Plug-in prevention method for online auction quotation

Abstract

The invention relates to information security, in particular to an anti-plug-in method for online auction quotation, which comprises the following steps that: a client performs time synchronization verification and calculates a 2FA dynamic code, and performs signing and data encryption operations at the same time; the client sends a service request to the server; the server verifies the service request sent by the client and performs data interaction with the client according to a verification result; according to the technical scheme provided by the invention, the defects of easy cracking and poor protection effect in the prior art can be effectively overcome.

Description

Technical Field

[0001] The invention relates to information security, and in particular to an anti-cheating method for online bidding and quotation. Background Art

[0002] In today's network environment, various online businesses (such as auctions, snap-ups, etc.) face serious threats from plug-in programs. Plug-in programs gain advantages through illegal means, undermining the fairness and normal operation of the business. Existing anti-plug-in technologies have many shortcomings, such as being easy to crack, poor protection effect, and affecting the experience of normal users. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] In view of the above-mentioned shortcomings of the prior art, the present invention provides an anti-cheating method for online bidding and quotation, which can effectively overcome the defects of the prior art that it is easy to be cracked and has poor protection effect.

[0005] (II) Technical solution

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0007] A method for preventing cheating in online bidding and quotation, comprising the following steps:

[0008] S1. The client performs time synchronization verification and calculates the 2FA dynamic code, while performing signature and data encryption operations;

[0009] S2, the client sends a service request to the server;

[0010] S3. The server verifies the service request sent by the client and interacts with the client based on the verification result.

[0011] Among them, the server introduces a honeypot luring mechanism to collect attack information and study attack behaviors.

[0012] Preferably, the client in S1 performs time synchronization verification and calculates the 2FA dynamic code, and performs signature and data encryption operations at the same time, including:

[0013] S11, the client requests the time API and sends the time request information to the server;

[0014] S12, after receiving the time request information sent by the client, the server returns the synchronization time to the client;

[0015] S13. After the client receives the synchronization time sent by the server, it calls WebAssembly to perform time synchronization verification, and uses the TOTP encryption algorithm to calculate the 2FA dynamic code, and performs signing and data encryption operations at the same time.

[0016] Preferably, the TOTP encryption algorithm is used to calculate the 2FA dynamic code in S13, including:

[0017] Use the following formula to calculate the 2FA dynamic code:

[0018] TOTP=HMAC-SHA-1(k,(t-t0) / x);

[0019] Among them, TOTP is the calculated 2FA dynamic code;

[0020] HMAC is a key-related hash operation message authentication code. The HMAC operation uses a hash algorithm, takes a key and a specific data as input, and generates a message digest as output;

[0021] SHA-1 is the Secure Hash Algorithm 1, which is a commonly used hash function used to convert input into a fixed-length hash value;

[0022] HMAC-SHA-1 uses a key and a specific data as input to generate a fixed-length hash value as the 2FA dynamic code TOTP;

[0023] k is the pre-shared key, which is a secret value assigned by the server to each client when the system is initialized. Each client has a unique key k, which is used to generate its own 2FA dynamic code TOTP;

[0024] t is the current time, obtained through the system clock;

[0025] t0 is the initial time, which is determined by the system startup time or a specific timestamp;

[0026] x is the time interval used to determine the update frequency of the 2FA dynamic code TOTP;

[0027] (t-t0) / x is used to calculate the time interval in which the current time t is located, that is, to convert the current time t into an integer time counter starting from the initial time t0.

[0028] Preferably, in S2, the client sends a service request to the server, including:

[0029] The client requests the service API and sends service request information to the server;

[0030] The service request information includes 2FA dynamic code TOTP, signature data and encrypted data.

[0031] Preferably, the server in S3 verifies the service request sent by the client, and interacts with the client based on the verification result, including:

[0032] S31. The server verifies the 2FA dynamic code TOTP. If the verification is successful, the server continues; otherwise, a failure response is returned.

[0033] S32. The server verifies the signed data. If the verification is successful, the server continues; otherwise, a failure response is returned.

