Request for detection methods, devices, electronic equipment, and storage media for smuggling attacks

Abstract

This invention provides a method, apparatus, electronic device, and storage medium for detecting request smuggling attacks. The method includes: receiving a user-sent request smuggling attack detection command based on Hypertext Transfer Protocol version 2 (HTTP version 2), wherein the detection command includes a target site and a detection method, and the detection method is either an active detection method or a passive detection method; in response to the detection method being an active detection method, generating a detection data packet containing feature values, and determining whether the target site has a request smuggling attack vulnerability based on the feature values; in response to the detection method being a passive detection method, periodically acquiring request data received by the target site and decompressing the header information frames in the request data to generate header information; and determining whether the target site is subjected to a request smuggling attack by determining whether the header information contains a target character. By actively detecting potential attack vulnerabilities and passively monitoring request smuggling attacks, the risk of a site being attacked is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting requests for smuggling attacks. Background Technology

[0002] HTTP / 2 is a network protocol, an upgrade from HTTP / 1.1, released by the IETF in 2015. HTTP / 2 aims to improve web performance, reduce latency, increase security, and make web applications faster, more efficient, and more reliable. Currently, many websites use reverse proxy technology to speed up user access and reduce the load on backend servers. A reverse proxy involves a proxy server receiving client traffic, forwarding it to servers on the internal network, retrieving resources, and then returning them to the client. To ensure that the proxy server and backend server receive data synchronously, it's necessary to specify the end of the request in the client's data. The HTTP / 1.1 specification provides two different methods to specify the end of the request: the Content-Length header and the Transfer-Encoding header. HTTP / 1.1 request smuggling exploits the differences in how different servers interpret request lengths. However, in HTTP / 2, these headers are redundant. HTTP / 2 messages are sent over the network as a series of separate data frames, each with a built-in length field in the message body that tells the server exactly how many bytes to read. Therefore, the length of the request is the sum of the lengths of the data frames. However, this does not mean that HTTP / 2 is immune to request smuggling attacks. HTTP / 2 downgrades still expose websites to the risk of request smuggling attacks.

[0003] HTTP / 2 downgrading is the process of rewriting an HTTP / 1.1 request using HTTP / 2 syntax to generate an equivalent HTTP / 1.1 request. Web servers and reverse proxies use HTTP / 2 downgrading to provide HTTP / 2 support to clients while communicating with backend servers that only use HTTP / 1.1. Hackers use HTTP / 2 downgrading to carry out HTTP / 2 request smuggling attacks, such as on backend servers and websites. HTTP / 2 request smuggling attacks are mainly divided into the following two types: (1) H2-CL, where the reverse proxy server uses the built-in request length of the HTTP / 2 protocol, and the backend HTTP / 1.1 server uses the Content-Length header; (2) H2-TE, where the reverse proxy server uses the built-in request length of the HTTP / 2 protocol, and the backend HTTP / 1.1 server uses the Transfer-Encoding header. Current HTTP smuggling attack detection methods all target the HTTP / 1.1 protocol. They determine the presence of HTTP smuggling attacks by constructing or generating request data packets and judging the presence of smuggling attack vulnerabilities based on the response or by judging the presence of smuggling attack vulnerabilities based on the response time. Due to the differences in the HTTP protocol, existing detection methods cannot effectively, quickly, and accurately detect HTTP / 2 request smuggling attacks. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, electronic device, and storage medium that can automatically detect whether a target site has an HTTP / 2 request smuggling vulnerability and whether it is subject to an HTTP / 2 request smuggling attack, in order to address the above-mentioned technical problems.

[0005] Firstly, a method for detecting smuggling attacks is provided, the method comprising:

[0006] The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0007] In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0008] Based on the characteristic values, determine whether the target site has the vulnerability for the request smuggling attack;

[0009] In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0010] The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0011] Determine whether the target character exists in the header information;

[0012] If so, then the target attack type is determined based on the target character;

[0013] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0014] In one embodiment, determining whether the target site has a vulnerability for the request smuggling attack based on the feature value includes:

[0015] The feature values ​​mentioned above include a first feature value and a second feature value;

[0016] A first detection data packet is generated based on the first feature value and sent to the target site;

[0017] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0018] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0019] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0020] In one embodiment, determining whether the target site has the attack vulnerability based on the second feature value includes:

[0021] A second detection data packet is generated based on the second feature value and sent to the target site;

[0022] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0023] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0024] If not, then it is determined that the target site does not have the attack vulnerability.

