Data packet-based authentication credential identification method, device and equipment

Abstract

The application discloses a data packet-based authentication credential identification method, device and equipment, comprising: obtaining M request data packets and M response data packets associated therewith from an associated database of a service system; in the case that a target login field is found in a first request data packet of the M request data packets, finding a first field with a field name satisfying a preset field name condition and a second field with a field value being a target string from each field of a first response data packet associated with the first request data packet; combining the first field and the second field to obtain N alternative authentication fields; performing a deletion operation on the N alternative authentication fields in a second request data packet containing the N alternative authentication fields to obtain N third request data packets; and identifying a target authentication field in the N alternative authentication fields based on N response results of the N third request data packets to obtain an authentication credential associated with the service system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of permission authentication, in particular to the field of identity authentication and access control, and specifically to a data packet-based authentication credential identification method, device and equipment. BACKGROUND

[0002] In a business system, generally includes a user device, a resource server and an authentication server. When the user device wants to access the resources provided by the resource server, it needs to pass the identity authentication of the authentication server first. After the authentication is passed, the authentication server generates an authentication credential and issues the generated authentication credential to the user device. In this way, the user device can carry the authentication credential to access the resources of the resource server, and the resource server can determine whether the user device has the permission to perform corresponding operations on the corresponding resources according to the authentication credential.

[0003] In the related art, different business systems use different authentication methods, so the authentication credentials associated with each business system are different. In order to realize secure access and avoid the occurrence of horizontal privilege infringement and other security problems, in the scene of various resource access permission management, for example, for API access permission management, the authentication credential must be identified first. At present, the identification of the authentication credential is usually realized by manual testing, which is low in efficiency. SUMMARY

[0004] Therefore, the embodiments of the present application provide a data packet-based authentication credential identification method, device, equipment, medium and product, which can automatically and effectively identify the authentication credentials corresponding to the business system and improve the identification efficiency.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying authentication credentials based on data packets, the method comprising: obtaining M request data packets and M response data packets associated with the M request data packets from an associated database of a service system; in a case that a target login field is found in a first request data packet of the M request data packets, finding, from each field of a first response data packet associated with the first request data packet, a first field whose field name meets a preset field name condition and a second field whose field value is a target string, wherein the target login field comprises at least one of a login field, a username field, and a passwd field; combining the first field and the second field to obtain N candidate authentication fields; selecting a second request data packet containing the N candidate authentication fields from the M request data packets, and obtaining N third request data packets corresponding to the N candidate authentication fields by performing a deletion operation of each candidate authentication field on the second request data packet, wherein each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain a third request data packet; receiving N response results returned by a service side of the service system based on the N third request data packets, and identifying a target authentication field from the N candidate authentication fields based on the N response results to obtain an authentication credential associated with the service system.

[0006] In some implementable manners of the first aspect, after obtaining the M request data packets and the M response data packets associated with the M request data packets from the associated database of the service system, the method further comprises: finding the login field in a uniform resource locator of the request data packet; finding the username field and the passwd field in a request body of the request data packet.

[0007] In some implementable manners of the first aspect, the preset field condition comprises at least one of the following: the field name is associated with a token, the field name is a session field, and the field name is a cookie field; and the target string comprises at least one of a 32-bit string, a 64-bit string, and a JWT string.

[0008] In some implementable manners of the first aspect, the response result is N target response data packets associated with the N third request data packets, and identifying the target authentication field from the N candidate authentication fields based on the N response results comprises: finding an authority keyword in the target response data packet by traversing the N target response data packets; in a case that the authority keyword in the target response data packet is used to represent that an authority is invalid or authentication fails, determining that the candidate authentication field corresponding to the target response data packet is the target authentication field; and in a case that the authority keyword in the target response data packet is used to represent that the authority is valid or authentication succeeds, determining that the candidate authentication field corresponding to the target response data packet is not the target authentication field.

[0009] In some possible implementations of the first aspect, the response result is N target response data packets associated with N third request data packets. Based on the N response results, the target authentication field is identified from N candidate authentication fields, including: obtaining a second response data packet associated with a second request data packet from M response data packets; comparing each target response data packet with the second response data packet; and determining the candidate authentication field corresponding to the target response data packet as the target authentication field when the target response data packet and the second response data packet are inconsistent.

[0010] In some possible implementations of the first aspect, the first field and the second field are combined to obtain N candidate authentication fields, including: combining the first field and the second field to obtain P candidate authentication fields, where P ≥ N; randomly selecting a preset number of data packets from M request data packets and their associated M response data packets; obtaining the frequency of each candidate authentication field appearing in the preset number of data packets to obtain P frequency values; deleting PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N candidate frequency fields.

[0011] In some possible implementations of the first aspect, randomly selecting a preset number of data packets from M request data packets and their associated M response data packets includes: obtaining the field value of a target field in each field of the M response data packets; filtering multiple response data packets from the M response data packets whose target field values ​​satisfy preset filtering conditions; and randomly selecting a preset number of data packets from the M request data packets and multiple response data packets; wherein the target field includes status code, data packet length, and return type MIME type, and the preset filtering conditions include at least one of status field value being 200, MIME type field value being json, and length field value being greater than a preset length threshold.

