Protection method, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of network security, and discloses a protection method, electronic equipment and a storage medium. When the protection method is applied to a server, the protection method comprises the steps that calculation parameters are sent to a client side, and the calculation parameters at least comprise one of the following parameters: operators, calculation times and input parameters; a computing power index sent by the client side is received, and the computing power index is used for representing the computing capacity of the client side according to the computing parameters; performing analysis according to the computing power index; and protecting the client according to an analysis result. At least the dependence on management and control information, dynamic code updating and the like in the protection process can be overcome, and more reliable and effective safety protection is achieved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a protection method, electronic device, and storage medium. Background Art

[0002] Cyber ​​Security refers to the protection of the hardware, software and data in the network system from damage, change or leakage due to accidental or malicious reasons, and the continuous and reliable operation of the system and uninterrupted network services. However, with the growing demand for the Internet, network security has been increasingly threatened. For example, malicious web crawlers frequently access corporate WEB servers, which brings a heavy burden to the servers, brings additional costs to the enterprises, and even causes the WEB application servers to be unable to be used normally. In order to ensure network security, various protection methods have been proposed, such as configuring web application firewalls according to specific rules, signatures and patterns to block suspicious incoming traffic.

[0003] However, these protective measures are not always effective. Summary of the invention

[0004] The embodiments of the present application provide a protection method, an electronic device, and a storage medium, which are at least conducive to providing more reliable and effective security protection and avoiding the hidden dangers of protection failure.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a protection method, which is applied to a server, and the method includes: sending calculation parameters to a client, wherein the calculation parameters include at least one of the following parameters: an operator, a number of calculations, and an input parameter; receiving a computing power indicator sent by the client, wherein the computing power indicator is used to characterize the ability of the client to perform calculations according to the calculation parameters; performing analysis based on the computing power indicator; and performing protection on the client based on the analysis results.

[0006] According to some embodiments of the present application, the second aspect of the embodiments of the present application further provides a protection method, which is applied to a client, and the method includes: receiving calculation parameters sent by a server, wherein the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters; performing calculations according to the calculation parameters to obtain a computing power indicator, wherein the computing power indicator is used to characterize the ability of the client to perform calculations according to the calculation parameters; and sending the computing power indicator to the server.

[0007] According to some embodiments of the present application, a third aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the protection method as described in the first aspect, or execute the protection method as described in the second aspect.

[0008] According to some embodiments of the present application, the fourth aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the protection method as described in the first aspect, or implements the protection method as described in the second aspect.

[0009] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0010] The server sends calculation parameters to the client so that when the client calculates according to the calculation parameters, the computing power index can be collected, and the server can analyze the computing power index to achieve protection. In the process of implementing this protection, it no longer relies on control information, dynamic update code, etc., thus avoiding the protection failure caused by the restrictions of control information, dynamic update code, etc., and achieving more reliable and effective security protection. At the same time, it no longer relies on verifying the calculation results of the client to achieve protection, so that the server no longer needs to spend a lot of computing resources to verify the client, reducing the resource consumption of the server, especially avoiding the occurrence of protection errors and omissions caused by malicious users cracking the calculation parameters and using other methods to calculate, making the protection more reliable and accurate, and the protection effect better. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0012] Figure 1 This is an example of an application scenario of the protection method provided in the embodiment of the present application. Figure 1 ;

[0013] Figure 2 This is an example of an application scenario of the protection method provided in the embodiment of the present application. Figure 2 ;

[0014] Figure 3 This is the process of the protection method provided in the embodiment of this application Figure 1 ;

[0015] Figure 4 This is the process of the protection method provided in the embodiment of this application Figure 2 ;

[0016] Figure 5 This is the process of the protection method provided in the embodiment of this application Figure 3 ;

[0017] Figure 6 This is the process of the protection method provided in the embodiment of this application Figure 4 ;

[0018] Figure 7 This is the process of the protection method provided in the embodiment of this application Figure 5 ;

[0019] Figure 8 is an interactive flow chart of the protection method provided in the embodiment of the present application;

[0020] Fig. 9 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] As can be seen from the background technology, existing protection solutions have the problem of not always being effective.

