Game account anti-collision library method and device, storage medium and computer equipment

Abstract

The application discloses a game account anti-collision library method and device, a storage medium and a computer device. The method comprises the following steps: in response to a game account login request from a client, obtaining account login information and login environment information carried by the game account login request; verifying whether the account login information is correct, and verifying whether the login environment corresponding to the game account login request belongs to an anti-collision library detection environment based on the login environment information; in the case that the account login information is incorrect and the login environment belongs to the anti-collision library detection environment, determining that the game account login request is a collision library behavior, generating a first false identity token and sending the first false identity token to the client, so that the client logs in a game account to a trap website based on the first false identity token, wherein the trap website is a mirror website of a game website, and game data of the trap website and game data of the game website are isolated from each other.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and apparatus, storage medium, and computer equipment for preventing credential stuffing of game accounts. Background Technology

[0002] In the gaming industry, players using cheat tools or hacks significantly increase the risk of account password leaks, leading to frequent credential stuffing attacks. Although various security measures exist, such as account bans targeting abnormal login behavior and IP address frequency restrictions, these measures remain inadequate against credential stuffing attacks. This is because the system provides clear feedback to attackers regardless of whether an account login is successful or failed. This allows attackers to quickly and accurately distinguish which accounts succeeded and which failed. This feedback mechanism inadvertently facilitates credential stuffing attacks, enabling them to more effectively locate and attack target accounts, posing a serious threat to game players' account security. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method, apparatus, storage medium, and computer equipment for preventing game accounts from being compromised by credential stuffing attacks, which helps to reduce the risk of game accounts being compromised by credential stuffing attacks, increase the difficulty of game accounts being compromised by credential stuffing attacks, and ensure the security of game accounts.

[0004] According to one aspect of this application, a method for preventing credential stuffing attacks on game accounts is provided, the method comprising:

[0005] In response to a game account login request from a client, obtain the account login information and login environment information carried in the game account login request;

[0006] Verify whether the account login information is correct, and verify whether the login environment corresponding to the game account login request belongs to the anti-credential collision detection environment based on the login environment information;

[0007] If the account login information is verified to be incorrect and the login environment belongs to the anti-credential stuffing detection environment, the game account login request is determined to be a credential stuffing behavior. A first fake identity token is generated and sent to the client, so that the client logs the game account to the trap website based on the first fake identity token. The trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website.

[0008] Optionally, after the client logs into the trap website with the game account based on the first fake identity token, the method further includes:

[0009] Based on the login environment information and the account login information, an abnormal login prompt message is generated;

[0010] Obtain the reserved contact information of the game account corresponding to the account login information, and send the abnormal login prompt information according to the reserved contact information, so as to prompt that the game account was logged into the trap website because the account login information is incorrect and is in the anti-credential collision detection environment, and to prompt that if the account login information is incorrect due to input error, the login should be requested again.

[0011] Optionally, the method further includes:

[0012] If the account login information is verified to be correct and the login environment belongs to the anti-credential detection environment, a first real identity token is generated, the first real identity token is marked as a suspicious token, and the first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token;

[0013] The system acquires game behavior data of game accounts marked with suspicious tokens, and if it is determined based on the game behavior data that the game account login request is a credential stuffing attack, it cancels the first real identity token to disconnect the game account from the game website.

[0014] Optionally, after canceling the first real identity token, the method further includes:

[0015] A second fake identity token is generated and sent to the client, so that the client can log in to the trap website with the game account based on the second fake identity token.

[0016] Optionally, the method further includes:

[0017] If, within a preset time period, it is determined based on the game behavior data that the game account login request does not constitute a credential stuffing attack, then the suspicious token marker on the first real identity token is deleted.

[0018] Optionally, the method further includes:

[0019] If the account login information is verified to be correct and the login environment does not belong to the anti-credential detection environment, a second real identity token is generated and sent to the client so that the client can log in to the game website based on the second real identity token;

[0020] If the account login information is found to be incorrect and the login environment does not belong to the anti-collision brute-force detection environment, an account verification failure message will be sent to the client.

