User access method and device based on proof of workload of mobile target defense system

Abstract

The invention provides a user access method and device based on proof of workload of a mobile target defense system. The method comprises the following steps: receiving a resource request sent by a target user; the resource request is allocated to proxy nodes in a hierarchical proxy cluster through the mobile target defense system, identity verification is performed on a target user, and a target proof-of-workload task is obtained and returned to the target user; receiving a solution which is sent by the target user and corresponds to the target workload proof task; in response to the correctness of the solution, returning a service result associated with the resource request; and in response to the solution error, performing identity verification on the target user through the mobile target defense system again. In a mobile target defense system, the security and stability of user access are improved by adopting a user access mechanism driven by the work certificate provided by the invention.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user access method and device based on proof-of-work of a mobile target defense system. Background Art

[0002] Moving Target Defense (MTD) is used to enhance network defense and combat distributed denial of service attacks. It mainly increases the complexity of attacks by dynamically changing server-side network configurations and makes it difficult for attackers to predict and exploit fixed targets.

[0003] Traditional server-side detection methods usually rely on continuous collection of user access information on the evaluation server to determine the legitimacy of the client in mobile target defense. In order to ensure the validity of the above information and accurately track user information, the user's access path needs to remain unchanged. However, the idea of ​​the mobile target defense system is to introduce dynamic changes in the access path, so it is not feasible to directly migrate the traditional server-based detection method to the mobile target defense system.

[0004] It can be seen from this that the user access method based on the mobile target defense system in the related art has the technical problem of low feasibility. Summary of the invention

[0005] The present invention provides a user access method and device based on proof of work of a mobile target defense system, which are used to solve the defect that the user access method based on the mobile target defense system in the prior art is not feasible, and to provide an effective solution to the user access problem in the mobile target defense system.

[0006] The present invention provides a user access method based on proof of work of a mobile target defense system, comprising the following steps: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, authenticating the target user, obtaining a target proof of work task and returning the target proof of work task to the target user; receiving a solution corresponding to the target proof of work task sent by the target user; in response to the solution being correct, returning a service result associated with the resource request; in response to the solution being wrong, re-authenticating the target user through the mobile target defense system.

[0007] According to a user access method based on proof-of-work of a mobile target defense system provided by the present invention, the identity of the target user is authenticated, a target proof-of-work task is obtained and the target proof-of-work task is returned to the target user, including: determining, by the mobile target defense system, the proof-of-work task level of the target user based on a preset proof-of-work level algorithm and according to the current system load rate of the mobile target defense system; generating a target proof-of-work task according to the proof-of-work task level; and returning the target proof-of-work task to the target user.

[0008] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, generating a target proof of work task according to the proof of work task level, comprising: determining an exponential moving average indicator at a current time point, wherein the exponential moving average indicator is used to represent the load rate of the mobile defense system; generating a target proof of work task based on the exponential moving average indicator and a key at the current time point according to the proof of work task level through an authentication agent of the mobile target defense system.

[0009] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, the target proof of work tasks include the following types: no task, hash collision task, asymmetric encryption task and verification code task.

[0010] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, after generating a target proof of work task according to the proof of work task level, the method also includes: determining the next proxy node address through the authentication agent of the mobile target defense system according to the load rate of each of the proxy nodes; and returning the next proxy node address to the target user.

[0011] According to a user access method based on proof-of-work of a mobile target defense system provided by the present invention, the mobile target defense system includes the hierarchical proxy cluster, a central scheduler with a database, and an application server, wherein the hierarchical proxy cluster is composed of the proxy nodes, the central scheduler is used to detect attacks according to user traffic characteristics, and the application server is used to provide actual services.

[0012] The present invention also provides a user access device based on the proof-of-work of a mobile target defense system, comprising the following modules: a first receiving module, used to receive a resource request sent by a target user; a verification module, used to distribute the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, and authenticate the target user, obtain a target proof-of-work task and return the target proof-of-work task to the target user; a second receiving module, used to receive a solution corresponding to the target proof-of-work task sent by the target user; a return module, used to return a service result associated with the resource request in response to the solution being correct; and in response to the solution being wrong, re-authenticate the target user through the mobile target defense system.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a user access method based on proof of work of a mobile target defense system as described above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a user access method based on proof of work of a mobile target defense system as described in any one of the above.