[0022] After analysis, it is found that the reasons for the above problems include at least: the mainstream idea of ​​the current protection scheme is information verification, such as verifying whether the user ID is a legal ID, verifying whether the result of the client's calculation of the question issued by the server is correct, etc. Of course, in addition to information verification, there are other protection ideas. For example, the protection scheme based on WEB front-end obfuscation technology can convert the key content (request parameters, HyperText Markup Language (HTML), JS (JavaScript) code, etc.) in the Hypertext Transfer Protocol (HTTP) session message into a form that is difficult to read and modify without affecting page presentation and user interaction, thereby preventing visitors from accessing the WEB site through methods other than manual interaction with the browser. However, in the information verification scheme, the verification information is not always successfully obtained; when the amount of calculation is large, the server's resources may not be sufficient to support the calculation result corresponding to the client for verification again. Even malicious users may crack the operator and switch to other platforms or devices for calculation to get the correct result and bypass the protection. In the protection scheme based on WEB front-end obfuscation technology, developers are usually required to dynamically update the executed JS code, but not all scenarios support developers to dynamically update the executed JS code. For example, in WeChat applets, due to the particularity of WeChat applets, it has a strict code control mechanism and cannot obtain some verification information, resulting in the ineffectiveness of many web-side protections. At the same time, WeChat applets also prohibit developers from dynamically updating the executed JS code, making the real-time dynamic obfuscation scheme ineffective for WeChat applets.

[0023] To solve the above technical problems, the embodiments of the present application provide a protection method, an electronic device and a storage medium. In combination with the fact that malicious users usually consume a large amount of resources to frequently initiate a large number of requests, and the characteristics of these resources being consumed in large quantities can be reflected from the computing power of the client, a new protection scheme is provided in addition to information verification and WEB front-end obfuscation: the server sends calculation parameters to the client, so that the client performs calculations based on the calculation parameters, thereby obtaining the client's computing power indicators for analysis and protection, and in this process, it is not necessary to rely on the acquisition of verification information, nor on the calculation verification of the server, and it is not necessary to dynamically update the JS code, which reduces the limitations of protection and will not cause the problem of protection being bypassed due to cracking by malicious users. The protection is more effective, reliable, accurate, and consumes less resources. When there are other services on the server, it is more conducive to the server to better support other services.

[0024] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0025] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0026] The embodiment of the present application provides a protection method, which is applied to a server. It should be noted that the embodiment of the present application does not limit the server, which can be any server that can support the protection method provided by the embodiment of the present application. For example, in some scenarios, such as Figure 1 As shown in the figure, the server is the server to which the client initiates the request, such as a CDN node server, a content server, etc., but while providing a response, the server also provides protection functions. Figure 2 As shown, the server is an intermediate server between the client and the server to which the client initiates the request, such as a platform for providing protection services provided by a third party. In addition, it can also be understood that the server can also refer to a single device, or a device cluster. For example, when a device cluster is used for implementation, different devices may be used to cooperate to implement the protection method provided in the embodiment of the present application. The servers described in the embodiment of the present application will not be described one by one here. The following will be combined with Figure 3-Figure 6 The flowchart shown illustrates the protection method.

[0027] In some embodiments, Figure 3 As shown, the protection method applied to the server includes the following steps:

[0028] Step 101: Send calculation parameters to the client, where the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters.

[0029] Step 102: Receive a computing power indicator sent by the client, wherein the computing power indicator is used to characterize the client's ability to perform calculations according to the calculation parameters.

[0030] Step 103: Analyze based on the computing power index.

[0031] Step 104: Protect the client according to the analysis result.

[0032] In this way, the server sends the calculation parameters to the client, so that when the client calculates according to the calculation parameters, the computing power index can be collected, and the server can analyze the computing power index to achieve protection. In the process of implementing this protection, it no longer relies on control information, dynamic update code, etc., thus avoiding the problem of protection failure caused by the restrictions of control information, dynamic update code, etc., and achieving more reliable and effective security protection. At the same time, it no longer relies solely on verifying the calculation results of the client to achieve protection, so that the server no longer needs to spend a lot of computing resources to verify the calculation results, reducing the resource consumption of the server, especially avoiding malicious users cracking the calculation parameters and using other methods to calculate, resulting in malicious requests being missed and causing protection errors, making the protection more reliable and accurate, and the protection effect is better.

[0033] To facilitate better understanding of those skilled in the art Figure 3 The embodiment shown in FIG. 1 is shown in FIG. 1 , and the corresponding steps are described below.

