User Access Method and Device Based on Proof-of-Work for Moving Target Defense Systems

Abstract

This invention provides a user access method and apparatus based on proof-of-work in a mobile target defense system. The method includes receiving a resource request from a target user; allocating the resource request to proxy nodes in a hierarchical proxy cluster through the mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task from the target user; returning a service result associated with the resource request if the solution is correct; and re-authenticating the target user through the mobile target defense system if the solution is incorrect. By employing the proof-of-work driven user access mechanism provided by this invention, the security and stability of user access are improved in the mobile target defense system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a user access method and apparatus based on proof-of-work for a mobile target defense system. Background Technology

[0002] Moving Target Defense (MTD) is used to enhance network defenses and combat distributed denial-of-service attacks. It mainly increases the complexity of attacks by dynamically changing the network configuration on the server side, making it difficult for attackers to predict and exploit fixed targets.

[0003] Traditional server-side detection methods in mobile target defense typically rely on the continuous collection of user access information on an evaluation server to determine client legitimacy. To ensure the validity of this information and accurately track user information, the user's access path needs to remain constant. However, the core idea of ​​mobile target defense systems is to introduce dynamic changes in access paths; therefore, directly migrating traditional server-based detection methods to mobile target defense systems is not feasible.

[0004] Therefore, it can be seen that the user access method based on the mobile target defense system in the relevant technology has the technical problem of low feasibility. Summary of the Invention

[0005] This invention provides a user access method and apparatus based on proof-of-work for a mobile target defense system, which addresses the shortcomings of existing user access methods based on mobile target defense systems in terms of low feasibility, and provides an effective solution to the user access problem in mobile target defense systems.

[0006] This invention provides a user access method based on proof-of-work in a mobile target defense system, comprising the following steps: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; returning a service result associated with the resource request in response to a correct solution; and re-authenticating the target user through the mobile target defense system in response to an incorrect solution.

[0007] According to a user access method based on proof-of-work in a mobile target defense system provided by the present invention, the step of authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user includes: determining the proof-of-work task level of the target user based on a preset proof-of-work level algorithm and the current system load rate of the mobile target defense system through the mobile target defense system; generating a target proof-of-work task according to the proof-of-work task level; and returning the target proof-of-work task to the target user.

[0008] According to the present invention, a user access method based on proof-of-work in a mobile target defense system includes generating a target proof-of-work task according to the proof-of-work task level, comprising: determining an exponential moving average index at the current time point, wherein the exponential moving average index is used to represent the load rate of the mobile target defense system; and generating the target proof-of-work task through the authentication proxy of the mobile target defense system, based on the proof-of-work task level, the exponential moving average index at the current time point, and a key.

[0009] According to the present invention, a user access method based on proof-of-work for a mobile target defense system is provided, wherein the target proof-of-work task includes the following types: no task, hash collision task, asymmetric encryption task, and CAPTCHA task.

[0010] According to the present invention, a user access method based on proof-of-work in a mobile target defense system, after generating a target proof-of-work task according to the proof-of-work task level, the method further includes: determining the address of the next proxy node through the authentication proxy of the mobile target defense system according to the load rate of each proxy node; and returning the address of the next proxy node to the target user.

[0011] According to the present invention, a user access method based on proof-of-work of a mobile target defense system is provided. The mobile target defense system includes a hierarchical proxy cluster, a central scheduler with a database, and an application server. The hierarchical proxy cluster is composed of proxy nodes. The central scheduler is used to detect attacks based on user traffic characteristics. The application server is used to provide actual services.

[0012] This invention also provides a user access device based on proof-of-work in a mobile target defense system, comprising the following modules: a first receiving module for receiving a resource request sent by a target user; a verification module for allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; a second receiving module for receiving a solution sent by the target user corresponding to the target proof-of-work task; and a return module for returning a service result associated with the resource request in response to a correct solution, and re-authenticating the target user through the mobile target defense system in response to an incorrect solution.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the user access method based on proof-of-work of a moving target defense system as described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the user access method based on proof-of-work for a moving target defense system as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the user access method based on proof-of-work for a moving target defense system as described above.

