Authentication certificate identification method, device and equipment based on data packet

Abstract

The invention discloses an authentication certificate identification method, device and equipment based on data packets. The method comprises the following steps: acquiring M request data packets and M response data packets associated with the M request data packets from an associated database of a service system; under the condition that the target login field is found in a first request data packet of the M request data packets, searching a first field of which the field name meets a preset field name condition and a second field of which the field value is a target character string from each field of a first response data packet associated with the first request data packet; combining the first field and the second field to obtain N alternative authentication fields; performing deletion operation of N alternative authentication fields on a second request data packet containing the N alternative authentication fields to obtain N third request data packets; and based on N response results of the N third request data packets, identifying a target authentication field in the N alternative authentication fields to obtain an authentication certificate associated with the service system.

Description

Technical Field

[0001] The present application relates to the field of authority authentication technology, in particular to the field of identity authentication and access control, and in particular to a method, device and equipment for identifying authentication credentials based on data packets. Background Art

[0002] In the business system, it generally includes user devices, resource servers and authentication servers. When the user device wants to access the resources provided by the resource server, it needs to pass the identity authentication of the authentication server first. After the authentication is passed, the authentication server will generate an authentication certificate and issue the generated authentication certificate to the user device. In this way, the user device can carry the authentication certificate to access the resources of the resource server, and the resource server can determine whether the user device has the authority to perform corresponding operations on the corresponding resources based on the authentication certificate.

[0003] In the related art, different business systems use different authentication methods, so each business system is associated with different authentication credentials. In order to achieve secure access and avoid security issues such as horizontal unauthorized access, in the context of various resource access permission management scenarios, such as API access permission management, authentication credentials must be identified first. Currently, authentication credentials are usually identified through manual testing, which is inefficient. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data packet-based authentication credential identification method, apparatus, device, medium and product, which can automatically and effectively identify the authentication credential corresponding to the business system and improve the identification efficiency.

[0005] In a first aspect, an embodiment of the present application provides a data packet-based authentication credential identification method, the method comprising: obtaining M request data packets and M response data packets associated with them from an associated database of a business system; when a target login field is found in a first request data packet of the M request data packets, searching, from the fields of a first response data packet associated with the first request data packet, a first field whose field name satisfies a preset field name condition, and a second field whose field value is a target string, wherein the target login field includes at least one of a login field, a username field, and a passwd field; combining the first field and the second field to obtain N candidate authentication fields; screening a second request data packet containing N candidate authentication fields from the M request data packets, and obtaining N third request data packets corresponding to the N candidate authentication fields by performing a deletion operation on the second request data packet, respectively, wherein each deletion operation is used to delete an alternative authentication field from the second request data packet to obtain a third request data packet; receiving N response results returned by the service side of the business system based on the N third request data packets, and identifying the target authentication field in the N candidate authentication fields based on the N response results to obtain the authentication credential associated with the business system.

[0006] In some implementations of the first aspect, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, it also includes: searching for a login field in the uniform resource locator of the request data packet; and searching for a username field and a passwd field in the request body of the request data packet.

[0007] In some implementations of the first aspect, the preset field conditions include at least one of the following: the field name is associated with a token, the field name is a session field, and the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, and a JWT string.

[0008] In some implementable embodiments of the first aspect, the response result is N target response data packets associated with N third request data packets, and the target authentication field in N alternative authentication fields is identified based on the N response results, including: searching for an authority keyword in the target response data packet by traversing the N target response data packets; when the authority keyword in the target response data packet is used to represent that the authority is invalid or the authentication fails, determining that the alternative authentication field corresponding to the target response data packet is the target authentication field; when the authority keyword in the target response data packet is used to represent that the authority is valid or the authentication is successful, determining that the alternative authentication field corresponding to the target response data packet is not the target authentication field.

[0009] In some implementations of the first aspect, the response result is N target response data packets associated with N third request data packets, and the target authentication field in N alternative authentication fields is identified based on the N response results, including: obtaining the second response data packet associated with the second request data packet from the M response data packets; comparing each target response data packet with the second response data packet; and when the target response data packet is inconsistent with the second response data packet, determining that the alternative authentication field corresponding to the target response data packet is the target authentication field.

[0010] In some implementation methods of the first aspect, the first field and the second field are combined to obtain N alternative authentication fields, including: combining the first field and the second field to obtain P alternative authentication fields, P ≥ N; randomly selecting a preset number of data packets from M request data packets and their associated M response data packets; obtaining the frequency of occurrence of each alternative authentication field in a preset number of data packets to obtain P frequency values; deleting PN alternative authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N alternative frequency fields.

[0011] In some implementations of the first aspect, a preset number of data packets are randomly selected from M request data packets and their associated M response data packets, including: obtaining the field value of a target field in each field of the M response data packets; screening multiple response data packets whose field values ​​of the target field meet preset screening conditions from the M response data packets; randomly selecting a preset number of data packets from the M request data packets and multiple response data packets; wherein the target field includes a status code status, a data length Length of the data packet, and a return type MIMEtype, and the preset screening conditions include at least one of the following: a status field value of 200, a MIMEtype field value of json, and a Length field value greater than a preset length threshold.

[0012] In some implementations of the first aspect, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, it also includes: when the target login field is not found in the M request data packets, searching from the fields of each request data packet for a first field whose field name satisfies a preset field name condition, and a second field whose field value is a target string.

