A method and device for preventing man-in-the-middle attacks in a blockchain and a storage medium

Abstract

The application discloses a method and device for preventing man-in-the-middle attacks in a blockchain and a storage medium. A preset method for preventing man-in-the-middle attacks is used to simulate the properties of a block node to dynamically detect a man-in-the-middle attack. The preset method for preventing man-in-the-middle attacks includes one or more of proxy detection, device detection, counter detection, and node detection, and whether a man-in-the-middle attack exists is determined according to a detection result. When a man-in-the-middle attack is detected, one or more of multiple preset detection methods for preventing man-in-the-middle attacks, including proxy detection, device detection, counter detection, and node detection, are used to simulate the properties of a block node to dynamically detect a man-in-the-middle attack. The man-in-the-middle attack can be detected from multiple dimensions, and can be freely selected as required to realize the combination of different detections, realize comprehensive and accurate detection of a man-in-the-middle attack, effectively prevent a man-in-the-middle attack, and improve the data security of a block node.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security protection, in particular to a method and device for preventing man-in-the-middle attack in a block chain and a storage medium. BACKGROUND

[0002] In a block chain, each block generally includes a plurality of block nodes, and each block node includes a plurality of node members. Since the link between the block node and the node member is easily captured by an agent to be grabbed for data analysis. If the block node is grabbed, the data of the node member on the block node will be grabbed for analysis, and the man-in-the-middle will use it as a data stepping stone. If the node member is grabbed, the node member data will be grabbed for analysis, and the man-in-the-middle will use it as a node member stepping stone to analyze the block node.

[0003] Existing man-in-the-middle attacks usually simulate hijacking of end data to attempt to server / node / member, and single encryption is likely to be enumerated and cracked after multiple attempts. Therefore, in order to ensure the security of data on the block node, it is necessary to take appropriate measures to prevent man-in-the-middle attacks. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a method and device for preventing man-in-the-middle attack in a block chain and a storage medium, which can prevent man-in-the-middle attack and improve the security of data on the block node.

[0005] To solve the above technical problems, a technical solution adopted by the present application is:

[0006] A method for preventing man-in-the-middle attack in a block chain, comprising the steps of:

[0007] Simulating block node attributes with a preset method for preventing man-in-the-middle attack to perform dynamic detection of man-in-the-middle, wherein the preset method for preventing man-in-the-middle attack includes one or more of agent detection, device detection, counter detection and node detection;

[0008] Determining whether there is a man-in-the-middle attack according to the detection result.

[0009] Further, the agent detection includes:

[0010] Temporarily generating a new block node;

[0011] Passively linking the new block node to the node member of the block to which it belongs, and sending a set of pre-set data to the node member;

[0012] Receiving response data returned by the node member;

[0013] judging a size of the response data, if the size of the response data is equal to a preset size, the node member does not belong to a man-in-the-middle, otherwise, the node member belongs to a man-in-the-middle.

[0014] Further, the device detects comprising:

[0015] obtaining a node member list of a block node;

[0016] traversing the node member list to determine a commonly used IP address of a node member and a corresponding device structure set;

[0017] obtaining an IP address of a node member to be detected as a target IP address;

[0018] determining a device structure corresponding to the target IP address, if there is no corresponding device structure or the device structure cannot be searched in the device structure set corresponding to the target IP address in the node member list, it is determined that the node member belongs to a man-in-the-middle.

[0019] Further, the device structure set comprises a commonly used computer, a keyboard, a mouse and a hardware device ID.

[0020] Further, the counter detection comprises:

[0021] predefining that a node member must respond immediately once receiving data;

[0022] sending data to a node member to be detected to determine a response time of the node member to be detected;

[0023] judging whether the response time is equal to a preset response time, if yes, the node member to be detected does not belong to a man-in-the-middle, otherwise, belongs to a man-in-the-middle.

[0024] Further, the judging whether the response time is equal to a preset response time comprises:

[0025] counting a response number of the node member to be detected to obtain a total response number;

[0026] judging whether the total response number is equal to a preset response number, if yes, the response time is equal to the preset response time, otherwise, the response time is not equal to the preset response time.