[0025] In one embodiment, the step of decompressing and generating header information based on the header information frame in the request data and the header compression algorithm of the Hypertext Transfer Protocol version 2 includes:

[0026] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0027] The mapping dictionary contains a mapping table between header information and indexes.

[0028] In one embodiment, the method further includes:

[0029] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0030] Determine whether the request line data exists in the body of the message;

[0031] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0032] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0033] In one embodiment, the method further includes acquiring response data sent by the target site, and after determining that the target site is subjected to a request smuggling attack of the target attack type, it further includes:

[0034] Determine if the target site reports an error;

[0035] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0036] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0037] In one embodiment, determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0038] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0039] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0040] On the other hand, a detection device for requesting a smuggling attack is provided, the device comprising:

[0041] The receiving module is used to receive a user's request for smuggling attack detection instructions based on Hypertext Transfer Protocol version 2, wherein the detection instructions include a target site and a detection method, and the detection method includes an active detection method and a passive detection method.

[0042] The generation module, in response to the detection method being the active detection method, is used to generate a detection data packet containing feature values.

[0043] The first determining module is used to determine whether the target site has an attack vulnerability for the request smuggling attack based on the feature value;

[0044] The acquisition module, in response to the detection method being the passive detection method, is used to periodically acquire the request data received by the target site according to the detection period set by the user;

[0045] The decompression module is used to decompress and generate header information based on the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0046] The second determining module is configured to include:

[0047] Determine whether the target character exists in the header information;

[0048] If so, then the target attack type is determined based on the target character;

[0049] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0050] In one embodiment, the first determining module determines whether the target site has a vulnerability for the request smuggling attack based on the feature value, including:

[0051] The feature values ​​mentioned above include a first feature value and a second feature value;

[0052] A first detection data packet is generated based on the first feature value and sent to the target site;

[0053] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0054] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0055] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0056] In one embodiment, the first determining module determines whether the target site has the attack vulnerability based on the second feature value by:

[0057] A second detection data packet is generated based on the second feature value and sent to the target site;

[0058] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0059] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0060] If not, then it is determined that the target site does not have the attack vulnerability.

[0061] In one embodiment, the decompression module generates header information by decompressing the header information frame in the request data and the header compression algorithm of the Hypertext Transfer Protocol version 2, including:

[0062] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0063] The mapping dictionary contains a mapping table between header information and indexes.

[0064] In one embodiment, the device further includes:

[0065] The decompression module, in response to the presence of target characters in the header information, is also used to decompress and generate the body information based on the body information frame in the request data and the header compression algorithm;

[0066] The second determining module is further configured to include:

[0067] Determine whether the request line data exists in the body of the message;

[0068] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0069] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0070] In one embodiment, the acquisition module is further configured to acquire response data sent by the target site, and after the second determining module determines that the target site is subjected to a request smuggling attack of the target attack type, it further includes:

[0071] Determine if the target site reports an error;

[0072] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0073] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0074] In one embodiment, the second determining module determines whether the error message from the target site and the unauthorized information in the response data are consistent, including:

[0075] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0076] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0077] In another aspect, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0078] The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0079] In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0080] Based on the characteristic values, determine whether the target site has the vulnerability for the request smuggling attack;

[0081] In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0082] The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0083] Determine whether the target character exists in the header information;

[0084] If so, then the target attack type is determined based on the target character;

[0085] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0086] In one embodiment, the processor performs the following steps when executing the computer program:

[0087] The step of determining whether the target site has a vulnerability for the smuggling attack based on the feature value includes:

[0088] The feature values ​​mentioned above include a first feature value and a second feature value;

[0089] A first detection data packet is generated based on the first feature value and sent to the target site;

[0090] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0091] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0092] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0093] In one embodiment, the processor performs the following steps when executing the computer program:

[0094] The step of determining whether the target site has the attack vulnerability based on the second feature value includes:

[0095] A second detection data packet is generated based on the second feature value and sent to the target site;

[0096] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0097] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0098] If not, then it is determined that the target site does not have the attack vulnerability.