[0012] In some possible implementations of the first aspect, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, the method further includes: if the target login field is not found in any of the M request data packets, searching for a first field whose field name satisfies the preset field name condition and a second field whose field value is the target string from each field of each request data packet.

[0013] Secondly, embodiments of this application provide a data packet-based authentication credential identification device, comprising: an acquisition module, configured to acquire M request data packets and M associated response data packets from an associated database of a business system; a search module, configured to, when a target login field is found in a first request data packet of the M request data packets, search from each field of a first response data packet associated with the first request data packet for a first field whose field name satisfies a preset field name condition, and a second field whose field value is a target string, wherein the target login field includes at least one of a login field, a username field, and a passwd field; and a combination module, configured to combine... The first field and the second field yield N candidate authentication fields; the filtering module is used to filter second request data packets containing N candidate authentication fields from M request data packets, and to obtain N third request data packets corresponding to the N candidate authentication fields by performing deletion operations on the N candidate authentication fields on the second request data packets respectively, wherein each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain the third request data packet; the identification module is used to receive N response results returned by the service side of the business system based on the N third request data packets, and to identify the target authentication field among the N candidate authentication fields based on the N response results to obtain the authentication credentials associated with the business system.

[0014] In some possible implementations of the second aspect, the lookup module is also used to look up the login field in the Uniform Resource Locator of the request data packet after obtaining M request data packets and their associated M response data packets from the association database of the business system; and to look up the username field and the passwd field in the request body of the request data packet.

[0015] In some possible implementations of the second aspect, the preset field conditions include at least one of the following: the field name is associated with the token, the field name is a session field, or the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, or a JWT string.

[0016] In some possible implementations of the second aspect, the response result is N target response data packets associated with N third request data packets. The identification module includes: a traversal unit, used to search for permission keywords in the target response data packets by traversing the N target response data packets; a determination unit, used to determine that the candidate authentication field corresponding to the target response data packet is the target authentication field when the permission keyword in the target response data packet is used to indicate permission failure or authentication failure; the determination unit is also used to determine that the candidate authentication field corresponding to the target response data packet is not the target authentication field when the permission keyword in the target response data packet is used to indicate permission validity or successful authentication.

[0017] In some possible implementations of the second aspect, the response result is N target response data packets associated with N third request data packets. The identification module includes: an acquisition unit, used to acquire the second response data packet associated with the second request data packet from M response data packets; a comparison unit, used to compare each target response data packet with the second response data packet; and a determination unit, used to determine the candidate authentication field corresponding to the target response data packet as the target authentication field when the target response data packet and the second response data packet are inconsistent.

[0018] In some possible implementations of the second aspect, the combination module is specifically used to: combine the first field and the second field to obtain P candidate authentication fields, where P ≥ N; randomly select a preset number of data packets from M request data packets and their associated M response data packets; obtain the frequency of each candidate authentication field appearing in the preset number of data packets to obtain P frequency values; and delete PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N candidate frequency fields.

[0019] In some possible implementations of the second aspect, the filtering module is specifically used to: obtain the field value of the target field in each field of M response data packets; filter multiple response data packets from the M response data packets whose target field values ​​satisfy preset filtering conditions; randomly select a preset number of data packets from the M request data packets and multiple response data packets; wherein the target field includes status code status, data packet length Length, and return type MIME type, and the preset filtering conditions include at least one of status field value being 200, MIME type field value being json, and length field value being greater than a preset length threshold.

[0020] In some possible implementations of the second aspect, the lookup module is further configured to, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, and if the target login field is not found in any of the M request data packets, search for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from each field of each request data packet.

[0021] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the steps of the data packet-based authentication credential identification method as described in the first aspect.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the steps of the data packet-based authentication credential identification method of the first aspect.

[0023] Fifthly, embodiments of this application provide a computer program product stored in a non-volatile storage medium, which, when executed by a processor, implements the steps of the data packet-based authentication credential identification method of the first aspect.

[0024] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the steps of the data packet-based authentication credential identification method of the first aspect.

[0025] This application provides a method, apparatus, device, medium, and product for authentication credential identification based on data packets. It retrieves M request data packets and their associated M response data packets from a business system's associated database. The target login field includes at least one of the following: login, username, and passwd fields. If the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet corresponds to the login interface. From the fields of the first response data packet associated with the first request data packet, it searches for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string. These are combined to obtain N candidate authentication fields, thereby filtering possible authentication fields from the returned data of the login interface. Based on this, it filters second request data packets containing N candidate authentication fields from the M request data packets, and performs a deletion operation on each of the N candidate authentication fields in each second request data packet. Each deletion operation removes one candidate authentication field from the second request data packet, ultimately obtaining N third request data packets corresponding to the N candidate authentication fields. That is, each third request data packet is missing one candidate authentication field. The receiving business system's service side returns N response results based on N third request data packets. These response results can indicate whether the response is successful or unsuccessful. Since the successful third request data packet will not lack the true authentication field, the true target authentication field can be identified from multiple alternative authentication fields based on the N response results. The identification accuracy is high, and the identification efficiency is higher than that of manual testing one by one. It can quickly obtain the authentication credentials associated with the business system. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings of the embodiments of this application will be briefly described below.