[0027] Further, the node detection comprises:

[0028] randomly selecting a block node to send data to a block node to be detected;

[0029] judging a data size of the block node to be detected and returned data;

[0030] If the data amount size becomes large or the returned data is abnormal, the block node to be detected belongs to a man-in-the-middle.

[0031] Further, the data amount size of the block node to be detected is judged by determining the size of the flow from the node member to the block node to be detected or the size of the flow from the block node to be detected to the block to which it belongs.

[0032] To solve the above technical problems, another technical solution adopted by the present application is:

[0033] A device for preventing man-in-the-middle attacks in a blockchain, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for preventing man-in-the-middle attacks in a blockchain when executing the computer program.

[0034] To solve the above technical problems, a technical solution adopted by the present application is:

[0035] A computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions are executable by a processor to implement the steps of the method for preventing man-in-the-middle attacks in a blockchain.

[0036] The present application has the beneficial effect that when detecting man-in-the-middle attacks, one or more of the various preset detection methods for preventing man-in-the-middle attacks, including proxy detection, device detection, counter detection, and node detection, are used to simulate the properties of a block node to dynamically detect man-in-the-middle attacks, which can detect man-in-the-middle attacks from multiple dimensions, can be freely selected as needed, can realize the combination of different detections, can comprehensively and accurately detect man-in-the-middle attacks, can effectively prevent man-in-the-middle attacks, and can improve the data security on the block node. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 A step flowchart of a method for preventing man-in-the-middle attacks in a blockchain according to an embodiment of the present application;

[0038] Figure 2 A structural schematic diagram of a device for preventing man-in-the-middle attacks in a blockchain according to an embodiment of the present application;

[0039] Figure 3 A relationship schematic diagram of four methods for preventing man-in-the-middle attacks in a blockchain according to an embodiment of the present application;

[0040] Figure 4 A relationship schematic diagram of a man-in-the-middle, a block node, and a node member in a blockchain for preventing man-in-the-middle attacks according to an embodiment of the present application;

[0041] Figure 5 A detailed step flowchart of a method for preventing man-in-the-middle attacks in a blockchain according to an embodiment of the present application;

[0042] Figure 6 An application schematic diagram of a method for preventing man-in-the-middle attacks in a blockchain according to an embodiment of the present application in an actual blockchain scenario. DETAILED DESCRIPTION

[0043] To specifically explain the technical content, the achieved purposes and effects of the present application, the following will be described in conjunction with the embodiments and the accompanying drawings.

[0044] The above-mentioned method, device and storage medium for preventing man-in-the-middle attacks in a blockchain can be applied to data protection in Web3.0 and other scenarios using blockchain technology. The following will be described through specific embodiments:

[0045] In an optional embodiment, as shown in Figure 1 , Figure 4 A method for preventing man-in-the-middle attacks in a blockchain includes the following steps:

[0046] S1, a preset method for preventing man-in-the-middle attacks is used to simulate the properties of a block node for dynamic detection of man-in-the-middle attacks, wherein the preset method for preventing man-in-the-middle attacks includes one or more of proxy detection, device detection, counter detection and node detection;

[0047] S2, whether there is a man-in-the-middle attack is determined according to the detection result;

[0048] Among them, as shown in Figure 3 The above four detection methods can all detect man-in-the-middle attacks, but the dimensions of detection are different. Combination detection can be performed according to specific actual needs to further improve the comprehensiveness and accuracy of detection.

[0049] In another optional embodiment, as shown in Figure 5 The proxy detection includes:

[0050] Temporarily generating a new block node;

[0051] Passively linking the new block node to the node members of the block to which it belongs, and sending a set of pre-set data to the node members;

[0052] Among them, in Web3.0, the link relationship between the block node and the node members is divided into active link and passive link. The active link means that the node members actively link to the block node and exchange data with the block node or the node members. The passive link means that the block node initiates the link to link the node members with other node members.

[0053] The pre-set data can be data related to the block, such as a piece of random information or a piece of random byte data, and can be pre-defined to return a piece of related data set according to a pre-set rule when the block node or the node member receives the piece of data.

