Method and device for preventing identity authentication information from being hijacked and embezzled, equipment and medium

Abstract

The invention provides a method for preventing identity authentication information from being hijacked and embezzled, which is applied to the field of data security or big data. Comprising the steps that in response to a first access request of a user accessing a server side, identity authentication information of the user is acquired, and the identity authentication information comprises a verification character string with a validity period; the identity authentication information is returned to the client of the user, and the verification character string is stored in the server; in response to a second access request of the user accessing the server, reading and checking the validity period of the verification character string in the identity authentication information carried by the user and the consistency of the verification character string and the verification character string stored in the server; and in response to the condition that the current time does not exceed the validity period of the verification character string and the verification character string is consistent with the verification character string stored in the server, passing verification of the second access request, and executing a regeneration operation on the verification character string. The invention further provides a device and equipment for preventing the identity authentication information from being hijacked and embezzled, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or big data, and more specifically to a method, device, equipment, medium and program product for preventing identity authentication information from being hijacked and stolen. Background Art

[0002] In the field of computer technology, especially in the field of network security, the security of identity authentication information is an important issue. Identity authentication information is usually used to save the user's login status. If it is hijacked and misused, the attacker can impersonate the user to perform operations. Cross-site request forgery attack is an attack method that uses the registration credentials that the victim has obtained on the attacked website to bypass the back-end user verification and impersonate the user to perform certain operations on the attacked website.

[0003] Currently, the legitimacy of access requests is mainly verified by comparing the fingerprint information of the terminal making the access request with the stored identity authentication information. However, this method cannot prevent the identity authentication information from being hijacked and misused. If an attacker obtains the user's identity authentication information, he can forge the user's fingerprint information and send a forged access request. Summary of the invention

[0004] In view of the above problems, embodiments of the present disclosure provide a method, apparatus, device, medium and program product for preventing identity authentication information from being hijacked and misused.

[0005] According to a first aspect of the present disclosure, a method for preventing identity authentication information from being hijacked and misused is provided, the method comprising: in response to a first access request of a user accessing a server, obtaining the identity authentication information of the user, wherein the identity authentication information comprises a verification string with a validity period; returning the identity authentication information to the client of the user, and storing the verification string on the server; in response to a second access request of the user accessing the server, reading and checking the validity period of the verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored on the server; in response to the current time not exceeding the validity period of the verification string, and the verification string is consistent with the verification string stored on the server, passing the verification of the second access request, and performing a regeneration operation on the verification string.

[0006] According to an embodiment of the present disclosure, the method also includes: traversing the storage system in which the server stores the verification strings, and reading the validity period of each verification string; determining whether the validity period of each verification string stored on the server exceeds the current time; and when the validity period of the verification string stored on the server exceeds the current time, deleting the corresponding verification string from the storage system.

[0007] According to an embodiment of the present disclosure, in response to a second access request from a user accessing the server, reading and checking the validity period of a verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored on the server include: receiving and parsing the second access request to obtain the verification string in the identity authentication information and its validity period; determining whether the validity period of the verification string exceeds the current time; in response to the validity period of the verification string exceeding the current time, intercepting the second access request; in response to the validity period of the verification string not exceeding the current time, comparing the verification string with the verification string stored on the server for consistency; and when the verification string is inconsistent with the verification string stored on the server, intercepting the second access request.

[0008] According to an embodiment of the present disclosure, the regeneration operation of the verification string includes: generating a random number with a preset range and precision through a random number generator, and converting the random number; generating a new verification string based on the converted random number; and storing the newly generated verification string to the server, and sending it to the client to update the verification string.

[0009] According to an embodiment of the present disclosure, the method further includes: in response to the current time exceeding the validity period of the verification string, or the verification string is inconsistent with the verification string stored in the server, intercepting the second access request.

[0010] According to an embodiment of the present disclosure, the method further includes: acquiring behavior data of the user; evaluating and determining the risk level of the user based on the behavior data of the user; and dynamically adjusting the validity period of the verification string based on the risk level of the user.

