Identity authentication enhancement method and device, computer equipment and storage medium
By analyzing and verifying the local terminal information in the TCP packet sent by the terminal, the problem that traditional identity authentication methods cannot continuously verify identity is solved, and continuous security monitoring after successful identity authentication is realized to prevent identity impersonation.
Patent Information
- Application Number
- CN202311263992.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-28
- Publication Date
- 2025-02-07
AI Technical Summary
Traditional identity authentication methods cannot be further verified after users log in to the system, and are vulnerable to attacks such as password cracking, social engineering and malware, resulting in identity impersonation.
By obtaining the TCP packets sent by the terminal, parsing out the local terminal information and determining its credibility. If trustworthy, the original traffic information is restored; if untrusted, the TCP connection is disconnected.
It realizes the credibility of continuously verifying terminal information after successful identity authentication, prevents identity impersonation, and has the characteristics of good compatibility and high security.
Smart Images
Figure CN119402212A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a database, and more specifically to an identity authentication enhancement method, device, computer equipment and storage medium. Background Art
[0002] With the development of the digital age, identity authentication and password security are important issues in the fields of network security and information technology. With the popularization of the Internet and the continuous increase of digital services, the identities and sensitive information of individuals and enterprises need to be effectively protected to prevent unauthorized access and potential data leakage.
[0003] Unified identity authentication is a mechanism for centrally managing and controlling identity authentication and access authorization. By using a single identity and credential, users can access multiple applications and services without having to provide authentication information for each application and service separately. Therefore, identity authentication is extremely important.
[0004] Traditional identity authentication methods usually perform a one-time identity authentication when a user logs into the system, such as using a username and password and multi-factor authentication. This static authentication method has some limitations. First, once a user successfully logs into the system, their identity is no longer further verified, which provides potential attackers with an opportunity to impersonate legitimate users after logging in. Second, traditional identity authentication methods are vulnerable to attacks such as password cracking, social engineering, and malware.
[0005] Therefore, it is necessary to design a new method to solve the risk of impersonation after successful identity authentication, and it has the characteristics of good compatibility and high security. Summary of the invention
[0006] The purpose of the present invention is to overcome the defects of the prior art and provide an identity authentication enhancement method, device, computer equipment and storage medium.
[0007] To achieve the above object, the present invention adopts the following technical solution: an identity authentication enhancement method, comprising:
[0008] Get TCP data packets from the terminal;
[0009] Parsing the TCP data packet to obtain local terminal information;
[0010] Determining whether the local terminal information is credible terminal information;
[0011] If the local terminal information is credible terminal information, the TCP data packet is restored to obtain original flow information;
[0012] If the local terminal information is not credible terminal information, the current TCP connection is disconnected.
[0013] Its further technical solution is: the TCP data packet is a data packet formed after the terminal intercepts the original traffic information generated by the event of successful TCP establishment when the terminal's operation and maintenance tool logs into the database service, and the local terminal information is added.
[0014] Its further technical solution is: the local terminal information includes MAC address, local IP, and PC terminal serial number.
[0015] A further technical solution is: parsing the TCP data packet to obtain local terminal information includes:
[0016] The TCP data packet is parsed according to a custom format to obtain local terminal information.
[0017] A further technical solution is: the recovery process of the TCP data packet to obtain the original flow information includes:
[0018] The local terminal information is deleted from the TCP data packet to obtain the original flow information.
[0019] The further technical solution is: the obtaining of the TCP data packet from the terminal comprises:
[0020] When a TCP connection success event occurs, a TCP data packet sent by the terminal is obtained.
[0021] The present invention also provides an identity authentication enhancement device, comprising:
[0022] An acquisition unit, used for acquiring a TCP data packet from a terminal;
[0023] A parsing unit, used for parsing the TCP data packet to obtain local terminal information;
[0024] A judging unit, used to judge whether the local terminal information is credible terminal information;
[0025] A recovery unit, configured to recover the TCP data packet to obtain original flow information if the local terminal information is credible terminal information;
[0026] A disconnection unit is used to disconnect the current TCP connection if the local terminal information is not trusted terminal information.
[0027] A further technical solution is: the parsing unit is used to parse the TCP data packet according to a custom format to obtain local terminal information.
[0028] The present invention further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above method when executing the computer program.