[0034] In step 101, calculation parameters are sent to the client. Specifically, the calculation parameters sent can be set as required, as long as the client can perform calculations based on the received calculation parameters. For example, in the case of pre-negotiation of the operator, after sending the input parameters and the number of calculations to the client, the client can perform calculations in combination with the default operator. For another example, when the complexity of the operator is sufficient to support the expected amount of calculations, the number of calculations can be omitted, and the default calculation based on the operator is performed only once or a preset number of times. For another example, when the input parameters use random parameters to improve security, only the operator and the number of calculations can be sent to the client. I will not go into details here.

[0035] It should be noted that the embodiment of the present application does not limit the operator, the number of calculations, and the input parameters. It can be any operator, the number of calculations, and the input parameters in the format defined by the operator. For example, the existing related function is used as the operator sent to the client. In particular, the server can distribute its own calculation task (or the subtask obtained by disassembling the calculation task) to the client for processing in the form of sending calculation parameters, so that the client resources can be fully utilized for calculation to improve the processing efficiency of the server; it can also be a custom function as the operator sent to the client, and it does not have to be related to the corresponding calculation task, so as to improve the security of the calculation, especially the custom function can be dynamically changed to further improve the security of the calculation, and further avoid the protection error caused by malicious users. For example, the number of calculations can be a specific value set in advance, and the server selects a suitable value for the corresponding client as the calculation parameter that needs to be sent currently before sending the calculation parameter; the number of calculations can be determined according to at least one of the following information: the risk level of the client's history, the reference number of calculations corresponding to the client, and the user status of the client, wherein the reference number of calculations corresponding to the client is obtained according to the experience value and / or the experimental value of the same device as the client. For ease of understanding, the following will be used to illustrate the determination of the number of calculations with the corresponding function. For example, the number of calculations L = [base*log(M, N)]; for another example, the number of calculations L = [base / 2+2^N]. Wherein, L is the number of calculations, base is the reference number of calculations corresponding to the client, M is a preset parameter, N is determined according to the historical protection situation of the client, [x] represents rounding x, and log(a, b) represents calculating the logarithm of b with a as the base; or, the number of calculations can be further defined by different functions, and the server selects a suitable function for the corresponding client and calculates the corresponding number of calculations before sending the calculation parameters, and sends the calculation number to the client. Taking the above expression of the number of calculations as an example, as a newly connected client, the risk level is not high, and the server selects the number of calculations L = [base*log(M, N)] to determine the number of calculations. As the risk level of the client continues to increase, the server will switch to selecting the number of calculations L = [base / 2+2^N] to determine the number of calculations, so that as the risk level increases, the number of calculations can be adaptively increased, and before the risk level of the client increases to a level that will cause a threat, the number of calculations increases at a slower rate, and when the risk level of the client increases to a level that will cause a threat, the number of calculations will increase significantly, thereby occupying sufficient resources in time to reduce the number of requests that the client can initiate.In this way, the number of calculations is determined by the set function, and the number of calculations is associated with the risk level of the client, so that when the client is low risk, the calculation parameters sent by the server will be able to occupy a small amount of computing power of the client to detect the client performance; when the client is medium risk, the calculation parameters sent by the server will be able to occupy more computing power of the client, such as occupying more than 80% of the computing power of the client, thereby reducing the resources that the client can use for concurrent requests, thereby reducing the number of concurrent requests of the client, and ultimately achieving the purpose of reducing the pressure on the server; when the client is high risk, the calculation parameters sent by the server can completely occupy the computing power of the client, forcing the client to be unable to perform other parallel tasks. Among them, the risk level of the client can be expressed in a quantitative way. For example, the risk level can be quantified into 10 levels, 1-3 for low risk, 4-6 for medium risk, 7-9 for high risk, and 10 for severe risk. As the client is determined to be abnormal during multiple protection processes, the risk level of the client will continue to increase. Of course, the above is only an example of quantifying the risk level. In other examples, the risk level can also be quantified in other ways, or the risk level is not quantified, which will not be repeated here.