[0027] Figure 1 This is a flowchart illustrating a data packet-based authentication credential identification method provided in an embodiment of this application;

[0028] Figure 2 This is a flowchart illustrating a data packet-based authentication credential identification method provided in another embodiment of this application;

[0029] Figure 3 This is a flowchart illustrating a data packet-based authentication credential identification method provided in another embodiment of this application;

[0030] Figure 4 This is a flowchart illustrating a data packet-based authentication credential identification method provided in another embodiment of this application;

[0031] Figure 5 This is a schematic diagram of the structure of a data packet-based authentication credential recognition device provided in an embodiment of this application;

[0032] Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0033] The principles and spirit of this application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided to make the principles and spirit of this application clearer and more thorough, enabling those skilled in the art to better understand and implement the principles and spirit of this application. The exemplary embodiments provided herein are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments described herein without inventive effort are within the scope of protection of this application.

[0034] In this document, terms such as first, second, and third are used only to distinguish one entity (or operation) from another, and are not intended to require or imply any order or relationship between these entities (or operations).

[0035] The data packet-based authentication credential recognition method provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0036] Figure 1 This is a flowchart illustrating a data packet-based authentication credential recognition method provided in an embodiment of this application. The executing entity of this data packet-based authentication credential recognition method can be an authentication credential recognition device, which can interface with various business systems to recognize the authentication credentials of each business system.

[0037] For example, in the context of online recruitment, each business system may include the B-end and C-end corresponding to the online recruitment platform. The B-end may include the online talent recruitment system, online application recruitment system, training system, etc. used by recruiting users, while the C-end may include the job search system for fresh graduates, online application job search system, job recommendation system, etc. used by job seekers.

[0038] The following example, using an authentication credential recognition device as the executing entity of the data packet-based authentication credential recognition method, illustrates the data packet-based authentication credential recognition method of this application. It should be noted that the aforementioned executing entity and application scenario do not constitute a limitation on this application.

[0039] like Figure 1 As shown, the authentication credential identification method based on data packets provided in this application embodiment may include steps 110-150.

[0040] Step 110: Retrieve M request data packets and their associated M response data packets from the business system's associated database;

[0041] Step 120: If the target login field is found in the first request data packet of M request data packets, search for the first field whose field name meets the preset field name condition and the second field whose field value is the target string from each field of the first response data packet associated with the first request data packet.

[0042] Step 130: Combine the first field and the second field to obtain N alternative authentication fields;

[0043] Step 140: Filter the second request data packet containing N candidate authentication fields from the M request data packets, and obtain the N third request data packets corresponding to the N candidate authentication fields by performing the deletion operation on the N candidate authentication fields of the second request data packets respectively;

[0044] Step 150: Receive N response results returned by the service side of the business system based on N third request data packets, and identify the target authentication field among the N candidate authentication fields based on the N response results to obtain the authentication credentials associated with the business system.

[0045] The authentication credential identification method based on data packets provided in this application retrieves M request data packets and their associated M response data packets from the associated database of the business system. The target login field includes at least one of the fields: login, username, and passwd. If the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet is the data packet corresponding to the login interface. From each field of the first response data packet associated with the first request data packet, the method searches for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string, thus obtaining N candidate authentication fields. This allows the method to filter possible authentication fields from the returned data of the login interface. Based on this, the method filters second request data packets containing N candidate authentication fields from the M request data packets, and performs a deletion operation on each of the N candidate authentication fields for each second request data packet. Each deletion operation removes one candidate authentication field from the second request data packet, ultimately obtaining N third request data packets corresponding to the N candidate authentication fields. That is, each third request data packet is missing one candidate authentication field. The receiving business system's service side returns N response results based on N third request data packets. These response results can indicate whether the response is successful or unsuccessful. Since the successful third request data packet will not lack the true authentication field, the true target authentication field can be identified from multiple alternative authentication fields based on the N response results. The identification accuracy is high, and the identification efficiency is higher than that of manual testing one by one. It can quickly obtain the authentication credentials associated with the business system.

[0046] The specific implementation of the above steps will be described in detail below with reference to specific embodiments.

[0047] Step 110 involves retrieving M request data packets and their associated M response data packets from the business system's associated database.

[0048] In step 110, the association database of each business system is used to store all request data packets and response data packets of that business system. Each request data packet is associated with a response data packet, which is returned by the service side based on the request data packet after the request data packet is sent to the service side of that business system. M is a positive integer. The M request data packets and their associated M response data packets can be all data packets in the association database, or they can be data packets obtained within a preset time range. The preset time range can be set according to specific needs, and this application does not make specific limitations on it.

[0049] In some embodiments, data packets of all API requests associated with a business system's domain name can be obtained from a network device or a Web Application Firewall (WAF), resulting in M ​​request data packets and their associated M response data packets, with each business system corresponding to a domain name.

[0050] In step 120, if the target login field is found in the first request data packet of M request data packets, the first field whose field name meets the preset field name condition and the second field whose field value is the target string are found from each field of the first response data packet associated with the first request data packet.