[0013] In a second aspect, an embodiment of the present application provides an authentication credential identification device based on a data packet, the device comprising: an acquisition module, used to acquire M request data packets and their associated M response data packets from an associated database of a business system; a search module, used to search for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from each field of a first response data packet associated with the first request data packet when a target login field is found in the first request data packet of the M request data packets, wherein the target login field includes at least one of a login field, a username field, and a password field; a combination module, used to combine The first field and the second field are used to obtain N alternative authentication fields; a screening module is used to screen the second request data packet containing the N alternative authentication fields from the M request data packets, and obtain N third request data packets corresponding to the N alternative authentication fields by performing deletion operations on the N alternative authentication fields on the second request data packet respectively, wherein each deletion operation is used to delete an alternative authentication field from the second request data packet to obtain the third request data packet; an identification module is used to receive N response results returned by the service side of the business system based on the N third request data packets, and identify the target authentication field in the N alternative authentication fields based on the N response results to obtain the authentication credential associated with the business system.

[0014] In some implementations of the second aspect, the search module is further used to search for a login field in the uniform resource locator of the request data packet after obtaining M request data packets and their associated M response data packets from an associated database of the business system; and to search for a username field and a passwd field in the request body of the request data packet.

[0015] In some implementations of the second aspect, the preset field conditions include at least one of the following: the field name is associated with a token, the field name is a session field, and the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, and a JWT string.

[0016] In some implementation methods of the second aspect, the response result is N target response data packets associated with N third request data packets, and the identification module includes: a traversal unit, which is used to search for an authority keyword in the target response data packet by traversing the N target response data packets; a determination unit, which is used to determine that the alternative authentication field corresponding to the target response data packet is the target authentication field when the authority keyword in the target response data packet is used to represent that the authority is invalid or the authentication fails; the determination unit is also used to determine that the alternative authentication field corresponding to the target response data packet is not the target authentication field when the authority keyword in the target response data packet is used to represent that the authority is valid or the authentication is successful.

[0017] In some implementation methods of the second aspect, the response result is N target response data packets associated with N third request data packets, and the identification module includes: an acquisition unit, used to acquire the second response data packet associated with the second request data packet from the M response data packets; a comparison unit, used to compare each target response data packet with the second response data packet; and a determination unit, used to determine that the alternative authentication field corresponding to the target response data packet is the target authentication field when the target response data packet is inconsistent with the second response data packet.

[0018] In some implementation methods of the second aspect, the combination module is specifically used to: combine the first field and the second field to obtain P alternative authentication fields, P ≥ N; randomly select a preset number of data packets from M request data packets and their associated M response data packets; obtain the frequency of occurrence of each alternative authentication field in a preset number of data packets to obtain P frequency values; delete PN alternative authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N alternative frequency fields.

[0019] In some implementation methods of the second aspect, the filtering module is specifically used to: obtain the field value of the target field in each field of M response data packets; from the M response data packets, filter multiple response data packets whose field values ​​of the target field meet the preset filtering conditions; randomly select a preset number of data packets from M request data packets and multiple response data packets; wherein the target field includes the status code status, the data length Length of the data packet, and the return type MIMEtype, and the preset filtering conditions include at least one of the field value of status being 200, the field value of MIMEtype being json, and the field value of Length being greater than a preset length threshold.

[0020] In some implementations of the second aspect, the search module is also used to, after obtaining M request data packets and their associated M response data packets from an associated database of a business system, search, if the target login field is not found in any of the M request data packets, for a first field whose field name satisfies a preset field name condition, and a second field whose field value is a target string from the various fields of each request data packet.

[0021] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the steps of the data packet-based authentication credential identification method of the first aspect are implemented.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the steps of the data packet-based authentication credential identification method of the first aspect are implemented.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product, which is stored in a non-volatile storage medium. When the computer program product is executed by a processor, it implements the steps of the data packet-based authentication credential identification method as in the first aspect.

[0024] In a sixth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the steps of the data packet-based authentication credential identification method as in the first aspect.

[0025] The present application provides a data packet-based authentication credential identification method, device, equipment, medium and product, which obtains M request data packets and M response data packets associated with them from an associated database of a business system; the target login field includes at least one of a login field, a username field and a passwd field; when the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet is a data packet corresponding to the login interface; from each field of the first response data packet associated with the first request data packet, the first field whose field name meets the preset field name condition and the second field whose field value is the target string are searched, and N candidate authentication fields are obtained by combination, so as to filter out possible authentication fields from the return data of the login interface. Based on this, the second request data packet containing N candidate authentication fields is filtered out from the M request data packets, and the deletion operation of the N candidate authentication fields is performed on each second request data packet, each deletion operation is used to delete an alternative authentication field from the second request data packet, and finally N third request data packets corresponding to the N candidate authentication fields are obtained, that is, one alternative authentication field is missing in each third request data packet. The service side of the receiving business system returns N response results based on N third request data packets. The response result can represent a successful response or a failed response. Since the real authentication field will not be missing in the third request data packet of a successful response, the real target authentication field can be identified from multiple alternative authentication fields based on the N response results. The recognition accuracy is high, and the recognition efficiency is higher than that of manual testing one by one, and the authentication credentials associated with the business system can be quickly obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following briefly introduces the drawings in the embodiments of the present application.