[0036] It should also be noted that, in some embodiments, the client can also be associated with a corresponding database, which stores relevant calculation parameters. Therefore, when the server sends the calculation parameters, it does not directly send the real calculation parameters, but the identifier corresponding to the calculation parameters. Taking the server and client interaction operator as an example, the operator library can be configured (or associated) for the client, and the corresponding operator is assigned a unique identifier. When the server sends the operator in the calculation parameter, it actually sends the unique identifier of the operator. The client can download or read the corresponding operator for calculation based on the received unique identifier. The specific interaction information will not be repeated here.

[0037] Of course, the above are only examples of operators, calculation times, and input parameters that can be considered when the corresponding effects need to be achieved. It does not mean that operators, calculation times, and input parameters can only be defined using the above methods, and they will not be described one by one here.

[0038] It is understandable that different operators, calculation times and input parameters will bring different calculation complexities or difficulties to the client. At the same time, on the client side, it is expected that the resources required for the client to obtain services are small, so that limited resources can be used to support more services and improve user experience. On the server side, it is expected that the resources of the malicious user's client can be occupied by additional things, so that its resources are insufficient to support the initiation of a large number of requests, at least reducing the number of requests that can be initiated. Based on this, in order to better meet and balance the above requirements, in some embodiments, the calculation parameters of the client can be associated with the risk level of the client's history, wherein the risk level of the client's history is at least one risk level determined before sending the calculation parameters to the client (which can be obtained by the analysis step in the protection method provided in the embodiment of the present application, or by using the existing solution for determining the risk level of the client), and when the calculation parameters are sent to the client for the first time, the risk level of the client's history can be the default value, or a value determined according to the type, brand, current device status, etc. of the client. In this way, by associating the calculation parameters of the client with the risk level acquired historically by the client, clients with different risk levels will perform calculations of different complexity or difficulty, so that clients with different risk levels will have different amounts of resources occupied by calculations and different amounts of resources available for initiating requests. Therefore, clients with different risk levels can support different numbers of requests, or in other words, clients with different risk levels can use different amounts of resources to support other functions. That is, on the one hand, the number of requests that can be initiated by the client of a malicious user is reduced, and on the other hand, the client of a normal user can be supported to better support other functions.

[0039] It should be noted that the embodiments of the present application do not limit the manner in which the calculation parameters of the client are associated with the risk level historically obtained by the client. For example, the calculation parameters of the client are associated with the risk level historically obtained by the client as follows: the higher the risk level historically obtained by the client, the more complex the operator and / or input parameters. In another example, the calculation parameters of the client are associated with the risk level historically obtained by the client as follows: the higher the risk level historically obtained by the client, the greater the number of calculations. Of course, the above examples can also be combined, or other methods can be used to associate the calculation parameters of the client with the risk level historically obtained by the client, which will not be described one by one here.

[0040] It can also be understood that there are many types of clients, and different types of clients have different possibilities of being used by malicious users. For example, non-mobile terminals (such as PC (personal computer) terminals) have more resources than mobile terminals (such as mobile phones) and are more likely to be selected by malicious users so that malicious users can better implement attack plans. Therefore, in some embodiments, the type of client can also be associated with the calculation parameters in combination with the above characteristics. In this way, by associating the type of client with the calculation parameters, different types of clients will perform calculations of different complexity or difficulty under the same or similar conditions, so that the resources of different types of clients are occupied by calculations to different degrees, and the degree of hindrance to the initiation of requests by different types of clients is different. That is, on the one hand, the number and scale of requests that can be initiated by the client of a malicious user are limited, and on the other hand, the restrictions on the client of a normal user can be reduced.

[0041] That is to say, taking into account the large number of parallel tasks on non-mobile terminals such as PCs or server devices, the large difference in FLOPS calculated by the computing power characteristics each time, and the fact that the reverse engineering operation platform is generally on non-mobile terminals such as PCs or server devices, special processing is performed on non-mobile terminals, such as increasing the frequency of sending operators (i.e., increasing the number of detection and protection times for non-mobile terminals), increasing the error value of abnormal judgment (i.e., tolerating performance fluctuations under multi-tasking conditions on non-mobile terminals), and increasing the amplitude of risk levels (i.e., when risk situations occur, increasing computing power consumption), so as to further improve the accuracy and reliability of protection for non-mobile terminals.