[0054] receiving the response data returned by the node member;

[0055] determining the size of the response data, if the size of the response data is equal to the pre-set size, the node member does not belong to the man-in-the-middle, otherwise, the node member belongs to the man-in-the-middle, that is, determining whether the size of the response data is the same as the size of the related data set according to the pre-set rule.

[0056] Since the man-in-the-middle attack is both a data multiplexing and a proxy link, either of them will cause the size of the data packet to change, such as block A-block node B-node member B1, if B1 is attacked by the man-in-the-middle, the data size generated by B1 must be incremental traffic, rather than the actual traffic size, therefore, in the embodiment, the man-in-the-middle can be accurately determined by judging the size of the response data.

[0057] In another optional embodiment, as shown in Figure 5 The device detects, including:

[0058] obtaining a node member list of a block node;

[0059] traversing the node member list to determine the commonly used IP address of the node member and the corresponding device structure set; wherein the device structure set includes commonly used computers, keyboards, mice and hardware device IDs, etc., that is, by traversing the node member list, the commonly used IP address of the node member and the commonly used device corresponding thereto can be managed, and the corresponding relationship therebetween can be established;

[0060] obtaining the IP address of the node member to be detected as a target IP address;

[0061] determining the device structure corresponding to the target IP address, if there is no corresponding device structure or the device structure cannot be searched in the device structure set corresponding to the target IP address in the node member list, it is determined that the node member belongs to the man-in-the-middle, that is, if it is only disguised as the IP of the node member, there is no corresponding commonly used device (i.e. the IP and the device information do not match) when linking or directly logging in, it can be determined that it belongs to the man-in-the-middle.

[0062] In the embodiment, the man-in-the-middle can be accurately and quickly determined by comparing the IP address and the device information.

[0063] In another optional implementation, as shown in Figure 5 The counter detects that the data includes:

[0064] It is stipulated that the node member must respond immediately once receiving the data, and if not, it is directly determined as an abnormal node member;

[0065] Data is sent to the node member to be detected, and the response time of the node member to be detected is determined;

[0066] It is determined whether the response time is equal to the preset response time, if yes, the node member to be detected does not belong to a man-in-the-middle, otherwise, it belongs to a man-in-the-middle;

[0067] The response time can be the time of data response after the block sends data to the block node to be detected, or the time of data response after the block node sends data to the node member to be detected;

[0068] For example, assuming that T is the block node sending time, T1 is the node member sending response time, n = T1-T is the response time, and t is the preset response time, i.e., the response period, if n < t, it means that the node member makes more than one response within the period of time, which is necessarily abnormal.

[0069] The determination of whether the response time is equal to the preset response time includes:

[0070] The response times of the node member to be detected are counted to obtain the total response times;

[0071] It is determined whether the total response times are equal to the preset response times, if yes, the response time is equal to the preset response time, otherwise, the response time is not equal to the preset response time.

[0072] In the embodiment, the response times of the node member to be detected within the response period can also be counted, and if greater than the preset response times, it means that it belongs to a man-in-the-middle.

[0073] In another optional implementation, as shown in Figure 5 The node detection includes:

[0074] A block node is randomly selected to send data to a block node to be detected;

[0075] The data amount of the block node to be detected and the returned data are determined;

[0076] If the data amount becomes larger or the returned data is abnormal, the block node to be detected belongs to a man-in-the-middle;

[0077] Since the block node is a relay point of the node member data, when the block node is attacked, the man-in-the-middle needs to reuse the block node data and repeatedly attempt, which will inevitably cause the change of data flow. Therefore, it can be accurately judged whether it is a man-in-the-middle based on this.

[0078] wherein the data amount of the block node to be detected is determined by determining the size of the flow from the node member to the block node to be detected or the size of the flow from the block node to be detected to the block to which it belongs;

[0079] Since the man-in-the-middle uses the target block node or node member as a stepping stone, additional data information will be generated when using data, and the size of the flow from the node member to the block node will change. Similarly, the size of the flow from the block node to the block will also change.

