Security protection method and device for Web application, electronic equipment and medium

Abstract

The invention discloses a safety protection method and device for a Web application, electronic equipment and a medium, and relates to the technical field of safety communication, and the method comprises the following steps: when a Web webpage access request is triggered to be generated in response to a service operation executed by a user for a front-end page, executing hash operation on the front-end page by adopting a locally stored dynamic token algorithm, obtaining a hash string containing the dynamic token; and packaging according to the Web webpage access request and the hash string to obtain a request data packet, encrypting the request data packet by adopting an encryption algorithm to obtain an encrypted data packet, and sending the encrypted data packet to the application server. A one-time and randomly-changing dynamic token is generated through a client and is verified by a security verification system at the front end of an application server, whether webpage content is tampered or not is determined, the legality of a request is verified, the defense capability for 0day vulnerabilities and automatic attacks is improved by a method of avoiding dependence on known features or patching, and the security of the webpage content is improved. And the reliability of Web application security protection is improved.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a security protection method, device, electronic device and medium for Web applications. Background Art

[0002] As Web applications increasingly become the main channel for system services, the potential malicious attacks they face are increasing, and their security issues are becoming particularly prominent.

[0003] In the existing technology, Web application security protection technology is generally divided into: feature-based protection technology, which identifies and intercepts known attack patterns or malicious code features by analyzing network traffic, Web page content or user behavior; patch-based protection technology, which fixes security vulnerabilities by regularly updating patches of operating systems and applications to prevent attackers from exploiting these vulnerabilities to launch attacks.

[0004] However, these Web application security protection technologies mainly rely on known attack features or vulnerability information, and cannot effectively defend against unknown 0day vulnerability (also known as zero-day vulnerability, generally refers to vulnerabilities that have not been publicly announced by manufacturers) attacks and automated attacks. They also require continuous updating of feature libraries and patches, have high protection costs, and have a high false alarm rate, which affects user experience and reduces the reliability of Web application security protection. Summary of the invention

[0005] The present invention provides a security protection method, device, electronic device and medium for Web applications to solve the problems of being unable to effectively defend against unknown 0day vulnerability attacks and automated attacks, high protection cost, high false alarm rate and low reliability of Web application security protection.

[0006] According to one aspect of an embodiment of the present invention, a method for protecting the security of a Web application is provided, which is executed by an application client and includes:

[0007] In response to a business operation performed by a user on a front-end page, when a Web page access request is triggered, a hash operation is performed on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token; wherein the front-end page is periodically generated by an application server and provided to an application client, and each time the application server generates a front-end page, a random field of a random length is dynamically added at a random position in the front-end page to generate a dynamic token for the application client; a request data packet is packaged according to the Web page access request and the hash string, the request data packet is encrypted using an encryption algorithm to obtain an encrypted data packet, and the encrypted data packet is sent to the application server; wherein a security verification system at the front end of the application server is used to perform a legitimacy verification on the received encrypted data packet, and after the legitimacy verification is passed, instructs the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

[0008] According to another aspect of an embodiment of the present invention, a method for protecting the security of a Web application is provided, which is executed by a security verification system at the front end of an application server and includes:

[0009] The data packet to be verified sent by the application client to the application server is intercepted, and the data packet to be verified is decrypted according to a preset decryption algorithm to obtain at least one item of information to be verified; the information to be verified includes a hash string of the dynamic token to be verified and a Web page access request; the at least one item of information to be verified is verified for legitimacy, and after the legitimacy verification is passed, the application server is instructed to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page; wherein the application server pre-dynamically encapsulates and obfuscates the dynamic web page content and then provides it to the application client.

[0010] According to another aspect of an embodiment of the present invention, there is also provided a security protection device for a Web application, which is executed by an application client and includes:

[0011] A hash string acquisition module is used to perform a hash operation on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token when a business operation performed by a user on the front-end page triggers the generation of a Web page access request; wherein the front-end page is periodically generated by the application server and provided to the application client, and each time the application server generates the front-end page, a random field of a random length is dynamically added at a random position in the front-end page to generate a dynamic token for the application client; an encrypted data packet acquisition module is used to obtain a request data packet by packaging the Web page access request and the hash string, encrypt the request data packet using an encryption algorithm to obtain an encrypted data packet, and send the encrypted data packet to the application server; wherein the security verification system at the front end of the application server is used to perform a legitimacy verification on the received encrypted data packet, and after the legitimacy verification is passed, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

[0012] According to another aspect of an embodiment of the present invention, there is also provided a security protection device for a Web application, which is executed by a security verification system at the front end of an application server, and includes:

[0013] The module for revealing the data packet to be verified is used to intercept the data packet to be verified sent by the application client to the application server, and decrypt the data packet to be verified according to a preset decryption algorithm to obtain at least one piece of information to be verified; the information to be verified includes a hash string of the dynamic token to be verified and a Web page access request; the module for providing dynamic web page content is used to verify the legitimacy of at least one piece of information to be verified, and after the legitimacy verification is passed, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page; wherein the application server pre-dynamically encapsulates and obfuscates the dynamic web page content and then provides it to the application client.

[0014] According to another aspect of an embodiment of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security protection method for Web applications described in any embodiment of the present invention.