[0034] S33. The server verifies the encrypted data. If the verification is successful, the server interacts with the client. Otherwise, a failure response is returned.

[0035] Preferably, the server introduces a honeypot luring mechanism, including:

[0036] S41, sending a disguised service API request;

[0037] S42, simulate business operations;

[0038] S43. If an attacker is successfully lured by the honeypot, a success response will be directly returned to confuse the attacker. At the same time, attack information will be collected and attack behavior will be recorded for subsequent research and prevention.

[0039] (III) Beneficial effects

[0040] Compared with the prior art, the anti-cheating method for online bidding provided by the present invention has the following beneficial effects:

[0041] 1) Dynamic protection, real-time update

[0042] The dynamic RESTful API combined with the 2FA dynamic code updated every 10 seconds greatly improves the security of the interface and the real-time protection. For example, in the frequent bidding process, plug-in scripts are difficult to predict and adapt to this rapidly changing protection mechanism, which effectively prevents illegal attacks.

[0043] 2) Time synchronization, precise protection

[0044] The client and server are required to automatically set the synchronization time to the standard Beijing time, which ensures the accuracy and reliability of the protection mechanism. Taking cross-border auctions as an example, no matter where the participants are located, they can perform protection verification based on the unified synchronization time.

[0045] 3) Prevent decompilation and improve security

[0046] The front-end 2FA dynamic code is implemented using WebAssembly, which effectively prevents decompilation and cracking, increases the difficulty for attackers to break through the defense, and provides a more solid security guarantee for users' bids in a highly competitive auction environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 It is a timing diagram of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] A method for preventing cheating in online auctions, such as Figure 1 As shown, S1 and the client perform time synchronization verification and calculate the 2FA dynamic code, and perform signature and data encryption operations at the same time, including:

[0051] S11, the client requests the time API and sends the time request information to the server;

[0052] S12, after receiving the time request information sent by the client, the server returns the synchronization time to the client;

[0053] S13. After the client receives the synchronization time sent by the server, it calls WebAssembly to perform time synchronization verification, and uses the TOTP encryption algorithm to calculate the 2FA dynamic code, and performs signing and data encryption operations at the same time.

[0054] Specifically, S13 uses the TOTP encryption algorithm to calculate the 2FA dynamic code, including:

[0055] Use the following formula to calculate the 2FA dynamic code:

[0056] TOTP=HMAC-SHA-1(k,(t-t0) / x);

[0057] Among them, TOTP is the calculated 2FA dynamic code;

[0058] HMAC is a key-related hash operation message authentication code. The HMAC operation uses a hash algorithm, takes a key and a specific data as input, and generates a message digest as output;

[0059] SHA-1 is the Secure Hash Algorithm 1, which is a commonly used hash function used to convert input into a fixed-length hash value;

[0060] HMAC-SHA-1 uses a key and a specific data as input to generate a fixed-length hash value as the 2FA dynamic code TOTP;

[0061] k is the pre-shared key, which is a secret value assigned by the server to each client when the system is initialized. Each client has a unique key k, which is used to generate its own 2FA dynamic code TOTP;

[0062] t is the current time, obtained through the system clock;

[0063] t0 is the initial time, which is determined by the system startup time or a specific timestamp;

[0064] x is the time interval used to determine the update frequency of the 2FA dynamic code TOTP;

[0065] (t-t0) / x is used to calculate the time interval in which the current time t is located, that is, to convert the current time t into an integer time counter starting from the initial time t0.

[0066] S2, the client sends a service request to the server, such as Figure 1 As shown, specifically including:

[0067] The client requests the service API and sends service request information to the server;

[0068] The service request information includes 2FA dynamic code TOTP, signature data and encrypted data.

[0069] S3. The server verifies the service request sent by the client and interacts with the client based on the verification result. Figure 1 As shown, specifically including:

[0070] S31. The server verifies the 2FA dynamic code TOTP. If the verification is successful, the server continues; otherwise, a failure response is returned.

