine whether the data packets obtained by the frontend server and the backend server are the same; checking the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, it is determined that the server system is safe; and if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling. It can be seen that the technical scheme provided by the present application checks the first data packet and the second data packet to determine whether the data packets obtained by the frontend server and the backend server are the same, thereby improving the security of user information and improving user experience.

[0076] Figure 4 Another structure diagram of the HTTP request smuggling defense device provided by the embodiment of the present application is shown in FIG. 2. Figure 4 The HTTP request smuggling defense device comprises: a memory 20 configured to store a computer program.

[0077] The processor 21 is configured to execute the computer program to realize the steps of the HTTP request smuggling defense method of the above-described embodiment.

[0078] The HTTP request smuggling defense device provided by the embodiment can include but is not limited to a smart phone, a tablet computer, a notebook computer, or a desktop computer, etc.

[0079] The processor 21 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one of a hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA), etc. The processor 21 can also include a main processor and a coprocessor. The main processor is a processor for processing data in a wake-up state, also known as a central processing unit (CPU). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 21 can be integrated with a graphics processor (GPU) for rendering and drawing content to be displayed by the display screen. In some embodiments, the processor 21 can further include an artificial intelligence (AI) processor for processing machine learning-related computing operations.

[0080] The memory 20 can include one or more computer-readable storage media, which can be non-transitory. The memory 20 can further include a high-speed random access memory, and a nonvolatile memory such as one or more disk storage devices, flash storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein the computer program is loaded and executed by the processor 21, and can implement the related steps of the HTTP request smuggling prevention method disclosed in any of the preceding embodiments. In addition, the resources stored by the memory 20 can further include an operating system 202 and data 203, etc., and the storage mode can be temporary storage or permanent storage. The operating system 202 can include Windows, Unix, Linux, etc. The data 203 can include but is not limited to a first data packet, a second data packet, verification data, etc.

[0081] In some embodiments, the HTTP request smuggling prevention apparatus can further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26.

[0082] Those skilled in the art can understand that, Figure 4 The structure shown in the figure does not constitute a limitation on the HTTP request smuggling prevention apparatus, and can include more or fewer components than those shown in the figure.

[0083] The HTTP request smuggling defense device provided in the embodiments of the present application comprises a memory and a processor. When the processor executes a program stored in the memory, the following method can be implemented.

[0084] A first data packet input to the front-end server is acquired.

[0085] When the working state of the front-end server meets a preset condition, a second data packet corresponding to the first data packet and received by a back-end server is acquired.

[0086] The first data packet and the second data packet are checked to determine whether the first data packet and the second data packet are consistent.

[0087] If the first data packet and the second data packet are consistent, it is determined that the server system is safe.

[0088] If the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling.

[0089] The embodiments provide an HTTP request smuggling defense device, comprising: acquiring a first data packet input to a front-end server; when the working state of the front-end server meets a preset condition, acquiring a second data packet corresponding to the first data packet and received by a back-end server, so as to subsequently determine whether the data packets acquired by the front-end server and the back-end server are consistent; checking the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, it is determined that the server system is safe; and if the first data packet and the second data packet are inconsistent, it is determined that there is HTTP request smuggling. It can be seen that, by checking the first data packet and the second data packet to determine whether the data packets acquired by the front-end server and the back-end server are consistent, the security of user information is improved, and user experience is improved.

[0090] Finally, the present application also provides an embodiment corresponding to a computer readable storage medium. The computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps recorded in the above method embodiments are implemented.

[0091] It can be understood that if the method in the above embodiment is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and performs all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0092] The HTTP request smuggling defense method, device and medium provided by the present application are described in detail above. The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part. It should be pointed out that for ordinary skilled persons in the technical field, without departing from the principles of the present application, the present application can be improved and modified in several ways, and these improvements and modifications also fall within the protection scope of the claims of the present application.

[0093] It should be further pointed out that in the present specification, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

Claims

1. A HTTP request smuggling defense method, characterized in that, The method comprises the following steps: acquiring a first data packet of an input front-end server; acquiring a second data packet corresponding to the first data packet received by a back-end server when the front-end server sends the first data packet to the back-end server; checking the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, determining that the server system is safe; if the first data packet and the second data packet are inconsistent, determining that there is HTTP request smuggling, and discarding the second data packet.

2. The HTTP request smuggling defense method of claim 1, wherein, After the step of acquiring the first data packet of the input front-end server, the method further comprises the following steps: acquiring IP information of a server sending the first data packet; determining whether the IP information is abnormal IP; if the IP information is abnormal IP, discarding the first data packet; if the IP information is not abnormal IP, executing the step of acquiring the second data packet corresponding to the first data packet received by the back-end server when the front-end server sends the first data packet to the back-end server.

3. The HTTP request smuggling defense method of claim 1, wherein, The first data packet and the second data packet are acquired by using a plug-in probe technology, and the first data packet and the second data packet are checked.

4. The HTTP request smuggling defense method of claim 1, wherein, The checking of the first data packet and the second data packet comprises the following steps: calculating a first MD5 value of the first data packet and a second MD5 value of the second data packet; determining whether the first MD5 value and the second MD5 value are consistent; if the first MD5 value and the second MD5 value are consistent, determining that the first data packet and the second data packet are consistent.

5. The HTTP request smuggling prevention method of any of claims 1 to 4, wherein, After the step of determining that the server system is safe, the method further comprises the following step: controlling the back-end server to process the second data packet.

6. The HTTP request smuggling defense method of claim 1, wherein, After the step of determining that there is HTTP request smuggling, the method further comprises the following step: sending alarm information to a manager.

7. An HTTP request smuggling defense apparatus characterized in that, The method comprises the following steps: a first acquiring module, configured to acquire a first data packet of an input front-end server; a second acquiring module, configured to acquire a second data packet corresponding to the first data packet received by a back-end server when the front-end server sends the first data packet to the back-end server; a checking module, configured to check the first data packet and the second data packet to determine whether the first data packet and the second data packet are consistent; if the first data packet and the second data packet are consistent, determining that the server system is safe; if the first data packet and the second data packet are inconsistent, determining that there is HTTP request smuggling, and discarding the second data packet.

8. An HTTP request smuggling defense apparatus characterized in that, The method comprises the following steps: a memory, configured to store a computer program; 9. A computer-readable storage medium, characterized in that, a processor, configured to execute the computer program to implement the steps of the HTTP request smuggling defense method according to any one of claims 1 to 6. The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the HTTP request smuggling defense method according to any one of claims 1 to 6.

Images