[0099] In one embodiment, the processor performs the following steps when executing the computer program:

[0100] The step of decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information includes:

[0101] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0102] The mapping dictionary contains a mapping table between header information and indexes.

[0103] In one embodiment, the processor performs the following steps when executing the computer program:

[0104] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0105] Determine whether the request line data exists in the body of the message;

[0106] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0107] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0108] In one embodiment, the processor performs the following steps when executing the computer program:

[0109] After obtaining the response data sent by the target site, the process of determining that the target site is under a request smuggling attack of the target attack type further includes:

[0110] Determine if the target site reports an error;

[0111] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0112] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0113] In one embodiment, the processor performs the following steps when executing the computer program:

[0114] Determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0115] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0116] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0117] In another aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0118] The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0119] In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0120] Based on the characteristic values, determine whether the target site has the vulnerability for the request smuggling attack;

[0121] In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0122] The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0123] Determine whether the target character exists in the header information;

[0124] If so, then the target attack type is determined based on the target character;

[0125] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0126] In one embodiment, the computer program performs the following steps when executed by a processor:

[0127] The step of determining whether the target site has a vulnerability for the smuggling attack based on the feature value includes:

[0128] The feature values ​​mentioned above include a first feature value and a second feature value;

[0129] A first detection data packet is generated based on the first feature value and sent to the target site;

[0130] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0131] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0132] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0133] In one embodiment, the computer program performs the following steps when executed by a processor:

[0134] The step of determining whether the target site has the attack vulnerability based on the second feature value includes:

[0135] A second detection data packet is generated based on the second feature value and sent to the target site;

[0136] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0137] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0138] If not, then it is determined that the target site does not have the attack vulnerability.

[0139] In one embodiment, the computer program performs the following steps when executed by a processor:

[0140] The step of decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information includes:

[0141] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0142] The mapping dictionary contains a mapping table between header information and indexes.

[0143] In one embodiment, the computer program performs the following steps when executed by a processor:

[0144] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0145] Determine whether the request line data exists in the body of the message;

[0146] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0147] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0148] In one embodiment, the computer program performs the following steps when executed by a processor:

[0149] After obtaining the response data sent by the target site, the process of determining that the target site is under a request smuggling attack of the target attack type further includes:

[0150] Determine if the target site reports an error;

[0151] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0152] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0153] In one embodiment, the computer program performs the following steps when executed by a processor:

[0154] Determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0155] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0156] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0157] By receiving user-sent HTTP / 2 request smuggling attack detection commands, which include the target site and detection method (active or passive detection), the system proactively detects HTTP / 2 request smuggling attacks. In response to an active detection method, it generates a detection data packet containing feature values ​​to determine if the target site is vulnerable to such attacks. In response to a passive detection method, it periodically acquires request data received by the target site according to a user-defined detection cycle, decompresses the request data using the header information frames and HTTP / 2 header compression algorithm, and determines if the header contains a target character. If so, it determines the target attack type; otherwise, it determines the target site is not vulnerable to request smuggling attacks. This proactive detection of potential HTTP / 2 request smuggling vulnerabilities reduces the risk of attack and improves the site's security. Passive monitoring of potential HTTP / 2 request smuggling attacks identifies the attack type and alerts the user for targeted remediation. Attached Figure Description

[0158] Figure 1 A flowchart illustrating the proactive detection method for requests to smuggle attacks;

[0159] Figure 2 A flowchart illustrating the passive detection method for requesting smuggling attacks;

[0160] Figure 3 A schematic diagram illustrating the steps of a method for detecting smuggling attacks;

[0161] Figure 4 Example diagram of a detection data packet containing the first feature value;

[0162] Figure 5 Example diagram of request data containing the first target character;

[0163] Figure 6 Example diagram of request data containing the second target character;

[0164] Figure 7 Example diagram of request data containing the first target character after processing by the site;

[0165] Figure 8 Example diagram of request data containing the second target character after processing by the site;

[0166] Figure 9 A schematic diagram of the detection device for requesting a smuggling attack;