[0018] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security protection method for Web applications described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention is as follows: first, when an application client generates a Web page access request in response to a business operation performed by a user on a front-end page, a locally stored dynamic token algorithm is used to perform a hash operation on the front-end page with a random field added thereto, so as to obtain a hash string containing a dynamic token; then, a request data packet is packaged according to the Web page access request and the hash string, and an encryption algorithm is used to encrypt the request data packet to obtain an encrypted data packet, and the encrypted data packet is sent to a security verification system at the front end of the application server; a one-time, randomly changing dynamic token is generated by the client and verified by the security verification system at the front end of the application server to determine whether the web page content has been tampered with and verify the legitimacy of the request, thereby avoiding reliance on known features or patching methods, improving the defense capability against 0day vulnerabilities and automated attacks, and reducing the protection cost. As an active defense measure, it does not rely on fixed rule matching, reduces the false alarm rate, improves user experience, and improves the reliability of Web application security protection.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 This is a flowchart of a method for protecting the security of a Web application provided according to Embodiment 1 of the present invention;

[0023] Figure 2 This is a flow chart of a method for protecting the security of a Web application provided according to Embodiment 2 of the present invention;

[0024] Figure 3 is a schematic diagram of a dynamic defense weapon applicable to Embodiment 3 of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of a security protection device for a Web application provided according to a fourth embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of the structure of a security protection device for a Web application provided according to a fifth embodiment of the present invention;

[0027] Figure 6 It is a schematic diagram of the structure of an electronic device for implementing the security protection method for Web applications according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flowchart of a security protection method for a Web application provided in the first embodiment of the present invention. This embodiment can be applied to the situation where the application client performs security protection on the accessed resources during various business operations of the user that require access to resources in the application server, especially sensitive business operations. This method can be executed by a security protection device for a Web application executed by the application client in any embodiment of the present invention. The security protection device for the Web application can be implemented in the form of hardware and / or software and can generally be configured in an electronic device. Figure 1 As shown, the method includes:

[0032] S110. In response to a business operation performed by a user on a front-end page, when a Web page access request is triggered, a hash operation is performed on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token.

[0033] The front-end page is periodically generated by the application server and provided to the application client. Each time the application server generates the front-end page, it dynamically adds a random field of random length at a random position in the front-end page to generate a dynamic token for the application client.

[0034] In the embodiment of the present invention, the dynamic token algorithm can be specifically understood as: an algorithm for generating a one-time password, and the generated password has higher security than the traditional static password. The implementation of the dynamic token algorithm requires a key, which is shared between the user and the server and is necessary for generating a one-time password, ensuring that each authentication is unique. Even if the password is intercepted, it cannot be used in the next authentication, thereby greatly improving security.

[0035] Specifically, when a user performs a business operation on the front-end page, such as clicking a button, filling out a form, selecting a drop-down menu, etc., a web page access request is generated and sent to the server. In order to prevent data from being tampered with, a locally stored dynamic token generation algorithm is used to perform a hash operation (such as MD5, SHA-256 or SM3, etc.) on the front-end page. Through one-way encryption, data of any length (such as files or messages, etc.) is converted into a string of fixed length to obtain a hash string containing a dynamic token. In order to further improve the security of the server, a random field of random length is dynamically added at a random position in the front-end page by the application server, and the random field in the front-end page is updated regularly (such as hourly or daily time intervals) to increase the randomness of the generated dynamic token, forcing attackers to find it difficult to perform pattern recognition and adapt attack strategies through automated tools, thereby effectively resisting automated attacks. In the dynamic token, there are but are not limited to information about the random field regularly updated in the front-end page, the user identity of this request, the access time of this request, and the access path of this request.

[0036] S120, packaging the web page access request and the hash string to obtain a request data packet, encrypting the request data packet using an encryption algorithm to obtain an encrypted data packet, and sending the encrypted data packet to the application server.

[0037] Among them, the security verification system at the front end of the application server is used to perform legitimacy verification on the received encrypted data packets, and after the legitimacy verification passes, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

[0038] In the embodiment of the present invention, the security verification system can be specifically understood as: a series of security technologies and processes used between the client and the application server to ensure the security, integrity and authentication of data transmission in the network communication between the client and the application server. The security verification system includes but is not limited to encryption, authentication, integrity verification, access control, security protocols, security auditing and monitoring and other measures, and is a comprehensive defense system.

[0039] Specifically, after obtaining the hash string containing the dynamic token, the Web page access request and the hash string are packaged to obtain a request data packet. In order to ensure the security of data transmission, an encryption algorithm (such as a symmetric encryption algorithm or an asymmetric encryption algorithm) is used to encrypt the request data packet to obtain an encrypted data packet, and the encrypted data packet is sent to the application server. The encrypted data packet needs to be first verified for legitimacy by the security verification system between the client and the application server. By decrypting the encrypted data packet, the legitimacy of the random field contained in the dynamic token, the user identity of this request, the access time of this request, and the access path information of this request are verified to ensure that the dynamic token is correctly generated by an authorized entity, the web page content has not been tampered with, and is used within the validity period of the dynamic token, thereby ensuring the security and credibility of this request and improving the security protection reliability of the Web application. If the legitimacy check passes, the application server is instructed to dynamically generate or retrieve the corresponding web page content through the server-side script or program according to the Web page access request, real-time data or program logic, and provide the dynamic web page content to the application client for rendering and display. If the legitimacy check fails, the request is rejected to prevent the user from accessing (for example, jumping to a navigation page or displaying an error page).