[0015] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned user access methods based on proof of work of a mobile target defense system.

[0016] The user access method and device based on the proof of work of the mobile target defense system provided by the present invention receive a resource request sent by a target user; the resource request is allocated to a proxy node in a hierarchical proxy cluster through the mobile target defense system, and the target user is authenticated to obtain a target proof of work task and return the target proof of work task to the target user. Thus, a user access mechanism driven by the proof of work of the hierarchical proxy node is adopted, which improves the security and stability of user access, thereby solving the deficiency of the existing mobile target defense system in ignoring the user access problem; through user identity authentication and re-verification, it can ensure that only legitimate users can obtain corresponding service results. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of a user access method based on proof of work of a mobile target defense system provided by the present invention.

[0019] Figure 2 It is a flow chart of the process from the first time a user accesses the system to the time when the user obtains actual service provided by the present invention.

[0020] Figure 3 It is a schematic diagram of the grading algorithm of PoW tasks provided by the present invention.

[0021] Figure 4 It is a system architecture diagram of the user access method based on mobile target defense system workload proof provided by the present invention.

[0022] Figure 5 It is a structural schematic diagram of a user access device based on proof of work of a mobile target defense system provided by the present invention.

[0023] Figure 6 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Mobile target defense systems are used to enhance network defense and counter distributed denial of service attacks. Mobile target defense systems mainly increase the complexity of attacks by dynamically changing server-side network configurations and make it difficult for attackers to predict and exploit fixed targets. This approach introduces the dynamics and randomness of the network, enhancing its complexity and making it more resilient to attacks. At present, many high-level mobile target defense system studies emphasize the dynamics of the network and hindering the adversary's reconnaissance of the network structure. For example, some studies propose to regularly or randomly change the host identification address, blur the network identifier, and introduce randomness and dynamics to reduce the predictability of the attacker's understanding of network behavior. By dynamically changing the network configuration and introducing randomness, mobile target defense systems increase the complexity of the attack surface, making it more difficult for attackers to exploit vulnerabilities and interfere with services. In addition, existing low-level mobile target defense system technologies focus on enhancing individual nodes in dynamic distributed scenarios. By randomizing the execution of instructions and memory of each node in the system, it is difficult for attackers to use a unified method to attack multiple dynamic nodes. This approach provides an additional layer of defense for the network, making it more difficult for attackers to target specific nodes.

[0026] However, in the existing mobile target defense system, one of the problems that needs to be solved urgently is the user access method. That is, in the mobile target defense system, since its network architecture is dynamically changing, it is necessary to consider how users who access the defense system can obtain legitimate identities to access the real relay agent and receive services. For this problem, current research often lacks attention to the issue of user access. Only some related technologies involve considering how users who access the system for the first time should connect. For example, one solution is to solve the problem by minimizing the risk of establishing a mapping from the user to the server, but the solution only conducts simulation experiments and does not explain how the mapping establishment interacts with the user. Another solution involves using a cloud-based mobile communication system to evaluate the deployment of the defense architecture of the mobile target defense system, but the user access method only relies on automatic authentication in the cloud environment. Although there are some studies specifically addressing this problem, most of the proposed solutions require that each external user must establish a connection with the access proxy and the authentication server at the same time. This limitation makes the scheduling algorithm unable to fully utilize the traffic information collected by the proxy cluster, which may cause performance problems.

[0027] Then, when the research related to mobile target defense system cannot solve the user access problem, the traditional server-side detection methods usually rely on the continuous collection of user access information on the evaluation server to determine the legitimacy of the client in the mobile target defense system. They usually rely on the characteristic indicators of user traffic or apply deep learning technology to analyze network behavior, including IP packets, TCP streams, HTTP request content size, timestamps and information entropy. In order to ensure the validity of the above information and accurately track user information, it is necessary to keep the user's access path unchanged, and maintaining TCP connections is crucial for these methods. However, the idea of ​​the mobile target defense system is to introduce dynamic changes in the access path, so it is not feasible to directly migrate the traditional server-based detection method to the mobile target defense system. In addition, another limitation of the traditional server-side detection method is that it cannot interrupt user access based on subsequent behavior. Once the user obtains authorization from the server, real-time detection is usually not performed on other layered agents. This limits the ability of these methods to dynamically adjust the security level according to the user's continuous behavior, which may make the system vulnerable to malicious activities.