[0167] Figure 10 This is an internal structural diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0168] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0169] This application provides, as follows Figure 1 The flowchart shown illustrates an active detection method for HTTP / 2 (Hypertext Transfer Protocol version 2) request smuggling attacks. It first generates a first detection data packet containing a first characteristic value and sends it to the target site. Then, it determines whether an HTTP / 2 request smuggling attack vulnerability exists based on whether the returned response data contains the first characteristic value. The same method is then used to determine again whether the target site has an HTTP / 2 request smuggling attack vulnerability based on a second characteristic value. The method provided in this application is as follows... Figure 2 The flowchart shown illustrates the passive detection method for HTTP / 2 request smuggling attacks. First, request and response data are periodically acquired during the detection period. Then, the request data is decompressed using the HPACK (HTTP / 2 header compression) algorithm to generate header information. By determining whether the header information contains the target character and whether the corresponding DATA frame contains request line data conforming to protocols such as HTTP / 1.1, it is determined whether the target site is under HTTP / 2 request smuggling attack. If the target site reports an error, it is further determined whether the unauthorized information in the response data matches the error information, thereby determining whether it is under other HTTP / 2 request smuggling attacks.

[0170] In one embodiment, such as Figure 3 As shown, the present invention provides a method for detecting requests for smuggling attacks, the method comprising:

[0171] S301. Receive a user-sent detection instruction for a smuggling attack based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0172] S302. In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0173] S303. Determine whether the target site has the vulnerability for the request smuggling attack based on the feature value;

[0174] S304. In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0175] S305. Decompress the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information;

[0176] S306. Determine whether the header information contains a target character;

[0177] S307. If so, then determine the target attack type based on the target character;

[0178] S308. If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0179] Specifically, within a 10-minute detection period, one or more requests and their corresponding responses can be randomly captured using packet capture software. The specific detection period and the number of request and response data pairs captured can be set by the user. Afterwards, the HTTP header information in the request data is recovered by decompressing the HEADERS frames using the HPACK algorithm. The presence of target characters in the header information determines whether the site is under attack and the type of attack. In complex production environments, users need to choose between proactively detecting HTTP / 2 request smuggling vulnerabilities or passively monitoring for such attacks. When both the reverse proxy and the target site are unreachable (e.g., on different LANs), proactive detection is not possible. Similarly, when the target site runs important business operations or stores sensitive information, proactive detection may cause unforeseen consequences, making passive detection the only viable option. Conversely, when the target site is simultaneously running business operations that could be intercepted by traffic capture software, proactive detection is not an option. The choice of which method to use, or even both (active detection can be performed first, followed by passive monitoring only after no vulnerabilities are found on the target site), is up to the user. For example, if the target site has at least one of the HTTP / 2 smuggling vulnerabilities corresponding to H2-CL and H2-TE types, an alert is sent to the user, reminding them to fix the vulnerability. After the vulnerability is fixed, the system continues to monitor the target site periodically within the user-defined detection cycle to check for HTTP / 2 request smuggling attacks. Generally, a fixed target site will not be vulnerable to H2-CL and H2-TE type HTTP / 2 smuggling attacks. However, HTTP / 2 request smuggling attacks are directly related to the actual server configuration. If the RFC specifications are not strictly followed and the actual configuration changes, there is no guarantee that the changed configuration will still be free of risk; that is, there is still a small probability of being vulnerable to HTTP / 2 smuggling attacks, including H2-CL and H2-TE types. Furthermore, coverage cannot be guaranteed for other methods that may cause HTTP / 2 request smuggling attacks in future research. Therefore, passive monitoring of the target site for HTTP / 2 smuggling attacks is still necessary.

[0180] In one embodiment, determining whether the target site has a vulnerability for the request smuggling attack based on the feature value includes:

[0181] The feature values ​​mentioned above include a first feature value and a second feature value;

[0182] A first detection data packet is generated based on the first feature value and sent to the target site;

[0183] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0184] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0185] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0186] Specifically, the first feature value is Content-Length, and the second feature value is Transfer-Encoding, such as... Figure 4 As shown, firstly, a detection data packet of type H2-CL containing Content-Length, i.e., a packet of erroneous HTTP request, is generated and then sent to the target site. If the site has an HTTP / 2 smuggling attack vulnerability corresponding to type H2-CL, the returned detection response data will contain the character "Content-Length". If the detection response data does not contain the character "Content-Length", it means that the target site does not have an HTTP / 2 smuggling attack vulnerability corresponding to type H2-CL, and the system will continue to determine whether there is an HTTP / 2 smuggling attack vulnerability of type H2-TE.