[0016] The present invention provides a user access method and apparatus based on proof-of-work in a mobile target defense system. The method receives resource requests sent by target users; allocates the resource requests to proxy nodes in a hierarchical proxy cluster through the mobile target defense system; authenticates the target user; obtains a target proof-of-work task; and returns the target proof-of-work task to the target user. Thus, by employing a user access mechanism driven by proof-of-work from hierarchical proxy nodes, the security and stability of user access are improved, thereby addressing the shortcomings of existing mobile target defense systems that neglect user access issues. Through user authentication and re-authentication, it can be ensured that only legitimate users can obtain the corresponding service results. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the user access method based on proof-of-work for a moving target defense system provided by the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the process from a user's initial access to the system to obtaining actual services, provided by the present invention.

[0020] Figure 3 This is a schematic diagram of the hierarchical algorithm for PoW tasks provided by the present invention.

[0021] Figure 4 This is a system architecture diagram of the user access method based on proof-of-work for a mobile target defense system provided by the present invention.

[0022] Figure 5 This is a schematic diagram of the user access device based on proof of workload of the moving target defense system provided by the present invention.

[0023] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0025] Mobile target defense (MDF) systems are used to enhance network defenses and combat distributed denial-of-service (DDoS) attacks. MDF systems primarily increase attack complexity by dynamically changing server-side network configurations, making it harder for attackers to predict and exploit fixed targets. This approach introduces dynamism and randomness into the network, enhancing its complexity and making it more resilient to attacks. Many current high-level MDF research emphasizes network dynamism and hindering adversaries' reconnaissance of the network structure. For example, some studies propose periodically or randomly changing host identifier addresses, obfuscating network identifiers, and introducing randomness and dynamism to reduce the predictability of attackers' understanding of network behavior. By dynamically changing network configurations and introducing randomness, MDF systems increase the complexity of the attack surface, making it harder for attackers to exploit vulnerabilities and disrupt services. Furthermore, existing low-level MDF technologies focus on enhancing individual nodes in dynamic distributed scenarios. By randomizing the instruction and memory execution of individual nodes in the system, it makes it difficult for attackers to use a uniform approach to attack multiple dynamic nodes. This approach provides an additional layer of defense for the network, making it harder for attackers to target specific nodes.

[0026] However, a critical issue in existing mobile target defense systems (MDS) is user access. Because the network architecture of MDS is dynamically changing, it's essential to consider how users gain legitimate identity to access the actual relay agents and receive services. Current research often neglects user access. Only some related technologies address how first-time users should connect. For example, one solution minimizes the risk of establishing a user-server mapping, but this only involves simulations and doesn't clarify how this mapping interacts with the user. Other solutions involve using cloud-based mobile communication systems to evaluate MDS architecture deployment, but user access relies solely on automatic authentication in the cloud environment. While some research addresses this issue, most solutions require each external user to connect to both the access agent and the authentication server simultaneously. This limitation prevents scheduling algorithms from fully utilizing traffic information collected by the agent cluster, potentially leading to performance issues.

[0027] Therefore, given that research on mobile target defense systems (MDX) fails to address user access issues, traditional server-side detection methods in MDX typically rely on continuous collection of user access information on an evaluation server to determine client legitimacy. These methods often depend on characteristic metrics of user traffic or apply deep learning techniques to analyze network behavior, including IP packets, TCP streams, HTTP request content size, timestamps, and entropy. To ensure the validity of this information and accurately track user information, the user's access path needs to remain constant, making the maintenance of TCP connections crucial for these methods. However, the core idea of ​​MDX is to introduce dynamic changes in access paths, making it impractical to directly migrate traditional server-based detection methods to MDX. Furthermore, another limitation of traditional server-side detection methods is their inability to interrupt user access based on subsequent behavior. Once a user is authorized by the server, real-time detection is typically not performed on other layered proxies. This limits the ability of these methods to dynamically adjust security levels based on continuous user behavior, potentially making the system vulnerable to malicious attacks.