[0040] The technical solution of the embodiment of the present invention firstly performs a hash operation on the front-end page with a random field added by using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token when a business operation performed by a user on the front-end page triggers the generation of a Web page access request; then, a request data packet is packaged according to the Web page access request and the hash string, and the request data packet is encrypted by an encryption algorithm to obtain an encrypted data packet, and the encrypted data packet is sent to the application server, and a one-time and randomly changing dynamic token is generated by the client, and verified by the security verification system of the front-end of the application server to ensure the integrity of the web page content and confirm the legitimacy of the request. This method does not rely on known features or patches, enhances the defense against 0day vulnerabilities and automated attacks, and reduces the cost of protection. As an active defense strategy, it does not rely on fixed rule matching, reduces false positives, improves user experience, and improves the reliability of security protection of Web applications.

[0041] Furthermore, after generating a web page access request in response to a business operation performed by a user on a front-end page, the following may also be included:

[0042] Detect whether the business operation performed by the user on the front-end page is an operation performed on sensitive business; if so, obtain dynamic verification information matching the application client, wherein the dynamic verification information includes device fingerprint information and / or user behavior information.

[0043] In the embodiment of the present invention, dynamic verification information can be specifically understood as: verification performed by the system according to real-time conditions or user behavior operations during the interaction between the user and the system. This verification may include checking user input, monitoring user behavior, reconfirming user identity, and / or verifying real-time scene information of the interaction.

[0044] In the embodiment of the present invention, the device fingerprint information can be specifically understood as: generating a unique identifier of the device through characteristic information such as the hardware, network, and environment of the user's Internet device, which is used to identify and track the device to provide security protection services.

[0045] Specifically, in order to take into account the timeliness and security of request processing of Web applications, dynamic verification is only performed when the business operations performed on the front-end page involve sensitive business, to prevent sensitive business data from being leaked, abused or accessed without authorization. Among them, in addition to dynamic token verification, dynamic verification information also includes device fingerprint information (such as the device's operating system, system plug-ins, browser language settings and time zone, mobile phone IMEI, etc.), and / or user behavior information (such as login, access, or file operations, etc.). By analyzing behavioral data, user behavior portraits can be established, and combined with device fingerprint information, abnormal behaviors can be identified and intercepted, thereby improving the security protection reliability of Web applications.

[0046] Furthermore, the request data packet is obtained by packaging the web page access request and the hash string, and further includes:

[0047] The request data packet is packaged according to the Web page access request, the hash string and the dynamic verification information.

[0048] Specifically, the request data packet generated by the application client includes not only the Web page access request and the dynamic token used to verify the legitimacy of the request, but also the device fingerprint information and / or user behavior information used to verify that the request comes from a legitimate user in order to further enhance the reliability of the security protection of the Web application.

[0049] Optionally, the device fingerprint information includes: at least one of a CPU (Central Processing Unit) model, a memory size, and a network interface, wherein the network interface includes a MAC (Media Access Control Address), an adapter type, or a network standard;

[0050] The user behavior information may include: at least one of a mouse movement track, a mouse click frequency, and a keyboard tapping frequency collected within a preset time interval.

[0051] Specifically, at least one device fingerprint information of the CPU model, memory size, and network interface can be used to verify that the request comes from a legitimate user, wherein the network interface refers to the connection point between the device and the network that allows the device to send, receive, and transmit data, which can be specifically MAC, adapter type, or network standard. Preferably, the MAC address is the physical address of the network device, which is usually burned into the ROM of the network card. It is an inherent property of the hardware and will not change due to the device moving to a different network or changing the IP configuration. It has unique identification. Therefore, the MAC address is preferably used as the device fingerprint information to verify the legitimacy of the requesting user. In the daily operation of the business, in order to ensure the consistency and efficiency of the work, the business operation needs to follow a series of standardized processes and steps. Each operation link is often accompanied by a specific user interface interaction mode, such as keyboard input, mouse clicks, and mouse movements. These interactive behaviors often show certain regularity in normal business operations, including but not limited to: click frequency, click order, movement range, and movement order. When users perform tasks, the number of clicks of the keyboard and mouse is usually within a reasonable range. Frequent clicks may indicate that there are abnormalities in the user's business operations or that there may be the intervention of automated scripts; the range and trajectory of mouse movement often match the business needs in normal operations, and its click sequence and click range are predictable. For example, when filling out a form, the range of mouse activity is usually limited to the form area. When the mouse movement range is abnormal or an abnormal click sequence occurs, it may indicate that the user is trying to access without authorization, bypass certain security measures, or perform non-standard business operations. In a specific example, when a user uses an emulator or multiple software to manage multiple business accounts at the same time, his behavior often shows a certain regularity and is significantly different from the keyboard and mouse operation mode of normal users. Therefore, in order to ensure the security and compliance of business operations, the user behavior information such as mouse movement trajectory, mouse click frequency, or keyboard tapping frequency collected within a preset time interval can be used to verify whether the request comes from a legitimate user, thereby improving the reliability of Web application security protection.