[0011] According to an embodiment of the present disclosure, evaluating and determining the risk level of the user based on the user's behavior data includes: predicting the risk probability of the user using a pre-trained risk prediction model based on the user's behavior data; and determining the risk level of the user based on the risk probability.

[0012] The second aspect of the present disclosure provides a device for preventing identity authentication information from being hijacked and stolen, including: an acquisition module, used to respond to a first access request of a user accessing a server, to acquire the identity authentication information of the user, wherein the identity authentication information includes a verification string with a validity period; a processing module, used to return the identity authentication information to the user's client, and store the verification string on the server; a checking module, used to respond to a second access request of the user accessing the server, read and check the validity period of the verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored on the server; an execution module, used to respond to the current time not exceeding the validity period of the verification string, and the verification string is consistent with the verification string stored on the server, pass the verification of the second access request, and perform a regeneration operation on the verification string.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above-mentioned method for preventing identity authentication information from being hijacked and stolen.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-mentioned method for preventing identity authentication information from being hijacked and misused.

[0015] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for preventing identity authentication information from being hijacked and stolen.

[0016] In the embodiments of the present disclosure, by introducing a verification string and setting a validity period for the verification string, when the verification string expires, the user needs to re-authenticate. In this way, attackers can be prevented from using expired verification strings to send access requests, thereby enhancing the authentication mechanism. At the same time, the verification string has a one-time verification mechanism, which will become invalid once used, thereby ensuring that even if an attacker obtains the user's authentication information, he cannot use the hijacked authentication information to send a valid access request, further enhancing the security of the system. In addition, by cleaning up invalid verification strings in the server, it is prevented that the server application takes up a large amount of memory due to storing too much invalid information, affecting the stability of the service. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The following schematically shows an application scenario diagram of a method, apparatus, device, medium, and program product for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure;

[0019] Figure 2 A flowchart of a method for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a method for checking the validity period and consistency of a verification string according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A schematic diagram of a structure of a device for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure is shown; and

[0022] Figure 5 A block diagram of an electronic device for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0028] Figure 1 The application scenario diagram of the method, apparatus, device, medium and program product for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown.

[0029] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0030] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0031] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0032] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0033] It should be noted that the method for preventing identity authentication information from being hijacked and stolen provided by the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for preventing identity authentication information from being hijacked and stolen provided by the embodiment of the present disclosure can generally be set in the server 105. The method for preventing identity authentication information from being hijacked and stolen provided by the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the device for preventing identity authentication information from being hijacked and stolen provided by the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0035] First, the technical terms described in this article are explained and described as follows.

[0036] Cookie: Cookie is a type of data stored on the user's local terminal (such as a browser), usually used to save the user's login status and personalized settings. When a user visits a website, the website server can send a cookie to the user's browser, and the browser will save the cookie. Each time the user visits the website again, the browser will automatically send the cookie to the server, and the server can identify the user through the cookie. The main function of cookies is to allow the server to remember the user's status. For example, a user adds some items to the shopping cart on a shopping website, and then closes the browser to do other things. When the user opens the shopping website again after a period of time, the items in the shopping cart are still there. This is because the server remembers the user's shopping cart status through cookies.

[0037] It should be noted that although cookies are very useful for providing personalized network services, they also have some security and privacy issues. For example, if an attacker obtains a user's cookies, he or she may impersonate the user to perform operations. Therefore, the use of cookies usually requires some security measures, such as using secure cookies, updating cookies regularly, etc. At the same time, most browsers also provide settings that allow users to control which websites can set cookies and how to handle cookies. In this way, users can manage cookies according to their needs and risk acceptance.

[0038] Cookie Token: A randomly generated string used to verify the validity of cookie information.

[0039] Session: is a mechanism for storing user status on the server.

[0040] CSRF attack: CSRF (Cross-Site Request Forgery) is a network security vulnerability that uses the user's authenticated session information to forge the user's request, thereby performing malicious operations without the user's knowledge. Specifically, the attacker can steal the user's login information and simulate sending various requests as the user. This request is completely legal to the server, but it completes an operation that the attacker expects, such as sending emails or messages in the name of the user, stealing your account, adding a system administrator, and even purchasing goods, transferring virtual currency, etc.

