Methods, devices, equipment and media for preventing identity authentication information from being hijacked and stolen

Abstract

A method for preventing the hijacking and misuse of identity authentication information is provided, applicable to data security or big data fields. It includes: responding to a first access request from a user accessing the server, obtaining the user's identity authentication information, wherein the identity authentication information includes a verification string with an expiration date; returning the identity authentication information to the user's client and storing the verification string on the server; responding to a second access request from the user accessing the server, reading and checking the expiration date of the verification string in the user's identity authentication information, and verifying the consistency between the verification string and the verification string stored on the server; responding that the current time has not exceeded the expiration date of the verification string, and that the verification string matches the verification string stored on the server, passing the verification of the second access request, and performing a regeneration operation on the verification string. An apparatus, device, storage medium, and program product for preventing the hijacking and misuse of identity authentication information are also provided.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of information security or big data, and more particularly to a method, device, equipment, medium and program product for preventing identity authentication information from being hijacked and stolen. BACKGROUND

[0002] In the field of computer technology, especially in the field of network security, the security of identity authentication information is an important issue. Identity authentication information is usually used to save the login state of a user, and if it is hijacked and stolen, an attacker can impersonate the user to perform operations. Cross-site request forgery attack is an attack method that uses the registered credentials obtained by a victim on the attacked website to bypass the user verification of the background and impersonate the user to perform certain operations on the attacked website.

[0003] Currently, the legality of an access request is mainly verified by comparing the fingerprint information of the terminal of the access request with the stored identity authentication information. However, this method cannot prevent identity authentication information from being hijacked and stolen. If an attacker obtains the identity authentication information of a user, the attacker can fake the fingerprint information of the user and send a fake access request. SUMMARY

[0004] In view of the above problems, embodiments of the present disclosure provide a method, device, equipment, medium and program product for preventing identity authentication information from being hijacked and stolen.

[0005] According to a first aspect of the present disclosure, a method for preventing identity authentication information from being hijacked and stolen is provided, the method comprising: in response to a first access request of a user accessing a service end, obtaining identity authentication information of the user, wherein the identity authentication information comprises a verification string with a validity period; returning the identity authentication information to a client of the user and storing the verification string in the service end; in response to a second access request of a user accessing the service end, reading and checking the validity period of the verification string in the identity authentication information carried by the user and the consistency of the verification string with the verification string stored in the service end; in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored in the service end, passing the verification of the second access request and performing a regeneration operation on the verification string.

[0006] According to an embodiment of the present disclosure, the method further comprises: traversing a storage system of the service end storing the verification strings and reading the validity period of each verification string; determining whether the validity period of each verification string stored in the service end exceeds the current time; and when the validity period of the verification string stored in the service end exceeds the current time, deleting the corresponding verification string from the storage system.

[0007] According to an embodiment of the present disclosure, the reading and checking, in response to a second access request of a user accessing the service end, of a validity period of a verification string in identity authentication information carried by the user and consistency of the verification string with a verification string stored by the service end comprises: receiving and parsing the second access request to obtain the verification string and the validity period of the verification string in the identity authentication information; judging whether the validity period of the verification string exceeds a current time; in response to the validity period of the verification string exceeding the current time, intercepting the second access request; in response to the validity period of the verification string not exceeding the current time, comparing the verification string with the verification string stored by the service end; and when the verification string is inconsistent with the verification string stored by the service end, intercepting the second access request.

[0008] According to an embodiment of the present disclosure, the performing a regeneration operation on the verification string comprises: generating a random number of a preset range and precision by a random number generator, and transforming the random number; generating a new verification string based on the transformed random number; and storing the newly generated verification string to the service end and sending the newly generated verification string to the client to update the verification string.

[0009] According to an embodiment of the present disclosure, the method further comprises: in response to the current time exceeding the validity period of the verification string or the verification string being inconsistent with the verification string stored by the service end, intercepting the second access request.

[0010] According to an embodiment of the present disclosure, the method further comprises: obtaining behavior data of the user; based on the behavior data of the user, evaluating and determining a risk level of the user; and based on the risk level of the user, dynamically adjusting the validity period of the verification string.