[0021] Optionally, the account login information includes a username and password; the login environment information includes a client IP address; and verifying whether the login environment corresponding to the game account login request belongs to the anti-credential stuffing detection environment based on the login environment information includes:

[0022] Based on the username in the account login information, obtain the historical login geographic address information corresponding to the username, determine the client geographic address corresponding to the client IP address, and based on the client geographic address and the historical login geographic address information, determine whether the login environment corresponding to the game account login request belongs to a different location login environment, wherein the different location login environment belongs to the anti-credential stuffing detection environment; and / or,

[0023] Based on the client IP address, obtain the historical login request frequency corresponding to the client IP address, and based on the historical login request frequency and a preset high-frequency threshold, determine whether the login environment corresponding to the game account login request belongs to a high-frequency login environment, wherein the high-frequency login environment belongs to the anti-credential collision detection environment.

[0024] According to another aspect of this application, a credential stuffing protection device for game accounts is provided, the device comprising:

[0025] The acquisition module is used to respond to a game account login request from a client and acquire the account login information and login environment information carried in the game account login request;

[0026] The verification module is used to verify whether the account login information is correct, and to verify whether the login environment corresponding to the game account login request belongs to the anti-collision detection environment based on the login environment information;

[0027] The processing module is used to determine that the game account login request is a credential stuffing attack when the account login information is incorrect and the login environment belongs to the anti-credential stuffing detection environment. It generates a first fake identity token and sends it to the client so that the client can log in to the trap website based on the first fake identity token. The trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website.

[0028] Optionally, the processing module is further configured to:

[0029] Based on the login environment information and the account login information, an abnormal login prompt message is generated;

[0030] Obtain the reserved contact information of the game account corresponding to the account login information, and send the abnormal login prompt information according to the reserved contact information, so as to prompt that the game account was logged into the trap website because the account login information is incorrect and is in the anti-credential collision detection environment, and to prompt that if the account login information is incorrect due to input error, the login should be requested again.

[0031] Optionally, the processing module is further configured to:

[0032] If the account login information is verified to be correct and the login environment belongs to the anti-credential detection environment, a first real identity token is generated, the first real identity token is marked as a suspicious token, and the first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token;

[0033] The system acquires game behavior data of game accounts marked with suspicious tokens, and if it is determined based on the game behavior data that the game account login request is a credential stuffing attack, it cancels the first real identity token to disconnect the game account from the game website.

[0034] Optionally, the processing module is further configured to:

[0035] A second fake identity token is generated and sent to the client, so that the client can log in to the trap website with the game account based on the second fake identity token.

[0036] Optionally, the processing module is further configured to:

[0037] If, within a preset time period, it is determined based on the game behavior data that the game account login request does not constitute a credential stuffing attack, then the suspicious token marker on the first real identity token is deleted.

[0038] Optionally, the processing module is further configured to:

[0039] If the account login information is verified to be correct and the login environment does not belong to the anti-credential detection environment, a second real identity token is generated and sent to the client so that the client can log in to the game website based on the second real identity token;

[0040] If the account login information is found to be incorrect and the login environment does not belong to the anti-collision brute-force detection environment, an account verification failure message will be sent to the client.

[0041] Optionally, the verification module is used for:

[0042] Based on the username in the account login information, obtain the historical login geographic address information corresponding to the username, determine the client geographic address corresponding to the client IP address, and based on the client geographic address and the historical login geographic address information, determine whether the login environment corresponding to the game account login request belongs to a different location login environment, wherein the different location login environment belongs to the anti-credential stuffing detection environment; and / or,

[0043] Based on the client IP address, obtain the historical login request frequency corresponding to the client IP address, and based on the historical login request frequency and a preset high-frequency threshold, determine whether the login environment corresponding to the game account login request belongs to a high-frequency login environment, wherein the high-frequency login environment belongs to the anti-credential collision detection environment.

[0044] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the aforementioned method for preventing credential stuffing attacks on game accounts.

[0045] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the aforementioned anti-credential stuffing method for game accounts.