[0041] The following will be based on Figure 1 The scene described by Figure 2 and Figure 3 The method for preventing identity authentication information from being hijacked and stolen in an embodiment of the present disclosure is described in detail.

[0042] Figure 2 The flowchart of the method for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure is schematically shown.

[0043] like Figure 2 As shown, the method for preventing identity authentication information from being hijacked and stolen in this embodiment includes operations S210 to S240.

[0044] In operation S210, in response to a first access request from a user accessing a service end, identity authentication information of the user is acquired, wherein the identity authentication information includes a verification string with a validity period.

[0045] In an embodiment of the present disclosure, before obtaining the user's identity authentication information, the user's consent or authorization is obtained. For example, before operation S210, a request to obtain the user's identity authentication information is issued to the user. When the user agrees or authorizes that the user's identity authentication information can be obtained, the operation S210 is performed.

[0046] In operation S220, the identity authentication information is returned to the user's client, and the verification string is stored in the server.

[0047] In operation S230, in response to a second access request from a user accessing the server, the validity period of the verification string in the identity authentication information carried by the user and the consistency between the verification string and the verification string stored in the server are read and checked.

[0048] In an embodiment of the present disclosure, a corresponding operation entry is provided for the user to choose to agree or reject the automated decision result. That is, before reading and checking the validity period of the verification string in the identity authentication information carried by the user, and the consistency processing / decision of the verification string with the verification string stored on the server, an instruction of the user to agree or reject the processing / decision input through the corresponding operation entry is obtained. If the user agrees to the processing / decision, the validity period of the verification string in the identity authentication information carried by the user, and the consistency processing / decision of the verification string with the verification string stored on the server are read and checked, and step S230 is executed. If the user refuses to perform the processing / decision, the expert decision process is entered.

[0049] In operation S240, in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored on the server, the second access request is verified and a regeneration operation is performed on the verification string.

[0050] Specifically, the user sends the first access request to the server. When requesting a service for the first time, identity authentication will be performed. If the authentication is successful, the user's identity authentication information (such as Cookie information, which will be explained in terms of Cookie information in the following embodiments) will be generated. The generated identity authentication information will include a random verification string (such as Cookie token), and the verification string has a validity period, which is consistent with the identity authentication information.

[0051] Exemplarily, when the server returns the Cookie information containing the Cookie token to the client, the Cookie token is stored in the server, such as in the Session of the server. When the user sends a second access request and requests the service again, the Cookie information after the first access will be carried. After receiving the second access request, the server will read the Cookie information and first parse the Cookie token information and its validity period. If the Cookie token information has expired, the authentication failure is returned for this request, and the user needs to re-authenticate; if the Cookie token is still within the validity period, the Cookie token carried by the client and the Cookie token saved in the server Session are compared to see if they are consistent. If they are consistent, the Cookie information is considered valid, and the identity information in the Cookie is processed and the data is returned. At the same time, a new Cookie token will be generated again, saved in the Session of the server, and the Cookie token information in the Cookie of the client will be updated to realize the one-time verification of the Cookie token, thereby preventing the identity authentication information from being hijacked and misused.

[0052] It should be noted that the method for preventing identity authentication information from being hijacked and misused provided by the embodiment of the present disclosure can solve the problem of CSRF attacks. In a CSRF attack, the attacker uses the registration credentials that the user has obtained on the attacked website to bypass the backend user verification and achieve the purpose of impersonating the user to perform a certain operation on the attacked website. Specifically, if the attacker obtains the user's cookie information, the user's request can be forged to perform malicious operations. Therefore, by using the cookie token and one-time verification mechanism disclosed in the present disclosure, CSRF attacks can be effectively prevented.

[0053] It can be understood that by using identity authentication information and a one-time verification method, it can be ensured that even if the identity authentication information is hijacked, the attacker cannot use the hijacked identity authentication information to send a valid access request, thereby effectively preventing the local identity authentication information from being hijacked and stolen, achieving the enhancement of the identity authentication mechanism and improving the security of the network.