[0028] For client-side detection methods, a common approach is to require users to complete a Proof-of-Work (PoW) task to verify their legitimacy. Related technologies have incorporated artificial intelligence to detect SYN flood attacks and dynamically adjust the difficulty of the PoW task based on user reputation. However, these methods all require operation on a single load balancer, which is challenging in multi-entry, dynamically changing mobile target defense system architectures. Therefore, applying client-side detection methods in mobile target defense systems also has certain limitations. These limitations are mainly reflected in the following aspects: First, these methods require users to complete a PoW task before accessing the system, which may increase the user's burden and access latency. Especially in mobile target defense systems, dynamic changes in user access paths may lead to frequent repetition of PoW tasks, further increasing the user's burden and access latency. Second, these methods require PoW verification on a single load balancer, which is challenging in multi-entry mobile target defense system architectures. Client access in mobile target defense systems typically involves multiple proxy nodes, making it impossible to simply rely on verification by a single load balancer.

[0029] This invention proposes a layered Proof-of-Work (PoW) authentication mechanism to address user access issues in mobile target defense systems. By combining PoW authentication with a proxy cluster architecture, it achieves the ability to dynamically adjust the PoW difficulty level. Furthermore, by employing exponential fallback within the proxy cluster, this invention can flexibly adjust the PoW difficulty based on system load, user reputation, and external traffic conditions, thereby providing a reliable and agile user authentication mechanism. A comparison with traditional mobile target defense system methods has been made. The mechanism described in this invention achieves improvements in mitigating distributed denial-of-service (DDoS) attacks and ensuring user experience. This invention provides an effective solution to user access problems in mobile target defense systems, enhancing system security and performance.

[0030] refer to Figure 1 , Figure 1 This is a flowchart illustrating the user access method based on proof-of-work for a moving target defense system provided by the present invention, as shown below. Figure 1 As shown, the method includes the following:

[0031] Step 101: Receive the resource request sent by the target user.

[0032] In this embodiment of the invention, a shuffling-based mobile target defense system is employed for user access procedures and security measures. Users first verify their identity on the authentication server using Proof-of-Work (PoW) authentication, and then re-authenticate as needed. This ensures the system's security and trustworthiness; only users with valid authentication can access the legitimate proxy server and obtain services.

[0033] Step 102: The resource request is allocated to the proxy node in the hierarchical proxy cluster through the mobile target defense system, the target user is authenticated, the target proof-of-work task is obtained, and the target proof-of-work task is returned to the target user.

[0034] A tiered proxy cluster is a dynamic, distributed, multi-level service composed of proxy nodes. These nodes can be physical computers or cloud-based containerized hosts, as long as they have independent IP addresses.

[0035] In this embodiment of the invention, whenever a new user (identified by IP address) accesses the system, the new user is redirected to a Level 0 proxy (proxy node) for authentication (this can be achieved through DNS resolution during service registration or through a simple redirection from a higher-level proxy). The Level 0 proxy assigns tasks to the user, which can take various forms, from simpler to more challenging tasks, such as executing JavaScript scripts, performing hash collision calculations, performing zk-SNARK asymmetric encryption calculations, requesting the user to manually click a link, CAPTCHA verification, SMS verification, etc. This hierarchical task mechanism enables the system to provide seamless user detection without being attacked or fully capable of withstanding attack traffic (traditional PoW).

[0036] When faced with an attack that reaches or exceeds server resource limits, a method for verifying real identity is adopted. The method of automatically redirecting to CAPTCHA verification is adjusted according to the user's level of suspicion. It should be noted that in the embodiments of the present invention, the mechanism based on distributed proxy information also considers the rapid adjustment of task difficulty level and minimizes the impact of task difficulty and user terminal.

[0037] Step 103: Receive the solution sent by the target user that corresponds to the target proof-of-work task.

[0038] Step 104: In response to a correct solution, return the service result associated with the resource request.

[0039] Step 105: In response to the solution error, re-authenticate the target user through the mobile target defense system.

[0040] refer to Figure 2 , Figure 2 This is a schematic diagram illustrating the process from a user's initial access to the system to obtaining actual services, as provided by the present invention. It includes a user, a mobile target defense system (including an authentication proxy, relay proxy, database, and scheduler), and services (the system). Specifically, it includes the following steps.