[0028] For client detection methods, a method that requires users to complete a proof of work (PoW) task to verify its legitimacy is usually used. In related technologies, artificial intelligence technology has been combined to detect SYN flood attacks and dynamically adjust the difficulty of the proof of work task according to the user's reputation. However, these methods all require running on the system's only load balancer, which is challenging in the multi-entry, dynamically changing mobile target defense system architecture. Therefore, there are certain limitations in applying client detection methods in mobile target defense systems. The limitations of client detection methods are mainly reflected in the following aspects. First, these methods require users to complete the PoW task before accessing the system, which may increase the user's burden and access delay. Especially in the mobile target defense system, the dynamic changes in the user's access path may lead to frequent repetition of the PoW task, further increasing the user's burden and access delay. Second, these methods require PoW verification on the system's only load balancer, which is challenging in the multi-entry mobile target defense system architecture. Client access in the mobile target defense system usually involves multiple proxy nodes and cannot simply rely on the verification of a single load balancer.

[0029] In an embodiment of the present invention, a hierarchical PoW identity authentication mechanism is proposed to solve the user access problem in the mobile target defense system, and the PoW identity authentication is combined with the proxy cluster architecture to realize the ability to dynamically adjust the PoW difficulty level; and by adopting exponential backoff and other methods in the proxy cluster, the embodiment of the present invention can flexibly adjust the difficulty of PoW according to information such as system load, user reputation and external traffic conditions, thereby providing a reliable and agile user identity authentication mechanism. It is compared with the traditional mobile target defense system method. The above mechanism of the embodiment of the present invention has achieved certain improvements in mitigating distributed denial of service attacks (DDoS) and ensuring user experience. The embodiment of the present invention can provide an effective solution to the user access problem in the mobile target defense system and improve the security and performance of the system.

[0030] refer to Figure 1 , Figure 1 : is a flow chart of a user access method based on proof of work of a mobile target defense system provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Receive a resource request sent by a target user.

[0031] In the embodiment of the present invention, the user access process and security measures of the mobile target defense system based on shuffle are adopted. The user first verifies his identity on the authentication server through proof of work (PoW) authentication, and then re-authenticates when necessary. This ensures the security and credibility of the system. Only users who have passed the legitimate identity authentication can access the real proxy server and obtain services.

[0032] Step 102, the resource request is allocated to the proxy node in the hierarchical proxy cluster through the mobile target defense system, and the target user is authenticated, the target proof-of-work task is obtained and the target proof-of-work task is returned to the target user.

[0033] A hierarchical proxy cluster is a dynamic, distributed, multi-level service composed of proxy nodes. These nodes can be actual computers or cloud-based containerized hosts, as long as they have independent IP addresses.

[0034] In an embodiment of the present invention, whenever a new user (identified by IP) accesses the system, the new user is directed to a zero-level agent (agent node) for authentication (which can be achieved through DNS resolution during service registration or through a simple redirection from a higher-level agent). The zero-level agent assigns tasks to users, which can take a variety of forms, from simpler tasks to more challenging tasks, such as executing JavaScript scripts, performing hash collision calculations, performing zk-SNARK asymmetric encryption calculations, requesting users to manually click on links, CAPTCHA verification, SMS verification, etc. This hierarchical task mechanism enables the system to provide seamless detection for users without being attacked or fully capable of resisting attack traffic (traditional PoW).

[0035] When facing an attack that reaches or exceeds the server resource limit, a method of verifying the real identity is adopted to adjust the method of automatically redirecting to the verification code verification according to the user's degree of suspicion. It should be noted that in the embodiment of the present invention, the mechanism based on distributed agent information also takes into account the rapid adjustment of the task difficulty level and minimizes the task difficulty and the impact on the user end.