[0054] In an embodiment of the present disclosure, the method further includes: in response to the current time exceeding the validity period of the verification string, or the verification string is inconsistent with the verification string stored in the server, intercepting the second access request.

[0055] In some exemplary embodiments, whenever a user sends an access request containing identity authentication information, the server will first intercept the request for subsequent identity authentication and permission checks. First, the server will check whether the current time exceeds the validity period of the verification string. If the validity period has expired, the verification string will be deemed invalid. If the validity period has not expired, the server will compare the verification string in the request with the original verification string stored in its server. If the verification string in the request is inconsistent with that stored by the server, it is considered that there is a problem with the identity authentication information in this request, and this request may be a forged user request. The access request is intercepted and the authentication failure is returned, requiring the user to re-authenticate.

[0056] Optionally, in order to prevent the verification string from being intercepted or tampered with during transmission, the HTTPS protocol may be used for encrypted transmission.

[0057] It is understandable that through timely interception, it is ensured that only users with legal identity authentication can access protected resources, which not only improves the security of the system, but also provides users with a more convenient and secure access experience.

[0058] In an embodiment of the present disclosure, the method also includes: traversing the storage system in which the server stores the verification strings, and reading the validity period of each verification string; determining whether the validity period of each verification string stored on the server exceeds the current time; and when the validity period of the verification string stored on the server exceeds the current time, deleting the corresponding verification string from the storage system.

[0059] Specifically, when saving on the server side, there are many choices of storage systems, such as databases, memory, file systems, cloud storage services and other types of storage systems. In some exemplary embodiments, a Session mechanism is used for storage.

[0060] Exemplarily, the Cookie token stored in the storage system by the server will be cleaned up after the set validity period. For example, the server periodically checks all Cookie tokens stored using Session to determine whether they have expired. Specifically, in this process, first, the server will traverse all records in the Session storage system. The Session storage system can be a memory, database, or other type of storage system, which is used to store user session information, including Cookie tokens. Then, for each record, the server will read the expiration time of the Cookie token therein. This expiration time is set when the Cookie token is generated, and it indicates the validity period of the Cookie token. Further, the server will obtain the current time and compare it with the expiration time of the Cookie token. If the current time is greater than the expiration time, it means that the Cookie token has expired. Finally, for the expired Cookie token, the server will delete it from the Session storage system. In this way, it is possible to prevent expired Cookie tokens from occupying storage space and affecting system performance.

[0061] It is understandable that by cleaning up the expired strings stored on the server, it is possible to prevent the server application from occupying a large amount of memory due to storing too much invalid information, thereby affecting the stability of the service.

[0062] Figure 3 The flowchart of the method for checking the validity period and consistency of a verification string according to an embodiment of the present disclosure is schematically shown.

[0063] Furthermore, if Figure 3 As shown, in response to a second access request from a user accessing the server, reading and checking the validity period of the verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored in the server include: receiving and parsing the second access request, obtaining the verification string in the identity authentication information and its validity period; determining whether the validity period of the verification string exceeds the current time; in response to the validity period of the verification string exceeding the current time, intercepting the second access request; in response to the validity period of the verification string not exceeding the current time, comparing the verification string with the verification string stored in the server for consistency; and when the verification string is inconsistent with the verification string stored in the server, intercepting the second access request.

[0064] Specifically, after receiving the second access request, the server can read the cookie information by parsing the Cookie field in the HTTP request header. Then, the server will parse the Cookie token information and its validity period from the Cookie information. This can be done by parsing a specific field (such as token) in the Cookie to obtain the Cookie token, and then parsing another specific field (such as expires) to obtain the validity period. Next, the server checks whether the Cookie token has expired by comparing the current time with the validity period of the Cookie token. If the Cookie token has expired, the server will return an authentication failure for this request, and the user needs to re-authenticate. If the Cookie token is still within the validity period, the server will compare the Cookie token carried by the client with the Cookie token saved in the server Session, generally by directly comparing whether the two Cookie tokens are completely consistent. Finally, if the Cookie tokens are consistent, the server will consider that the Cookie information is valid. Then, the server will process the identity information in the Cookie and return the data. If the Cookie tokens are inconsistent, the server will intercept this access request and require the user to re-authenticate.