[0029] The present invention also provides a storage medium, wherein the storage medium stores a computer program, and the computer program implements the above method when executed by a processor.
[0030] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention obtains a TCP data packet to which local terminal information is added by a terminal, parses the local terminal information in the TCP data packet, and after determining that the local terminal information is credible terminal information, removes the local terminal information in the TCP data packet to obtain original traffic information; when the local terminal information is untrustworthy, disconnects the current TCP connection, thereby solving the risk of impersonation after successful identity authentication, and has the characteristics of good compatibility and high security.
[0031] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.
[0033] Figure 1 A schematic diagram of an application scenario of the identity authentication enhancement method provided by an embodiment of the present invention;
[0034] Figure 2 A schematic diagram of a flow chart of an identity authentication enhancement method provided by an embodiment of the present invention;
[0035] Figure 3 A schematic block diagram of an identity authentication enhancement device provided by an embodiment of the present invention;
[0036] Figure 4 A schematic block diagram of a computer device provided for an embodiment of the present invention;
[0037] Figure 5 Schematic diagram of the structure of the private information package in the embodiment of the present invention DETAILED DESCRIPTION
[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0039] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.
[0040] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.
[0041] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.
[0042] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of the identity authentication enhancement method provided in an embodiment of the present invention. Figure 2 A schematic flow chart of an identity authentication enhancement method provided by an embodiment of the present invention. The identity authentication enhancement method is applied to a server. The server interacts with a terminal for data. When the operation and maintenance tool of the terminal initiates a database connection request, the terminal hijacks the network TCP traffic of the database request, i.e., the original traffic information, and adds encrypted local terminal information (including but not limited to MAC address, IP address, operation and maintenance tool application name, application hash, and terminal device serial number, etc.) by modifying the original traffic information. The network traffic will be sent to the database server, which hijacks the TCP data packet, analyzes the added private information, and parses the local terminal information. The local terminal information is compared. If it is a trusted terminal information, the private traffic, i.e., the local terminal information, is deleted from the TCP data packet, and the original traffic information is restored. If it is an untrusted terminal, the current TCP connection is directly disconnected, thereby solving the risk of being impersonated after successful identity authentication, and having the characteristics of good compatibility and high security.
[0043] Figure 2FIG. 1 is a flow chart of an identity authentication enhancement method provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S150.
[0044] S110: Obtain a TCP data packet from the terminal.
[0045] In this embodiment, the TCP data packet is the original traffic information that is sent after the terminal intercepts the successful TCP establishment when the terminal's operation and maintenance tool logs into the database service.
[0046] Specifically, when there is a TCP connection success event, a TCP data packet sent by the terminal is acquired.
[0047] When a user accesses the database server through the operation and maintenance tool, the application initiates a network connection.
[0048] The module corresponding to traffic hijacking is injected into the third-party application to hijack the TCP connection of the third-party application. After the connection handshake is successful, the current TCP four-tuple information is analyzed first. If the target IP and port are the IP port of the protected database, before TCP Send, the current network connection will be used to send a private data packet. The body of the private data packet consists of encrypted local terminal device information, including but not limited to MAC, IP, operation and maintenance tool application name, application hash value, and terminal serial number; after sending the private data packet, the module corresponding to traffic hijacking will no longer operate in this connection.
[0049] Figure 5 It is a schematic diagram of the structure of a private information packet in an embodiment of the present invention, which includes a packet header of a fixed length and a packet body including local terminal information.
[0050] For example, when using Navica to access the database 192.168.51.209:1521, the module injected into Navicat will hijack this TCP connection and obtain the local terminal information MAC, IP, operation and maintenance application Hash and application name. After TCP Connect, obtain the TCP four-tuple information. The destination IP port is the IP port that protects the database 192.168.51.209:1521. Send the private information package data first, and then call the Send system function to send the original traffic information. In the private information encapsulation process, the local information is first encapsulated in JSON format, and then the JSON string is calculated by MD5 Hash to generate a Hash value, and then the MD5Hash is encrypted through the national secret SM2 asymmetric algorithm to generate the final Hash value, and finally it is combined with the terminal information to form a private data packet body. The final package body example is shown in the figure:
[0051] {
[0052] "Data": {
[0053] "MAC":"xx:xx:xx:xx:xxxx",
[0054] "IP":"xxx.xxx.xxx.xxx",
[0055] “AppName”: “xxxx”,
[0056] “AppHash”: “xxxxx”,
[0057] "XXXX": "xxxxxxx",
[0058] },
[0059] “Hash”: “SM2 ciphertext”
[0060] }.