[0051] In step 120, by traversing M request data packets, the target login field is searched within each request data packet. If the target login field is found, the API corresponding to the request data packet is determined to be a login interface. The target login field may include at least one of the fields: login, username, and passwd. This target login field is used to characterize the interface type corresponding to the request data packet as a login interface. Therefore, if the first request data packet contains the target login field, it indicates that the first request data packet is a request data packet for the login interface. The login interface is used to process user login requests, and the login request is used to authenticate and verify the user's identity. Therefore, the response data packet of the login interface must carry an authentication field. Thus, based on the pre-set authentication field search rules based on field name and field value, searching the response data packet containing the login interface can yield possible authentication fields, i.e., candidate authentication fields.

[0052] In some embodiments of this application, after obtaining M request data packets and their associated M response data packets from the association database of the business system, and before step 120, step 110 may further include the following steps:

[0053] Look for the login field in the Uniform Resource Locator of the request packet;

[0054] Look for the username and passwd fields in the request body of the request packet.

[0055] In this embodiment, by determining whether the URL contains a "login" field and whether the parameter values ​​in the request body contain target login fields such as "username" and "passwd" used to characterize the login request, it is possible to effectively determine whether the API corresponding to the request data packet is a login interface. Since the response data packet of the login interface has a high probability of carrying authentication fields, subsequent verification can be performed only on the response data packet of the login interface using preset field conditions, without needing to verify the request data packet and other response data packets. This improves the efficiency of filtering candidate authentication fields and effectively filters out possible authentication fields as candidate authentication fields based on the response data packet of the login interface.

[0056] For example, if the business system is a B2B online application and recruitment system, the above login interface can be a login interface for recruiting users. The request data packet can carry the recruiting user's username, password, etc. Only after successful login can the recruiting user obtain information such as the resume submitted by the recruiting user. If the business system is a C2C online application and job search system, the above login interface can be a login interface for job seekers.

[0057] In some embodiments of this application, the preset field conditions may include at least one of the following: the field name is associated with the token, the field name is a session field, or the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, or a JWT (JsonWeb Token) string.

[0058] Specifically, associating a field name with a token can mean that the field name contains the character "token". JWT is a lightweight authorization and authentication specification in JSON style, which enables stateless, distributed authorization for web applications. A JWT consists of three parts: a header, a payload, and a signature. These three parts are concatenated together with a period (.) to form a JWT string.

[0059] In one example, if the first response data packet contains field names in **token** format, such as usertoken, Im-Token, or accesstoken, then that field can be identified as a candidate authentication field. If a cookie or session field exists, then the cookie or session field can be directly used as a candidate authentication field.

[0060] In another example, after receiving the first response packet, the Guid field value in the first response packet is 4b757594da053919ef88fb1f8c392c58, and the Accesstoken field value is B25A271CA817449CB80E31F0870BBFC8. Both field values ​​are 32-bit strings, so the Guid and Accesstoken fields can be identified as alternative authentication fields.

[0061] In this embodiment, commonly used API authentication methods include JSON Web Tokens (JWT), session, and token. API authentication fields typically appear in the cookie header and other header fields such as User-Token, Im-Token, and Access Token. Based on this, the field name characteristics appearing in the first response data packet are determined using preset field conditions to identify potential authentication fields as candidate authentication fields. Then, the actual target authentication field is identified from these potential authentication fields.

[0062] In some embodiments of this application, after obtaining M request data packets and their associated M response data packets from the association database of the business system, the following steps may also be included:

[0063] If the target login field is not found in any of the M request data packets, search for the first field whose field name meets the preset field name condition and the second field whose field value is the target string from each field of each request data packet.

[0064] In this embodiment, if none of the request data packets contain the target login field, it indicates that no request data packet for the login interface was found. Based on this, preset field conditions can be used to query all request data packets, effectively filtering out fields that match the field name or value characteristics in the preset field conditions from all fields involved in the request data packets, thus avoiding the omission of genuine authentication fields.

[0065] Step 130 involves combining the first field and the second field to obtain N alternative authentication fields.

[0066] In step 130, N is a positive integer. The N candidate authentication fields include the first field and the second field. The N candidate authentication fields can include all the first field and the second field. Alternatively, this application first performs a filtering operation on all the first field and the second field, and combines the filtered first field and the second field to obtain N candidate authentication fields.

[0067] In some embodiments of this application, in order to improve the filtering efficiency and accuracy of selecting the target authentication field from the candidate authentication fields, this application can filter the first field and the second field before filtering the target authentication field. Figure 2 This is a flowchart illustrating a data packet-based authentication credential identification method according to another embodiment of this application. Step 130 described above may include... Figure 2 Steps 210-230 are shown.

[0068] Step 210: Combine the first field and the second field to obtain P candidate authentication fields, where P ≥ N;

[0069] Step 220: Randomly select a preset number of data packets from the M request data packets and their associated M response data packets;

[0070] Step 230: Obtain the frequency of each candidate authentication field in a preset number of data packets to obtain P frequency values;

[0071] Step 240: Delete PN candidate authentication fields whose frequency values ​​are less than the preset frequency threshold to obtain N candidate frequency fields.

[0072] Where P is a positive integer, and the P candidate authentication fields include all of the first and second fields, that is, the sum of the number of fields in the first and second fields is P. The preset number can be set according to specific needs, such as 8, 10, or other values, and this application does not impose a specific limitation on it. The aforementioned preset number of data packets can include request data packets and response data packets. For each candidate authentication field, the first number of data packets containing that candidate authentication field is counted, and this frequency value can be the ratio of the first number to the preset number. The preset frequency threshold can also be set according to specific needs, such as 0.6, 0.8, or other values, and this application does not impose a specific limitation on it.