[0052] Further, in an embodiment of the present invention, the dynamic verification algorithm can be updated according to the user's historical behavior data. For example, for the tapping frequency and motion trajectory in the keyboard and mouse operation, the system will set an initial security threshold, and this threshold will change dynamically within a predefined range according to the user's normal operation behavior. Over time, the system will refine and adjust this threshold based on the collected historical data. For example, the system collects normal user behavior data over a period of time, calculates the average value and standard deviation of these data, and thus establishes a baseline. When the user behavior monitored in real time deviates significantly from the baseline data, the system will consider that there may be a security risk and update the parameters accordingly. In addition, the system can also use curve fitting technology, such as polynomial fitting, to establish a mathematical model of user behavior, and use this model to predict and identify abnormal behavior. These methods can help the system identify and respond to potential security threats more accurately, adapt to the natural changes in user behavior, and respond quickly to abnormal behavior, while improving security, reducing false positives, missed positives, and interference with normal user operations. Through this dynamic learning and updating method, the dynamic verification algorithm can bring more personalized and flexible security protection to users and improve the reliability of Web application security protection.

[0053] Furthermore, in response to the business operation performed by the user on the front-end page, after triggering the generation of a Web page access request, it also includes: sending a dynamic token to the user through at least one of SMS, email and internal communication tools, and the user enters the dynamic token for verification.

[0054] Specifically, in order to increase the defense depth of the system, in addition to dynamic information verification, double-causal or multi-causal verification can be performed through one or more additional verification methods (such as SMS, email, and internal communication tools). Even if one verification link is bypassed, the attacker still needs to overcome other verification methods, thereby greatly improving security. A reasonable multi-causal verification design can provide stronger security protection without significantly reducing the user experience, thereby improving the reliability of Web application security protection.

[0055] Furthermore, a method for protecting the security of a Web application further includes:

[0056] Whenever a dynamic token update algorithm periodically sent by the security verification system is received, the dynamic token update algorithm is used to replace the locally stored dynamic token algorithm;

[0057] Among them, the dynamic token update algorithm is dynamically generated by the security verification system according to the random forest algorithm or the linear regression algorithm.

[0058] Specifically, in order to further increase the randomness of dynamic tokens and ensure that it is difficult for attackers to reverse analyze and crack them, the application server will regularly (for example, at hourly or daily time intervals) update the dynamic token algorithm. The update content includes the generation algorithm of random fields that are regularly updated in the front-end page, and the hash algorithm used for the front-end page in the process of generating dynamic tokens. The multi-decision tree structure of random forest can introduce additional random variables to increase the randomness of the hash algorithm and the generation of random fields. The introduction of linear regression models can predict the output of the hash algorithm and the generation of random fields, so as to detect and enhance the random characteristics of the hash algorithm and random fields. By integrating with the ensemble learning method of random forest or the predictive ability of linear regression, the generated dynamic token can be made more complex and difficult to predict, increasing the reliability of Web application security protection.

[0059] Further, after the request data packet is encrypted by using a preset encryption algorithm to obtain an encrypted data packet and sent to the application server, the method further includes:

[0060] The static web page content in the target web page is preloaded locally; when the dynamic web page content in the target web page fed back by the application server is received, the static web page content and the dynamic web page content are combined to obtain the target web page, and the target web page is rendered and displayed.

[0061] Specifically, in web page development, in order to improve user experience and loading speed, a series of optimization techniques can be used to preload static content in the target web page. These techniques may include: preloading certain specified resources (such as CSS, JavaScript files or images), local caching of static resources (such as CSS, JavaScript files, images, etc.), and using content distribution networks to ensure that resources are quickly loaded from the nearest server. Through the combined effect of these methods, even if the dynamic content has not been fully loaded from the server, the user can quickly see the static part of the web page, thereby improving the response speed and overall performance of the web page. If the security verification system successfully verifies the legitimacy of the request and the legitimacy of the requesting user, the application server processes the request and feeds back the dynamic web page content in the target web page, and the client combines the static web page content and the dynamic web page content to obtain the target web page, and renders and displays the target web page. If the security verification system fails to verify the legitimacy of the request and the legitimacy of the requesting user, the request is rejected, resulting in the server not returning the dynamic web page content, preventing the user from accessing (for example, jumping to the login page, jumping to the navigation page, displaying the error page, and only displaying the static content in the target web page). For users who have failed multiple verifications, the system may consider this to be an automated attack or malicious attempt, and a series of gradually enhanced security measures can be taken to protect the security of Web applications and user data. These measures may include: restricting certain user operations for a certain period of time, such as prohibiting form submissions, limiting the frequency of API calls, etc., to reduce the chance of malicious attempts; temporarily prohibiting user logins to prevent malicious users from continuously trying to crack accounts; freezing user accounts until they are unfrozen through customer service or other verification processes; freezing user accounts until they are unfrozen through customer service or other verification processes; for accounts that seriously violate security policies or are suspected of being abused, the system can implement permanent bans to prevent further security risks.

[0062] Embodiment 2

[0063] Figure 2 The flowchart of a security protection method for a Web application provided in the second embodiment of the present invention is applicable to the situation where the security verification system at the front end of the application server verifies and determines whether the application client accesses the resources in the application server based on the encrypted data packet sent by the application client. The method can be executed by the security protection device for the Web application executed by the security verification system at the front end of the application server in any embodiment of the present invention. The security protection device for the Web application can be implemented in the form of hardware and / or software, and can generally be configured inside the application server, or in the form of an independent device entity, and communicates with the application server. Figure 2 As shown, the method includes:

[0064] S210: intercepting a data packet to be verified sent by the application client to the application server, and decrypting the data packet to be verified according to a preset decryption algorithm to obtain at least one item of information to be verified.