[0041] Step 1: The user requests resources from the verification agent.

[0042] Step 2: Verify that the agent sends a request to the database to obtain the user's reputation.

[0043] User reputation is preset based on user information and user behavior.

[0044] Step 3: The database returns the default user reputation result.

[0045] Since this is the user's first time accessing the system, the database returns the default user reputation.

[0046] Step 4: Verify that the agent determines the user's proof-of-work task level.

[0047] Step 5: Verify that the agent returns the target proof-of-work task to the user.

[0048] If the user obtains authorization, the following steps are included:

[0049] Step 6: The user completes the target workload proof task.

[0050] Step 7: The user returns the task answer and resource request to the relay agent.

[0051] Step 8: Intermediate agent verifies the answer.

[0052] Step 9: The relay agent sends a request for registered user information to the scheduler.

[0053] Step 10: The scheduler saves (user) traffic characteristics to the database.

[0054] Step 11: The relay agent requests resources from the service (system).

[0055] Step 12: The service (system) returns the resources to the user.

[0056] The shuffle process in a moving target defense system includes the following steps:

[0057] Step 13: The scheduler sends a shuffle signal to the relay agent.

[0058] Step 14: The relay agent returns a re-authentication instruction to the user.

[0059] Step 15: The user requests resources from the verification agent (i.e., returns to step 1).

[0060] The process from a user's initial access to the system to receiving actual service is as follows: Figure 2As shown. Components other than users and services belong to the mobile target defense system and are located within the same subnet. Each proxy has a publicly exposed IP address, and during the DNS registration phase, the authentication proxy (auth-proxy) is associated with the service domain. The initial request from an unregistered user can be divided into two main phases: First, a PoW task is obtained from the authentication proxy (i.e., the proxy node). After completing the task, the user carries the solution to the designated relay proxy. If the answer is correct, the relay request function is executed, providing the user with the actual service. If the answer is incorrect, the system logs this behavior and redirects the user to the authentication server. Furthermore, the system's scheduler can proactively signal to the relay proxy during the shuffling process that the user's authentication is invalid and redirect them to the authentication proxy to restart the process. Authenticated users only need to execute... Figure 2 Steps 7, 10, 11, and 12 are performed until suspicion arises during the shuffling process.

[0061] Through the steps described in this embodiment of the invention, a resource request sent by a target user is received; the resource request is allocated to a proxy node in a hierarchical proxy cluster through a mobile target defense system, and the target user is authenticated to obtain a target proof-of-work task, which is then returned to the target user; a solution corresponding to the target proof-of-work task is received from the target user; if the solution is correct, a service result associated with the resource request is returned; if the solution is incorrect, the target user is re-authenticated through the mobile target defense system. The user access mechanism driven by proof-of-work from hierarchical proxy nodes improves the security and stability of user access, thereby addressing the shortcomings of existing mobile target defense systems that neglect user access issues.

[0062] According to the present invention, a user access method based on proof-of-work in a mobile target defense system includes authenticating the target user, obtaining the target proof-of-work task, and returning the target proof-of-work task to the target user, comprising:

[0063] The mobile target defense system determines the workload proof task level of the target user based on a preset work proof level algorithm and the current system load rate of the mobile target defense system.

[0064] Generate the target proof-of-work task based on the proof-of-work task level;

[0065] Return the target proof-of-work task to the target user.

[0066] In this embodiment of the invention, during the user access process, the AuthProxy needs to create appropriate PoW tasks for users accessing the system for the first time. To achieve a balance between user experience, resource consumption, and security, this embodiment implements a tiered approach to PoW. Through a preset proof-of-work (PoW) level algorithm, different levels of authentication tasks can be provided to specific IP addresses within a multi-proxy level and scheduler architecture, based on current system resources and user information. These levels range from no authentication, hash calculation, encryption operations, CAPTCHA verification to SMS verification, and their impact on user experience determines the level.

[0067] refer to Figure 3 , Figure 3 This is a schematic diagram of the hierarchical algorithm for PoW tasks provided by the present invention, including the input part, the output part, and related code.