[0011] According to an embodiment of the present disclosure, the evaluating and determining, based on the behavior data of the user, of a risk level of the user comprises: based on the behavior data of the user, predicting a risk probability of the user by using a pre-trained risk prediction model; and based on the risk probability, determining the risk level of the user.

[0012] The second aspect of the present disclosure provides an apparatus for preventing hijacking of identity authentication information, comprising: an obtaining module configured to obtain identity authentication information of a user accessing a service end in response to a first access request of the user, wherein the identity authentication information comprises a verification string with a validity period; a processing module configured to return the identity authentication information to a client of the user and store the verification string in the service end; a checking module configured to read and check the validity period of the verification string in the identity authentication information carried by a user accessing the service end in response to a second access request of the user, and consistency of the verification string with the verification string stored in the service end; and an executing module configured to pass the verification of the second access request and perform a regeneration operation on the verification string in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored in the service end.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device configured to store one or more programs, the one or more processors executing the one or more computer programs to implement the steps of the above method for preventing hijacking of identity authentication information.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the steps of the above method for preventing hijacking of identity authentication information.

[0015] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program, the computer program being executed by a processor to implement the steps of the above method for preventing hijacking of identity authentication information.

[0016] In the embodiments of the present disclosure, by introducing a verification string and setting a validity period for the verification string, the user needs to perform identity authentication again when the verification string expires. In this way, the attacker cannot send an access request using the expired verification string, and the identity authentication mechanism is enhanced. At the same time, the verification string has a one-time verification mechanism and will be invalid once used, thereby ensuring that even if the attacker obtains the identity authentication information of the user, the hijacked identity authentication information cannot be used to send a valid access request, further enhancing the security of the system. In addition, by cleaning up the invalid verification strings in the service end, the application of the service end is prevented from occupying a large amount of memory due to saving too much invalid information, thereby affecting the stability of the service. BRIEF DESCRIPTION OF DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1 An application scenario diagram of a method, device, equipment, medium and program product for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a method for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a method for checking the validity period and consistency of a verification string according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A structural block diagram of a device for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown; and

[0022] Figure 5 A block diagram of an electronic device for a method for preventing identity authentication information from being hijacked and stolen according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to one skilled in the art that the present disclosure can be practiced without these specific details. In other instances, descriptions of well-known structures and techniques have been omitted in order to avoid obscuring the concepts of the present disclosure.

[0024] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprise", and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein, including technical and scientific terms, have meanings commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or overly formal manner.

[0026] In the case of using expressions similar to "at least one of A, B, and C, etc.", it is generally intended to include any of A, B, and C alone, a combination of at least two of A, B, and C, etc.

[0027] In the technical solutions of the present application, the user information (including but not limited to user personal information, user image information, user equipment information, such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards of relevant countries and regions, necessary security measures are taken, public order and good customs are not violated, and appropriate operation portals are provided for users to choose authorization or refusal.

[0028] Figure 1 The application scenario of the method, device, equipment, medium and program product for preventing identity authentication information from being hijacked and stolen according to the embodiments of the present disclosure is schematically shown.

[0029] As Figure 1 shown, the application scenario 100 according to the embodiments can include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0030] The user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0031] The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0032] The server 105 can be a server that provides various services, such as a background management server that provides support for a website browsed by a user using the terminal device 101, 102, 103 (as an example). The background management server can perform analysis and the like on received user requests and the like, and feed back the processing results (such as a webpage, information, or data, or the like, obtained or generated in accordance with a user request) to the terminal device.

[0033] It should be noted that the method for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the apparatus for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure can generally be arranged in the server 105. The method for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, 103 and / or the server 105. Accordingly, the apparatus for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the terminal device 101, 102, 103 and / or the server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the system 100 is merely illustrative. Any number of terminal devices, networks, and servers can be provided according to implementation needs.

[0035] First, the technical terms described herein are explained and described as follows.

[0036] Cookie: Cookie is a kind of data stored in the user's local terminal (such as a browser), usually used to save the user's login status and personalized settings. When a user visits a website, the website server can send a Cookie to the user's browser, and the browser will save this Cookie. Next time the user visits this website, the browser will automatically send this Cookie to the server, and the server can identify the user through this Cookie. The main role of Cookie is to let the server remember the user's state. For example, the user adds some goods to the shopping cart on a shopping website, then closes the browser to do other things. A period of time later, the user opens this shopping website again, and the goods in the shopping cart are still there, which is because the server remembers the user's shopping cart state through Cookie.