[0187] In one embodiment, determining whether the target site has the attack vulnerability based on the second feature value includes:

[0188] A second detection data packet is generated based on the second feature value and sent to the target site;

[0189] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0190] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0191] If not, then it is determined that the target site does not have the attack vulnerability.

[0192] Specifically, as described above, a detection data packet of type H2-TE containing Transfer-Encoding, i.e., a packet of erroneous HTTP request, is first generated. Then, this detection data packet is sent to the target site. If the target site has an HTTP / 2 smuggling attack vulnerability of type H2-TE, the returned detection response data will contain the character "Transfer-Encoding". If the detection response data does not contain the character "Transfer-Encoding", it means that the target site does not have an HTTP / 2 smuggling attack vulnerability corresponding to type H2-TE.

[0193] In one embodiment, the step of decompressing and generating header information based on the header information frame in the request data and the header compression algorithm of the Hypertext Transfer Protocol version 2 includes:

[0194] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0195] The mapping dictionary contains a mapping table between header information and indexes.

[0196] Specifically, regarding the HPACK algorithm, due to the characteristics of the HTTP / 2 protocol, HTTP / 2 transmits data entirely in binary format, unlike HTTP / 1.1 which uses plain text. HTTP / 2 divides the original HTTP / 1.1 header and body into several binary frames and defines various frame types. HEADERS frames store header data, and DATA frames store the request body information. In HTTP / 1.1, the first line of the request contains the request method and path; HTTP / 2 replaces this with a series of pseudo-header fields. Because the HTTP / 1.1 header contains many identical fields, this increases the data transmission burden. Therefore, HTTP / 2 uses the HPACK algorithm to compress the request line, request headers, response line, and HTTP header information. In the HPACK algorithm, a mapping relationship between HTTP header information and an index can be established using a dictionary. Once both the request sender and receiver know this mapping relationship, they can directly include the index in the HTTP / 2 data header. Upon receiving the HTTP / 2 request, the index is looked up in the dictionary to restore the corresponding HTTP header information, thereby reducing the amount of data transmitted.

[0197] In one embodiment, the method further includes:

[0198] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0199] Determine whether the request line data exists in the body of the message;

[0200] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0201] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0202] Specifically, such as Figure 5 as well as Figure 6 As shown, after obtaining the request data using packet capture software, the HTTP header information in the request is recovered after decompressing the HEADERS frame using the HPACK algorithm. If the HTTP header information contains "Content-Length" (the first target character) or "Transfer-Encoding" (the second target character), it indicates that the request data sent by the front-end device or reverse proxy server to the back-end server may contain malicious attacks, i.e., HTTP / 2 request smuggling attacks. Figure 7 As shown, when the HTTP header contains the target character "Content-Length", it is also necessary to determine whether the corresponding DATA (body) frame contains request line data conforming to, for example, the HTTP / 1.1 protocol, such as "GET / SECRETHTTP / 1.1" and "Host: attack.com". Simply containing a header consisting of "Content-Length" or "Transfer-Encoding" is insufficient to actually harm the target site; a request line data conforming to the HTTP protocol is required, and this request line data must contain malicious behavior. In other words, only if the DATA frame contains request line data conforming to, for example, the HTTP / 1.1 protocol, can it be determined that a request containing a malicious attack has been received; if it does not exist, there is no need to alert the user.