[0036] Step 103: Receive a solution corresponding to the target proof-of-work task sent by the target user.

[0037] Step 104: In response to the solution being correct, a service result associated with the resource request is returned.

[0038] Step 105, in response to a solution error, re-authenticate the target user through the mobile target defense system.

[0039] refer to Figure 2 , Figure 2 This is a flow chart of the process from the first time a user accesses the system to the actual service provided by the present invention, which includes the user, the mobile target defense system (including the verification agent, the relay agent, the database and the scheduler), and the service (system). Specifically, it includes the following steps.

[0040] Step 1: The user requests a resource from the authentication agent.

[0041] Step 2: The verification agent sends a request to the database to obtain the user's reputation.

[0042] Among them, user reputation is pre-set based on user information and user behavior.

[0043] Step 3: The database returns the default user reputation result.

[0044] Among them, since the user is accessing the system for the first time, the database returns the default user reputation.

[0045] Step 4: The verification agent determines the user's proof-of-work task level.

[0046] Step 5: The verification agent returns the target proof-of-work task to the user.

[0047] When the user obtains authorization, the following steps are included: Step 6: The user completes the target proof-of-work task.

[0048] Step 7: The user returns the task answer and resource request to the relay agent.

[0049] Step 8: The intermediate agent verifies the answer.

[0050] Step 9: The relay agent sends a request to register user information to the scheduler.

[0051] Step 10: The scheduler saves the (user) traffic characteristics to the database.

[0052] Step 11: The relay agent requests resources from the service (system).

[0053] Step 12: The service (system) returns the resources to the user.

[0054] The shuffle process of the mobile target defense system includes the following steps: Step 13: The scheduler sends a shuffle signal to the relay agent.

[0055] Step 14: The relay agent returns a re-authentication instruction to the user.

[0056] Step 15: The user requests resources from the authentication agent (ie, returns to step 1).

[0057] The process from the user's first access to the system to obtaining actual services is as follows Figure 2 As shown. Components other than users and services all belong to the Mobile Target Defense System and are within the same subnet. Each proxy has a publicly exposed IP address, and during the DNS registration phase, an authentication proxy (auth-proxy) is associated with the service domain. The initial request of an unregistered user can be divided into two main stages: First, a PoW task is obtained from the authentication proxy (i.e., the proxy node). After completing the task, the user carries the solution to visit the designated relay agent, and if the answer is correct, the function of the relay request is executed to provide the user with real services. If the answer is incorrect, the system records this behavior and redirects the user to the authentication server. In addition, the system's scheduler can actively send a signal to the relay agent during the shuffle process, indicating that the user's verification is invalid, and redirect it to the authentication proxy to restart the process. Authenticated users only need to perform Figure 2Repeat steps 7, 10, 11, and 12 until it is suspected during the shuffling process.

[0058] Through the above steps of the embodiment of the present invention, a resource request sent by a target user is received; the resource request is allocated to a proxy node in a hierarchical proxy cluster through a mobile target defense system, and the target user is authenticated to obtain a target proof-of-work task and return the target proof-of-work task to the target user; a solution corresponding to the target proof-of-work task sent by the target user is received; if the solution is correct, a service result associated with the resource request is returned; if the solution is wrong, the target user is authenticated again through the mobile target defense system. The user access mechanism driven by the proof-of-work of hierarchical proxy nodes is adopted to improve the security and stability of user access, thereby solving the problem of existing mobile target defense systems ignoring user access issues.

[0059] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, identity authentication is performed on a target user, a target proof of work task is obtained, and the target proof of work task is returned to the target user, including: Through the mobile target defense system, based on the preset proof-of-work level algorithm, the target user's proof-of-work task level is determined according to the current system load rate of the mobile target defense system; Generate target proof-of-work tasks according to the proof-of-work task level; Return the target proof-of-work task to the target user.