[0037] It should be noted that, although cookies are very useful for providing personalized web services, there are also some security and privacy issues. For example, if an attacker obtains a user's cookie, it may impersonate the user to operate. Therefore, the use of cookies usually needs to take some security measures, such as using secure cookies, regularly updating cookies, etc. At the same time, most browsers also provide settings that allow users to control which websites can set cookies and how to handle cookies. In this way, users can manage cookies according to their own needs and risk acceptance level.

[0038] Cookie Token: A randomly generated string used to verify the validity of cookie information.

[0039] Session: A mechanism for storing user state on the server side.

[0040] CSRF attack: CSRF (Cross-Site Request Forgery) is a network security vulnerability that uses user- authenticated session information to fake user requests and perform malicious operations without the user's knowledge. Specifically, an attacker can steal a user's login information and simulate sending various requests in the user's identity. This request is completely legal to the server, but it has completed an operation that the attacker expects, such as sending an email or message in the user's name, stealing your account, adding a system administrator, or even buying goods, virtual currency transfers, etc.

[0041] The following will be based on Figure 1 The scenario described in detail Figure 2 And Figure 3 The method for preventing hijacking and stealing of identity authentication information of the embodiments of the present disclosure is described.

[0042] Figure 2 The flowchart of the method for preventing hijacking and stealing of identity authentication information according to the embodiments of the present disclosure is schematically shown.

[0043] As Figure 2 The method for preventing hijacking and stealing of identity authentication information of the embodiments includes operations S210-S240.

[0044] In operation S210, in response to a first access request of a user accessing a server, identity authentication information of the user is obtained, wherein the identity authentication information includes a verification string with a validity period.

[0045] In embodiments of the present disclosure, the consent or authorization of the user is obtained before the identity authentication information of the user is acquired. For example, before operation S210, the user is prompted to acquire the identity authentication information of the user. In the case that the user consents or authorizes the identity authentication information of the user to be acquired, the operation S210 is performed.

[0046] In operation S220, the identity authentication information is returned to the client of the user, and the verification string is stored in the server.

[0047] In operation S230, in response to a second access request of a user accessing the server, the validity period of the verification string in the identity authentication information carried by the user is read and checked, and the consistency of the verification string with the verification string stored in the server is checked.

[0048] In embodiments of the present disclosure, the user is provided with a corresponding operation portal for the user to select to agree or refuse the automatic decision result. That is, before the validity period of the verification string in the identity authentication information carried by the user is read and checked, and the consistency of the verification string with the verification string stored in the server is processed / decided, the instruction of the user input through the corresponding operation portal to agree or refuse the processing / decision is obtained. If the user agrees to the processing / decision, the validity period of the verification string in the identity authentication information carried by the user is read and checked, and the consistency of the verification string with the verification string stored in the server is processed / decided, that is, operation S230 is performed. If the user refuses the processing / decision, the expert decision process is entered.

[0049] In operation S240, in response to the current time not exceeding the validity period of the verification string, and the verification string being consistent with the verification string stored in the server, the second access request is verified, and the regeneration operation of the verification string is performed.

[0050] Specifically, when the user sends a first access request to the server for the first time, identity authentication is performed, and the identity authentication information (such as Cookie information, which is described in the following embodiments) of the user is generated after the authentication is successful. The identity authentication information contains a random verification string (such as Cookie token), and the verification string has a validity period, the length of which is consistent with the identity authentication information.

[0051] Exemplarily, when the service end returns the Cookie information containing the Cookie token to the client, the Cookie token is stored in the service end, such as the Session of the service end. When the user sends a second access request and requests the service again, the Cookie information after the first access is carried. The service end reads the Cookie information after receiving the second access request, and first parses the Cookie token information and the validity period thereof. If the Cookie token information has expired, the authentication fails for the current request, and the user needs to perform identity authentication again. If the Cookie token is still within the validity period, the Cookie token carried by the client is compared with the Cookie token saved in the Session of the service end. If they are consistent, it is considered that the Cookie information is valid this time, the identity information in the Cookie is processed, and data is returned. Meanwhile, a new Cookie token is generated again, saved in the Session of the service end, and the Cookie token information in the Cookie of the client is updated, so as to realize one-time verification of the Cookie token, thereby realizing the problem of preventing the identity authentication information from being hijacked and stolen.