[0080] The operation method of the above four detection methods will be described below through a specific embodiment, as shown in Figure 6 The block VF9A is detected:

[0081] It is found through proxy detection that the size of the data sent by the member BA4 does not match the size of the data received, so the BA4 member has a problem, and the data that should not appear is received when receiving data, which also indicates that the BA4 member has a problem;

[0082] It is found that the commonly used IP device structure of BA4 does not belong to the VF9A block record when performing device detection, so BA4 has abnormal behavior of man-in-the-middle;

[0083] When performing counter detection, it is found that the counter detection data Q12278W12FDSC2CE sent by 9DF as a block node to 10A as a node member returns twice at 35ms and 37ms, which indicates that the first return is normal, and the latter one is returned by the device of the man-in-the-middle; The next group of data indicates that the device is used by multiple man-in-the-middle, so it can be accurately determined whether there is a man-in-the-middle.

[0084] In another optional embodiment, as shown in Figure 2 A device for preventing man-in-the-middle attack in a block chain, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for preventing man-in-the-middle attack in a block chain according to any one of the embodiments when executing the computer program.

[0085] In another optional implementation, a computer readable storage medium has stored thereon computer program instructions, which, when executed by a processor, implement the steps of the method for preventing man-in-the-middle attack in a block chain in any one of the above-mentioned implementations.

[0086] To sum up, the method, device and storage medium for preventing man-in-the-middle attack in a block chain provided by the application can detect man-in-the-middle attack from multiple dimensions, can freely select as needed, realize the combination of different detections, can detect man-in-the-middle in different dimensions without using data encryption, can comprehensively and accurately detect man-in-the-middle attack, can effectively prevent man-in-the-middle attack, improve the data security and data stability on the block node, and ensure the data security of the block node and its node members.

[0087] The above-mentioned is only an embodiment of the application, and does not limit the patent scope of the application, and any equivalent transformation or direct or indirect application in the related technical field by using the content of the specification and drawings of the application is also included in the patent protection scope of the application.

Claims

1. A method for preventing man-in-the-middle attacks in blockchain, characterized in that, The method comprises the steps of: Simulating the properties of a block node by using a preset anti-middleman attack method for dynamic detection of a middleman, wherein the preset anti-middleman attack method comprises one or more of agent detection, device detection, counter detection, and node detection; Determining whether a middleman attack exists according to the detection result; The agent detection comprises: Temporarily generating a new block node; Passively linking the new block node to the node members of the block to which the new block node belongs, and sending a set of pre-set data to the node members; Receiving response data returned by the node members; Determining the size of the response data, and if the size of the response data is equal to a preset size, the node members do not belong to a middleman, otherwise, the node members belong to a middleman; The counter detection comprises: Predefining that a node member must respond immediately once it receives data; Sending data to a node member to be detected to determine the response time of the node member to be detected; Determining whether the response time is equal to a preset response time, if yes, the node member to be detected does not belong to a middleman, otherwise, it belongs to a middleman; Determining the data size of the node member to be detected by determining the size of the flow from the node member to the block node to be detected or the size of the flow from the block node to be detected to the block to which it belongs.

2. The method of claim 1, wherein, The device detection comprises: Obtaining a node member list of a block node; Traversing the node member list to determine the commonly used IP address of a node member and the corresponding device structure set; Obtaining the IP address of a node member to be detected as a target IP address; Determining the device structure corresponding to the target IP address, and if there is no corresponding device structure or the device structure cannot be searched in the device structure set corresponding to the target IP address in the node member list, it is determined that the node member belongs to a middleman.

3. The method of claim 2, wherein, The device structure set comprises commonly used computers, keyboards, mice, and hardware device IDs.

4. The method of claim 1, wherein, The determination of whether the response time is equal to a preset response time comprises: Counting the response times of the node member to be detected to obtain the total response times; Determining whether the total response times are equal to a preset response number, if yes, the response time is equal to the preset response time, otherwise, the response time is not equal to the preset response time.

5. The method of claim 1, wherein, The node detection comprises: Randomly selecting a block node to send data to a block node to be detected; Determining the data size of the block node to be detected and the returned data; If the data size becomes larger or the returned data is abnormal, the block node to be detected belongs to a middleman.

6. An apparatus for preventing man-in-the-middle attack in a blockchain, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the method for preventing a middleman attack in a block chain according to any one of claims 1 to 5.

7. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the steps of the method for preventing a middleman attack in a block chain according to any one of claims 1 to 5.

Images