[0065] The information to be verified includes a hash string of the dynamic token to be verified and a web page access request.

[0066] Specifically, the security verification system at the front end of the application server intercepts the data packet to be verified sent by the application client to the application server, that is, the encrypted data packet containing the web page request information and the hash string of the dynamic token, and decrypts the data packet to be verified according to the decryption algorithm preset by the application server to obtain at least one item of information to be verified, including the hash string of the dynamic token and the web page access request. Furthermore, the information to be verified may also include device fingerprint information, user behavior information, or both, as well as one or more verification methods including SMS, email, and internal communication tools, to strengthen the verification of the legitimacy of the request and the legitimacy of the requesting user.

[0067] S220, performing a legitimacy verification on at least one item of information to be verified, and after the legitimacy verification passes, instructing the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page.

[0068] The application server dynamically encapsulates and obfuscates the dynamic web page content in advance and then provides it to the application client.

[0069] Specifically, at least one piece of information to be verified is verified for legitimacy, and it is verified whether the device initiating the request is authorized, whether the user initiating the request is a legitimate user, and whether the web page content has been tampered with. If the legitimacy verification is passed, the application server is instructed to dynamically generate or retrieve the corresponding web page content through the server-side script or program according to the Web page access request, real-time data or program logic, and provide the dynamic web page content to the application client for rendering and display. If the legitimacy verification fails, the request is rejected and the user's access is blocked (for example, jumping to the navigation page or displaying the error page). Among them, in order to further improve the overall security and stability of the Web application, before the application server provides the dynamic web page content to the application client, the returned dynamic web page content is encapsulated and obfuscated, thereby hiding the attack entry and preventing the attacker from obtaining sensitive information. Web page encapsulation improves the maintainability, readability and reusability of the code by packaging the code and data in the web page content and adding additional obfuscation code. Through encapsulation, complex logic can be hidden behind a simple interface, so that external code does not need to understand the internal implementation details. Web page obfuscation is a technique that converts the code into a form that is difficult to read and understand without changing the code's functionality, such as changing the code structure, inserting invalid code at random locations, and encrypting sensitive information through API keys or database connection strings. By using encapsulation and obfuscation technology at the same time, the code can be organized and modularized, and the code can be protected from unauthorized access and analysis, thereby improving the security and reliability of Web applications.

[0070] Preferably, in order to ensure that Web applications have both security and timeliness, only the information and code related to sensitive business in the returned dynamic web page content are encapsulated and obfuscated, which not only ensures the security of sensitive information, but also improves the processing efficiency of sensitive business and the reliability of Web application security protection.

[0071] Further, in an embodiment of the present invention, the dynamic encapsulation algorithm and the obfuscation algorithm can be combined with random forest or linear regression for regular (e.g., hourly or daily time interval) updates to further increase the randomness of the obfuscated code part, increase the difficulty of cracking, prevent malicious analysis and attacks, and enhance the reliability of Web application security protection. For the addition of additional obfuscated code links in the dynamic encapsulation link of the web page and the obfuscation of the web page, random forest can be used to generate a complex decision tree model, by randomly selecting different code blocks to execute, simulating different code paths and logic, introducing randomness in the code, making the code structure difficult to predict, thereby changing the execution process without changing the function, and increasing the complexity of the code. The linear regression model can be used to predict the possible invalid code location in the code. By analyzing the pattern and structure of the code, linear regression can help determine where the insertion of invalid code is least likely to attract attention. These invalid codes can be empty operations, useless function calls, or unexecuted branches, thereby confusing attackers and increasing the obfuscation of the code. Random forest and linear regression can be used to encrypt sensitive information. For example, random forest can be used to identify the occurrence pattern of sensitive information, and a linear regression model can be used to generate parameters of the encryption algorithm to add randomness to the encryption form of sensitive information.

[0072] The technical solution of the embodiment of the present invention first intercepts the data packet to be verified sent by the application client to the application server, and decrypts the data packet to be verified according to the preset decryption algorithm to obtain at least one piece of information to be verified, which contains the hash string of the dynamic token to be verified and the Web page access request; then the at least one piece of information to be verified is verified for legitimacy, and after the legitimacy verification is passed, the application server is instructed to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page, and the application server pre-dynamically encapsulates and obfuscates the dynamic web page content, and then provides it to the application client. The information to be verified is verified by the security verification system to ensure the integrity of the web page content and confirm the legitimacy of the request. The feature token, device fingerprint information and / or user behavior information contained in the information to be verified do not rely on known features or patches, which enhances the defense against 0day vulnerabilities and automated attacks. After the verification is successful, the code is increased invisibly and randomly by dynamically encapsulating and obfuscating the dynamic web page content, which increases the difficulty of reverse cracking by attackers, improves the security of sensitive business data, and improves the reliability of Web application security protection.

[0073] Embodiment 3

[0074] Figure 3 FIG. 1 is a schematic diagram of a dynamic defense weapon applicable to Embodiment 3 of the present invention. Figure 3As shown, it includes: a client (equivalent to the application client mentioned above), dynamic token generation and verification, dynamic verification, and dynamic encapsulation and obfuscation.