[0073] In this embodiment, since the actual authentication fields are used frequently in request and response scenarios, they appear frequently in both request and response data packets. Therefore, a predetermined number of data packets can be randomly selected as a set, and the frequency of each candidate authentication field in the set can be statistically analyzed to obtain the frequency values ​​of P candidate authentication fields. Then, based on these frequency values, PN candidate authentication fields with lower frequencies are filtered out, resulting in N candidate authentication fields with higher frequencies from the P candidate authentication fields. Thus, by pre-filtering out PN candidate authentication fields, the target authentication field can be directly selected from the N candidate authentication fields, reducing the difficulty of selecting the target authentication field and improving selection efficiency. Furthermore, adding a frequency value as a selection threshold can improve the accuracy of selecting the target authentication field.

[0074] In some embodiments of this application, step 220, which involves randomly selecting a preset number of data packets from M request data packets and their associated M response data packets, may specifically include the following steps:

[0075] Retrieve the field value of the target field from each field of M response data packets;

[0076] From M response data packets, filter multiple response data packets whose target field values ​​meet preset filtering conditions;

[0077] A preset number of data packets are randomly selected from M request data packets and multiple response data packets.

[0078] The target fields include status code, data length of the data packet, and return type (MIME type). The preset filtering conditions include at least one of the following: status field value is 200, MIME type field value is json, and length field value is greater than a preset length threshold.

[0079] In this embodiment, the status code (status) returned in the response data packet is 200, indicating a successful return, i.e., successful authentication. Therefore, the response data packet is more likely to carry an authentication field. The longer the response data packet, the more information it carries, and the more authentication is required. Usually, in the case of a failure, the data length is shorter, so the response data packet with a longer data length is more likely to carry an authentication field. The JSON format indicates that the response data packet carries sensitive information, and obtaining sensitive information requires authentication. Therefore, the response data packet carrying sensitive information will also carry an authentication field. Based on the above filtering rules, this application can effectively divide M response data packets using preset filtering conditions, group multiple data packets that are more likely to carry authentication fields into one category, and then randomly select a preset number of data packets from them. This avoids the random selection of data packets not containing candidate authentication fields or containing only a few candidate authentication fields, which would affect the accuracy of the frequency value calculation. As a result, the calculated frequency value can more accurately represent the true frequency of candidate authentication fields in the response data packet. When using the frequency value as a filtering threshold, it can improve the filtering accuracy of the target authentication field.

[0080] In step 140, a second request data packet containing N candidate authentication fields is selected from M request data packets, and by performing a deletion operation on each of the N candidate authentication fields on the second request data packet, N third request data packets corresponding to the N candidate authentication fields are obtained.

[0081] In step 140, each deletion operation is used to remove one candidate authentication field from the second request data packet to obtain a third request data packet. The deletion operation is used to delete the field name and field value of the candidate authentication field. The number of second request data packets can be one or N, and the second request data packets can be randomly obtained from all request data packets containing N filter fields. When the number of second request data packets is one, the deletion operation of N candidate authentication fields is performed for one second request data packet, that is, each deletion operation is used to delete one candidate authentication field from the same second request data packet. When the number of second request data packets is N, the deletion operation of N candidate authentication fields is performed for N second request data packets, that is, each deletion operation is used to delete one candidate authentication field from one second request data packet. The operation objects (i.e., the second request data packets) of different deletion operations are different.

[0082] In one example, N is 3, the candidate authentication fields are usertoken, Guid, and Accesstoken, and the number of second request packets is 1, designated A1. Then, deleting the usertoken field and its value from A1 yields the third request packet a1 corresponding to the usertoken field; deleting the Guid field and its value from A1 yields the third request packet a2 corresponding to the Guid field; and deleting the Accesstoken field and its value from A1 yields the third request packet a3 corresponding to the Accesstoken field. Thus, three third request packets a1, a2, and a3 corresponding to the three candidate authentication fields can be obtained respectively.

[0083] In another example, N is 3, the alternative authentication fields are usertoken, Guid, and Accesstoken, and the number of second request packets is 3. The second request packets contain A1, B1, and C1. Then, by deleting the usertoken field and its value from A1, we obtain the third request packet a1 corresponding to the usertoken field; by deleting the Guid field and its value from B1, we obtain the third request packet b1 corresponding to the Guid field; and by deleting the Accesstoken field and its value from C1, we obtain the third request packet c1 corresponding to the Accesstoken field. Thus, we can obtain three third request packets a1, b1, and c1 corresponding to the three alternative authentication fields.

[0084] In step 150, the system receives N response results from the service side of the business system based on N third request data packets, and identifies the target authentication field among the N candidate authentication fields based on the N response results to obtain the authentication credentials associated with the business system.

[0085] In step 150, after sending N third request data packets to the service side, N response results can be received. Each third request data packet corresponds to a response result, which can indicate whether the response is successful or unsuccessful. Since the successful third request data packet will not lack the actual authentication field, it is possible to determine whether the candidate authentication field corresponding to each third request data packet is the target authentication field, i.e., the actual authentication field, based on the response result.