[0027] Figure 1 It is a flowchart of an authentication credential identification method based on a data packet provided by an embodiment of the present application;

[0028] Figure 2 It is a flowchart of an authentication credential identification method based on a data packet provided by another embodiment of the present application;

[0029] Figure 3 It is a flowchart of an authentication credential identification method based on a data packet provided in yet another embodiment of the present application;

[0030] Figure 4 It is a flowchart of an authentication credential identification method based on a data packet provided in yet another embodiment of the present application;

[0031] Figure 5 It is a structural diagram of an authentication credential identification device based on a data packet provided in an embodiment of the present application;

[0032] Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that the purpose of providing these embodiments is to make the principles and spirit of the present application clearer and more thorough, so that those skilled in the art can better understand and implement the principles and spirit of the present application. The exemplary embodiments provided herein are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments herein, all other embodiments obtained by ordinary technicians of the art without creative work are within the scope of protection of this application.

[0034] In this document, terms such as first, second, third, etc. are only used to distinguish one entity (or operation) from another entity (or operation), but not to require or imply any order or relationship between these entities (or operations).

[0035] The following, in conjunction with the accompanying drawings, describes in detail the data packet-based authentication credential identification method provided in the embodiment of the present application through specific embodiments and their application scenarios.

[0036] Figure 1 It is a flow chart of an authentication credential identification method based on a data packet provided in one embodiment of the present application. The executor of the authentication credential identification method based on a data packet may be an authentication credential identification device, which may be connected to various business systems to identify the authentication credentials of various business systems.

[0037] Exemplarily, in an online recruitment scenario, each business system may include the B-end and C-end corresponding to the online recruitment platform. The B-end may include the online talent recruitment system, online application recruitment system, training system, etc. used by recruiting users, and the C-end may include the job search system for fresh graduates, online application job search system, job recommendation system, etc. used by job seekers.

[0038] The following takes the authentication credential identification method based on data packets as an example, and describes the authentication credential identification method based on data packets of the present application. It should be noted that the above-mentioned execution subjects and application scenarios do not constitute limitations on the present application.

[0039] like Figure 1 As shown, the data packet-based authentication credential identification method provided in the embodiment of the present application may include steps 110 to 150.

[0040] Step 110, obtaining M request data packets and their associated M response data packets from a correlation database of the business system;

[0041] Step 120, when the target login field is found in the first request data packet of the M request data packets, searching for a first field whose field name satisfies a preset field name condition and a second field whose field value is the target string from each field of the first response data packet associated with the first request data packet;

[0042] Step 130, combining the first field and the second field to obtain N candidate authentication fields;

[0043] Step 140, selecting a second request data packet containing N candidate authentication fields from the M request data packets, and performing a deletion operation on the N candidate authentication fields on the second request data packets respectively, to obtain N third request data packets corresponding to the N candidate authentication fields;

[0044] Step 150, receiving N response results returned by the service side of the business system based on the N third request data packets, and identifying the target authentication field in the N candidate authentication fields based on the N response results, to obtain the authentication credential associated with the business system.

[0045] The authentication credential identification method based on data packets provided in the embodiment of the present application obtains M request data packets and M response data packets associated with them from the associated database of the business system; the target login field includes at least one of the login field, the username field, and the passwd field. When the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet is a data packet corresponding to the login interface. From each field of the first response data packet associated with the first request data packet, the first field whose field name meets the preset field name condition and the second field whose field value is the target string are searched to obtain N candidate authentication fields, thereby filtering out possible authentication fields from the return data of the login interface. Based on this, the second request data packet containing N candidate authentication fields is filtered out from the M request data packets, and the deletion operation of the N candidate authentication fields is performed on each second request data packet, each deletion operation is used to delete an alternative authentication field from the second request data packet, and finally N third request data packets corresponding to the N candidate authentication fields are obtained, that is, one alternative authentication field is missing in each third request data packet. The service side of the receiving business system returns N response results based on N third request data packets. The response result can represent a successful response or a failed response. Since the real authentication field will not be missing in the third request data packet of a successful response, the real target authentication field can be identified from multiple alternative authentication fields based on the N response results. The recognition accuracy is high, and the recognition efficiency is higher than that of manual testing one by one, and the authentication credentials associated with the business system can be quickly obtained.

[0046] The specific implementation of the above steps will be described in detail below in conjunction with specific embodiments.

[0047] Involving step 110, M request data packets and their associated M response data packets are obtained from a correlation database of the business system.

[0048] In step 110, the associated database of each business system is used to store all request data packets and response data packets of the business system, and each request data packet is associated with a response data packet, which is returned by the service side based on the request data packet after the request data packet is sent to the service side of the business system. M is a positive integer, and the M request data packets and their associated M response data packets can be all data packets in the associated database, or data packets obtained within a preset time range. The preset time range can be set according to specific needs, and this application does not make specific limitations on this.

[0049] In some embodiments, data packets of all API requests of a domain name associated with a business system can be obtained from a network device or a Web application protection system waf to obtain M request data packets and their associated M response data packets, where each business system corresponds to a domain name.

[0050] Involving step 120, when the target login field is found in the first request data packet of M request data packets, the first field whose field name meets the preset field name condition and the second field whose field value is the target string are searched from the various fields of the first response data packet associated with the first request data packet.