[0046] By employing the above technical solutions, this application provides a method, apparatus, storage medium, and computer device for preventing credential stuffing attacks on game accounts. When a game account login request is sent from the client, the system first obtains the account login information and login environment information, and performs dual verification. On one hand, it verifies whether the account login information (such as username and password) is correct; on the other hand, it verifies whether the login environment (such as client IP address) belongs to a possible credential stuffing detection environment (such as login from a different location or high-frequency login) based on the login environment information (such as client IP address). If the account login information is incorrect and the login environment is abnormal, the system determines that the login request is a credential stuffing attack and generates a fake identity token to send to the client, inducing the attacker to log in to a trap website isolated from the real game website, thereby protecting the security of the real game website and game data. This application, by verifying account login information and login environment information, can promptly detect and intercept credential stuffing attacks, effectively protecting game account security. When credential stuffing is detected, the system does not directly reject the login request, but sends a fake identity token to induce the attacker to enter the trap website. This can reduce the attacker's continuous attacks on the real game website and reduce potential security risks. By setting up a trap website, credential stuffing attack traffic is redirected to an environment isolated from the real game website. This reduces the load on the real game server, ensuring a smooth gaming experience for legitimate users. Furthermore, the game data on the trap website is completely isolated from the data on the real game website; even if an attacker successfully logs into the trap website, they cannot access or tamper with the data on the real game website. Because the credential stuffing attack is promptly intercepted and redirected to the trap website, legitimate users are not disturbed, their gaming experience is maintained, and the attacker is misled into believing they have succeeded, thus increasing the difficulty for them to steal game accounts.

[0047] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0048] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0049] Figure 1 A flowchart illustrating a method for preventing credential stuffing of game accounts according to an embodiment of this application is shown.

[0050] Figure 2 A schematic diagram of the structure of a game account anti-collision credentialing device provided in an embodiment of this application is shown. Detailed Implementation

[0051] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0052] This embodiment provides a method for preventing credential stuffing attacks on game accounts, such as... Figure 1 As shown, the method includes:

[0053] Step 101: In response to the game account login request from the client, obtain the account login information and login environment information carried in the game account login request.

[0054] This application provides a method for preventing credential stuffing attacks on game accounts. In a network environment, credential stuffing attacks typically refer to hackers using leaked user data (such as usernames and passwords) obtained from other websites or services to attempt to log in to other websites or services in order to steal user information or carry out other malicious activities. To prevent such credential stuffing attacks from harming game accounts, this method takes the following measures: When a game account login request from a client arrives at the server, the server system first captures the request and obtains the account login information and login environment information carried within it.

[0055] Step 102: Verify whether the account login information is correct, and verify whether the login environment corresponding to the game account login request belongs to the anti-credential collision detection environment based on the login environment information.

[0056] In this embodiment, the system verifies the provided account login information to ensure that the account and password are correct. In addition to verifying the account login information, the system also determines whether the login originates from an environment that might be engaging in credential stuffing attacks based on login environment information (such as IP address, device information, geographical location, etc.).

[0057] Step 103: If the account login information is verified to be incorrect and the login environment belongs to the anti-credential stuffing detection environment, determine that the game account login request is a credential stuffing behavior, generate a first fake identity token and send it to the client, so that the client can log in to the trap website based on the first fake identity token, wherein the trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website.

[0058] In this embodiment, if the account login information is incorrect and the login environment is determined to be an anti-credential stuffing detection environment (i.e., an environment potentially at risk of credential stuffing), the system will consider this a credential stuffing attempt and generate a first fake identity token to send to the client. Upon receiving this fake identity token, the client will be redirected to a trap website to log in. This trap website is a mirror site of the game website, similar in appearance and function to the actual game website, but the game data is isolated from the real game website and will not affect the real game data. This embodiment, by verifying account login information and checking the login environment, can promptly detect and intercept credential stuffing attempts, protecting the security of game accounts. Even if a credential stuffing attempt is triggered, because the client is redirected to the trap website, hackers cannot obtain the real game data, thus reducing the risk of data leakage. Furthermore, since the real game data is unaffected, users will not experience any loss or inconvenience when subjected to a credential stuffing attack, ensuring the normal operation of the game and a good user experience. Simultaneously, based on the above scheme, if the login information is incorrect, the hacker will be redirected to the mirror trap website of the game website, making them mistakenly believe that the credential stuffing attempt has been successful, increasing the difficulty for hackers to steal game accounts.