[0065] It is understandable that the double verification mechanism, namely the validity period verification and consistency verification of the verification string, reduces the risk of abuse after being stolen, ensures that the verification string has not been tampered with, and further prevents forgery or man-in-the-middle attacks. At the same time, since the verification string has an expiration date, even if it is intercepted, the attacker cannot reuse it within the validity period, thus effectively preventing replay attacks. In addition, it also increases users' trust in account security and improves the overall user experience.

[0066] Furthermore, the regeneration operation of the verification string includes: generating a random number with a preset range and precision through a random number generator, and converting the random number; generating a new verification string based on the converted random number; and storing the newly generated verification string to the server, and sending it to the client to update the verification string.

[0067] Specifically, when generating a Cookie token, a secure random number generator is used to prevent attackers from predicting the value of the next Cookie token by analyzing the values ​​of multiple Cookie tokens. In this process, a secure random number generator is first selected. The so-called "secure" means that the generated random number sequence has a high randomness, that is, the probability of each number appearing is uniform, and there is no correlation between the numbers, so that the unknown part cannot be predicted by a known part of the sequence. Then use the selected random number generator to generate a random number. The range and accuracy of this random number will be set according to security requirements. For example, if you need to generate a random string of length 32 as a Cookie token, you can generate a random number between 0 and 2^256-1. Then convert the generated random number to the required format. For example, if you need to generate a random string, you can convert the random number into a string in hexadecimal or Base64 format. The generated random string can be used as a Cookie token. At the same time, the server saves the new Cookie token in the Session by updating the corresponding record in the Session storage system. Finally, the server sends the new Cookie token to the client, for example, by adding a Set-Cookie field in the HTTP response header, where the value of the Set-Cookie field is a Cookie containing the new Cookie token.

[0068] It should be noted that the relationship between the new Cookie token and the old Cookie token is mainly reflected in the following aspects.

[0069] One-time use: The new Cookie token is one-time, that is, once used, it cannot be used again. This is because a new Cookie token is generated for each user's request, and the old Cookie token will become invalid immediately after being verified. Independence: The new Cookie token is completely independent of the old Cookie token, that is, the value of the new Cookie token does not depend on the value of the old Cookie token. This is to prevent attackers from predicting the value of the next Cookie token by analyzing the values ​​of multiple Cookie tokens. Continuity: Although the new Cookietoken is independent of the old Cookie token, there is a continuity between them, that is, each new Cookie token is generated after the old Cookie token is verified. This ensures that each request of the user is continuous, thereby improving the user experience.

[0070] It is understandable that each verification string generated is based on a new random number, which ensures the uniqueness and unpredictability of the verification string, prevents the reuse of the verification string, thereby reducing the risk of the verification string being guessed or brute-forced, and significantly enhances the security of the system.

[0071] In an embodiment of the present disclosure, the method further includes: acquiring behavior data of the user; evaluating and determining the risk level of the user based on the behavior data of the user; and dynamically adjusting the validity period of the verification string based on the risk level of the user.

[0072] In some exemplary embodiments, the validity period of the verification string may be dynamically adjusted based on the risk level of the user.

[0073] Specifically, the user's behavior data is first collected and processed, such as the user's login frequency, request frequency, request time, and request type. By analyzing this data, the server can understand the user's behavior pattern. The server will then evaluate the user's risk level. For example, some security algorithms or models, such as machine learning models or risk scoring models, are used to calculate the user's risk level. The risk level can be based on a variety of factors, such as the user's behavior pattern, the user's device information, and the user's network environment.

[0074] Furthermore, based on the user's behavior data, evaluating and determining the user's risk level includes: based on the user's behavior data, predicting the user's risk probability using a pre-trained risk prediction model; and determining the user's risk level based on the risk probability.

[0075] When assessing a user's risk level, the server may use one or more models, including but not limited to machine learning models and risk scoring models.