[0068] Algorithm 1 is the preset Proof-of-Work (PoW) level algorithm. In the input section, "system_resourceS" represents system resources, i.e., the total amount of currently available system resources. "user_creditC" represents user credit, i.e., the user's reputation or historical performance value. "req" represents the request, i.e., the type or number of proof-of-work tasks the user requests to perform. In the output section, "PoWtask" represents the task list, containing the proof-of-work tasks assigned according to the algorithm.

[0069] like Figure 3 As shown, the specific steps of the algorithm include calculating the system load rate, determining whether the system load rate is too high, and performing corresponding operations.

[0070] The calculation of system load factor includes using the Exponential Moving Average (EMA) to calculate the system load factor R, where EMA ({C i ,req},i) represents the calculation of the current system load rate based on the historical data of the i-th user's credit C and request req.

[0071] Determine if the system load rate is too high. If the system load rate R exceeds the preset threshold Abort_threshold, perform the following operations:

[0072] Distribute users to other proxies: Distribute the current user to other proxy servers or nodes to reduce the load on the current system.

[0073] Immediately destroy itself: The currently running instance or node stops running to avoid further burdening the system.

[0074] Determine if the system load rate is too high. If the system load rate is not high (system load rate R does not exceed the preset threshold), then perform the following operations:

[0075] Iterate through all PoW levels p and their corresponding thresholds l;

[0076] Match the system load rate. If a certain threshold l matches the current system load rate R, then perform the following operations:

[0077] Get Task Mode Key: Based on the matching conditions, get a task mode key K. The task mode key K is used to determine the specific type or configuration of the task.

[0078] Update Shuffle_internal: Update the internal shuffle or rearrangement mechanism based on the system load rate R to optimize subsequent task allocation.

[0079] Return PoW Task: Generates and returns a PoW task using the current PoW level p and the task mode key K.

[0080] According to the present invention, a user access method based on proof-of-work in a mobile target defense system generates a target proof-of-work task according to the proof-of-work task level, including:

[0081] Determine the exponential moving average indicator for the current time point, where the exponential moving average indicator is used to represent the load rate of the mobile defense system;

[0082] The authentication agent of the mobile target defense system generates a target proof-of-work task based on the proof-of-work task level, the exponential moving average indicator at the current time, and the key.

[0083] like Figure 3 As shown in the aforementioned preset proof-of-work (PoW) level algorithm, the system load factor is currently primarily implemented using an exponential moving average (EMA) metric. This metric affects the shuffle interval, allowing for exponential adjustments to the system's PoW-level adaptation rate in the event of an attack.

[0084] This algorithm is invoked during scheduler shuffling. Therefore, information about agents detected as anomalous can be directly utilized during the shuffling process. This allows for disconnection and further verification of users connected to such agents, mitigating potential threats.

[0085] In this embodiment of the invention, after determining the user's PoW level, the authentication agent can generate a specific PoW task based on the difficulty index and key at the current time (for hashing tasks, this may be similar to the pattern required for hash collisions; for cryptographic tasks, it may involve public and private keys, etc.).

[0086] According to the present invention, a user access method based on proof-of-work for a mobile target defense system is provided. The target proof-of-work task includes the following types: no task, hash collision task, asymmetric encryption task, and CAPTCHA task.

[0087] The tasks include: No task, which filters extreme traffic based solely on the termination threshold of the aforementioned algorithm; Hash Collision task, which allows adjusting the target hash value to the desired form (e.g., using the user's IP address plus any string to obtain a hash string starting with 0000); Asymmetric Encryption task, which saves verification broker resources by only requiring the transmission of the agreed public and private keys; the client provides evidence, which the relay broker checks; and CAPTCHA task, which performs a graphical CAPTCHA task.

[0088] According to the present invention, a user access method based on proof-of-work for a mobile target defense system, after generating a target proof-of-work task according to the proof-of-work task level, the method further includes:

[0089] The authentication proxy of the mobile target defense system determines the address of the next proxy node based on the load rate of each proxy node, and returns the address of the next proxy node to the target user.