[0059] By applying the technical solution of this embodiment, when a game account login request is sent from the client, the system first obtains the account login information and login environment information, and performs dual verification. On the one hand, it verifies whether the account login information (such as username and password) is correct; on the other hand, it verifies whether the login environment (such as client IP address) belongs to a possible anti-credential stuffing detection environment (such as login from a different location or high-frequency login) based on the login environment information (such as client IP address). If the account login information is incorrect and the login environment is abnormal, the system determines that the login request is a credential stuffing attack and generates a fake identity token to send to the client, inducing the credential stuffer to log in to a trap website isolated from the real game website, thereby protecting the security of the real game website and game data. This embodiment of the application can detect and intercept credential stuffing attacks in a timely manner by verifying account login information and login environment information, effectively protecting the security of game accounts. When credential stuffing is detected, the system does not directly reject the login request, but sends a fake identity token to induce the credential stuffer to enter the trap website. This can reduce the continuous attacks of credential stuffers on the real game website and reduce potential security risks. By setting up a trap website, credential stuffing attack traffic is redirected to an environment isolated from the real game website. This reduces the load on the real game server, ensuring a smooth gaming experience for legitimate users. Furthermore, the game data on the trap website is completely isolated from the data on the real game website; even if an attacker successfully logs into the trap website, they cannot access or tamper with the data on the real game website. Because the credential stuffing attack is promptly intercepted and redirected to the trap website, legitimate users are not disturbed, their gaming experience is maintained, and the attacker is misled into believing they have succeeded, thus increasing the difficulty for them to steal game accounts.

[0060] In this embodiment of the application, optionally, the account login information includes a username and password; the login environment information includes a client IP address; step 102 includes: obtaining historical login geographic address information corresponding to the username in the account login information, determining the client geographic address corresponding to the client IP address, and determining whether the login environment corresponding to the game account login request belongs to a remote login environment based on the client geographic address and the historical login geographic address information, wherein the remote login environment belongs to the anti-credential stuffing detection environment; and / or, obtaining the historical login request frequency corresponding to the client IP address based on the client IP address, and determining whether the login environment corresponding to the game account login request belongs to a high-frequency login environment based on the historical login request frequency and a preset high-frequency threshold, wherein the high-frequency login environment belongs to the anti-credential stuffing detection environment.

[0061] In this embodiment, account login information includes a username and password, and login environment information includes at least the client IP address. Based on the client IP address, this method provides two ways to verify whether the login environment belongs to the anti-credential stuffing detection environment: The first is remote login environment detection: First, based on the username in the account login information, the system retrieves and obtains the historical login geographic address information corresponding to that username (which can be the geographic location obtained by resolving the IP address of the historical login device). Next, the system determines the client geographic address corresponding to the current client IP address. Then, the system compares the client geographic address of the current login request with the historical login geographic address information. If the client geographic address of the current login request is not in the same city as the historical login geographic address, then the login environment corresponding to the game account login request is determined to be a remote login environment, which is considered one of the anti-credential stuffing detection environments. The second is high-frequency login environment detection: First, based on the client IP address, the system retrieves and obtains the historical login request frequency corresponding to that IP address. Then, the system compares this historical login request frequency with a preset high-frequency threshold. If the historical login request frequency exceeds this high-frequency threshold (i.e., multiple login attempts within a short period), the login environment corresponding to the game account login request is determined to be a high-frequency login environment, which is also considered one of the anti-credential stuffing detection environments. This application embodiment, by detecting logins from different locations and high-frequency login environments, allows the system to more accurately identify potential credential stuffing behaviors, thereby helping to prevent these behaviors from harming game accounts. Credential stuffing attackers typically need to try a large number of username and password combinations, while the detection mechanism for logins from different locations and high-frequency logins can quickly lock down and block these abnormal behaviors, thereby reducing the probability of successful credential stuffing, ensuring user account security, and reducing the losses and inconvenience suffered by users due to account theft. Furthermore, by collecting and analyzing data on logins from different locations and high-frequency logins, game operators can better understand account security and formulate more effective security strategies. In addition to directly blocking credential stuffing behaviors, this detection mechanism can also prevent other risks related to abnormal login behaviors (such as illegal transactions or the posting of prohibited content after account theft).

[0062] Optionally, after step 103, the method further includes: generating an abnormal login prompt message based on the login environment information and the account login information; obtaining the reserved contact information of the game account corresponding to the account login information, and sending the abnormal login prompt message according to the reserved contact information, so as to prompt that the game account was logged into the trap website because the account login information is incorrect and is in an anti-credential collision detection environment, and to prompt that if the account login information is incorrect due to input error, the user should request to log in again.