[0061] The value of the Data field is used to calculate the MD5 value, and the Hash field is the final Hash generated by SM2 asymmetric encryption. This Hash is used to verify the integrity and tamper-proofing of private data packets.
[0062] S120: Parse the TCP data packet to obtain local terminal information.
[0063] In this embodiment, the TCP data packet is parsed according to a custom format to obtain local terminal information. As described in step S110, the data packet is a data packet with a custom format.
[0064] Specifically, after receiving a TCP connection through the hijacking module installed on the server, a TCP connection success event will be intercepted. When receiving TCP, the first 12-byte length data packet will be parsed according to the private data packet format. Successful parsing indicates that there is a private data packet in the TCP data packet. Then the entire data packet is parsed, and the integrity of the data packet is verified by the national secret algorithm SM2 asymmetric algorithm to prevent the data packet from being tampered with by other tools, to ensure that the acquired terminal information is authentic and reliable, and finally the local terminal information is parsed. In this embodiment, the local terminal information includes MAC address, local IP, operation and maintenance application Hash, and application name.
[0065] S130: Determine whether the local terminal information is credible terminal information.
[0066] In this embodiment, a rule matching strategy is specifically used to determine whether the local terminal information is a trusted terminal.
[0067] Specifically, the trusted terminal policy is configured by the administrator in advance in the server management center and sent to the matching module. The policy configuration can be configured with a single factor or different combinations of multiple factors, or it can be configured as a whitelist or blacklist of factors and multiple factors. If the whitelist matches, the database can be accessed, and if the blacklist matches, access is denied.
[0068] For example, the IP is set to 192.168.60.14 in the policy, the application hash value is aabbccxx, the accessible database is 192.168.51.209:1521, which is policy A, the Mac address is 70:B5:E8:34:7F:BD, the inaccessible database is 192.168.51.21:3306, which is policy B, the IP address is 192.168.61.xxx, the application name is Navicat, the accessible database is 192.168.51.201:1433, which is policy C, A and C are whitelist policies, and B is a blacklist policy. When the policy matches, first verify the data integrity of the private data packet parsed in step S120. If it is incomplete, the data has been tampered with, and it is an untrusted terminal, and an error alarm log is generated and sent to the server. If the information packet is intact and has not been tampered with, it will match policies A, B, and C. For example, if an application with an IP address of 192.168.60.14 and an application hash of bbccddeexx accesses the database 192.168.51.209:1521, and there is no matching policy, it is an untrusted terminal, and an alarm log is generated and sent to the server. This can prevent the name of the operation and maintenance tool from being modified to impersonate the real application to access the database, thereby realizing the application anti-counterfeiting function; if a terminal with an IP address of 192.168.60.15 and a MAC address of 70:B5:E8:34:7F:BD accesses the database
[0069] 192.165.51.21:3306, at this time, policy B is hit, it is a trusted terminal and can access the database. In this case, a specific terminal device can be specified to access the protected database; if the IP address is 192.168.61.22, the application named Navicat accesses the database 19.168.51.201:1433, at this time, policy C is hit, it is a trusted terminal and can access the database. In this case, the IP end of a specific department can be specified and a specific tool can be used to access the specified database. In summary, different policies can be configured according to different needs.
[0070] S140: If the local terminal information is trusted terminal information, restore the TCP data packet to obtain original traffic information.
[0071] In this embodiment, the original traffic information refers to the remaining content of the TCP data packet that does not carry the private data packet.
[0072] Specifically, the private information packet is deleted from the TCP data packet to obtain the original traffic information.
[0073] Untrusted terminals are filtered according to pre-set rules. When the local terminal information is determined to be a trusted terminal, the original traffic information can be extracted for system processing without interfering with subsequent TCP data processing.
[0074] S150: If the local terminal information is not credible terminal information, disconnect the current TCP connection.
[0075] When the local terminal information is unreliable, an error message is directly returned and the current TCP connection is disconnected to ensure the security of the database.