[0060] In the embodiment of the present invention, during the specific process of user access, the authentication proxy (AuthProxy) needs to create a suitable PoW task for the user who accesses the system for the first time. In order to strike a balance between user experience, resource consumption and security, the embodiment of the present invention implements a grading method for PoW. Through the preset proof-of-work grade algorithm, different levels of authentication tasks can be provided for specific IPs within the architecture of multiple proxy levels and schedulers, based on current system resources and user information. These levels can range from no identity authentication, hash calculation, encryption operation, verification code verification to SMS verification, and their impact on user experience determines the level.

[0061] refer to Figure 3 , Figure 3 It is a schematic diagram of the hierarchical algorithm of the PoW task provided by the present invention, including an input part, an output part and related codes.

[0062] Among them, Algorithm 1 is the preset PoW level algothrirhm. In the input part, "system_resourceS" represents the system resources, that is, the variable of the total amount of resources currently available in the system. "user_creditC" represents the user credit, that is, the numerical value of the user's reputation or historical performance. "req" represents the request, that is, the type or number of proof-of-work tasks requested by the user; in the output part, "PoWtask" represents the task list, which contains the proof-of-work tasks assigned according to the algorithm.

[0063] like Figure 3 As shown, the specific steps of the algorithm include calculating the system load rate, determining whether the system load rate is too high, and performing corresponding operations.

[0064] The calculation of the system load rate includes using the exponential moving average (EMA) to calculate the system load rate R, where EMA ({C i ,req},i) represents the calculation of the current system load rate based on the historical data of the i-th user credit C and request req.

[0065] Determine whether the system load rate is too high. If the system load rate R exceeds the preset threshold Abort_threshold, perform the following operations: Assign users to other proxies: Assign current users to other proxy servers or nodes to reduce the pressure on the current system.

[0066] Destroy itself immediately: The currently executing instance or node stops running to avoid further burdening the system.

[0067] Determine whether the system load rate is too high. If the system load rate is not high (the system load rate R does not exceed the preset threshold), perform the following operations: Traverse all PoW levels p and corresponding thresholds l; Matching system load rate, if a certain threshold l matches the current system load rate R, then perform the following operations: Get task mode key: According to the matching conditions, get a task mode key K, which is used to determine the specific type or configuration of the task.

[0068] Update Shuffle_internal: Update the internal shuffle or reordering mechanism according to the system load rate R to optimize subsequent task allocation.

[0069] Return PoW task: Generate and return a PoW task using the current PoW level p and task mode key K.

[0070] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, a target proof of work task is generated according to the proof of work task level, including: Determine an exponential moving average indicator at a current time point, wherein the exponential moving average indicator is used to represent a load rate of the mobile defense system; Through the authentication agent of the mobile target defense system, the target proof-of-work task is generated according to the proof-of-work task level, based on the exponential moving average indicator and key at the current time point.

[0071] like Figure 3 As shown in the above pre-set proof-of-work level algorithm, the system load rate is currently mainly achieved through an exponential moving average indicator. This indicator affects the shuffle interval, allowing the system to adapt to the PoW level exponentially when attacked.

[0072] The algorithm is called during scheduler shuffle. Hence, information about proxies detected as anomalous can be directly utilized during the shuffle. This allows disconnecting and further verifying users connected to such proxies to mitigate potential threats.

[0073] In an embodiment of the present invention, after determining the user's PoW level, the authentication agent can generate a specific PoW task based on the difficulty index and key at the current time point (for hash tasks, this may be similar to the pattern required for hash value collision; for encryption tasks, it may involve public keys and private keys, etc.).

[0074] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, the target proof of work tasks include the following types: no task, hash collision task, asymmetric encryption task and verification code task.

[0075] Among them, the None task only filters extreme traffic according to the abort threshold of the above algorithm. The Hash Collision Task allows the target hash value to be adjusted to the desired form (for example, use the user's IP + any string to get a hash string starting with 0000). The Asymmetric Encryption Task saves verification agent resources and only requires the transmission of the agreed public and private keys. The client provides evidence and the relay agent checks it. The CAPTCHA Task performs a graphical CAPTCHA task.