[0052] It should be noted that the method for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure can solve the problem of CSRF attack. In CSRF attack, an attacker uses the registered credentials of a user who has obtained from an attacked website to bypass the user verification of the background, so as to impersonate the user to perform an operation on the attacked website. Specifically, if the attacker obtains the Cookie information of the user, the attacker can fake the request of the user and perform malicious operations. Therefore, by using the Cookie token and the one-time verification mechanism of the present disclosure, CSRF attack can be effectively prevented.

[0053] It can be understood that by using the identity authentication information and the one-time verification method, even if the identity authentication information is hijacked, the attacker cannot send a valid access request using the hijacked identity authentication information, so as to effectively prevent the local identity authentication information from being hijacked and stolen, enhance the identity authentication mechanism, and improve the security of the network.

[0054] In the embodiments of the present disclosure, the method further includes: in response to the current time exceeding the validity period of the verification string, or the verification string being inconsistent with the verification string stored in the service end, intercepting the second access request.

[0055] In some example embodiments, whenever a user sends an access request containing identity authentication information, the server will first intercept the request for subsequent identity verification and permission check. First, the server will check whether the current time exceeds the validity period of the verification string. If the validity period is exceeded, the verification string will be considered invalid. If the validity period is not exceeded, the server will compare the verification string in the request with the original verification string stored in its server. If the verification string in the request is inconsistent with the one stored in the server, it is considered that the identity authentication information in this request has a problem, and this request may be a fake user request. The access request is intercepted, and an authentication failure is returned, and the user needs to re-perform identity authentication.

[0056] Optionally, in order to prevent the verification string from being intercepted or tampered during transmission, HTTPS protocol can be used for encrypted transmission.

[0057] It can be understood that through timely interception, only users who have passed legal identity authentication can access protected resources, thereby not only improving the security of the system, but also providing users with a more convenient and secure access experience.

[0058] In an embodiment of the present disclosure, the method further comprises: traversing a storage system in which the server stores the verification strings, and reading the validity period of each verification string; determining whether the validity period of each verification string stored in the server exceeds the current time; and when the validity period of the verification string stored in the server exceeds the current time, deleting the corresponding verification string from the storage system.

[0059] Specifically, when saved in the server, the storage system has more options, such as a database, memory, a file system, a cloud storage service, and other types of storage systems. In some example embodiments, a Session mechanism is used for storage.

[0060] Exemplarily, the service end cleans up the cookie token stored in the storage system after the set validity period. For example, the service end periodically checks all cookie tokens stored by using the session to determine whether they have expired. Specifically, in this process, first, the service end traverses all records in the session storage system. The session storage system can be memory, a database, or other types of storage systems, which is used to store the session information of the user, including the cookie token. Then, for each record, the service end reads the expiration time of the cookie token therein. The expiration time is set when the cookie token is generated, which indicates the validity period of the cookie token. Further, the service end acquires the current time and compares it with the expiration time of the cookie token. If the current time is greater than the expiration time, it means that the cookie token has expired. Finally, for the expired cookie token, the service end deletes it from the session storage system. In this way, it can prevent the expired cookie token from occupying storage space and affecting the system performance.

[0061] It can be understood that, by cleaning up the expired strings stored by the service end, it can prevent the application of the service end from occupying a large amount of memory because of saving too much invalid information, and affect the stability of the service.

[0062] Figure 3 A method flowchart for checking the validity period and consistency of a verification string according to an embodiment of the present disclosure is schematically shown.