[0076] When the database server obtains the database connection; the injection module injects the traffic hijacking module into the database server process; the traffic hijacking module detects the TCP Receive start event; the traffic hijacking module attempts to read a small piece of data received by Receive, and if it conforms to the private data protocol format, the corresponding private information data is read according to the format; the MAC address, application Hash and other information of the private information are parsed, and the rules are matched. If it conforms to the pre-set rules, the private information packet data is deleted and the TCP protocol processing logic of the system is returned. If the match fails, an error is directly returned and the current network connection is terminated.
[0077] The process of adding private information packages to the terminal and removing private information packages from the server is all done in the TCP connection initiated by the operation and maintenance tool, and no new connection is created. In addition, each time a TCP network connection is initiated, the hijacking operation and the analysis process of the private information package are performed. No new network connection is created, and only the TCP data packet data initiated by the operation and maintenance tool is modified. Continuous identity authentication can be performed, avoiding the problem of identity impersonation caused by one-time authentication and lifelong trust.
[0078] Each TCP connection will be hijacked, and the private data packet information will be parsed and matched. Sustainable identity authentication is achieved. Since it is hijacked at the TCP layer, it does not rely on a specific database type. The private data packet information can be local terminal information, including MAC address, IP address, PC serial number, operation and maintenance application Hash, etc., or a single information. Identity authentication can increase the authentication of operation and maintenance applications and terminals.
[0079] The above-mentioned identity authentication enhancement method obtains a TCP data packet to which local terminal information has been added by the terminal, parses the local terminal information in the TCP data packet, and after determining that the local terminal information is credible terminal information, removes the local terminal information in the TCP data packet to obtain the original traffic information; when the local terminal information is untrustworthy, disconnects the current TCP connection, thereby solving the risk of impersonation after successful identity authentication, and has the characteristics of good compatibility and high security.
[0080] Figure 5 is a schematic block diagram of an identity authentication enhancement device 300 provided in an embodiment of the present invention. Figure 5 As shown, corresponding to the above identity authentication enhancement method, the present invention also provides an identity authentication enhancement device 300. The identity authentication enhancement device 300 includes a unit for executing the above identity authentication enhancement method, and the device can be configured in a server. Figure 5 The identity authentication enhancement device 300 includes an acquisition unit 301, a parsing unit 302, a judgment unit 303, a recovery unit 304 and a disconnection unit 305.
[0081] An acquisition unit 301 is used to acquire a TCP data packet from a terminal; a parsing unit 302 is used to parse the TCP data packet to obtain local terminal information; a judgment unit 303 is used to judge whether the local terminal information is trusted terminal information; a recovery unit 304 is used to recover the TCP data packet to obtain original traffic information if the local terminal information is trusted terminal information; and a disconnection unit 305 is used to disconnect the current TCP connection if the local terminal information is not trusted terminal information.
[0082] In one embodiment, the parsing unit 302 is used to parse the TCP data packet according to a custom format to obtain local terminal information.
[0083] In one embodiment, the acquisition unit 301 is used to acquire a TCP data packet sent by the terminal when a TCP connection success event occurs.
[0084] In one embodiment, the recovery unit 304 is used to delete the local terminal information from the TCP data packet to obtain the original traffic information.
[0085] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned identity authentication enhancement device 300 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.
[0086] The identity authentication enhancement device 300 can be implemented in the form of a computer program. The computer program can be implemented in the form of a computer program. Figure 4 Runs on computer equipment.
[0087] See also Figure 4 Figure 4 A schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.
[0088] See also Figure 4 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .
[0089] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute an identity authentication enhancement method.
[0090] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .
[0091] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute an identity authentication enhancement method.
[0092] The network interface 505 is used to communicate with other devices over the network. Figure 4 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0093] The processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps:
[0094] Obtain a TCP data packet from a terminal; parse the TCP data packet to obtain local terminal information; determine whether the local terminal information is trusted terminal information; if the local terminal information is trusted terminal information, restore the TCP data packet to obtain original flow information; if the local terminal information is not trusted terminal information, disconnect the current TCP connection.
[0095] The TCP data packet is a data packet formed by adding local terminal information after the terminal intercepts the original traffic information generated by the event of successful TCP establishment when the terminal's operation and maintenance tool logs into the database service.