[0076] Exemplarily, this step can be performed according to the following process: First, the server collects relevant data, including the user's behavior pattern (such as login frequency, request type, etc.), device information (such as operating system, browser type, etc.) and network environment (such as IP address, geographic location, etc.). This data can be obtained from the user's request or extracted from the server's log. Then the server processes the collected data to generate features that can be used by the model. This may involve steps such as data cleaning, encoding and normalization. For example, the login frequency can be normalized to between 0 and 1, and the operating system and browser type can be encoded with one hot encoding. The server then inputs the generated features into the model to obtain the user's risk level prediction. If a machine learning model such as a decision tree, random forest and neural network is used, then this process is the forward propagation of the model; if a risk scoring model is used, then this process is to calculate the risk score based on the weight of the feature. Then, the server will judge the user's risk level based on the predicted risk probability. For example, a threshold can be set. If the predicted risk probability exceeds the threshold, then the user's risk level is considered to be high; otherwise, the user's risk level is considered to be low. Finally, according to the user's risk level, the server will dynamically adjust the validity period of the Cookie token. For example, for users with higher risks, the server can shorten the validity period of the Cookie token to reduce the window of attack; for users with lower risks, the server can extend the validity period of the Cookie token to improve the user experience.

[0077] It should be noted that this process can be adjusted according to specific application scenarios and requirements. For example, different data, features, and models may be used, and other factors may be introduced, such as user historical behavior and feedback. At the same time, different thresholds may be used, or multiple risk levels may be used.

[0078] It is understandable that by dynamically adjusting the validity period of the Cookie token, the Cookie can be effectively prevented from being hijacked and misused. At the same time, the user experience can be optimized according to the user's risk level, so that the system can provide a more personalized security strategy. In addition, using the pre-trained risk prediction model, the system can predict the user's risk probability and perform risk management accordingly, so that the system can take preventive measures before the risk occurs, thereby avoiding potential security threats.

[0079] Figure 4The structural block diagram of the device for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown.

[0080] like Figure 4 As shown, the device 400 for preventing identity authentication information from being hijacked and stolen according to this embodiment includes an acquisition module 410 , a processing module 420 , a checking module 430 and an execution module 440 .

[0081] The acquisition module 410 is used to respond to the first access request of the user accessing the server, and obtain the identity authentication information of the user, wherein the identity authentication information includes a verification string with a validity period. In one embodiment, the acquisition module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0082] The processing module 420 is used to return the identity authentication information to the client of the user and store the verification string in the server. In one embodiment, the processing module 420 can be used to perform the operation S220 described above, which will not be described in detail here.

[0083] The checking module 430 is used to respond to the second access request of the user accessing the server, read and check the validity period of the verification string in the identity authentication information carried by the user, and the consistency of the verification string with the verification string stored by the server. In one embodiment, the checking module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0084] The execution module 440 is used to respond to the current time not exceeding the validity period of the verification string, and the verification string is consistent with the verification string stored by the server, pass the verification of the second access request, and perform a regeneration operation on the verification string. In one embodiment, the execution module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0085] In an embodiment of the present disclosure, the execution module 440 can also be used to: traverse the storage system in which the verification strings are stored on the server, and read the validity period of each verification string; determine whether the validity period of each verification string stored on the server exceeds the current time; and when the validity period of the verification string stored on the server exceeds the current time, delete the corresponding verification string from the storage system.

[0086] In an embodiment of the present disclosure, the checking module 430 is specifically used to: receive and parse the second access request, obtain the verification string in the identity authentication information and its validity period; determine whether the validity period of the verification string exceeds the current time; in response to the validity period of the verification string exceeding the current time, intercept the second access request; in response to the validity period of the verification string not exceeding the current time, compare the verification string with the verification string stored on the server to see if they are consistent; and when the verification string is inconsistent with the verification string stored on the server, intercept the second access request.

[0087] In an embodiment of the present disclosure, the execution module 440 can also be used to: generate a random number with a preset range and precision through a random number generator, and convert the random number; generate a new verification string based on the converted random number; and store the newly generated verification string to the server, and send it to the client to update the verification string.

[0088] In an embodiment of the present disclosure, the execution module 440 may also be used to: in response to the current time exceeding the validity period of the verification string, or the verification string being inconsistent with the verification string stored on the server, intercept the second access request.