[0075] The client is a user device that initiates an access request to a server (also called an application server). The dynamic token generation and verification phase is responsible for generating a dynamic token and comparing it with the token in the client request to verify the legitimacy of the request. The dynamic verification module phase is responsible for dynamically verifying the client, including device fingerprint recognition, behavior analysis, etc., to ensure that the request comes from a legitimate user. The dynamic encapsulation and obfuscation phase is responsible for dynamically encapsulating and obfuscating the returned web page content, hiding the attack entry point, and preventing attackers from obtaining sensitive information.

[0076] In this application scenario, the technical implementation solutions include:

[0077] 1. Dynamic token generation and verification:

[0078] The system generates a dynamic token based on user identity, access time, access path and other information.

[0079] The client request contains a dynamic token. The system compares the token in the request with the generated token to verify the legitimacy of the request.

[0080] By continuously and dynamically changing the underlying code of web pages, the "unpredictability" of server behavior is increased, forcing attackers to constantly re-adapt, effectively preventing attackers from using automatic zombie programs to attack.

[0081] By assigning a one-time "pass identification code", i.e. a dynamic token, to legitimate requests and dynamically verifying the client, malicious terminals are prevented from accessing and impersonating legitimate users.

[0082] 2. Dynamic Verification:

[0083] The system performs device fingerprint recognition on the client to obtain hardware feature information of the client device, such as CPU model, memory size, network interface, etc.

[0084] The system analyzes the client's behavior, such as mouse movement trajectory, keyboard tapping frequency, etc., to determine whether the client's behavior conforms to the behavior pattern of normal users.

[0085] The system determines whether the request comes from a legitimate user based on the device fingerprint and behavior analysis results.

[0086] The attack source can be located through terminal fingerprints, and it can be effectively identified even if the attacker keeps switching the source address through springboards.

[0087] 3. Dynamic encapsulation and obfuscation:

[0088] The system dynamically encapsulates web page content, packages it, and adds additional obfuscation code.

[0089] The system obfuscates web page content, such as changing the code structure, inserting invalid code, and encrypting sensitive information.

[0090] The system returns the encapsulated and obfuscated web page content to the client.

[0091] By encapsulating and obfuscating the underlying code of the content returned by the website, the attack entry point is hidden, preventing attackers from obtaining sensitive information, and effectively increasing the difficulty of man-in-the-middle attacks.

[0092] 4. Dynamic update algorithm:

[0093] The system regularly updates the dynamic token generation algorithm, dynamic verification algorithm, and dynamic encapsulation and obfuscation algorithm to ensure that it is difficult for attackers to reverse analyze and crack.

[0094] By making front-end information collection dynamic, it is difficult for attackers to reversely obtain the collected content, greatly increasing the cost of attack.

[0095] This technical solution does not need to rely on "known" features, and provides "in-process" protection while the attack is "in progress", effectively reducing the problems of protection gaps and feature bypasses. This technical solution does not use blacklists, frequency limits, thresholds, attack protection policy rules and other means to minimize the complexity and workload of security protection and improve work efficiency. Through dynamic changes in the underlying code of web pages, dynamic tokens and verification, dynamic encapsulation and obfuscation and other technical means, effective defense against automated attacks (such as vulnerability scanning tools, attack scripts and blasting tools) and 0day vulnerability attacks is achieved; there is no need to rely on "known" features and patch updates, which reduces maintenance costs and labor costs and improves protection efficiency; through dynamic changes and obfuscation technology, the difficulty and cost of attacks are increased, effectively improving the security of Web applications; reducing false alarm rates, avoiding the behavior of mistakenly killing normal users, and improving user experience.

[0096] Embodiment 4

[0097] Figure 4 This is a schematic diagram of the structure of a security protection device for a Web application provided by the fourth embodiment of the present invention. Figure 4 As shown, the device is configured in the application client, and specifically includes: a hash string acquisition module 410 and an encrypted data packet acquisition module 420.

[0098] The hash string acquisition module 410 is used to perform a hash operation on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token when a web page access request is triggered in response to a business operation performed by a user on the front-end page.

[0099] The front-end page is periodically generated by the application server and provided to the application client. Each time the application server generates the front-end page, it dynamically adds a random field of random length at a random position in the front-end page to generate a dynamic token for the application client.

[0100] The encrypted data packet acquisition module 420 is used to package the Web page access request and the hash string to obtain a request data packet, encrypt the request data packet using an encryption algorithm to obtain an encrypted data packet, and send the encrypted data packet to the application server.

[0101] Among them, the security verification system at the front end of the application server is used to perform legitimacy verification on the received encrypted data packets, and after the legitimacy verification passes, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

[0102] The technical solution of the embodiment of the present invention firstly performs a hash operation on the front-end page with a random field added by using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token when a business operation performed by a user on the front-end page triggers the generation of a Web page access request; then, a request data packet is packaged according to the Web page access request and the hash string, and the request data packet is encrypted by an encryption algorithm to obtain an encrypted data packet, and the encrypted data packet is sent to the application server, and a one-time and randomly changing dynamic token is generated by the client, and verified by the security verification system of the front-end of the application server to ensure the integrity of the web page content and confirm the legitimacy of the request. This method does not rely on known features or patches, enhances the defense against 0day vulnerabilities and automated attacks, and reduces the cost of protection. As an active defense strategy, it does not rely on fixed rule matching, reduces false positives, improves user experience, and improves the reliability of security protection of Web applications.