[0051] In step 120, by traversing M request data packets, the target login field is searched in the request data packet. When the target login field is found, it is determined that the API corresponding to the request data packet is a login interface. The target login field may include at least one of the login field, the username field, and the passwd field. The target login field is used to characterize that the interface type corresponding to the request data packet is a login interface. Therefore, if the first request data packet contains the target login field, it indicates that the first request data packet is a request data packet for the login interface. The login interface is used to process user login requests, and the login request is used to authenticate and verify the user identity. Therefore, the response data packet of the login interface must carry an authentication field. In this way, based on the pre-set authentication field search rule based on the field name and field value, the response data packet containing the login interface is searched to obtain possible authentication fields, that is, alternative authentication fields.

[0052] In some embodiments of the present application, after the above step 110 obtains M request data packets and their associated M response data packets from the associated database of the business system and before step 120, the following steps may also be included:

[0053] Find the login field in the Uniform Resource Locator of the request data packet;

[0054] Look for the username and password fields in the request body of the request packet.

[0055] In the embodiment of the present application, by judging whether the url contains the login field, and whether the parameter value of the request body contains the target login fields such as username and password used to characterize the login request, it is possible to effectively determine whether the API corresponding to the request data packet is a login interface. Since the probability of carrying the authentication field in the response data packet of the login interface is relatively high, the preset field conditions are used to verify only the response data packet of the login interface, and there is no need to verify the request data packet and the remaining response data packets, thereby improving the screening efficiency of the alternative authentication fields. On the basis of the response data packet of the login interface, the authentication fields that may exist are effectively screened out as alternative authentication fields.

[0056] For example, if the business system is a B-end online recruitment system, the above login interface can be a recruitment user login interface, and the request data packet can carry the recruitment user's account name, account password, etc. After successful login, the recruitment user can obtain the recruitment user's submitted resume and other information. If the business system is a C-end online job application system, the above login interface can be a job seeker login interface.

[0057] In some embodiments of the present application, the preset field conditions may include at least one of the following: the field name is associated with the token, the field name is the session field, and the field name is the cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, and a JWT (JsonWeb Token) string.

[0058] Specifically, the field name is associated with the token by carrying the "token" character in the field name. JWT is a JSON-style lightweight authorization and identity authentication specification that can implement stateless, distributed Web application authorization. JWT is composed of three pieces of information: header, payload, and signature. These three pieces of information text are linked together to form a JWT string.

[0059] In one example, if the first response data packet carries a field name in the **token** format such as usertoken, Im-Token, accesstoken, etc., then the field can be determined as an alternative authentication field. If there is a cookie field or session field, then the cookie field or session field can be directly used as an alternative authentication field.

[0060] In another example, after obtaining the first response data packet, the Guid field value in the first response data packet is 4b757594da053919ef88fb1f8c392c58, and the Accesstoken field value is B25A271CA817449CB80E31F0870BBFC8. The field values ​​of both fields are 32-bit strings, so the Guid and Accesstoken fields can be determined as alternative authentication fields.

[0061] In the embodiment of the present application, currently the commonly used authentication methods for APIs include JSON Web Tokens (JWT), session, token, etc., and the location where the API authentication field appears is usually in the cookie of the header, as well as other fields of the header such as User-Token, Im-Token, Accesstoke, etc. Based on this, the field name features appearing in the first response data packet are determined using the preset field conditions, and the authentication fields that may exist in the first response data packet are identified as candidate authentication fields, and then the real target authentication field is identified from these possible authentication fields.

[0062] In some embodiments of the present application, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, the following steps may also be included:

[0063] When the target login field is not found in any of the M request data packets, a first field whose field name meets the preset field name condition and a second field whose field value is the target character string are searched from each field of each request data packet.

[0064] In the embodiment of the present application, if all request packets do not contain the target login field, it means that the request packet of the login interface has not been found. Based on this, all request packets can be queried using the preset field conditions, and the fields that meet the field name characteristics or field value characteristics in the preset field conditions can be effectively screened out from the various fields involved in all request packets, thereby avoiding the omission of the real authentication field.

[0065] Involving step 130, combining the first field and the second field to obtain N candidate authentication fields.

[0066] In step 130, N is a positive integer, the N alternative authentication fields include the first field and the second field, the N alternative authentication fields may include all the first field and the second field, or, the present application first filters all the first fields and the second fields, and combines the first fields and the second fields obtained after filtering to obtain N alternative authentication fields.

[0067] In some embodiments of the present application, in order to improve the efficiency of filtering out the target authentication field from the candidate authentication fields and the accuracy of filtering the target authentication field, the present application may filter the first field and the second field before filtering the target authentication field. Figure 2 is a flow chart of a method for identifying authentication credentials based on a data packet provided by another embodiment of the present application. The above step 130 may include Figure 2 Steps 210 to 230 are shown.

[0068] Step 210, combining the first field and the second field to obtain P candidate authentication fields, P ≥ N;

[0069] Step 220, randomly selecting a preset number of data packets from the M request data packets and their associated M response data packets;

[0070] Step 230, obtaining the frequency of each candidate authentication field appearing in a preset number of data packets to obtain P frequency values;

[0071] Step 240: Delete PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N candidate frequency fields.