[0096] The local terminal information includes MAC address, local IP, and PC terminal serial number.
[0097] In one embodiment, when the processor 502 implements the step of parsing the TCP data packet to obtain the local terminal information, the processor 502 specifically implements the following steps:
[0098] The TCP data packet is parsed according to a custom format to obtain local terminal information.
[0099] In one embodiment, when the processor 502 implements the step of restoring the TCP data packet to obtain the original traffic information, the processor 502 specifically implements the following steps:
[0100] The local terminal information is deleted from the TCP data packet to obtain the original flow information.
[0101] In one embodiment, when the processor 502 implements the step of obtaining a TCP data packet from the terminal, the processor 502 specifically implements the following steps:
[0102] When a TCP connection success event occurs, a TCP data packet sent by the terminal is obtained.
[0103] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
[0104] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.
[0105] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:
[0106] Obtain a TCP data packet from a terminal; parse the TCP data packet to obtain local terminal information; determine whether the local terminal information is trusted terminal information; if the local terminal information is trusted terminal information, restore the TCP data packet to obtain original flow information; if the local terminal information is not trusted terminal information, disconnect the current TCP connection.
[0107] The TCP data packet is a data packet formed by adding local terminal information after the terminal intercepts the original traffic information generated by the event of successful TCP establishment when the terminal's operation and maintenance tool logs into the database service.
[0108] The local terminal information includes MAC address, local IP, and PC terminal serial number.
[0109] In one embodiment, when the processor executes the computer program to implement the step of parsing the TCP data packet to obtain local terminal information, the processor specifically implements the following steps:
[0110] The TCP data packet is parsed according to a custom format to obtain local terminal information.
[0111] In one embodiment, when the processor executes the computer program to implement the step of restoring the TCP data packet to obtain the original traffic information, the processor specifically implements the following steps:
[0112] The local terminal information is deleted from the TCP data packet to obtain the original flow information.
[0113] In one embodiment, when the processor executes the computer program to implement the step of obtaining a TCP data packet from a terminal, the processor specifically implements the following steps:
[0114] When a TCP connection success event occurs, a TCP data packet sent by the terminal is obtained.
[0115] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.
[0116] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0117] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0118] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0119] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.
[0120] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.
Claims
1. An identity authentication enhancement method, characterized in that: include: Get TCP data packets from the terminal; Parsing the TCP data packet to obtain local terminal information; Determining whether the local terminal information is credible terminal information; If the local terminal information is credible terminal information, the TCP data packet is restored to obtain original flow information; If the local terminal information is not credible terminal information, the current TCP connection is disconnected.
2. The identity authentication enhancement method according to claim 1, characterized in that: The TCP data packet is a data packet formed after the terminal intercepts the original traffic information generated by the event of successful TCP establishment when the terminal's operation and maintenance tool logs into the database service, and the local terminal information is added.
3. The identity authentication enhancement method according to claim 1, characterized in that: The local terminal information includes MAC address, local IP, and PC terminal serial number.
4. The identity authentication enhancement method according to claim 1, characterized in that: The parsing of the TCP data packet to obtain local terminal information includes: The TCP data packet is parsed according to a custom format to obtain local terminal information.
5. The identity authentication enhancement method according to claim 1, characterized in that: The restoring process of the TCP data packet to obtain original flow information includes: The local terminal information is deleted from the TCP data packet to obtain the original flow information.
6. The identity authentication enhancement method according to claim 1, characterized in that: The obtaining of the TCP data packet from the terminal comprises: When a TCP connection success event occurs, a TCP data packet sent by the terminal is obtained.
7. An identity authentication enhancement device, characterized in that: include: An acquisition unit, used for acquiring a TCP data packet from a terminal; A parsing unit, used for parsing the TCP data packet to obtain local terminal information; A judging unit, used to judge whether the local terminal information is credible terminal information; A recovery unit, configured to recover the TCP data packet to obtain original flow information if the local terminal information is credible terminal information; A disconnection unit is used to disconnect the current TCP connection if the local terminal information is not trusted terminal information.
8. The identity authentication enhancement device according to claim 7, characterized in that: The parsing unit is used to parse the TCP data packet according to a custom format to obtain local terminal information.
9. A computer device, characterized in that: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program.
10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.