[0063] In this embodiment, after the client logs into the game account on the trap website using the first fake identity token, in addition to trapping the credential stuffing attacker, the system performs a series of additional operations to ensure the security of the game account and simultaneously provide relevant notifications and prompts to the account owner. First, the system generates an abnormal login prompt message based on the login environment information and account login information. This prompt message clearly states that the current login behavior has been identified as abnormal by the system because it involves incorrect account login information and occurs in an environment marked by the system for credential stuffing detection. Next, the system searches for and retrieves the contact information reserved by the game account corresponding to the login information. This contact information typically includes the account owner's email address, mobile phone number, etc., which are provided by the account owner during account registration or subsequent updates to receive account-related notifications and prompts. Finally, the system sends the previously generated abnormal login prompt message to the account owner based on the retrieved reserved contact information. This message not only informs the account owner that their account has been redirected to a trap website due to abnormal login behavior but also reminds them that if the incorrect account login information was due to input error, they should try logging in again. This application embodiment sends abnormal login notification messages to account owners, enabling the system to inform them of potential security risks to their accounts in a timely manner, allowing them to take appropriate measures to protect their account security. If the incorrect login information is due to input errors, the abnormal login notification message will clearly inform the account owner of this and encourage them to try logging in again, thus avoiding unnecessary trouble for the account owner due to system misjudgment. Through timely notifications and prompts, the system can ensure account security while minimizing the impact on the gaming experience of normal users, thereby improving overall user satisfaction.

[0064] Optionally, in this embodiment of the application, step 102 may be followed by:

[0065] Step 104: After verifying that the account login information is correct and that the login environment belongs to the anti-credential stuffing detection environment, a first real identity token is generated, and the first real identity token is marked as a suspicious token. The first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token. Game behavior data of the game account marked with the suspicious token is obtained. If it is determined based on the game behavior data that the game account login request belongs to credential stuffing, the first real identity token is cancelled so that the game account is disconnected from the game website.

[0066] In this embodiment, when the system verifies that the account login information is correct, but the login environment is under anti-credential stuffing detection (e.g., abnormal IP address, multiple login attempts within a short period of time), the system will not directly reject the login request, but will instead adopt a "monitoring" approach. First, the system generates a first real identity token and marks it as a "suspicious token." This token allows the client to use it to log in to the game website, but the system will also closely monitor it. Next, the system collects game behavior data of the game account marked with the suspicious token within the game website. This data may include login time, game duration, in-game operation habits, etc., which will be used to further determine whether the account login request is indeed a credential stuffing attack. For example, human verification methods are added during high-risk operations such as entering the game, account management, and purchasing items. Subsequent collection of user behavior data, such as mouse movement / click events, is used to determine whether the user is a normal user. If, based on this game behavior data, the system determines that the game account login request is indeed a credential stuffing attack (e.g., there is a significant difference between the game behavior data and the account's historical behavior data), the system will immediately cancel the first real identity token, thereby forcing the game account to disconnect from the game website. In this embodiment, even if the account login information is correct but the login environment is abnormal, the system will not immediately reject the login request. Instead, it will monitor the system by generating a suspicious token, which reduces the possibility of rejecting normal user logins due to system misjudgment. Furthermore, by collecting and analyzing game behavior data, the system can monitor suspicious tokens in real time and respond quickly when credential stuffing attacks are detected, canceling the token and disconnecting the connection, thereby promptly preventing potential security risks. By canceling suspicious tokens and disconnecting the connection, the system can prevent credential stuffing attackers from using stolen account information to maliciously manipulate game accounts, thus protecting account security. For normal users, even if their login environment occasionally becomes abnormal (e.g., changing network environment or device), they can still log in to the game website normally and have a good gaming experience.

[0067] Optionally, after canceling the first real identity token, the method further includes: generating a second fake identity token and sending it to the client, so that the client can log in to the trap website with the game account based on the second fake identity token.