[0072] Wherein, P is a positive integer, and the P alternative authentication fields include all the first fields and the second fields, that is, the field number and value of the first field and the second field are P. The preset number can be set according to specific needs, for example, it can be set to 8, 10 or other values, and the present application does not make specific restrictions on this. The above-mentioned preset number of data packets may include request data packets and response data packets. For each alternative authentication field, the first number of data packets containing the alternative authentication field is counted, and the frequency value can be the ratio of the first number to the preset number. The preset frequency threshold can also be set according to specific needs, for example, it can be set to 0.6, 0.8 or other values, and the present application does not make specific restrictions on this.

[0073] In the embodiment of the present application, since the real authentication field is used more times in the request call scenario, it appears more frequently in the request data packet and the response data packet. Based on this, a preset number of data packets can be randomly selected as a set, and the frequency of occurrence of each alternative authentication field in the set can be counted to obtain the frequency value of P alternative authentication fields, and then based on the frequency value, PN alternative authentication fields with lower occurrence frequency are filtered out, and then N alternative authentication fields with higher occurrence frequency are screened out from the P alternative authentication fields. Based on this, since PN alternative authentication fields are filtered out in advance, the target authentication field is directly screened from the N alternative authentication fields subsequently, which can reduce the difficulty of screening the target authentication field from the alternative authentication fields, improve the screening efficiency, and increase the frequency value as the screening threshold, which can improve the screening accuracy of the target authentication field.

[0074] In some embodiments of the present application, the above step 220 randomly selects a preset number of data packets from the M request data packets and the M response data packets associated therewith, and may specifically include the following steps:

[0075] Obtain the field value of the target field in each field of the M response data packets;

[0076] From the M response data packets, multiple response data packets whose field values ​​of the target fields meet the preset screening conditions are screened;

[0077] A preset number of data packets are randomly selected from the M request data packets and the multiple response data packets.

[0078] Among them, the target fields include the status code status, the data length Length of the data packet, and the return type MIMEtype. The preset filtering conditions include at least one of the status field value is 200, the MIMEtype field value is json, and the Length field value is greater than the preset length threshold.

[0079] In the embodiment of the present application, the status code (status) returned in the response data packet is 200, indicating a successful return, that is, the authentication is successful, so the response data packet is more likely to carry the authentication field; the longer the data length of the response data packet, the more information it carries, and the more authentication is required. Usually, in the case of a return failure, the data length is shorter, so the longer the data length, the more likely it is that the response data packet carries the authentication field; the json format indicates that the response data packet carries sensitive information, and authentication is required to obtain sensitive information, so the response data packet carrying sensitive information will carry the authentication field synchronously. Based on the above screening rules, the present application can use preset screening conditions to effectively divide M response data packets, classify multiple data packets with a greater probability of carrying the authentication field into one category, and then randomly select a preset number of data packets from them, so as to avoid the calculation accuracy of the frequency value being affected by the fact that the randomly selected data packet does not contain the alternative authentication field or only contains a small number of alternative authentication fields, thereby making the calculated frequency value more accurately represent the true frequency of the alternative authentication field in the response data packet, and when the frequency value is used as the screening threshold, the screening accuracy of the target authentication field can be improved.

[0080] Involving step 140, a second request data packet containing N alternative authentication fields is screened from M request data packets, and N third request data packets corresponding to the N alternative authentication fields are obtained by performing deletion operations on the second request data packet respectively.

[0081] In step 140, each deletion operation is used to delete an alternative authentication field from the second request data packet to obtain a third request data packet, and the deletion operation is used to delete the field name and field value of the alternative authentication field. The number of second request data packets can be one or N, and the second request data packet can be randomly obtained from all request data packets containing N screening fields. When the number of second request data packets is one, for one second request data packet, the deletion operation of N alternative authentication fields is performed respectively, that is, each deletion operation is used to delete an alternative authentication field from the same second request data packet. When the number of second request data packets is N, for N second request data packets, the deletion operation of N alternative authentication fields is performed respectively, that is, each deletion operation is used to delete an alternative authentication field from a second request data packet, and the operation objects (i.e., second request data packets) of different deletion operations are different.

[0082] In one example, N is 3, the candidate authentication fields are usertoken, Guid, and Accesstoken, the number of second request packets is 1, and the second request packet is A1. Then, the usertoken field and its field value are deleted from A1 to obtain the third request packet a1 corresponding to the usertoken field; the Guid field and its field value are deleted from A1 to obtain the third request packet a2 corresponding to the Guid field; the Accesstoken field and its field value are deleted from A1 to obtain the third request packet a3 corresponding to the Accesstoken field. In this way, three third request packets a1, a2, and a3 corresponding to the three candidate authentication fields can be obtained respectively.

[0083] In another example, N is 3, the alternative authentication fields are usertoken, Guid, and Accesstoken, the number of second request packets is 3, and the second request packet contains A1, B1, and C1. Then, the usertoken field and its field value are deleted from A1 to obtain the third request packet a1 corresponding to the usertoken field; the Guid field and its field value are deleted from B1 to obtain the third request packet b1 corresponding to the Guid field; the Accesstoken field and its field value are deleted from C1 to obtain the third request packet c1 corresponding to the Accesstoken field. In this way, three third request packets a1, b1, and c1 corresponding to the three alternative authentication fields can be obtained respectively.

[0084] Involving step 150, the service side of the receiving business system returns N response results based on N third request data packets, and identifies the target authentication field in N candidate authentication fields based on the N response results to obtain the authentication credential associated with the business system.