[0103] In the embodiment of the present invention, the hash string acquisition module 410 is specifically used to:

[0104] After triggering the generation of a Web page access request in response to a business operation performed by the user on the front-end page, it is detected whether the business operation performed by the user on the front-end page is an operation performed on sensitive business; if so, dynamic verification information matching the application client is obtained, wherein the dynamic verification information includes device fingerprint information and / or user behavior information.

[0105] In the embodiment of the present invention, the encrypted data packet acquisition module 420 is specifically used to:

[0106] The request data packet is packaged according to the Web page access request, the hash string and the dynamic verification information.

[0107] In an embodiment of the present invention, the device fingerprint information specifically includes: at least one of the CPU model, memory size, and network interface, the network interface includes MAC, adapter type, or network standard. The user behavior information includes: at least one of the mouse movement track, mouse click frequency, and keyboard tapping frequency collected within a preset time interval.

[0108] In an embodiment of the present invention, a dynamic token algorithm update module may also be included, which is used to replace the locally stored dynamic token algorithm with the dynamic token update algorithm whenever a dynamic token update algorithm periodically sent by the security verification system is received, wherein the dynamic token update algorithm is dynamically generated by the security verification system according to a random forest algorithm or a linear regression algorithm.

[0109] In an embodiment of the present invention, a target web page rendering module may also be included, which is used to locally preload static web page content in the target web page; when dynamic web page content in the target web page fed back by the application server is received, the static web page content and the dynamic web page content are combined to obtain the target web page, and the target web page is rendered and displayed.

[0110] Furthermore, the hash string acquisition module 410 is also specifically used to: the dynamic verification algorithm can be updated according to the user's historical behavior data.

[0111] Furthermore, the hash string acquisition module 410 is also specifically used to: send a dynamic token to the user through at least one of SMS, email, and internal communication tools, and the user enters the dynamic token for verification.

[0112] The security protection device for Web applications configured in the application client provided in the embodiment of the present invention can execute the security protection method for Web applications executed by the application client provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0113] Embodiment 5

[0114] Figure 5 This is a schematic diagram of the structure of a security protection device for a Web application provided by Embodiment 5 of the present invention. Figure 5 As shown, the device is configured in a security verification system at the front end of an application server, and specifically includes: a data packet decryption module 510 to be verified and a dynamic web page content providing module 520.

[0115] The verification data packet decryption module 510 is used to intercept the verification data packet sent by the application client to the application server, and decrypt the verification data packet according to a preset decryption algorithm to obtain at least one verification information; the verification information includes a hash string of the dynamic token to be verified and a Web page access request.

[0116] The dynamic web page content providing module 520 is used to verify the legitimacy of at least one item of information to be verified, and after the legitimacy verification is passed, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page; wherein the application server pre-dynamically encapsulates and obfuscates the dynamic web page content and then provides it to the application client.

[0117] The technical solution of the embodiment of the present invention first intercepts the data packet to be verified sent by the application client to the application server, and decrypts the data packet to be verified according to the preset decryption algorithm to obtain at least one piece of information to be verified, which contains the hash string of the dynamic token to be verified and the Web page access request; then the at least one piece of information to be verified is verified for legitimacy, and after the legitimacy verification is passed, the application server is instructed to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page, and the application server pre-dynamically encapsulates and obfuscates the dynamic web page content, and then provides it to the application client. The information to be verified is verified by the security verification system to ensure the integrity of the web page content and confirm the legitimacy of the request. The feature token, device fingerprint information and / or user behavior information contained in the information to be verified do not rely on known features or patches, which enhances the defense against 0day vulnerabilities and automated attacks. After the verification is successful, the code is increased invisibly and randomly by dynamically encapsulating and obfuscating the dynamic web page content, which increases the difficulty of reverse cracking by attackers, improves the security of sensitive business data, and improves the reliability of Web application security protection.

[0118] In the embodiment of the present invention, the dynamic webpage content providing module 520 is specifically used for:

[0119] The dynamic packing algorithm and obfuscation algorithm are regularly updated in combination with random forest and / or linear regression.

[0120] The security protection device for Web applications configured in the security verification system at the front end of the application server provided in the embodiment of the present invention can execute the security protection method for Web applications performed by the security verification system at the front end of the application server provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0121] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0122] Example 6

[0123] Figure 6A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0124] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0125] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0126] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the security protection method for the Web application executed by the application client, that is:

[0127] In response to a business operation performed by a user on a front-end page, when a web page access request is triggered, a hash operation is performed on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token;

[0128] The front-end page is periodically generated by the application server and provided to the application client, and each time the application server generates the front-end page, a random field of random length is dynamically added at a random position in the front-end page to generate a dynamic token for the application client;

[0129] Packing the web page access request and the hash string to obtain a request data packet, encrypting the request data packet using an encryption algorithm to obtain an encrypted data packet, and sending the encrypted data packet to the application server;

[0130] Among them, the security verification system at the front end of the application server is used to perform legitimacy verification on the received encrypted data packets, and after the legitimacy verification passes, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

[0131] Or, for example, a security protection method for a Web application executed by a security verification system at the front end of an application server, that is:

[0132] Intercept the data packet to be verified sent by the application client to the application server, and decrypt the data packet to be verified according to a preset decryption algorithm to obtain at least one item of information to be verified; the information to be verified includes a hash string of the dynamic token to be verified and a web page access request;

[0133] Performing a validity verification on at least one piece of information to be verified, and after the validity verification passes, instructing the application server to provide the dynamic web page content in the target web page corresponding to the web page access request to the application client, so that the application client can display the target web page;

[0134] The application server dynamically encapsulates and obfuscates the dynamic web page content in advance and then provides it to the application client.