[0203] In one embodiment, the method further includes acquiring response data sent by the target site, and after determining that the target site is subjected to a request smuggling attack of the target attack type, it further includes:

[0204] Determine if the target site reports an error;

[0205] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0206] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0207] Specifically, as mentioned above, when it is detected that the target site on the backend server has received request data containing malicious attacks, it is also necessary to check whether the target site reports an error. For example, if the reverse proxy server and the backend server, after being repaired by the user, are configured not to support HTTP / 2 downgrade, meaning the target site does not have an attack vulnerability, then the target site will treat the data that the hacker can control—the aforementioned request line data—as ordinary data and will not parse it into a separate request, thus preventing the hacker from smuggling the malicious request. By determining whether the target site reports an error, it is determined whether the target site has an attack vulnerability for HTTP / 2 request smuggling attacks. If an error is reported, the target site definitely has an attack vulnerability and has been subjected to an HTTP / 2 request smuggling attack.

[0208] In one embodiment, determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0209] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0210] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0211] Specifically, as mentioned above, when the error message and the unauthorized information in the response data of the target site are found to be consistent, i.e. Figure 8 As shown, the target site reports an error because the response data contains unauthorized information (the last chunk has a length of 0 and the corresponding chunk data is empty, and it contains request line data conforming to the HTTP / 1.1 protocol); the specific content can be as follows: "0GET / SECRETHTTP / 1.1Host: attack.com". Since the identified target attack type matches the unauthorized information, it is determined that the target site is subjected to an HTTP / 2 smuggling attack corresponding to the H2-TE type. If the target attack type identified based on the request data is H2-CL, but the unauthorized information in the response data is of type H2-TE, it indicates that the target site may have received other request data containing HTTP / 2 smuggling attacks.

[0212] The proposed solution has the following beneficial effects:

[0213] 1) By proactively detecting potential HTTP / 2 request smuggling vulnerabilities on target sites, the risk of attack on target sites can be reduced, thereby improving the security of target sites;

[0214] 2) Passively monitor potential HTTP / 2 request smuggling attacks on target sites, identify the types of HTTP / 2 smuggling attacks, and thus remind users to take targeted remediation measures.

[0215] It should be understood that, although Figure 3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 3 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0216] In one embodiment, such as Figure 9 As shown, a detection device for requesting a smuggling attack is provided, the device comprising:

[0217] The receiving module 901 is used to receive a detection instruction for a smuggling attack based on the Hypertext Transfer Protocol version 2 sent by a user, wherein the detection instruction includes a target site and a detection method, and the detection method includes an active detection method and a passive detection method.

[0218] The generation module 902, in response to the detection method being the active detection method, is used to generate a detection data packet containing feature values.

[0219] The first determining module 903 is used to determine whether the target site has an attack vulnerability for the request smuggling attack based on the feature value;

[0220] The acquisition module 904, in response to the detection method being the passive detection method, is used to periodically acquire the request data received by the target site according to the detection period set by the user;

[0221] The decompression module is used to decompress and generate header information based on the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0222] The second determining module is configured to include:

[0223] Determine whether the target character exists in the header information;

[0224] If so, then the target attack type is determined based on the target character;

[0225] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0226] In one embodiment, the first determining module determines whether the target site has a vulnerability for the request smuggling attack based on the feature value, including:

[0227] The feature values ​​mentioned above include a first feature value and a second feature value;

[0228] A first detection data packet is generated based on the first feature value and sent to the target site;

[0229] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0230] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0231] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0232] In one embodiment, the first determining module determines whether the target site has the attack vulnerability based on the second feature value by:

[0233] A second detection data packet is generated based on the second feature value and sent to the target site;

[0234] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0235] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0236] If not, then it is determined that the target site does not have the attack vulnerability.

[0237] In one embodiment, the decompression module generates header information by decompressing the header information frame in the request data and the header compression algorithm of the Hypertext Transfer Protocol version 2, including:

[0238] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0239] The mapping dictionary contains a mapping table between header information and indexes.