[0085] In step 150, after sending N third request data packets to the service side respectively, N response results can be received, and each third request data packet corresponds to a response result, which can represent a successful response or a failed response. Since the real authentication field will not be missing in the third request data packet with a successful response, it can be determined based on the response result whether the alternative authentication field corresponding to each third request data packet is the target authentication field, that is, the real authentication field.

[0086] In some embodiments of the present application, in order to improve the accuracy of the authentication credentials of the business system, the response result is N target response data packets associated with N third request data packets, Figure 3 is a flowchart of a method for identifying authentication credentials based on a data packet provided by another embodiment of the present application. The above step 150 may include Figure 3 Steps 310 to 330 are shown.

[0087] Step 310, searching for the permission keyword in the target response data packet by traversing N target response data packets;

[0088] Step 320, when the authority keyword in the target response data packet is used to indicate that the authority is invalid or the authentication fails, determining the candidate authentication field corresponding to the target response data packet as the target authentication field;

[0089] Step 330: When the authority keyword in the target response data packet is used to indicate that the authority is valid or the authentication is successful, determine that the candidate authentication field corresponding to the target response data packet is not the target authentication field.

[0090] Specifically, the permission keywords used to characterize the expiration of permission or the failure of authentication may be keywords such as "response failed", "permission expired", "permission does not exist", "authentication failed", "unauthenticated", "login information not obtained, please log in again"; correspondingly, the permission keywords used to characterize the validity of permission or the success of authentication may be keywords such as "response successful", "permission valid", "authentication successful", "login information obtained, logged in" and so on.

[0091] In the embodiment of the present application, the third request data packet with the missing alternative authentication field is resent to the service side of the business system, and a target response data packet can be obtained for each third request data packet. Based on this, by obtaining the authority keyword in the target response data packet, the accurate request result of the third request data packet can be determined according to the authority keyword, and based on the request result, it can be accurately determined whether the alternative authentication field is the target authentication field, and then the target authentication field can be accurately identified from the N alternative authentication fields, and the accurate authentication credentials of the business system can be obtained.

[0092] In some other embodiments of the present application, the response result is N target response data packets associated with N third request data packets. Figure 4 is a flowchart of a method for identifying authentication credentials based on a data packet provided by another embodiment of the present application. The above step 150 may include Figure 4 Steps 410 - 430 are shown.

[0093] Step 410, obtaining a second response data packet associated with the second request data packet from the M response data packets;

[0094] Step 420, comparing each target response data packet with the second response data packet;

[0095] Step 430: When the target response data packet is inconsistent with the second response data packet, determine that the candidate authentication field corresponding to the target response data packet is the target authentication field.

[0096] Specifically, the permission keyword in the second response data packet associated with the second request data packet is used to indicate that the permission is valid or the authentication is successful. When the target response data packet is consistent with the second response data packet, it is determined that the candidate authentication field corresponding to the target response data packet is not the target authentication field.

[0097] In the embodiment of the present application, when the request data packet does not lack the target authentication field, the request result represented by the corresponding response data packet is a successful request (i.e., a successful response); when the request data packet lacks the target authentication field, the request result represented by the corresponding response data packet is a failed request (i.e., a failed response); therefore, in the two cases where the request data packet does not lack the target authentication field and the target authentication field is missing, the corresponding response data packet is used to represent different request results, so the two must be different. Based on this, a third request data packet with a missing alternative authentication field is sent to the service side of the business system again, and a target response data packet can be obtained for each third request data packet. If the target response data packet is consistent with the second response data packet, it means that the request result represented by the target response data packet is a successful request, and the real authentication field is not missing in the third request data packet, so the alternative authentication field missing in the third request data packet is not the target authentication field; accordingly, if the target response data packet is inconsistent with the second response data packet, it means that the request result represented by the target response data packet is a failed request, and the real authentication field is missing in the third request data packet, so the alternative authentication field missing in the third request data packet is the target authentication field. In this way, by retransmitting the third request data packet that lacks the alternative authentication field, the target response data packet can be obtained. There is no need to extract the permission keyword in the target response data packet for judgment. By simply comparing the target response data packet with the existing second response data packet, it is possible to quickly and accurately determine whether the missing alternative authentication field in the third request data packet is the real authentication field. This ensures the recognition accuracy of the target authentication field while improving the recognition efficiency of the target authentication field.

[0098] Corresponding to the method embodiment of the present application, the present application also provides an authentication credential identification device based on a data packet.

[0099] Figure 5 Schematic diagram of a data packet-based authentication credential recognition device provided in an embodiment of the present application. Figure 5 As shown, the data packet-based authentication credential identification device 500 may include: an acquisition module 510 , a search module 520 , a combination module 530 , a screening module 540 , and an identification module 550 .

[0100] The acquisition module 510 is used to acquire M request data packets and their associated M response data packets from the associated database of the business system; the search module 520 is used to search for a first field whose field name meets a preset field name condition and a second field whose field value is a target string from each field of a first response data packet associated with the first request data packet when a target login field is found in the first request data packet of the M request data packets, wherein the target login field includes at least one of a login field, a username field, and a passwd field; the combination module 530 is used to combine the first field and the second field to obtain N backup data packets. Select the authentication field; the screening module 540 is used to screen the second request data packet containing N alternative authentication fields from the M request data packets, and obtain N third request data packets corresponding to the N alternative authentication fields by performing the deletion operation of the N alternative authentication fields on the second request data packet respectively, wherein each deletion operation is used to delete an alternative authentication field from the second request data packet to obtain the third request data packet; the identification module 550 is used to receive N response results returned by the service side of the business system based on the N third request data packets, and identify the target authentication field in the N alternative authentication fields based on the N response results to obtain the authentication credential associated with the business system.