[0076] According to a user access method based on proof of work of a mobile target defense system provided by the present invention, after generating a target proof of work task according to the proof of work task level, the method further includes: The authentication agent of the mobile target defense system determines the address of the next proxy node according to the load rate of each proxy node; and returns the address of the next proxy node to the target user.

[0077] In the embodiment of the present invention, the next proxy node address is returned to the target user along with the proof-of-work task.

[0078] In the embodiment of the present invention, the authentication agent selects the next agent address according to the load of each agent to send the task to the user. Specifically, there are four representative types of PoW tasks: no task, hash collision task, asymmetric encryption task and verification code task.

[0079] According to a user access method based on proof-of-work of a mobile target defense system provided by the present invention, the mobile target defense system includes a hierarchical proxy cluster, a central scheduler with a database, and an application server, wherein the hierarchical proxy cluster is composed of proxy nodes, the central scheduler is used to detect attacks based on user traffic characteristics, and the application server is used to provide actual services.

[0080] refer to Figure 4 , Figure 4 This is a system architecture diagram of the user access method based on the proof of work of the mobile target defense system provided by the present invention, which specifically includes the user (Client), the authentication agent (Auth Proxy), the relay agent (Relay Proxy), the database (Database), and the server (Server). Specifically, it includes the authentication process (Authentication), the data flow process (Dataflow), the internal signal process (Internal signal) and the client control process (Client control).

[0081] Among them, the user is directly connected to the relay agent (agent node) (Redirect), the relay agent transmits the user data to the database for user registration (Register User), the mobile target defense system instructs the relay agent to shuffle and re-authorize (shuffle and re-Auth), and the relay agent and the server perform program scheduling (Scheduler).

[0082] In the embodiment of the present invention, the mobile target defense system consists of three main parts: a hierarchical proxy cluster, a central scheduler with a database, and an application server.

[0083] A hierarchical proxy cluster is a dynamic, distributed, multi-level service composed of proxy nodes. These nodes can be actual computers or cloud-based containerized hosts as long as they have independent IP addresses. They handle the main traffic transmission and filtering within the system. The authentication servers of traditional mobile target defense systems are integrated into hierarchical proxy clusters, especially zero-level proxies, to reduce implementation complexity. Zero-level proxies respond to user requests from any source and require users to complete specific tasks to prove their identity. These tasks involve completing proof of work (PoW). Once the user's identity is verified, other proxy levels facilitate relay communication between legitimate users and application servers. Under the control of the scheduler, these proxies can request suspicious users to authenticate.

[0084] The central scheduler, as the core module of the system, is responsible for detecting attacks based on user traffic characteristics and searching for malicious users through user shuffling. The main task of the scheduler is to synchronously determine whether the user needs to re-authenticate and adjust the task difficulty during the shuffling process. It communicates with the internal database and proxy cluster, stores user information on the proxy node, and implements a stateless and easy-to-switch proxy mode.

[0085] The application server is responsible for providing the actual service, and its controller has the highest authority in the system. The controller can view or modify the scheduling information of the proxy cluster in the database and customize the defense strategy.

[0086] In summary, the present invention proposes a user access mechanism based on hierarchical PoW in a mobile target defense system, which solves the deficiency of the existing mobile target defense system in ignoring the user access problem, and implements a hierarchical proof-of-work (PoW) identity authentication mechanism in the shuffle-based proxy switching mobile target defense system to ensure that only legitimate users can access the real relay agent and receive services. The mechanism includes: 1. User access process, which guides users on how to access the distributed proxy cluster in the shuffle-based mobile target defense system. The process starts with the user's first access to the system's authentication server, verifies the user's identity through PoW, and then re-verifies when the verification expires or the behavior is suspicious. This design ensures the security and credibility of the system. Only users who have passed the legitimate identity authentication can access the real proxy server and enjoy the service.

[0087] 2. PoW verification method suitable for multi-entry scenarios. By using user traffic information to calculate the PoW difficulty level, and according to the characteristics of hierarchical agents, the authentication server and the ordinary proxy server are flexibly scheduled, so that the load can be balanced in the face of attacks, and tasks and verification answers can be accurately distributed. In addition, suspicious users can also be re-verified through the scheduler to improve the security and performance of the system.