[0086] In some embodiments of this application, in order to improve the accuracy of authentication credentials in the business system, the response result is N target response data packets associated with N third request data packets. Figure 3 This is a flowchart illustrating a data packet-based authentication credential identification method according to another embodiment of this application. Step 150 described above may include... Figure 3 Steps 310-330 are shown.

[0087] Step 310: Search for permission keywords in N target response data packets by traversing them.

[0088] Step 320: If the permission keyword in the target response data packet is used to indicate permission failure or authentication failure, determine the alternative authentication field corresponding to the target response data packet as the target authentication field.

[0089] Step 330: If the permission keyword in the target response data packet is used to indicate that the permission is valid or the authentication is successful, determine that the alternative authentication field corresponding to the target response data packet is not the target authentication field.

[0090] Specifically, permission keywords used to indicate invalid permissions or authentication failures can be keywords such as "response failure", "permission invalid", "permission does not exist", "authentication failure", "unauthenticated", "login information not obtained, please log in again"; correspondingly, permission keywords used to indicate valid permissions or successful authentication can be keywords such as "response success", "permission valid", "authentication successful", "login information obtained, already logged in".

[0091] In this embodiment, a third request data packet with missing alternative authentication fields is resent to the business system service side. For each third request data packet, a target response data packet can be obtained. Based on this, by obtaining the permission keyword in the target response data packet, the accurate request result of the third request data packet can be determined according to the permission keyword. Based on the request result, it is possible to accurately determine whether the alternative authentication field is the target authentication field, and thus accurately identify the target authentication field from N alternative authentication fields, obtaining the accurate authentication credential of the business system.

[0092] In other embodiments of this application, the response result is N target response data packets associated with N third request data packets. Figure 4 This is a flowchart illustrating a data packet-based authentication credential identification method according to another embodiment of this application. Step 150 described above may include... Figure 4 Steps 410-430 are shown.

[0093] Step 410: Obtain the second response data packet associated with the second request data packet from the M response data packets;

[0094] Step 420: Compare each target response data packet with the second response data packet;

[0095] Step 430: If the target response data packet and the second response data packet are inconsistent, determine the alternative authentication field corresponding to the target response data packet as the target authentication field.

[0096] Specifically, the permission keyword in the second response packet associated with the second request packet is used to indicate that the permission is valid or the authentication is successful. If the target response packet and the second response packet are identical, it is determined that the alternative authentication field corresponding to the target response packet is not the target authentication field.

[0097] In this embodiment, when the request data packet is not missing the target authentication field, its corresponding response data packet represents a successful request (i.e., a successful response). When the request data packet is missing the target authentication field, its corresponding response data packet represents a failed request (i.e., a failed response). Therefore, the response data packets for the two cases—without the target authentication field and with the target authentication field missing—represent different request results, and thus must be different. Based on this, a third request data packet missing the alternative authentication field is resent to the business system service side. For each third request data packet, a target response data packet can be obtained. If the target response data packet is consistent with the second response data packet, it indicates that the request result represented by the target response data packet is a successful request, and the third request data packet does not lack the actual authentication field. Therefore, the alternative authentication field missing in the third request data packet is not the target authentication field. Conversely, if the target response data packet is inconsistent with the second response data packet, it indicates that the request result represented by the target response data packet is a failed request, and the third request data packet lacks the actual authentication field. Therefore, the alternative authentication field missing in the third request data packet is the target authentication field. In this way, by retransmitting the third request data packet with missing alternative authentication fields, the target response data packet can be obtained. There is no need to extract the permission keywords in the target response data packet for judgment. By simply comparing the target response data packet with the existing second response data packet, it is possible to quickly and accurately determine whether the missing alternative authentication fields in the third request data packet are the real authentication fields. This ensures the accuracy of the identification of the target authentication fields while improving the identification efficiency.

[0098] Corresponding to the method embodiments of this application, this application also provides a data packet-based authentication credential identification device.

[0099] Figure 5 This is a schematic diagram of the structure of a data packet-based authentication credential recognition device provided in an embodiment of this application. Figure 5 As shown, the data packet-based authentication credential recognition device 500 may include: an acquisition module 510, a search module 520, a combination module 530, a filtering module 540, and a recognition module 550.

[0100] The acquisition module 510 is used to acquire M request data packets and their associated M response data packets from the associated database of the business system; the search module 520 is used to, if the target login field is found in the first request data packet of the M request data packets, search for a first field whose field name meets the preset field name condition and a second field whose field value is the target string from each field of the first response data packet associated with the first request data packet, wherein the target login field includes at least one of the fields login, username, and passwd; the combination module 530 is used to combine the first field and the second field to obtain N backups. The system includes a selection and filtering module 540, which filters a second request data packet containing N candidate authentication fields from M request data packets. It then performs a deletion operation on each of the N candidate authentication fields in the second request data packet to obtain N third request data packets corresponding to the N candidate authentication fields. Each deletion operation removes one candidate authentication field from the second request data packet to obtain the third request data packet. An identification module 550 receives N response results from the service side of the business system based on the N third request data packets. Based on the N response results, it identifies the target authentication field among the N candidate authentication fields to obtain the authentication credentials associated with the business system.