[0240] In one embodiment, the device further includes:

[0241] The decompression module, in response to the presence of target characters in the header information, is also used to decompress and generate the body information based on the body information frame in the request data and the header compression algorithm;

[0242] The second determining module is further configured to include:

[0243] Determine whether the request line data exists in the body of the message;

[0244] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0245] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0246] In one embodiment, the acquisition module is further configured to acquire response data sent by the target site, and after the second determining module determines that the target site is subjected to a request smuggling attack of the target attack type, it further includes:

[0247] Determine if the target site reports an error;

[0248] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0249] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0250] In one embodiment, the second determining module determines whether the error message from the target site and the unauthorized information in the response data are consistent, including:

[0251] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0252] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0253] Specific limitations regarding the detection device for smuggling requests can be found in the limitations of the detection method for smuggling requests described above, and will not be repeated here. Each module in the aforementioned detection device for smuggling requests can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0254] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an alarm information processing method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0255] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0256] In one embodiment, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0257] The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0258] In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0259] Based on the characteristic values, determine whether the target site has the vulnerability for the request smuggling attack;

[0260] In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0261] The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0262] Determine whether the target character exists in the header information;

[0263] If so, then the target attack type is determined based on the target character;

[0264] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0265] In one embodiment, the processor performs the following steps when executing the computer program:

[0266] The step of determining whether the target site has a vulnerability for the smuggling attack based on the feature value includes:

[0267] The feature values ​​mentioned above include a first feature value and a second feature value;

[0268] A first detection data packet is generated based on the first feature value and sent to the target site;

[0269] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0270] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0271] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0272] In one embodiment, the processor performs the following steps when executing the computer program:

[0273] The step of determining whether the target site has the attack vulnerability based on the second feature value includes:

[0274] A second detection data packet is generated based on the second feature value and sent to the target site;

[0275] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0276] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0277] If not, then it is determined that the target site does not have the attack vulnerability.

[0278] In one embodiment, the processor performs the following steps when executing the computer program:

[0279] The step of decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information includes:

[0280] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0281] The mapping dictionary contains a mapping table between header information and indexes.

[0282] In one embodiment, the processor performs the following steps when executing the computer program:

[0283] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0284] Determine whether the request line data exists in the body of the message;

[0285] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0286] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0287] In one embodiment, the processor performs the following steps when executing the computer program:

[0288] After obtaining the response data sent by the target site, the process of determining that the target site is under a request smuggling attack of the target attack type further includes:

[0289] Determine if the target site reports an error;

[0290] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0291] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0292] In one embodiment, the processor performs the following steps when executing the computer program:

[0293] Determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0294] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0295] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0296] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0297] The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method.

[0298] In response to the detection method being the active detection method, a detection data packet containing feature values ​​is generated.

[0299] Based on the characteristic values, determine whether the target site has the vulnerability for the request smuggling attack;

[0300] In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user.

[0301] The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol.

[0302] Determine whether the target character exists in the header information;

[0303] If so, then the target attack type is determined based on the target character;

[0304] If not, then it is determined that the target site has not been subjected to the requested smuggling attack.

[0305] In one embodiment, the computer program performs the following steps when executed by a processor:

[0306] The step of determining whether the target site has a vulnerability for the smuggling attack based on the feature value includes:

[0307] The feature values ​​mentioned above include a first feature value and a second feature value;

[0308] A first detection data packet is generated based on the first feature value and sent to the target site;

[0309] In response to receiving first detection response data returned by the target site, determine whether the first feature value exists in the first detection response data;

[0310] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0311] If not, then the existence of the attack vulnerability in the target site is determined based on the second feature value.

[0312] In one embodiment, the computer program performs the following steps when executed by a processor:

[0313] The step of determining whether the target site has the attack vulnerability based on the second feature value includes:

[0314] A second detection data packet is generated based on the second feature value and sent to the target site;

[0315] In response to receiving second detection response data returned by the target site, determine whether the second feature value exists in the second detection response data;

[0316] If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user;

[0317] If not, then it is determined that the target site does not have the attack vulnerability.

[0318] In one embodiment, the computer program performs the following steps when executed by a processor:

[0319] The step of decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information includes:

[0320] The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm.

[0321] The mapping dictionary contains a mapping table between header information and indexes.

[0322] In one embodiment, the computer program performs the following steps when executed by a processor:

[0323] In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information.

[0324] Determine whether the request line data exists in the body of the message;

[0325] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0326] The target characters include a first target character and a second target character, and the target attack type includes a first target attack type and a second target attack type.