[0042] It should be noted that the embodiment of the present application does not limit the association method of the type of client and the calculation parameter. Assume that the client is divided into two categories: mobile terminal and non-mobile terminal: for example, the type of client is associated with the calculation parameter: when the risk degree obtained historically is the same, the frequency of sending the calculation parameter to the mobile terminal is lower than the frequency of sending the calculation parameter to the non-mobile terminal. For another example, the type of client is associated with the calculation parameter: when the risk degree obtained historically is the same, the number of calculations of the mobile terminal is less than the number of calculations of the non-mobile terminal. For another example, the type of client is associated with the calculation parameter: when the risk degree obtained historically is the same, the operator and / or input parameter of the non-mobile terminal is more complex than the operator and / or input parameter of the mobile terminal. For another example, the type of client is associated with the calculation parameter: when the analysis is performed according to the computing power index, the conditionality of the non-mobile terminal determining the existence of risk is more relaxed than the condition of the mobile terminal determining the existence of risk. Among them, the conditional relaxation means that it is easier to meet the condition. Taking the threshold condition as an example, the larger the threshold range when the condition is met, the more relaxed the condition. Of course, the above examples can also be combined, or other methods are used to associate the type of client with the calculation parameter, which will not be repeated here.

[0043] That is to say, before sending the calculation parameters to the client, the server can dynamically generate corresponding calculation parameters according to the characteristics of different clients, different states of the clients, and then send them to the corresponding clients to dynamically occupy different computing power of the clients. In particular, the dynamic generation of calculation parameters can be achieved through relevant algorithms deployed in the server. Of course, it is also possible to select from pre-configured settings according to preset strategies, etc., which will not be described here one by one.

[0044] It should also be noted that the embodiment of the present application does not limit the timing of step 101. For example, step 101 can be automatically executed by the server according to a certain period. For example, after receiving the request sent by the client and before responding to the request of the client, the server will trigger step 101, etc., which will not be repeated here.

[0045] In step 102, a computing power indicator sent by the client is received. The embodiment of the present application does not limit the computing power indicator, which can be any indicator that can reflect the ability of the client to perform calculations according to the calculation parameters. For example, the computing power indicator may include some existing indicators, such as computing speed, computing energy consumption, computing accuracy, parallelism, floating-point operations per second (Floating-point Operations Per Second, FLOPS), instructions per second (Instructions PerSecond, IPS), transactions per second (Transaction Per Second, TPS), etc. For example, the computing power indicator may also include some custom indicators, such as whether it exceeds the preset time, parameter indicators of the execution device, etc. Of course, the above is only an exemplary description of the computing power indicators, and does not mean that the computing power indicators can only be selected from the above indicators, nor does it mean that the computing power indicators must include all of the above indicators. For example, the computing power indicators can also be distinguished based on different hardware on the basis of the above indicators, such as computing power based on graphics processing unit (GPU), computing power based on field programmable gate array (FPGA), computing power based on proprietary application (Application Specific Integrated Circuit, ASIC), etc., and one or more of the aforementioned indicators can be selected as the computing power indicators used in the embodiments of the present application, etc., which will not be described one by one here.

[0046] It should be noted that the embodiments of the present application do not limit the method for receiving the computing power indicator. For example, the server can send the calculation parameters to the client while also issuing a monitoring script, so that the server can monitor the process of the client calculating according to the calculation parameters through the monitoring script, thereby obtaining the corresponding computing power indicator. For example, the client is configured to actively monitor and report computing power indicators, etc. Among them, a computing power feature generation library can also be deployed on the client, and the algorithm library calculates the computing power of the current client according to different operators and generates computing power indicators. Of course, the above is also an exemplary explanation, and the computing power indicator can be received by the server in other ways, which will not be repeated here.

[0047] In step 103, analysis is performed based on the computing power index. The embodiment of the present application does not limit the method of analysis. For example, analysis can be performed in combination with the situation where the client performs calculations based on the calculation parameters under normal circumstances. In another example, analysis can be performed in combination with the situation where the client performs calculations based on the calculation parameters when a malicious user launches an attack through the client. In another example, the client's past historical computing power indicators, etc., are not given examples here. Among them, the situation where the client performs calculations based on the calculation parameters under normal circumstances and the situation where the client performs calculations based on the calculation parameters when a malicious user launches an attack through the client can be determined according to experience or by experiment.

[0048] That is, in some examples, analysis based on computing power indicators can be achieved in the following ways: comparing the computing power indicators with reference computing power indicators, where the reference computing power indicators include empirical indicators, experimental indicators, and / or historical indicators; and / or comparing the client's hardware usage based on the computing power indicators.