[0101] The data packet-based authentication credential identification device provided by the embodiment of the present application obtains M request data packets and M response data packets associated therewith from the associated database of the business system; the target login field includes at least one of the login field, the username field, and the passwd field. When the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet is a data packet corresponding to the login interface. From each field of the first response data packet associated with the first request data packet, the first field whose field name meets the preset field name condition and the second field whose field value is the target string are searched, and N candidate authentication fields are obtained by combination, so as to filter out possible authentication fields from the return data of the login interface. Based on this, the second request data packet containing N candidate authentication fields is filtered out from the M request data packets, and the deletion operation of the N candidate authentication fields is performed on each second request data packet, each deletion operation is used to delete an alternative authentication field from the second request data packet, and finally N third request data packets corresponding to the N candidate authentication fields are obtained, that is, one alternative authentication field is missing in each third request data packet. The service side of the receiving business system returns N response results based on N third request data packets. The response result can represent a successful response or a failed response. Since the real authentication field will not be missing in the third request data packet of a successful response, the real target authentication field can be identified from multiple alternative authentication fields based on the N response results. The recognition accuracy is high, and the recognition efficiency is higher than that of manual testing one by one, and the authentication credentials associated with the business system can be quickly obtained.

[0102] In some embodiments of the present application, the search module 520 is also used to search for a login field in the uniform resource locator of the request data packet after obtaining M request data packets and their associated M response data packets from the associated database of the business system; and to search for a username field and a passwd field in the request body of the request data packet.

[0103] In some embodiments of the present application, the preset field conditions include at least one of the following: the field name is associated with a token, the field name is a session field, and the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, and a JWT string.

[0104] In some embodiments of the present application, the response result is N target response data packets associated with N third request data packets, and the identification module 550 includes: a traversal unit, which is used to search for the permission keyword in the target response data packet by traversing the N target response data packets; a determination unit, which is used to determine that the alternative authentication field corresponding to the target response data packet is the target authentication field when the permission keyword in the target response data packet is used to represent that the permission is invalid or the authentication fails; the determination unit is also used to determine that the alternative authentication field corresponding to the target response data packet is not the target authentication field when the permission keyword in the target response data packet is used to represent that the permission is valid or the authentication is successful.

[0105] In some embodiments of the present application, the response result is N target response data packets associated with N third request data packets, and the identification module 550 includes: an acquisition unit, used to acquire the second response data packet associated with the second request data packet from the M response data packets; a comparison unit, used to compare each target response data packet with the second response data packet; and a determination unit, used to determine that the alternative authentication field corresponding to the target response data packet is the target authentication field when the target response data packet is inconsistent with the second response data packet.

[0106] In some embodiments of the present application, the combination module 530 is specifically used to: combine the first field and the second field to obtain P alternative authentication fields, P ≥ N; randomly select a preset number of data packets from M request data packets and their associated M response data packets; obtain the frequency of each alternative authentication field appearing in a preset number of data packets to obtain P frequency values; delete PN alternative authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N alternative frequency fields.

[0107] In some embodiments of the present application, the filtering module 540 is specifically used to: obtain the field value of the target field in each field of M response data packets; from the M response data packets, filter multiple response data packets whose field values ​​of the target field meet the preset filtering conditions; randomly select a preset number of data packets from M request data packets and multiple response data packets; wherein the target field includes the status code status, the data length Length of the data packet, and the return type MIMEtype, and the preset filtering conditions include at least one of the field value of status being 200, the field value of MIMEtype being json, and the field value of Length being greater than a preset length threshold.

[0108] In some embodiments of the present application, the search module 520 is also used to, after obtaining M request data packets and their associated M response data packets from an associated database of a business system, search, if the target login field is not found in any of the M request data packets, for a first field whose field name satisfies a preset field name condition, and a second field whose field value is a target string from the various fields of each request data packet.

[0109] The authentication credential recognition device based on data packets provided in the embodiment of the present application can realize Figure 1-4 The various processes implemented by the service platform in the method embodiment can achieve the same technical effect. To avoid repetition, they will not be described here.

[0110] Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0111] like Figure 6 As shown, the electronic device 600 includes a memory 601 , a processor 602 , and a computer program stored in the memory 601 and executable on the processor 602 .

[0112] In an example, the processor 602 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0113] The memory 601 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it can be operated to perform the operations described in the card opening method in the embodiment according to the first aspect of the present application.

[0114] The processor 602 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 601, so as to implement the card activation method in the embodiment of the first aspect.

[0115] In some examples, the electronic device 600 may further include a communication interface 603 and a bus 610. Figure 6As shown, the memory 601, the processor 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0116] The communication interface 603 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 603 can also be used to access input devices and / or output devices.

[0117] The bus 610 includes hardware, software, or both, coupling the components of the electronic device 600 to each other. By way of example and not limitation, the bus 610 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a Memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 610 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0118] The electronic device provided in the embodiment of the present application can realize Figure 1-4 The various processes implemented by the electronic device in the method embodiment can achieve the same technical effect, and to avoid repetition, they will not be described here.