[0090] In this embodiment of the invention, the address of the next proxy node is returned to the target user along with the proof-of-work task.

[0091] In this embodiment of the invention, the authentication agent selects the next agent address to distribute the task to the user based on the load of each agent. Specifically, there are four representative types of PoW tasks: no-task, hash collision task, asymmetric encryption task, and CAPTCHA task.

[0092] According to the present invention, a user access method based on proof-of-work of a mobile target defense system is provided. The mobile target defense system includes a hierarchical proxy cluster, a central scheduler with a database, and an application server. The hierarchical proxy cluster consists of proxy nodes, the central scheduler is used to detect attacks based on user traffic characteristics, and the application server is used to provide actual services.

[0093] refer to Figure 4 , Figure 4This is a system architecture diagram of the user access method based on proof-of-work in a mobile target defense system provided by the present invention. Specifically, it includes a user (Client), an authentication proxy, a relay proxy, a database, and a server. Specifically, it includes an authentication process, a data flow process, an internal signal process, and a client control process.

[0094] In this process, users are directly connected to relay agents (agent nodes). The relay agents transmit user data to the database for user registration. The mobile target defense system instructs the relay agents to perform shuffle and re-authorization. The relay agents and servers perform program scheduling.

[0095] In this embodiment of the invention, the mobile target defense system consists of three main parts: a hierarchical agent cluster, a central scheduler with a database, and an application server.

[0096] A tiered proxy cluster is a dynamic, distributed, multi-level service composed of proxy nodes. These nodes can be physical computers or cloud-based containerized hosts, as long as they have independent IP addresses. They handle the main traffic transmission and filtering within the system. Authentication servers from traditional mobile target defense systems are integrated into the tiered proxy cluster, particularly the level-0 proxy, to reduce implementation complexity. The level-0 proxy responds to user requests from any source and requires the user to complete specific tasks to prove their identity. These tasks involve completing proof-of-work (PoW). Once the user's identity is verified, other proxy levels facilitate relay communication between legitimate users and the application server. Under the control of a scheduler, these proxies can request authentication from suspicious users.

[0097] The central scheduler, as the core module of the system, is responsible for detecting attacks based on user traffic characteristics and searching for malicious users through user shuffling. The scheduler's main task is to simultaneously determine whether users need re-authentication and adjust the task difficulty during the shuffling process. It communicates with the internal database and proxy cluster, stores user information on proxy nodes, and implements a stateless, easily switchable proxy mode.

[0098] The application server is responsible for providing the actual services, and its controller has the highest system privileges. This controller can view or modify the scheduling information of the proxy cluster in the database and customize defense strategies.

[0099] In summary, this invention proposes a layered Proof-of-Work (PoW) driven user access mechanism based on a mobile target defense system, addressing the shortcomings of existing mobile target defense systems that neglect user access issues. Furthermore, it implements a layered Proof-of-Work (PoW) authentication mechanism in a shuffle-based proxy switching mobile target defense system to ensure that only legitimate users can access the real relay proxy and receive services. The mechanism includes:

[0100] 1. User Access Process: This process guides users through the connection to the distributed proxy cluster in a shuffle-based mobile target defense system. The process begins with the user's initial access to the system's authentication server, where the user's identity is verified using Proof-of-Work (PoW). Re-authentication is then performed if verification expires or behavior is suspicious. This design ensures the system's security and trustworthiness; only users with legitimate authentication can access the actual proxy server and enjoy the services.

[0101] 2. A PoW verification method suitable for multi-entry scenarios. By utilizing user traffic information to calculate the PoW difficulty level and flexibly scheduling authentication servers and ordinary proxy servers based on the characteristics of tiered proxies, the system can balance the load and accurately distribute tasks and verification answers when facing attacks. Furthermore, the scheduler can perform operations such as re-verification of suspicious users to improve system security and performance.

[0102] 3. An algorithm for credit scoring using user information collected by a distributed agent cluster, which then determines the difficulty of the PoW task. By fully utilizing information collected through multiple agents and a variable network, this embodiment of the invention can accurately assess a user's creditworthiness and adjust the difficulty level of the PoW task accordingly. This design allows the system to adapt to and utilize dynamic network structures, improving system performance and stability.