[0049] It should be noted that, in the above comparison process, for example, when the client performs multiple calculations based on the calculation parameters, the computing power index can also be processed to simplify the comparison process while ensuring the accuracy of the comparison. The processing of the computing power index can be to remove outliers, obtain statistical values ​​(such as mean, median, standard deviation, peak value, etc.), etc.

[0050] Taking FLOPS and computing time as computing power indicators as an example, the client collects the computing time and FLOPS for each calculation and sends them to the server during the calculation according to the calculation parameters. After receiving the above information, the server can analyze the time consumption in the process of analyzing according to the computing power indicators, calculate the difference after eliminating abnormal data, and calculate the mean, standard deviation, maximum value or minimum value and other data. For FLOPS, the maximum value of the received FLOPS can be calculated, and then the computing time and FLOPS data of the corresponding device (platform, device brand, device model, operating system and version, etc. are the same. Of course, in the case of limited data, the above part of the information can be the same) are queried from the database (and / or, historical data calculated based on the computing power indicators fed back by the client in history), and compared with the calculated data. When the fluctuation of the calculated data relative to the queried data (and / or historical data) exceeds a preset threshold, such as 12%, it is determined that the client is at risk (or abnormal). In particular, if the corresponding model of the device supports GPU computing, but the result returned by the current client indicates that the GPU is not used for computing, it can also be determined that the client is at risk (or abnormal).

[0051] In step 104, protection is performed on the client according to the analysis result. The embodiment of the present application does not limit the protection method, for example, blocking the client, blocking the IP address of the client, normally responding to the request of the client, etc.

[0052] In some examples, protection is performed on the client based on the analysis results, which can be achieved in the following manner: based on the different risk levels indicated by the analysis results, the risk level of the client is updated and protection processing is performed on the access request initiated by the client, wherein the protection processing includes at least one of the following: banning the client, banning the client's IP address, and responding normally to the client's request.

[0053] In some examples, it is assumed that the above steps have been analyzed to determine whether the client has an abnormality or a risk. Then, when protecting the client according to the analysis results, for the client determined to have an abnormality, the request initiated by the client is intercepted (or, in the case where the server sends the calculation parameter triggered by the request sent by the client, the request that currently causes the calculation parameter to be sent and determines that there is an abnormality is intercepted), and when the operator is generated next time to be sent to the client, the number of calculations sent to the client is increased from base*log(6, X) to base / 2+2^X; for the client determined to have a risk, the server monitors the request initiated by the client (or, in the case where the server sends the calculation parameter triggered by the request sent by the client, the request that currently causes the calculation parameter to be sent and determines that there is an abnormality is monitored), and when the operator is generated next time to be sent to the client, the number of calculations is determined according to base*log(6, X). Where X is the number of abnormalities, and base is the number of iterations corresponding to the computing power of the corresponding brand database.

[0054] It should be noted that when the risk level of the client has reached a level that poses a threat, even if the server occupies the client's computing power by sending calculation parameters to suppress and reduce the malicious requests that the client can initiate to achieve protection, it cannot completely eliminate the malicious requests initiated by malicious clients. Therefore, it is necessary to punish them through other means, such as IP blocking, adding to blacklists, etc., to further protect the server.

[0055] It should also be noted that the embodiments of the present application do not limit the application conditions of various protection processes. For example, when it is analyzed that the client is at risk, the client and / or the IP address of the client is blocked. For another example, when it is analyzed that the client is at risk, it is further determined whether the number of times the client is judged to be at risk per unit time is greater than a threshold number. If so, the risk level of the client is increased until the risk level of the client is determined to be raised to a certain threshold, and the client is blocked and / or the IP address of the client is blocked, etc., which will not be described one by one here.

[0056] It is also understandable that more diverse protection strategies can be adopted when performing protection, so that more comprehensive, reliable and accurate protection can be achieved through different protection strategies.

[0057] Based on this, in some embodiments, information verification is further combined on the basis of the above embodiments. Figure 4 As shown, the process of the protection method includes the following steps:

[0058] Step 201: Send calculation parameters to the client, where the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters.

[0059] Step 202, receiving a computing power indicator and verification information sent by the client, wherein the computing power indicator is used to characterize the client's ability to perform calculations according to calculation parameters, and the verification information includes at least one of the following information: first information for verifying the client, and second information for verifying an application associated with an access request sent by the client.