[0089] In an embodiment of the present disclosure, the acquisition module 410 may also be used to: acquire the user's behavior data; evaluate and determine the user's risk level based on the user's behavior data; and dynamically adjust the validity period of the verification string based on the user's risk level.

[0090] In an embodiment of the present disclosure, the acquisition module 410 may also be used to: predict the risk probability of the user based on the user's behavior data using a pre-trained risk prediction model; and determine the risk level of the user based on the risk probability.

[0091] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 410, the processing module 420, the inspection module 430 and the execution module 440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the processing module 420, the inspection module 430 and the execution module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 410, the processing module 420, the inspection module 430 and the execution module 440 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0092] Figure 5 A block diagram of an electronic device for preventing identity authentication information from being hijacked and misused according to an embodiment of the present disclosure is schematically shown.

[0093] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0094] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0095] According to an embodiment of the present invention, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0096] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0097] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0098] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method for preventing identity authentication information from being hijacked and misused provided by the embodiment of the present disclosure.

[0099] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0100] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0101] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0102] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0103] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0104] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0105] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for preventing identity authentication information from being hijacked and misused, characterized in that: The method comprises: In response to a first access request from a user accessing the service end, obtaining identity authentication information of the user, wherein the identity authentication information includes a verification string with a validity period; Returning the identity authentication information to the user's client, and storing the verification string on the server; In response to a second access request from a user accessing the server, reading and checking the validity period of a verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored in the server; In response to the current time not exceeding the validity period of the verification string, and the verification string is consistent with the verification string stored on the server, the second access request is verified and a regeneration operation is performed on the verification string.

2. The method according to claim 1, characterized in that The method further comprises: Traversing the storage system of the server storing the verification strings, and reading the validity period of each verification string; Determine whether the validity period of each verification string stored in the server exceeds the current time; and When the validity period of the verification string stored in the server exceeds the current time, the corresponding verification string is deleted from the storage system.

3. The method according to claim 1 or 2, characterized in that: In response to a second access request from a user accessing the server, reading and checking the validity period of a verification string in the identity authentication information carried by the user, and the consistency between the verification string and the verification string stored in the server, comprises: Receiving and parsing the second access request, obtaining the verification string and its validity period in the identity authentication information; Determine whether the validity period of the verification string exceeds the current time; In response to the validity period of the verification string exceeding the current time, intercepting the second access request; In response to the validity period of the verification string not exceeding the current time, comparing the verification string with the verification string stored by the server to see whether they are consistent; and When the verification string is inconsistent with the verification string stored in the server, the second access request is intercepted.

4. The method according to claim 1 or 2, characterized in that: The regenerating operation on the verification string comprises: Generate a random number with a preset range and precision through a random number generator, and convert the random number; Based on the converted random number, generate a new verification string; and The newly generated verification string is stored in the server and sent to the client to update the verification string.

5. The method according to claim 1, characterized in that The method further comprises: In response to the current time exceeding the validity period of the verification string, or the verification string is inconsistent with the verification string stored on the server, intercepting the second access request.

6. The method according to claim 1 or 2, characterized in that: The method further comprises: Obtaining behavioral data of the user; Assess and determine the risk level of the user based on the user's behavior data; and The validity period of the verification string is dynamically adjusted based on the risk level of the user.

7. The method according to claim 6, characterized in that Based on the user's behavior data, evaluating and determining the risk level of the user includes: Based on the user's behavior data, predicting the risk probability of the user using a pre-trained risk prediction model; and Based on the risk probability, a risk level of the user is determined.

8. A device for preventing identity authentication information from being hijacked and misused, characterized in that: The device comprises: An acquisition module, configured to acquire, in response to a first access request from a user accessing the server, identity authentication information of the user, wherein the identity authentication information includes a verification string with a validity period; A processing module, used to return the identity authentication information to the user's client and store the verification string in the server; A checking module, configured to read and check the validity period of a verification string in the identity authentication information carried by the user and the consistency between the verification string and the verification string stored in the server in response to a second access request of the user accessing the server; The execution module is used to, in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored in the server, pass the verification of the second access request and perform a regeneration operation on the verification string.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that when the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images