[0063] Further, as shown in Figure 3 the response to the second access request of the user accessing the service end, reading and checking the validity period of the verification string in the identity authentication information carried by the user, and the consistency of the verification string and the verification string stored by the service end includes: receiving and parsing the second access request to obtain the verification string and its validity period in the identity authentication information; determining whether the validity period of the verification string exceeds the current time; in response to the validity period of the verification string exceeding the current time, intercepting the second access request; in response to the validity period of the verification string not exceeding the current time, comparing whether the verification string is consistent with the verification string stored by the service end; and when the verification string is inconsistent with the verification string stored by the service end, intercepting the second access request.

[0064] Specifically, after receiving the second access request, the server can read the Cookie information by parsing the Cookie field in the HTTP request header. Then, the server parses the Cookie token information and its validity period from the Cookie information. This can be achieved by parsing a specific field (e.g., token) in the Cookie to obtain the Cookie token, and then parsing another specific field (e.g., expires) to obtain the validity period. Next, the server checks whether the Cookie token has expired by comparing the current time with the validity period of the Cookie token. If the Cookie token has expired, the server returns an authentication failure for this request and requires the user to perform identity authentication again. If the Cookie token is still within the validity period, the server compares the Cookie token carried by the client with the Cookie token saved in the server session, usually by directly comparing whether the two Cookie tokens are completely consistent. Finally, if the Cookie tokens are consistent, the server considers the Cookie information valid. Then, the server processes the identity information in the Cookie and returns data. If the Cookie tokens are not consistent, the server intercepts the access request and requires the user to perform identity authentication again.

[0065] It can be understood that, through the double verification mechanism, i.e., the validity period check and consistency check of the verification string, the risk of being misused after being stolen is reduced, it is ensured that the verification string is not tampered with, and further prevention of forgery or man-in-the-middle attacks is achieved. At the same time, since the verification string has a validity period, even if it is intercepted, the attacker cannot reuse it within the validity period, thereby effectively preventing replay attacks. In addition, the trust of users in account security is also improved, and the overall user experience is improved.

[0066] Further, the regeneration operation on the verification string includes: generating a random number with a preset range and precision by a random number generator, and transforming the random number; generating a new verification string based on the transformed random number; and storing the newly generated verification string to the server and sending it to the client to update the verification string.

[0067] Specifically, when generating the Cookie token, a secure random number generator is used to prevent an attacker from predicting the value of the next Cookie token by analyzing the values of multiple Cookie tokens. In this process, first, a secure random number generator is selected. By "secure", it means that the generated random number sequence has high randomness, that is, the probability of each number appearing is uniform, and there is no correlation between the numbers, so it is impossible to predict the unknown part by knowing part of the sequence. Then a random number is generated using the selected random number generator. The range and precision of this random number will be set according to the security requirements. For example, if a random string of length 32 is needed as a Cookie token, a random number between 0 and 2^256-1 can be generated. The generated random number is then converted to the required format. For example, if a random string is needed, the random number can be converted to a hexadecimal or Base64 format string. The generated random string can be used as the Cookie token, and at the same time, the server updates the corresponding record in the Session storage system to save the new Cookie token in the Session. Finally, the server sends the new Cookie token to the client, for example, by adding a Set-Cookie field in the HTTP response header, where the value of the Set-Cookie field is a Cookie containing the new Cookie token.

[0068] It should be noted that the relationship between the new Cookie token and the old Cookie token mainly reflects in the following aspects.

[0069] One-time use: The new Cookie token is one-time use, that is, once used, it cannot be used again. This is because a new Cookie token is generated for each user request, and the old Cookie token is invalidated immediately after being verified. Independence: The new Cookie token is completely independent of the old Cookie token, that is, the value of the new Cookie token does not depend on the value of the old Cookie token. This is to prevent attackers from predicting the value of the next Cookie token by analyzing the values of multiple Cookie tokens. Continuity: Although the new Cookie token is independent of the old Cookie token, there is a continuity between them, that is, each new Cookie token is generated after the old Cookie token is verified. This ensures that each request of the user is continuous, thereby improving the user experience.

[0070] It can be understood that the verification string generated each time is based on a new random number, which ensures the uniqueness and unpredictability of the verification string, prevents the reuse of the verification string, reduces the risk of guessing or brute force cracking of the verification string, and significantly enhances the security of the system.

[0071] In an embodiment of the present disclosure, the method further comprises: obtaining behavior data of the user; based on the behavior data of the user, evaluating and determining the risk level of the user; and based on the risk level of the user, dynamically adjusting the validity period of the verification string.