[0068] In this embodiment, in the game account anti-credential stuffing method described above, when the system determines that the login behavior of a game account is suspected of credential stuffing, it will first cancel the original first real identity token, causing the game account to disconnect from the normal connection with the game website. To further confuse and track potential credential stuffers, the system can then perform an additional step: generating a second fake identity token and sending it to the client. After receiving this second fake identity token, the client will attempt to log in to the game account again using it. However, this login will not redirect to the real game website, but rather to a pre-set trap website. This trap website is a mirror image of the real game website, similar in appearance and function, but the game data is completely isolated. By generating and sending the second fake identity token, this embodiment can confuse potential credential stuffers, making them mistakenly believe that they have successfully bypassed the security mechanism and obtained valid login credentials. This misleading can delay the time for credential stuffers to discover the truth, providing an opportunity for the system to take further security measures. When credential stuffers attempt to log in to the trap website using the second fake identity token, the system can collect and analyze their activity data on the trap website. This data helps the system more accurately identify the behavioral patterns of credential stuffing attackers and adjust and improve security strategies accordingly. By redirecting credential stuffing attackers to rigged websites, the system can reduce the impact and burden on legitimate gaming websites. Legitimate gaming websites can focus on providing services to normal users without worrying about performance degradation or security risks caused by credential stuffing attacks. Because the game data on rigged websites is completely isolated from that on legitimate gaming websites, even if credential stuffing attackers perform malicious operations on rigged websites, it will not affect the user data on legitimate gaming websites. This helps protect the security and integrity of user data.

[0069] Optionally, after obtaining the game behavior data of the game account marked with a suspicious token, the method further includes: if it is determined from the game behavior data within a preset time period that the game account login request does not belong to credential stuffing, then the suspicious token mark of the first real identity token is deleted.

[0070] In this embodiment, after the system obtains game behavior data of a game account marked with a suspicious token, it analyzes this data to determine whether the account's login request truly constitutes a credential stuffing attack. If, within a preset time period, the system, through comprehensive analysis of the game behavior data, finds that the account's login request does not meet the characteristics of a credential stuffing attack, the system will remove the suspicious token mark from the first real identity token. This means that the system has confirmed that the login request is secure, and the token can be considered a normal and valid token. By comprehensively analyzing game behavior data within a preset time period, this embodiment allows the system to more accurately determine whether a login request constitutes a credential stuffing attack, thereby reducing the possibility of normal users being wrongly banned due to misjudgment. For normal users, if their login request is temporarily marked as suspicious by the system but is subsequently proven to be secure, the system's removal of the suspicious token mark ensures that they can continue to enjoy a smooth gaming experience without unnecessary interference due to misjudgment. This approach demonstrates the system's high flexibility and adaptability. The system can dynamically adjust its security strategy based on actual conditions (such as user behavior, network environment, etc.) to ensure that it effectively prevents credential stuffing attacks while minimizing inconvenience for normal users.

[0071] Optionally, in this embodiment of the application, step 102 may be followed by:

[0072] Step 105: After verifying that the account login information is correct and that the login environment does not belong to the anti-credential detection environment, a second real identity token is generated and sent to the client so that the client can log in to the game website based on the second real identity token.

[0073] Step 106: If the account login information is incorrect and the login environment does not belong to the anti-collision detection environment, send an account verification failure message to the client.

[0074] In this embodiment, when the system verifies that the account login information in the game account login request from the client is correct, and the login environment does not belong to the preset anti-credential stuffing detection environment (i.e., the login environment is secure and has not triggered any anomalies or risk warnings), the system generates a second real identity token and sends this token to the client. The client then uses this second real identity token to log in to the game website, thereby ensuring that the user can access and enjoy the game services normally. If the system verifies that the account login information is incorrect, and the login environment does not belong to the anti-credential stuffing detection environment (i.e., the account input is incorrect, and the login environment does not raise security concerns), then the system will not perform further anti-credential stuffing processing, but will directly send a message to the client indicating that the account verification failed. In this way, the client user will immediately know that the account information entered is incorrect and has the opportunity to re-enter the correct account information and try to log in again.

[0075] The technical solution of this embodiment achieves the following beneficial effects: Enhanced account security: By implementing a multi-layered anti-credential stuffing strategy, the system ensures that only correct accounts can log in to the game website in a secure environment, effectively preventing the risk of account theft or misuse. Whether it's verifying identity by generating a real identity token or redirecting suspicious login requests to a phishing website, the likelihood of successful credential stuffing attacks is effectively reduced. Reduced false positives and false bans: By collecting and analyzing user behavior data, the system dynamically evaluates login requests within a preset timeframe, enabling more accurate judgment of whether a login request constitutes a credential stuffing attack. This approach reduces the chance of legitimate users being falsely banned due to misjudgments, improving the system's flexibility and adaptability. Improved user experience: For legitimate users, when their login information is correct and the login environment is secure, they can quickly obtain a valid identity token, thus successfully logging into the game website. Simultaneously, when login information is incorrect or anti-credential stuffing detection is triggered, the system can provide immediate feedback, avoiding unnecessary inconvenience for users due to long waiting times or repeated login attempts. Streamlined Processing: For login requests outside the anti-credential stuffing detection environment, the system can quickly process them based on the correctness of the account login information, eliminating the need for complex anti-credential stuffing detection and responses. This simplifies the processing flow and improves system efficiency. Protecting User Data Security: Because the game data on the phishing website is completely isolated from the real game website, even if an attacker performs malicious operations on the phishing website, it will not affect the user data on the real game website. This helps protect the security and integrity of user data. In summary, the above solutions effectively improve the security and user experience of game websites by enhancing account security, reducing false positives and false bans, improving user experience, simplifying processing, collecting and analyzing data, and protecting user data security.