[0327] In one embodiment, the computer program performs the following steps when executed by a processor:

[0328] After obtaining the response data sent by the target site, the process of determining that the target site is under a request smuggling attack of the target attack type further includes:

[0329] Determine if the target site reports an error;

[0330] If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent;

[0331] If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

[0332] In one embodiment, the computer program performs the following steps when executed by a processor:

[0333] Determining whether the error message from the target site and the unauthorized information in the response data are consistent includes:

[0334] If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type;

[0335] If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

[0336] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0337] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0338] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting a smuggling attack, the method comprising: The system receives a user's request to detect smuggling attacks based on Hypertext Transfer Protocol version 2, wherein the detection instruction includes a target site and a detection method, and the detection method is an active detection method and a passive detection method. In response to the detection method being the active detection method, a detection data packet containing the target character is generated. Determine whether the target site has a vulnerability for the request smuggling attack based on the target characters; In response to the detection method being the passive detection method, the request data received by the target site is periodically acquired according to the detection period set by the user. The header information is generated by decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol. Determine whether the target character exists in the header information; If so, then the target attack type is determined based on the target character; If not, then it is determined that the target site has not been subjected to the requested smuggling attack; The target characters include the first target character Content-Length and the second target character Transfer-Encoding.

2. The method according to claim 1, characterized in that, The step of determining whether the target site has a vulnerability for the request smuggling attack based on the target character includes: A first detection data packet is generated based on the first target character and sent to the target site; In response to receiving first detection response data returned by the target site, determine whether the first target character exists in the first detection response data; If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user; If not, then determine whether the target site has the attack vulnerability based on the second target character.

3. The method according to claim 2, characterized in that, The step of determining whether the target site has the attack vulnerability based on the second target character includes: A second detection data packet is generated based on the second target character and sent to the target site; In response to receiving second detection response data returned by the target site, determine whether the second target character exists in the second detection response data; If so, then the target site is confirmed to have the attack vulnerability and an alert is sent to the user; If not, then it is determined that the target site does not have the attack vulnerability.

4. The method according to claim 1, characterized in that, The step of decompressing the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol to generate header information includes: The header information is generated based on the header index corresponding to the header information frame and the mapping dictionary corresponding to the header compression algorithm. The mapping dictionary contains a mapping table between header information and indexes.

5. The method according to claim 1, characterized in that, The method further includes: In response to the presence of target characters in the header information, the header information is decompressed and generated according to the body information frame in the request data and the header compression algorithm to generate the body information. Determine whether the request line data exists in the body of the message; If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type; The target attack types mentioned therein include a first target attack type and a second target attack type.

6. The method according to claim 5, characterized in that, The method further includes acquiring response data sent by the target site, and after determining that the target site is subjected to a request smuggling attack of the target attack type, it further includes: Determine if the target site reports an error; If so, determine whether the error message from the target site and the unauthorized information in the response data are consistent; If not, then it is determined that the target site does not have the attack vulnerability of the target attack type.

7. The method according to claim 6, characterized in that, Determining whether the error message from the target site and the unauthorized information in the response data are consistent includes: If so, then it is determined that the target site is subjected to a request smuggling attack of the target attack type; If not, then it is determined that the target site is also subject to other request smuggling attacks based on the Hypertext Transfer Protocol version 2.

8. A detection device for requesting a smuggling attack, the device comprising: The receiving module is used to receive a user's request for smuggling attack detection instructions based on Hypertext Transfer Protocol version 2, wherein the detection instructions include a target site and a detection method, and the detection method includes an active detection method and a passive detection method. The generation module, in response to the detection method being the active detection method, is used to generate a detection data packet containing the target character. The first determining module is used to determine whether the target site has an attack vulnerability for the request smuggling attack based on the target character; The acquisition module, in response to the detection method being the passive detection method, is used to periodically acquire the request data received by the target site according to the detection period set by the user; The decompression module is used to decompress and generate header information based on the header information frame in the request data and the header compression algorithm of the second version of Hypertext Transfer Protocol. The second determining module is configured to include: Determine whether the target character exists in the header information; If so, then the target attack type is determined based on the target character; If not, then it is determined that the target site has not been subjected to the requested smuggling attack; The target characters include the first target character Content-Length and the second target character Transfer-Encoding.

9. An electronic device, characterized in that, include: One or more processors; And a memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images