[0072] In some example embodiments, the validity period of the verification string can be dynamically adjusted based on the risk level of the user.

[0073] Specifically, first, the behavior data of the user is collected and processed, such as the login frequency, request frequency, request time, and request type of the user, etc. By analyzing these data, the server can understand the behavior pattern of the user. Then the server will evaluate the risk level of the user. For example, using some security algorithms or models, such as machine learning models or risk scoring models, etc., to calculate the risk level of the user. The risk level can be based on various factors, such as the behavior pattern of the user, the device information of the user, and the network environment of the user, etc.

[0074] Further, based on the behavior data of the user, evaluating and determining the risk level of the user comprises: based on the behavior data of the user, predicting the risk probability of the user using a pre-trained risk prediction model; and based on the risk probability, determining the risk level of the user.

[0075] In assessing the risk level of a user, the server can use one or more models, including but not limited to machine learning models and risk scoring models.

[0076] Illustratively, this step can be performed according to the following process: first, the server collects relevant data, including the user's behavior patterns (such as login frequency, request type, etc.), device information (such as operating system, browser type, etc.), and network environment (such as IP address, geographic location, etc.). These data can be obtained from the user's request, or extracted from the server's log. Then the server processes the collected data to generate features that can be used by the model. This can involve steps such as data cleaning, encoding, and normalization. For example, the login frequency can be normalized to 0-1, the operating system and browser type can be one-hot encoded, etc. The server then inputs the generated features into the model to obtain the user's risk level prediction. If a machine learning model is used, such as decision tree, random forest, and neural network, etc., this process is the forward propagation of the model; if a risk scoring model is used, this process is to calculate the risk score according to the weight of the features. Further, the server will determine the user's risk level according to the predicted risk probability. For example, a threshold can be set, if the predicted risk probability exceeds the threshold, it is considered that the user's risk level is high; otherwise, it is considered that the user's risk level is low. Finally, according to the user's risk level, the server will dynamically adjust the validity period of the Cookie token. For example, for users with high risk, the server can shorten the validity period of the Cookie token to reduce the window of attack; for users with low risk, the server can extend the validity period of the Cookie token to improve user experience.

[0077] It should be noted that this process can be adjusted according to specific application scenarios and needs. For example, different data, features and models can be used, other factors such as user's historical behavior and feedback can be introduced, and different thresholds can be used, or multiple levels of risk levels can be used, etc.

[0078] It can be understood that by dynamically adjusting the validity period of the Cookie token, the Cookie can be effectively prevented from being hijacked and stolen, and at the same time, the user experience can be optimized according to the user's risk level, so that the system can provide more personalized security policies. In addition, by using a pre-trained risk prediction model, the system can predict the user's risk probability and manage the risk accordingly, so that the system can take preventive measures before the risk occurs, thereby avoiding potential security threats.

[0079] Figure 4A structural block diagram of an apparatus for preventing identity authentication information from being hijacked and stolen is shown according to an embodiment of the present disclosure.

[0080] As shown in the figure, the apparatus 400 for preventing identity authentication information from being hijacked and stolen according to the embodiment includes an obtaining module 410, a processing module 420, a checking module 430, and an executing module 440. Figure 4 The obtaining module 410 is configured to obtain identity authentication information of a user accessing a service end in response to a first access request of the user, wherein the identity authentication information includes a verification string with a validity period. In an embodiment, the obtaining module 410 can be configured to perform the operation S210 described above, and details are not repeated here.

[0081] The processing module 420 is configured to return the identity authentication information to a client of the user and store the verification string in the service end. In an embodiment, the processing module 420 can be configured to perform the operation S220 described above, and details are not repeated here.

[0082] The checking module 430 is configured to read and check the validity period of the verification string in the identity authentication information carried by a user accessing the service end and the consistency of the verification string with the verification string stored in the service end in response to a second access request of the user. In an embodiment, the checking module 430 can be configured to perform the operation S230 described above, and details are not repeated here.

[0083] The executing module 440 is configured to pass the verification of the second access request and perform a regeneration operation on the verification string in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored in the service end. In an embodiment, the executing module 440 can be configured to perform the operation S240 described above, and details are not repeated here.