[0101] The authentication credential recognition device based on data packets provided in this application retrieves M request data packets and their associated M response data packets from the associated database of the business system. The target login field includes at least one of the fields: login, username, and passwd. If the target login field is found in the first request data packet of the M request data packets, it indicates that the first request data packet is the data packet corresponding to the login interface. From each field of the first response data packet associated with the first request data packet, a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string are searched, and N candidate authentication fields are obtained by combining them, thereby filtering possible authentication fields from the returned data of the login interface. Based on this, a second request data packet containing N candidate authentication fields is filtered from the M request data packets, and a deletion operation of N candidate authentication fields is performed on each second request data packet. Each deletion operation is used to delete one candidate authentication field from the second request data packet, and finally N third request data packets corresponding to the N candidate authentication fields are obtained, that is, each third request data packet is missing one candidate authentication field. The receiving business system's service side returns N response results based on N third request data packets. These response results can indicate whether the response is successful or unsuccessful. Since the successful third request data packet will not lack the true authentication field, the true target authentication field can be identified from multiple alternative authentication fields based on the N response results. The identification accuracy is high, and the identification efficiency is higher than that of manual testing one by one. It can quickly obtain the authentication credentials associated with the business system.

[0102] In some embodiments of this application, the lookup module 520 is further configured to, after obtaining M request data packets and their associated M response data packets from the association database of the business system, look up the login field in the Uniform Resource Locator of the request data packets; and look up the username field and the passwd field in the request body of the request data packets.

[0103] In some embodiments of this application, the preset field conditions include at least one of the following: the field name is associated with the token, the field name is a session field, and the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, and a JWT string.

[0104] In some embodiments of this application, the response result is N target response data packets associated with N third request data packets. The identification module 550 includes: a traversal unit, used to search for permission keywords in the target response data packets by traversing the N target response data packets; a determination unit, used to determine that the candidate authentication field corresponding to the target response data packet is the target authentication field when the permission keyword in the target response data packet is used to indicate permission failure or authentication failure; the determination unit is also used to determine that the candidate authentication field corresponding to the target response data packet is not the target authentication field when the permission keyword in the target response data packet is used to indicate permission validity or successful authentication.

[0105] In some embodiments of this application, the response result is N target response data packets associated with N third request data packets. The identification module 550 includes: an acquisition unit, used to acquire a second response data packet associated with a second request data packet from M response data packets; a comparison unit, used to compare each target response data packet with the second response data packet; and a determination unit, used to determine the candidate authentication field corresponding to the target response data packet as the target authentication field when the target response data packet and the second response data packet are inconsistent.

[0106] In some embodiments of this application, the combination module 530 is specifically used to: combine the first field and the second field to obtain P candidate authentication fields, where P ≥ N; randomly select a preset number of data packets from M request data packets and their associated M response data packets; obtain the frequency of each candidate authentication field appearing in the preset number of data packets to obtain P frequency values; and delete PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain N candidate frequency fields.

[0107] In some embodiments of this application, the filtering module 540 is specifically used to: obtain the field value of the target field in each field of M response data packets; filter multiple response data packets from the M response data packets whose target field values ​​satisfy preset filtering conditions; randomly select a preset number of data packets from the M request data packets and multiple response data packets; wherein the target field includes status code status, data packet length Length, and return type MIME type, and the preset filtering conditions include at least one of status field value being 200, MIME type field value being json, and length field value being greater than a preset length threshold.

[0108] In some embodiments of this application, the search module 520 is further configured to, after obtaining M request data packets and their associated M response data packets from the associated database of the business system, and if the target login field is not found in any of the M request data packets, search for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from each field of each request data packet.

[0109] The authentication credential recognition device based on data packets provided in this application can achieve... Figures 1-4 The various processes implemented by the service platform in the method embodiment can achieve the same technical effect, and will not be described again here to avoid repetition.

[0110] Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application.

[0111] like Figure 6 As shown, the electronic device 600 includes a memory 601, a processor 602, and a computer program stored in the memory 601 and executable on the processor 602.

[0112] In one example, the processor 602 described above may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that may be configured to implement the embodiments of this application.

[0113] Memory 601 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the card opening method in the embodiments according to the first aspect of this application.

[0114] The processor 602 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 601, in order to implement the card opening method in the embodiment of the first aspect above.

[0115] In some examples, electronic device 600 may also include communication interface 603 and bus 610. For example, Figure 6As shown, the memory 601, processor 602, and communication interface 603 are connected through bus 610 and complete communication with each other.

[0116] The communication interface 603 is mainly used to enable communication between various modules, devices, units, and / or equipment in the embodiments of this application. Input devices and / or output devices can also be connected through the communication interface 603.

[0117] Bus 610 includes hardware, software, or both, that couples components of electronic device 600 together. For example, and not limitingly, bus 610 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0118] The electronic device provided in this application embodiment is capable of achieving Figures 1-4 The various processes implemented by the electronic device in the method embodiment can achieve the same technical effect, and will not be described again here to avoid repetition.

[0119] In conjunction with the data packet-based authentication credential recognition method in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement the steps of any of the data packet-based authentication credential recognition methods in the above embodiments.

[0120] In conjunction with the packet-based authentication credential recognition method in the above embodiments, this application embodiment can provide a computer program product to implement it. This (computer) program product is stored in a non-volatile storage medium, and when executed by at least one processor, it implements the steps of any of the packet-based authentication credential recognition methods in the above embodiments.