[0076] Furthermore, as Figure 1 In terms of specific implementation, this application provides a game account anti-credential collision detection device, such as... Figure 2 As shown, the device includes:

[0077] The acquisition module is used to respond to a game account login request from a client and acquire the account login information and login environment information carried in the game account login request;

[0078] The verification module is used to verify whether the account login information is correct, and to verify whether the login environment corresponding to the game account login request belongs to the anti-collision detection environment based on the login environment information;

[0079] The processing module is used to determine that the game account login request is a credential stuffing attack when the account login information is incorrect and the login environment belongs to the anti-credential stuffing detection environment. It generates a first fake identity token and sends it to the client so that the client can log in to the trap website based on the first fake identity token. The trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website.

[0080] Optionally, the processing module is further configured to:

[0081] Based on the login environment information and the account login information, an abnormal login prompt message is generated;

[0082] Obtain the reserved contact information of the game account corresponding to the account login information, and send the abnormal login prompt information according to the reserved contact information, so as to prompt that the game account was logged into the trap website because the account login information is incorrect and is in the anti-credential collision detection environment, and to prompt that if the account login information is incorrect due to input error, the login should be requested again.

[0083] Optionally, the processing module is further configured to:

[0084] If the account login information is verified to be correct and the login environment belongs to the anti-credential detection environment, a first real identity token is generated, the first real identity token is marked as a suspicious token, and the first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token;

[0085] The system acquires game behavior data of game accounts marked with suspicious tokens, and if it is determined based on the game behavior data that the game account login request is a credential stuffing attack, it cancels the first real identity token to disconnect the game account from the game website.

[0086] Optionally, the processing module is further configured to:

[0087] A second fake identity token is generated and sent to the client, so that the client can log in to the trap website with the game account based on the second fake identity token.

[0088] Optionally, the processing module is further configured to:

[0089] If, within a preset time period, it is determined based on the game behavior data that the game account login request does not constitute a credential stuffing attack, then the suspicious token marker on the first real identity token is deleted.

[0090] Optionally, the processing module is further configured to:

[0091] If the account login information is verified to be correct and the login environment does not belong to the anti-credential detection environment, a second real identity token is generated and sent to the client so that the client can log in to the game website based on the second real identity token;

[0092] If the account login information is found to be incorrect and the login environment does not belong to the anti-collision brute-force detection environment, an account verification failure message will be sent to the client.

[0093] Optionally, the verification module is used for:

[0094] Based on the username in the account login information, obtain the historical login geographic address information corresponding to the username, determine the client geographic address corresponding to the client IP address, and based on the client geographic address and the historical login geographic address information, determine whether the login environment corresponding to the game account login request belongs to a different location login environment, wherein the different location login environment belongs to the anti-credential stuffing detection environment; and / or,

[0095] Based on the client IP address, obtain the historical login request frequency corresponding to the client IP address, and based on the historical login request frequency and a preset high-frequency threshold, determine whether the login environment corresponding to the game account login request belongs to a high-frequency login environment, wherein the high-frequency login environment belongs to the anti-credential collision detection environment.

[0096] It should be noted that other corresponding descriptions of the functional units involved in the anti-credential stuffing device for game accounts provided in this application embodiment can be found in the following references. Figure 1 The corresponding descriptions in the method will not be repeated here.

[0097] This application also provides a computer device, specifically a personal computer, server, network device, etc. The computer device includes a bus, processor, memory, and communication interface, and may also include input / output interfaces and a display device. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores location information. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0098] Those skilled in the art will understand that the structure of the computer device described above is only a partial structure related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. A specific computer device may include more or fewer components, or combine certain components, or have different component arrangements.