[0084] In an embodiment of the present disclosure, the executing module 440 can also be configured to traverse a storage system in which the service end stores the verification strings, read the validity period of each verification string, determine whether the validity period of each verification string stored in the service end exceeds the current time, and delete the corresponding verification string from the storage system when the validity period of the verification string stored in the service end exceeds the current time.

[0085]

[0086] ​In embodiments of the present disclosure, the checking module 430 is specifically configured to: receive and parse the second access request to obtain a verification string and a validity period thereof in the identity authentication information; determine whether the validity period of the verification string exceeds a current time; in response to the validity period of the verification string exceeding the current time, intercept the second access request; in response to the validity period of the verification string not exceeding the current time, compare the verification string with a verification string stored on the server; and when the verification string is inconsistent with the verification string stored on the server, intercept the second access request.

[0087] In embodiments of the present disclosure, the execution module 440 can also be configured to: generate a random number in a preset range and precision by a random number generator, and transform the random number; generate a new verification string based on the transformed random number; and store the newly generated verification string to the server and send it to the client to update the verification string.

[0088] In embodiments of the present disclosure, the execution module 440 can also be configured to: in response to the current time exceeding the validity period of the verification string, or the verification string being inconsistent with the verification string stored on the server, intercept the second access request.

[0089] In embodiments of the present disclosure, the acquisition module 410 can also be configured to: acquire behavior data of the user; evaluate and determine a risk level of the user based on the behavior data of the user; and dynamically adjust the validity period of the verification string based on the risk level of the user.

[0090] In embodiments of the present disclosure, the acquisition module 410 can also be configured to: predict a risk probability of the user by using a pre-trained risk prediction model based on the behavior data of the user; and determine the risk level of the user based on the risk probability.

[0091] According to an embodiment of the present disclosure, any of the modules of the obtaining module 410, the processing module 420, the checking module 430 and the performing module 440 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of the other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the obtaining module 410, the processing module 420, the checking module 430 and the performing module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system in package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. or implemented by hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the obtaining module 410, the processing module 420, the checking module 430 and the performing module 440 can be at least partially implemented as a computer program module which can perform the corresponding functions when the computer program module is run.

[0092] Figure 5 A block diagram of an electronic device according to an embodiment of the present disclosure is shown schematically.

[0093] As Figure 5 shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 502 or loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 can include, for example, a general purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special purpose microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 501 can also include an on-board memory for cache use. The processor 501 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0094] In the RAM 503, various programs and data required for the operation of the electronic device 500 are stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via the bus 504. The processor 501 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 502 and / or the RAM 503. It should be noted that the programs can also be stored in one or more memories other than the ROM 502 and the RAM 503. The processor 501 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0095] According to the embodiments of the present application, the electronic device 500 can further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 can further include one or more of the following components connected to the I / O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable recording medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage portion 508 as necessary.

[0096] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present application is implemented.

[0097] According to an embodiment of the present application, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, can include but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include one or more memories of the ROM 502 and / or the RAM 503 described above and / or one or more memories other than the ROM 502 and the RAM 503.

[0098] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the method for preventing identity authentication information from being hijacked and stolen provided by the embodiments of the present disclosure.

[0099] The above functions defined in the system / device of the embodiments of the present disclosure are performed when the computer program is executed by the processor 501. According to an embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0100] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of signals on a network medium, and be downloaded and installed through the communication part 509, and / or installed from the detachable medium 511. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

[0101] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the detachable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0102] According to embodiments of the present disclosure, program code of the computer program for performing the methods provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and can be implemented in a computer program product. Specifically, the computer program can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. The programming language includes, but is not limited to, Java, C++, python, “C” language, or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, and partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0103] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (or computer readable medium) having stored therein a sequence of instructions executable by a machine such as a personal digital assistant (PDA), a laptop, a desktop computer, or a server. Alternatively, the computer program product can be a propagated signal per se generated by using the program code, and the program code can be stored on a machine-readable medium that can be read by a machine such as a personal digital assistant (PDA), a laptop, a desktop computer, or a server. The program code of the computer program product defines a function, preferably a corresponding action, and / or implements the elements / object / means for performing this function or a part thereof as disclosed in the embodiments of the present disclosure. The program code can be executed by using one or more processors.