[0103] The present invention has the following technical effects:

[0104] This invention proposes a user access mechanism specifically adapted for mobile target defense systems. First, it employs a layered PoW-driven user access mechanism. This mechanism addresses the shortcomings of existing mobile target defense systems that neglect user access issues, significantly improving security, performance, and stability. Through user authentication and re-authentication, it ensures that only legitimate users can access the real relay agent and receive services. Furthermore, this invention employs a PoW authentication method suitable for multi-entry scenarios, balancing the load and accurately distributing tasks and verification answers by flexibly scheduling authentication servers and ordinary proxy servers. This invention also utilizes a reputation scoring algorithm based on user information collected by a distributed proxy cluster to determine the difficulty of PoW tasks. By fully leveraging information collected from multiple proxies and variable networks, it accurately assesses user reputation and adjusts the difficulty level of PoW tasks accordingly. This allows the system to adapt to and utilize dynamic network structures, improving performance and stability.

[0105] It should be noted that, in addition to the main scenarios, this embodiment of the invention also considers several possible typical attack scenarios. For example, in the initial generation of the PoW task, the strategy considered is to create a "task-answer" pair and store it for each accessing user in the first part of the process. However, this mechanism may be vulnerable to attacks such as SYN Flood attacks targeting the database, leading to database crashes. If shared storage of the database across the entire proxy cluster is avoided, the access process (first obtain and resolve the problem, then obtain the relay proxy address, and finally request the service) will be affected. Therefore, for this part of the implementation, the authentication proxy only stores a set of key data that changes over time. The level of the PoW task can be calculated during idle time, and the content of the PoW task is only related to these keys. Users can perform asymmetric time-consuming verification without prior knowledge (e.g., in a task using zk-SNARK, the client's proof takes 600ms, while the server verification only takes 6ms; the difficulty ratio can be arbitrarily adjusted using hash-based verification). As for verification methods such as CAPTCHA that require storing information for each user, they are at a higher task level and are protected by the previous filtering methods.

[0106] Furthermore, considering the PoW mechanism, attackers could potentially send a large number of erroneous task completion requests to the relay server, causing the agent to continuously verify answers and block normal traffic. To mitigate such attacks, on one hand, specific traffic patterns indicating such attacks can be selectively logged and blocked. On the other hand, leveraging the characteristics of agent clusters, congestion can be limited to a single relay agent node. Subsequently, the scheduler can restart the agent for shuffling scheduling. As for the authentication server, since it generates PoW tasks based on multiple keys to populate the task template, the probability of overload is significantly lower than that of the relay agent in the threat model. For other more common attacks, the defense methods outlined above can also be integrated into the detection modules of the agent or scheduler.

[0107] The following describes the user access device based on proof of workload of mobile target defense system provided by the present invention. The user access device based on proof of workload of mobile target defense system described below can be referred to in correspondence with the user access method based on proof of workload of mobile target defense system described above.

[0108] refer to Figure 5 , Figure 5 This is a schematic diagram of the user access device based on proof of workload of mobile target defense system provided by the present invention, which includes a first receiving module 501, a verification module 502, a second receiving module 503 and a return module 504.

[0109] The first receiving module 501 is used to receive a resource request sent by a target user; the verification module 502 is used to allocate the resource request to a proxy node in the hierarchical proxy cluster through the mobile target defense system, and to authenticate the target user, obtain a target proof-of-work task, and return the target proof-of-work task to the target user; the second receiving module 503 is used to receive a solution sent by the target user corresponding to the target proof-of-work task; the return module 504 is used to return a service result associated with the resource request in response to the correct solution; and to re-authenticate the target user through the mobile target defense system in response to an incorrect solution.

[0110] Specifically, the user access device based on proof of workload of mobile target defense system provided by the present invention can implement all the method steps implemented in the above-mentioned user access method embodiment based on proof of workload of mobile target defense system, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0111] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as... Figure 6As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can invoke logical instructions in the memory 630 to execute a user access method based on proof-of-work in a mobile target defense system. This method includes: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; returning a service result associated with the resource request in response to a correct solution; and re-authenticating the target user through the mobile target defense system in response to an incorrect solution.