[0119] In combination with the authentication credential identification method based on data packets in the above embodiments, the present application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, the steps of any one of the authentication credential identification methods based on data packets in the above embodiments are implemented.

[0120] In combination with the authentication credential identification method based on data packets in the above embodiments, the present application embodiment can provide a computer program product for implementation. The (computer) program product is stored in a non-volatile storage medium, and when the program product is executed by at least one processor, it implements the steps of any one of the authentication credential identification methods based on data packets in the above embodiments.

[0121] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned data packet-based authentication credential identification method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0122] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0123] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0124] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), appropriate firmware, plug-in, function card, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0125] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0126] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0127] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for identifying authentication credentials based on data packets, characterized in that: include: Obtain M request data packets and their associated M response data packets from the associated database of the business system; In the case where the target login field is found in the first request data packet of the M request data packets, searching for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from various fields of the first response data packet associated with the first request data packet, wherein the target login field includes at least one of a login field, a username field, and a passwd field; Combining the first field and the second field to obtain N candidate authentication fields; Selecting a second request data packet including the N candidate authentication fields from the M request data packets, and obtaining N third request data packets corresponding to the N candidate authentication fields by respectively performing a deletion operation on the second request data packet, wherein each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain a third request data packet; The service side of the business system receives N response results returned based on the N third request data packets, and identifies a target authentication field in the N candidate authentication fields based on the N response results to obtain an authentication credential associated with the business system.

2. The method according to claim 1, characterized in that After obtaining M request data packets and their associated M response data packets from the associated database of the business system, the method further includes: Searching for the login field in the uniform resource locator of the request data packet; Search the username field and the passwd field in the request body of the request data packet.

3. The method according to claim 1, characterized in that The preset field condition includes at least one of the following: the field name is associated with a token, the field name is a session field, and the field name is a cookie field; the target string includes at least one of a 32-bit string, a 64-bit string, and a JWT string.

4. The method according to claim 1, characterized in that The response results are N target response data packets associated with the N third request data packets, and the identifying the target authentication field in the N candidate authentication fields based on the N response results includes: By traversing the N target response data packets, searching for a permission keyword in the target response data packets; In a case where the authority keyword in the target response data packet is used to represent an invalid authority or an authentication failure, determining that the candidate authentication field corresponding to the target response data packet is the target authentication field; In a case where the authority keyword in the target response data packet is used to represent that the authority is valid or the authentication is successful, it is determined that the candidate authentication field corresponding to the target response data packet is not the target authentication field.

5. The method according to claim 1, characterized in that The response results are N target response data packets associated with the N third request data packets, and the identifying the target authentication field in the N candidate authentication fields based on the N response results includes: Obtaining, from the M response data packets, a second response data packet associated with the second request data packet; comparing each target response data packet with the second response data packet; In a case where the target response data packet is inconsistent with the second response data packet, the candidate authentication field corresponding to the target response data packet is determined to be the target authentication field.

6. The method according to claim 1, characterized in that The combining of the first field and the second field to obtain N candidate authentication fields includes: Combining the first field and the second field to obtain P candidate authentication fields, P ≥ N; Randomly selecting a preset number of data packets from the M request data packets and the M response data packets associated therewith; Obtaining the frequency of occurrence of each candidate authentication field in the preset number of data packets to obtain P frequency values; PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold are deleted to obtain the N candidate frequency fields.

7. The method according to claim 6, characterized in that The randomly selecting a preset number of data packets from the M request data packets and the M response data packets associated therewith comprises: Obtaining the field value of the target field in each field of the M response data packets; From the M response data packets, screening multiple response data packets whose field values ​​of the target fields meet a preset screening condition; Randomly selecting a preset number of data packets from the M request data packets and the multiple response data packets; Among them, the target field includes the status code status, the data length Length of the data packet, and the return type MIMEtype, and the preset screening conditions include at least one of the status field value is 200, the MIME type field value is json, and the Length field value is greater than the preset length threshold.

8. The method according to claim 1, characterized in that After obtaining M request data packets and their associated M response data packets from the associated database of the business system, the method further includes: When the target login field is not found in any of the M request data packets, a first field whose field name satisfies a preset field name condition and a second field whose field value is a target character string are searched from the fields of each request data packet.

9. An authentication credential recognition device based on a data packet, characterized in that: include: An acquisition module, used to acquire M request data packets and their associated M response data packets from a related database of a business system; a search module, configured to search, when a target login field is found in a first request data packet of the M request data packets, a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from various fields of a first response data packet associated with the first request data packet, wherein the target login field includes at least one of a login field, a username field, and a passwd field; A combining module, used for combining the first field and the second field to obtain N candidate authentication fields; a screening module, configured to screen a second request data packet containing the N candidate authentication fields from the M request data packets, and obtain N third request data packets corresponding to the N candidate authentication fields by respectively performing a deletion operation on the N candidate authentication fields on the second request data packet, wherein each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain a third request data packet; An identification module is used to receive N response results returned by the service side of the business system based on the N third request data packets, and identify the target authentication field in the N alternative authentication fields based on the N response results to obtain the authentication credential associated with the business system.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the electronic device executes the computer program instructions, the method according to any one of claims 1 to 8 is implemented.

Images