[0135] In some embodiments, the security protection method for a Web application may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security protection method for a Web application described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the security protection method for a Web application in any other appropriate manner (e.g., by means of firmware).

[0136] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0137] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0138] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0139] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0140] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0141] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0142] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0143] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security protection method for Web applications, characterized in that: Executed by an application client, the method includes: In response to a business operation performed by a user on a front-end page, when a web page access request is triggered, a hash operation is performed on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token; The front-end page is periodically generated by the application server and provided to the application client, and each time the application server generates the front-end page, a random field of random length is dynamically added at a random position in the front-end page to generate a dynamic token for the application client; Packing the web page access request and the hash string to obtain a request data packet, encrypting the request data packet using an encryption algorithm to obtain an encrypted data packet, and sending the encrypted data packet to the application server; Among them, the security verification system at the front end of the application server is used to perform legitimacy verification on the received encrypted data packets, and after the legitimacy verification passes, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

2. The method according to claim 1, characterized in that After triggering the generation of a web page access request in response to a business operation performed by a user on a front-end page, the method further includes: Detect whether the business operations performed by users on the front-end page are operations performed on sensitive businesses; If yes, then obtaining dynamic verification information matching the application client, wherein the dynamic verification information includes device fingerprint information and / or user behavior information; The request data packet is obtained by packaging the web page access request and the hash string, further comprising: The request data packet is packaged according to the Web page access request, the hash string and the dynamic verification information.

3. The method according to claim 2, characterized in that The device fingerprint information includes: at least one of: CPU model, memory size, and network interface, the network interface includes MAC, adapter type, or network standard; The user behavior information includes: at least one of a mouse movement track, a mouse click frequency, and a keyboard tapping frequency collected within a preset time interval.

4. The method according to claim 1, characterized in that: Also includes: Whenever a dynamic token update algorithm periodically sent by the security verification system is received, the dynamic token update algorithm is used to replace the locally stored dynamic token algorithm; The dynamic token update algorithm is dynamically generated by the security verification system according to a random forest algorithm or a linear regression algorithm.

5. The method according to any one of claims 1 to 4, characterized in that: After the request data packet is encrypted by using a preset encryption algorithm to obtain an encrypted data packet and sent to the application server, the method further includes: Locally preload static web page content in the target web page; When the dynamic webpage content in the target webpage fed back by the application server is received, the static webpage content and the dynamic webpage content are combined to obtain the target webpage, and the target webpage is rendered and displayed.

6. A security protection method for Web applications, characterized in that: Executed by a security verification system at the front end of an application server, the method includes: Intercepting a data packet to be verified sent by the application client to the application server, and decrypting the data packet to be verified according to a preset decryption algorithm to obtain at least one item of information to be verified; the information to be verified includes a hash string of the dynamic token to be verified and a web page access request; Performing a validity verification on the at least one item of information to be verified, and after the validity verification passes, instructing the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page; The application server dynamically encapsulates and obfuscates the dynamic web page content in advance and then provides it to the application client.

7. A security protection device for a Web application, characterized in that: Configured in the application client, including: A hash string acquisition module is used to perform a hash operation on the front-end page using a locally stored dynamic token algorithm to obtain a hash string containing a dynamic token when a web page access request is generated in response to a business operation performed by a user on the front-end page; The front-end page is periodically generated by the application server and provided to the application client, and each time the application server generates the front-end page, a random field of random length is dynamically added at a random position in the front-end page to generate a dynamic token for the application client; The encrypted data packet acquisition module is used to obtain a request data packet according to the Web page access request and the hash string, encrypt the request data packet using an encryption algorithm to obtain an encrypted data packet, and send the encrypted data packet to the application server; Among them, the security verification system at the front end of the application server is used to perform legitimacy verification on the received encrypted data packets, and after the legitimacy verification passes, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client.

8. A security protection device for a Web application, characterized in that: The security verification system configured in the front end of the application server includes: The data packet decryption module to be verified is used to intercept the data packet to be verified sent by the application client to the application server, and decrypt the data packet to be verified according to a preset decryption algorithm to obtain at least one item of information to be verified; the information to be verified includes a hash string of the dynamic token to be verified and a Web page access request; A dynamic web page content providing module, used to verify the legitimacy of the at least one piece of information to be verified, and after the legitimacy verification is passed, instruct the application server to provide the dynamic web page content in the target web page corresponding to the Web page access request to the application client, so that the application client can display the target web page; The application server dynamically encapsulates and obfuscates the dynamic web page content in advance and then provides it to the application client.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a security protection method for a Web application according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a security protection method for a Web application according to any one of claims 1 to 6 when executed.

Images