[0088] 3. An algorithm for using user information collected by a distributed proxy cluster to perform reputation scoring, thereby determining the difficulty of a PoW task. By making full use of information collected by multiple proxies and variable networks, the embodiment of the present invention can accurately evaluate the user's reputation and adjust the difficulty level of the PoW task based on the reputation. Such a design enables the system to adapt to and utilize a dynamic network structure, improving the performance and stability of the system.

[0089] The present invention has the following technical effects: The embodiment of the present invention proposes a user access mechanism solution specially adapted for the mobile target defense system. First, the embodiment of the present invention adopts a hierarchical PoW-driven user access mechanism. This mechanism solves the deficiency of the existing mobile target defense system that ignores the user access problem, and has achieved significant improvements in security, performance and stability. Through user identity authentication and re-verification, it is ensured that only legitimate users can access the real relay agent and receive services. In addition, the embodiment of the present invention also adopts a PoW verification method suitable for multi-entry scenarios, and balances the load and accurately distributes tasks and verification answers by flexibly scheduling authentication servers and ordinary proxy servers. In the embodiment of the present invention, an algorithm for reputation scoring using user information collected by a distributed proxy cluster is used to determine the difficulty of the PoW task. By making full use of the information collected by multiple agents and variable networks, the user's reputation can be accurately evaluated, and the difficulty level of the PoW task can be adjusted according to the reputation. The system is able to adapt to and utilize dynamic network structures to improve performance and stability.

[0090] It should be noted that, in addition to the main scenario, the embodiment of the present invention also considers several possible typical attack scenarios. For example, in the initial generation of the PoW task, the strategy considered is to create a "task-answer" pair and store it for each access user in the first part of the process. However, this mechanism may be vulnerable to attacks such as SYN Flood attacks against the database, causing the database to crash. If the use of the database for shared storage on the entire proxy cluster is avoided, it will lead to an access process (first obtain and solve the problem, then obtain the relay agent address, and finally request the service). Therefore, the implementation of this part is that the authentication agent only stores a set of key data that changes based on time. The level of the PoW task can be calculated at idle time, and the content of the PoW task is only related to these keys. Users can perform asymmetric time-consuming verification without prior knowledge (for example, in a task using zk-SNARK, the client's proof takes 600ms, while the server verification only takes 6ms; the difficulty ratio can be adjusted arbitrarily using hash-based verification). As for verification methods such as verification codes that require storage of each user's information, they are at a higher task level and are protected by the previous filtering method.

[0091] In addition, given the mechanism of PoW, it is possible for an attacker to send a large number of erroneous task completion requests to the relay server, causing the agent to constantly verify the answer and block normal traffic. To address such attacks, on the one hand, specific traffic patterns that indicate such attacks can be selectively recorded and blocked. On the other hand, by leveraging the characteristics of the agent cluster, congestion can be limited to a single relay agent node. Subsequently, the scheduler can restart the agent for shuffle scheduling. As for the authentication server, since it generates PoW tasks based on multiple keys to fill the task template, the probability of overload is significantly lower than that of the relay agent in the threat model. For other more common attacks, the defense methods outlined earlier can also be integrated into the detection module of the agent or scheduler.

[0092] The user access device based on proof of work of a mobile target defense system provided by the present invention is described below. The user access device based on proof of work of a mobile target defense system described below and the user access method based on proof of work of a mobile target defense system described above can be referenced to each other.

[0093] refer to Figure 5 , Figure 5 It is a structural diagram of a user access device based on proof of work of a mobile target defense system provided by the present invention, which includes a first receiving module 501, a verification module 502, a second receiving module 503 and a return module 504.

[0094] The first receiving module 501 is used to receive a resource request sent by a target user; the verification module 502 is used to allocate the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, and authenticate the target user, obtain a target proof-of-work task and return the target proof-of-work task to the target user; the second receiving module 503 is used to receive a solution corresponding to the target proof-of-work task sent by the target user; the return module 504 is used to return a service result associated with the resource request in response to the solution being correct; in response to the solution being wrong, re-authenticate the target user through the mobile target defense system.