[0099] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0100] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0101] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0102] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0103] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0104] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for preventing database collapsing of game accounts, characterized in that, The method includes: In response to a game account login request from a client, obtain the account login information and login environment information carried in the game account login request; Verify whether the account login information is correct, and verify whether the login environment corresponding to the game account login request belongs to the anti-credential collision detection environment based on the login environment information; If the account login information is found to be incorrect and the login environment is within the anti-credential stuffing detection environment, the game account login request is determined to be a credential stuffing behavior. A first fake identity token is generated and sent to the client, so that the client can log in to the trap website based on the first fake identity token. The trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website. If the account login information is verified to be correct and the login environment belongs to the anti-credential stuffing detection environment, a first real identity token is generated and marked as a suspicious token. The first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token. Game behavior data of the game account marked with the suspicious token is obtained. If it is determined from the game behavior data that the game account login request belongs to credential stuffing, the first real identity token is cancelled so that the game account is disconnected from the game website.

2. The method according to claim 1, characterized in that, After the client logs into the trap website with the game account based on the first fake identity token, the method further includes: Based on the login environment information and the account login information, an abnormal login prompt message is generated; Obtain the reserved contact information of the game account corresponding to the account login information, and send the abnormal login prompt information according to the reserved contact information, so as to prompt that the game account was logged into the trap website because the account login information is incorrect and is in the anti-credential collision detection environment, and to prompt that if the account login information is incorrect due to input error, the login should be requested again.

3. The method according to claim 1, characterized in that, After cancelling the first real identity token, the method further includes: A second fake identity token is generated and sent to the client, so that the client can log in to the trap website with the game account based on the second fake identity token.

4. The method according to claim 1, characterized in that, The method further includes: If, within a preset time period, it is determined based on the game behavior data that the game account login request does not constitute a credential stuffing attack, then the suspicious token marker on the first real identity token is deleted.

5. The method according to claim 1, characterized in that, The method further includes: If the account login information is verified to be correct and the login environment does not belong to the anti-credential detection environment, a second real identity token is generated and sent to the client so that the client can log in to the game website based on the second real identity token; If the account login information is found to be incorrect and the login environment does not belong to the anti-collision brute-force detection environment, an account verification failure message will be sent to the client.

6. The method according to any one of claims 1 to 5, characterized in that, The account login information includes username and password; the login environment information includes client IP address; based on the login environment information, the system verifies whether the login environment corresponding to the game account login request belongs to the anti-credential stuffing detection environment, including: Based on the username in the account login information, obtain the historical login geographic address information corresponding to the username, determine the client geographic address corresponding to the client IP address, and based on the client geographic address and the historical login geographic address information, determine whether the login environment corresponding to the game account login request belongs to a different location login environment, wherein the different location login environment belongs to the anti-credential stuffing detection environment; and / or, Based on the client IP address, obtain the historical login request frequency corresponding to the client IP address, and based on the historical login request frequency and a preset high-frequency threshold, determine whether the login environment corresponding to the game account login request belongs to a high-frequency login environment, wherein the high-frequency login environment belongs to the anti-credential collision detection environment.

7. A credential stuffing protection device for game accounts, characterized in that, The device includes: The acquisition module is used to respond to a game account login request from a client and acquire the account login information and login environment information carried in the game account login request; The verification module is used to verify whether the account login information is correct, and to verify whether the login environment corresponding to the game account login request belongs to the anti-collision detection environment based on the login environment information; The processing module is configured to, when verifying that the account login information is incorrect and the login environment belongs to the anti-credential stuffing detection environment, determine that the game account login request is a credential stuffing attack, generate a first fake identity token and send it to the client, so that the client logs the game account to the trap website based on the first fake identity token, wherein the trap website is a mirror website of the game website, and the game data of the trap website is isolated from the game data of the game website; and, If the account login information is verified to be correct and the login environment belongs to the anti-credential stuffing detection environment, a first real identity token is generated and marked as a suspicious token. The first real identity token is sent to the client so that the client can log in to the game website with the game account based on the first real identity token. Game behavior data of the game account marked with the suspicious token is obtained. If it is determined from the game behavior data that the game account login request belongs to credential stuffing, the first real identity token is cancelled so that the game account is disconnected from the game website.

8. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

9. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

Images