[0104] Those skilled in the art will appreciate that features of the various embodiments and / or claims of the present disclosure can be combined or / and integrated with one another, even though such combinations or integrations are not expressly disclosed in the present disclosure. In particular, the features of the various embodiments and / or claims of the present disclosure can be combined and / or integrated with one another in any manner, without departing from the spirit and scope of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0105] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A method for preventing hijacking of identity authentication information, characterized by, The method comprises: in response to a first access request of a user accessing a service end, obtaining identity authentication information of the user, wherein the identity authentication information comprises a verification string with a validity period; obtaining behavior data of the user; based on the behavior data of the user, evaluating and determining a risk level of the user; based on the risk level of the user, dynamically adjusting the validity period of the verification string; returning the identity authentication information to a client of the user and storing the verification string in the service end; in response to a second access request of a user accessing the service end, reading and checking the validity period of the verification string in the identity authentication information carried by the user and the consistency of the verification string with the verification string stored in the service end; and in response to the current time not exceeding the validity period of the verification string and the verification string being consistent with the verification string stored in the service end, passing the verification of the second access request and performing a regeneration operation on the verification string.

2. The method of claim 1, wherein, The method further comprises: traversing a storage system in which the service end stores the verification strings and reading the validity period of each verification string; determining whether the validity period of each verification string stored in the service end exceeds the current time; and when the validity period of the verification string stored in the service end exceeds the current time, deleting the corresponding verification string from the storage system.

3. The method according to claim 1 or 2, characterized in that, The reading and checking of the validity period of the verification string in the identity authentication information carried by the user and the consistency of the verification string with the verification string stored in the service end in response to the second access request of the user accessing the service end comprises: receiving and parsing the second access request to obtain the verification string and its validity period in the identity authentication information; determining whether the validity period of the verification string exceeds the current time; in response to the validity period of the verification string exceeding the current time, intercepting the second access request; in response to the validity period of the verification string not exceeding the current time, comparing whether the verification string is consistent with the verification string stored in the service end; and when the verification string is inconsistent with the verification string stored in the service end, intercepting the second access request.

4. The method according to claim 1 or 2, characterized in that, The regeneration operation on the verification string comprises: generating a random number with a preset range and precision by a random number generator and transforming the random number; generating a new verification string based on the transformed random number; and storing the newly generated verification string to the service end and sending it to the client to update the verification string.

5. The method of claim 1, wherein, The method further comprises: in response to the current time exceeding the validity period of the verification string or the verification string being inconsistent with the verification string stored in the service end, intercepting the second access request.

6. The method of claim 1, wherein, The evaluation and determination of the risk level of the user based on the behavior data of the user comprises: based on the behavior data of the user, predicting the risk probability of the user by using a pre-trained risk prediction model; and based on the risk probability, determining the risk level of the user.

7. A device for preventing the hijacking and theft of identity authentication information, characterized in that, The device comprises: an acquisition module, configured to acquire identity authentication information of a user accessing a service end in response to a first access request of the user, wherein the identity authentication information comprises a verification string with a validity period, and behavior data of the user; based on the behavior data of the user, to evaluate and determine a risk level of the user, and to dynamically adjust the validity period of the verification string based on the risk level of the user; a processing module, configured to return the identity authentication information to a client of the user, and to store the verification string in the service end; an inspection module, configured to read and inspect the validity period of the verification string in identity authentication information carried by a user accessing the service end in response to a second access request of the user, and consistency of the verification string with the verification string stored in the service end; and an execution module, configured to pass the verification of the second access request and to perform a regeneration operation on the verification string in response to the current time not exceeding the validity period of the verification string, and the verification string being consistent with the verification string stored in the service end. 8.An electronic device, comprising: one or more processors; a storage device configured to store one or more computer programs, when the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1-6.

9. A computer-readable storage medium having stored thereon executable instructions that cause a processor-based system to perform steps comprising: The instruction is executed by the processor to make the processor perform the method according to any one of claims 1-6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method according to any one of claims 1-6.

Images