[0121] This application also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described data packet-based authentication credential recognition method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0122] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0123] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0124] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0125] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0126] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0127] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A data packet-based authentication credential identification method, characterized in that, include: Retrieve M request data packets and their associated M response data packets from the business system's associated database; If a target login field is found in the first request data packet of the M request data packets, then from each field of the first response data packet associated with the first request data packet, a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string are searched. The target login field includes at least one of the following: login field, username field, and passwd field. By combining the first field and the second field, N alternative authentication fields are obtained; Filter the second request data packet containing the N candidate authentication fields from the M request data packets, and obtain N third request data packets corresponding to the N candidate authentication fields by performing a deletion operation on the second request data packet for each of the N candidate authentication fields. Each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain the third request data packet. The system receives N response results returned by the service side of the business system based on the N third request data packets, and identifies the target authentication field among the N candidate authentication fields based on the N response results to obtain the authentication credentials associated with the business system. The combination of the first field and the second field yields N candidate authentication fields, including: By combining the first field and the second field, P alternative authentication fields are obtained, where P ≥ N; From the M request data packets and their associated M response data packets, a preset number of data packets are randomly selected; Obtain the frequency of each alternative authentication field in the preset number of data packets to obtain P frequency values; Delete PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain the N candidate frequency fields.

2. The method according to claim 1, characterized in that, After retrieving M request data packets and their associated M response data packets from the business system's relational database, the process also includes: The login field is located in the Uniform Resource Locator of the request data packet; The username and passwd fields are located in the request body of the request data packet.

3. The method according to claim 1, characterized in that, The preset field name conditions include at least one of the following: the field name is associated with a token, the field name is a session field, or the field name is a cookie field; the target string contains at least one of a 32-bit string, a 64-bit string, or a JWT string.

4. The method according to claim 1, characterized in that, The response results are N target response data packets associated with the N third request data packets. The step of identifying the target authentication field from the N candidate authentication fields based on the N response results includes: By traversing the N target response data packets, permission keywords are searched within the target response data packets; If the permission keyword in the target response data packet is used to indicate permission failure or authentication failure, the alternative authentication field corresponding to the target response data packet is determined as the target authentication field. If the permission keyword in the target response data packet is used to indicate that the permission is valid or the authentication is successful, it is determined that the alternative authentication field corresponding to the target response data packet is not the target authentication field.

5. The method according to claim 1, characterized in that, The response results are N target response data packets associated with the N third request data packets. The step of identifying the target authentication field from the N candidate authentication fields based on the N response results includes: From the M response data packets, obtain the second response data packet associated with the second request data packet; Compare each target response data packet with the second response data packet; If the target response data packet is inconsistent with the second response data packet, the alternative authentication field corresponding to the target response data packet is determined as the target authentication field.

6. The method according to claim 1, characterized in that, The step of randomly selecting a preset number of data packets from the M request data packets and their associated M response data packets includes: Obtain the field value of the target field from each field of the M response data packets; From the M response data packets, filter multiple response data packets whose field values ​​of the target field satisfy preset filtering conditions; A preset number of data packets are randomly selected from the M request data packets and the plurality of response data packets; The target fields include status code, data packet length, and return type (MIME type). The preset filtering conditions include at least one of the following: status field value is 200, MIME type field value is json, and length field value is greater than a preset length threshold.

7. The method according to claim 1, characterized in that, After retrieving M request data packets and their associated M response data packets from the business system's relational database, the process also includes: If the target login field is not found in any of the M request data packets, search for the first field whose field name meets the preset field name condition and the second field whose field value is the target string from each field of each request data packet.

8. A data packet-based authentication credential identification device, characterized in that, include: The acquisition module is used to retrieve M request data packets and their associated M response data packets from the associated database of the business system; The lookup module is used to, when a target login field is found in the first request data packet of the M request data packets, search for a first field whose field name satisfies a preset field name condition and a second field whose field value is a target string from each field of the first response data packet associated with the first request data packet. The target login field includes at least one of the following: login field, username field, and passwd field. The combination module is used to combine the first field and the second field to obtain N alternative authentication fields; The filtering module is used to filter second request data packets containing the N candidate authentication fields from the M request data packets, and to obtain N third request data packets corresponding to the N candidate authentication fields by performing deletion operations on the N candidate authentication fields on the second request data packets respectively. Each deletion operation is used to delete one candidate authentication field from the second request data packet to obtain the third request data packet. The identification module is used to receive N response results returned by the service side of the business system based on the N third request data packets, and to identify the target authentication field among the N candidate authentication fields based on the N response results, so as to obtain the authentication credentials associated with the business system. Specifically, the combined module is used for: By combining the first field and the second field, P alternative authentication fields are obtained, where P ≥ N; From the M request data packets and their associated M response data packets, a preset number of data packets are randomly selected; Obtain the frequency of each alternative authentication field in the preset number of data packets to obtain P frequency values; Delete PN candidate authentication fields whose frequency values ​​are less than a preset frequency threshold to obtain the N candidate frequency fields.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory storing computer program instructions; when the electronic device executes the computer program instructions, it implements the method as described in any one of claims 1-7.

Images