[0071] S32. The server verifies the signed data. If the verification is successful, the server continues; otherwise, a failure response is returned.

[0072] S33. The server verifies the encrypted data. If the verification is successful, the server interacts with the client. Otherwise, a failure response is returned.

[0073] In the technical solution of the present application, the server introduces a honeypot luring mechanism to collect attack information and study attack behaviors.

[0074] Specifically, the server introduces a honeypot luring mechanism, such as Figure 1 As shown, including:

[0075] S41, sending a disguised service API request;

[0076] S42, simulate business operations;

[0077] S43. If an attacker is successfully lured by the honeypot, a success response will be directly returned to confuse the attacker. At the same time, attack information will be collected and attack behavior will be recorded for subsequent research and prevention.

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for preventing cheating in online bidding, characterized in that: The following steps are involved: S1. The client performs time synchronization verification and calculates the 2FA dynamic code, while performing signature and data encryption operations; S2, the client sends a service request to the server; S3. The server verifies the service request sent by the client and interacts with the client based on the verification result. Among them, the server introduces a honeypot luring mechanism to collect attack information and study attack behaviors.

2. The anti-cheating method for online bidding and quotation according to claim 1 is characterized in that: In S1, the client performs time synchronization verification and calculates the 2FA dynamic code, and performs signature and data encryption operations, including: S11, the client requests the time API and sends time request information to the server; S12, after receiving the time request information sent by the client, the server returns the synchronization time to the client; S13. After the client receives the synchronization time sent by the server, it calls WebAssembly to perform time synchronization verification, and uses the TOTP encryption algorithm to calculate the 2FA dynamic code, and performs signing and data encryption operations at the same time.

3. The anti-cheating method for online bidding and quotation according to claim 2 is characterized in that: S13 uses the TOTP encryption algorithm to calculate the 2FA dynamic code, including: Use the following formula to calculate the 2FA dynamic code: TOTP=HMAC-SHA-1(k,(t-t0) / x); Among them, TOTP is the calculated 2FA dynamic code; HMAC is a key-related hash operation message authentication code. The HMAC operation uses a hash algorithm, takes a key and a specific data as input, and generates a message digest as output; SHA-1 is the Secure Hash Algorithm 1, which is a commonly used hash function used to convert input into a fixed-length hash value; HMAC-SHA-1 uses a key and a specific data as input to generate a fixed-length hash value as the 2FA dynamic code TOTP; k is the pre-shared key, which is a secret value assigned by the server to each client when the system is initialized. Each client has a unique key k, which is used to generate its own 2FA dynamic code TOTP; t is the current time, obtained through the system clock; t0 is the initial time, which is determined by the system startup time or a specific timestamp; x is the time interval used to determine the update frequency of the 2FA dynamic code TOTP; (t-t0) / x is used to calculate the time interval in which the current time t is located, that is, to convert the current time t into an integer time counter starting from the initial time t0.

4. The anti-cheating method for online bidding and quotation according to claim 2 is characterized in that: In S2, the client sends a service request to the server, including: The client requests the service API and sends service request information to the server; The service request information includes 2FA dynamic code TOTP, signature data and encrypted data.

5. The anti-cheating method for online bidding and quotation according to claim 4 is characterized in that: The server in S3 verifies the service request sent by the client and interacts with the client based on the verification result, including: S31. The server verifies the 2FA dynamic code TOTP. If the verification is successful, the server continues; otherwise, a failure response is returned. S32. The server verifies the signed data. If the verification is successful, the server continues; otherwise, a failure response is returned. S33. The server verifies the encrypted data. If the verification is successful, the server interacts with the client. Otherwise, a failure response is returned.

6. The anti-cheating method for online bidding and quotation according to any one of claims 1 to 5, characterized in that: The server introduces a honeypot luring mechanism, including: S41, sending a disguised service API request; S42, simulate business operations; S43. If an attacker is successfully lured by the honeypot, a success response will be directly returned to confuse the attacker. At the same time, attack information will be collected and attack behavior will be recorded for subsequent research and prevention.

Images