[0112] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the user access method based on proof-of-work of a mobile target defense system provided by the above methods. The method includes: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through the mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; returning a service result associated with the resource request in response to a correct solution; and re-authenticating the target user through the mobile target defense system in response to an incorrect solution.

[0114] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the user access method based on proof-of-work in a mobile target defense system provided by the above methods. The method includes: receiving a resource request sent by a target user; allocating the resource request to a proxy node in a hierarchical proxy cluster through a mobile target defense system, authenticating the target user, obtaining a target proof-of-work task, and returning the target proof-of-work task to the target user; receiving a solution corresponding to the target proof-of-work task sent by the target user; returning a service result associated with the resource request in response to a correct solution; and re-authenticating the target user through the mobile target defense system in response to an incorrect solution.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A user access method based on proof-of-work in a moving target defense system, characterized in that, include: Receive resource requests sent by the target user; The mobile target defense system distributes the resource request to the proxy nodes in the hierarchical proxy cluster, authenticates the target user, obtains the target proof-of-work task, and returns the target proof-of-work task to the target user. Receive the solution sent by the target user that corresponds to the target proof-of-work task; If the solution is correct, return the service result associated with the resource request; In response to the error in the solution, the target user is re-authenticated through the mobile target defense system; The step of authenticating the target user, obtaining the target proof-of-work task, and returning the target proof-of-work task to the target user includes: The mobile target defense system determines the workload proof task level of the target user based on a preset work proof level algorithm and the current system load rate of the mobile target defense system. Based on the work proof task level, generate a target work proof task; The target proof-of-work task is returned to the target user.

2. The user access method based on proof-of-work for a moving target defense system according to claim 1, characterized in that, The step of generating a target proof-of-work task based on the proof-of-work task level includes: Determine the exponential moving average indicator for the current time point, wherein the exponential moving average indicator is used to represent the load rate of the mobile target defense system; The authentication agent of the mobile target defense system generates a target proof-of-work task based on the proof-of-work task level, the exponential moving average indicator at the current time, and the key.

3. The user access method based on proof-of-work for a moving target defense system according to claim 2, characterized in that, The target proof-of-work task includes the following types: no task, hash collision task, asymmetric encryption task, and CAPTCHA task.

4. The user access method based on proof-of-work for a moving target defense system according to claim 1, characterized in that, After generating the target proof-of-work task based on the proof-of-work task level, the method further includes: The authentication proxy of the mobile target defense system determines the address of the next proxy node based on the load rate of each proxy node, and returns the address of the next proxy node to the target user.

5. The user access method based on proof-of-work for a moving target defense system according to any one of claims 1 to 4, characterized in that, The mobile target defense system includes the layered proxy cluster, a central scheduler with a database, and an application server. The layered proxy cluster is composed of the proxy nodes, the central scheduler is used to detect attacks based on user traffic characteristics, and the application server is used to provide actual services.

6. A user access device based on proof-of-work for a moving target defense system, characterized in that, include: The first receiving module is used to receive resource requests sent by the target user; The verification module is used to allocate the resource request to the proxy node in the hierarchical proxy cluster through the mobile target defense system, authenticate the target user, obtain the target proof-of-work task, and return the target proof-of-work task to the target user. The second receiving module is used to receive the solution sent by the target user that corresponds to the target proof-of-work task; The return module is used to return the service result associated with the resource request in response to a correct solution; and to re-authenticate the target user through the mobile target defense system in response to an incorrect solution. The step of authenticating the target user, obtaining the target proof-of-work task, and returning the target proof-of-work task to the target user includes: The mobile target defense system determines the workload proof task level of the target user based on a preset work proof level algorithm and the current system load rate of the mobile target defense system. Based on the work proof task level, generate a target work proof task; The target proof-of-work task is returned to the target user.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the user access method based on proof-of-work for a moving target defense system as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the user access method based on proof-of-work for a moving target defense system as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the user access method based on proof-of-work for a moving target defense system as described in any one of claims 1 to 5.

Images