[0095] Specifically, the user access device based on proof of work of a mobile target defense system provided by the present invention can implement all the method steps implemented by the user access method embodiment based on proof of work of a mobile target defense system, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0096] Figure 6 is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 complete mutual communication through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a user access method based on the proof of work of the mobile target defense system, the method comprising: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, and authenticating the target user, obtaining a target proof of work task and returning the target proof of work task to the target user; receiving a solution corresponding to the target proof of work task sent by the target user; in response to a correct solution, returning a service result associated with the resource request; in response to an error in the solution, re-authenticating the target user through the mobile target defense system.

[0097] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0098] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the user access method based on the proof-of-work of the mobile target defense system provided by the above-mentioned methods, and the method includes: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, and authenticating the target user, obtaining a target proof-of-work task and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; in response to a correct solution, returning a service result associated with the resource request; in response to an error in the solution, re-authenticating the target user through the mobile target defense system.

[0099] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the user access method based on the proof-of-work of the mobile target defense system provided by the above-mentioned methods, the method comprising: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, and authenticating the target user, obtaining a target proof-of-work task and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; in response to a correct solution, returning a service result associated with the resource request; in response to an incorrect solution, re-authenticating the target user through the mobile target defense system.

[0100] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0101] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A user access method based on proof of work of a mobile target defense system, characterized in that: include: Receive resource requests sent by target users; Allocating the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; Receiving a solution corresponding to the target proof-of-work task sent by the target user; In response to the solution being correct, returning a service result associated with the resource request; In response to the resolution error, the target user is re-authenticated through the mobile target defense system.

2. The user access method based on proof of work of mobile target defense system according to claim 1 is characterized in that: The authenticating the target user, obtaining a target proof-of-work task and returning the target proof-of-work task to the target user includes: Determine, by the mobile target defense system, the proof-of-work task level of the target user based on a preset proof-of-work level algorithm and according to the current system load rate of the mobile target defense system; Generating a target proof-of-work task according to the proof-of-work task level; Return the target proof-of-work task to the target user.

3. The user access method based on proof of work of mobile target defense system according to claim 2 is characterized in that: Generating a target proof-of-work task according to the proof-of-work task level includes: Determining an exponential moving average indicator at a current time point, wherein the exponential moving average indicator is used to represent a load rate of the mobile defense system; Through the authentication agent of the mobile target defense system, a target proof-of-work task is generated according to the proof-of-work task level, based on the exponential moving average indicator and the key at the current time point.

4. The user access method based on proof of work of a mobile target defense system according to claim 3 is characterized in that: The target workload proof tasks include the following types: no task, hash collision task, asymmetric encryption task and verification code task.

5. The user access method based on proof of work of mobile target defense system according to claim 2 is characterized in that: After generating a target proof-of-work task according to the proof-of-work task level, the method further includes: The authentication agent of the mobile target defense system determines the address of the next proxy node according to the load rate of each proxy node; and returns the address of the next proxy node to the target user.

6. The user access method based on proof of work of a mobile target defense system according to any one of claims 1 to 5, characterized in that: The mobile target defense system includes the hierarchical proxy cluster, a central scheduler with a database, and an application server, wherein the hierarchical proxy cluster is composed of the proxy nodes, the central scheduler is used to detect attacks according to user traffic characteristics, and the application server is used to provide actual services.

7. A user access device based on proof of work of a mobile target defense system, characterized in that: include: A first receiving module, used for receiving a resource request sent by a target user; A verification module, configured to distribute the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, authenticate the target user, obtain a target proof-of-work task, and return the target proof-of-work task to the target user; A second receiving module is used to receive a solution corresponding to the target proof-of-work task sent by the target user; The return module is used to return the service result associated with the resource request in response to the solution being correct; and to re-authenticate the target user through the mobile target defense system in response to the solution being wrong.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the user access method based on proof of work of a mobile target defense system as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the user access method based on proof of work of a mobile target defense system as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the user access method based on proof of work of a mobile target defense system as described in any one of claims 1 to 6 is implemented.

Images