[0060] Step 203: perform verification according to the verification information.

[0061] Step 204: If the verification is passed, analysis is performed based on the computing power index.

[0062] Step 205: Protect the client according to the analysis result.

[0063] Step 206: If the verification fails, at least one of the following protection processes is performed on the client: blocking the client, blocking the IP address of the client.

[0064] In this way, on the basis of the aforementioned embodiment, information verification is further integrated into the protection process, so that the client can be analyzed more comprehensively, accurately and reliably, thereby achieving more accurate and reliable protection for the server and further improving the protection effect.

[0065] To facilitate better understanding of those skilled in the art Figure 4 The embodiment shown in FIG. 1 is shown, and its steps are described below.

[0066] In step 201, the implementation of sending the calculation parameters to the client is substantially the same as step 101 in the aforementioned embodiment, and will not be described in detail here.

[0067] In step 202, the implementation of receiving the computing power indicator and verification information sent by the client is roughly the same as step 102 in the aforementioned embodiment. The main difference is that the received information also includes verification information, and the parts that are the same as step 102 will not be repeated here. Among them, the first information can be information that can uniquely identify the client, such as the client ID. The second information can be information that can uniquely identify the mini program, such as the mini program ID. Of course, the above is only an example. In some embodiments, the first information can also be merged with the second information into the same information, that is, an ID assigned to a specified mini program on a client, etc., which will not be repeated here.

[0068] It should be noted that the embodiments of the present application do not limit the manner in which the client obtains verification information. For example, the verification information may be information reported autonomously by the client. In this case, the first information in the verification information may be a unique device identifier (UDID), and / or the second information in the verification information may be an AppID. For example, the verification information may be identification information assigned by the server to the client. In this case, the first information and the second information in the verification information may be identifications randomly generated by the server. Of course, the above is only an example of the verification information, and does not mean that the verification information must be the information described in the above example, so it will not be repeated here.

[0069] In step 203, verification is performed according to the verification information. The embodiment of the present application does not limit the verification method, which may be related to the form of the verification information. For example, when the verification information is not complicated, the verification method that can be used may be a one-to-one comparison to ensure the accuracy and reliability of the verification. For example, when the verification information is complicated, a parity check or other verification method may be used to improve the verification efficiency. This will not be repeated here.

[0070] In step 204, the implementation of analysis based on the computing power index is roughly the same as step 103 in the aforementioned embodiment, the main difference being that the implementation of step 204 has the prerequisite of passing the information verification, which will not be described in detail here.

[0071] In step 205, based on the analysis results, the implementation of protection for the client is substantially the same as step 104 in the aforementioned embodiment, and will not be described in detail here.

[0072] In step 206, if the verification fails, at least one of the following protection processes is performed on the client: banning the client, banning the IP address of the client. It is understandable that when the verification information fails to pass the verification, that is, the client is an illegal client, it will pose a threat. At this time, even if the server occupies the computing power of the client by issuing calculation parameters to suppress and reduce the malicious requests that the client can initiate through computing power to achieve protection, it is impossible to completely eliminate malicious requests initiated by malicious clients. Therefore, it is necessary to punish through other means, such as banning the client, banning the IP address of the client, etc. for further protection, so as to achieve further protection of the server.

[0073] It should be noted that Figure 4The execution order of the steps shown is only an example. In some embodiments, the verification according to the verification information and the analysis according to the computing power index can also be set as independent execution steps, such as in order to improve the processing efficiency, they can be implemented in parallel, and then the protection measures are determined by the verification results and the analysis results. In some embodiments, the verification according to the verification information and the analysis according to the computing power index can be performed alternately. In a certain protection process, the scheme of verifying according to the verification information and performing protection according to the verification results is adopted, and in the next protection process, the scheme of analyzing according to the computing power index and performing protection according to the analysis results is adopted, etc., which will not be listed one by one here.

[0074] Further, based on the above embodiments, in order to avoid the problem that the verification information cannot be obtained due to the limitation of the client or the application itself, the first information and / or the second information is set as the information assigned by the server to the client. Figure 5 As shown, the process of the protection method includes the following steps:

[0075] Step 301: periodically update the verification information corresponding to the client and synchronize it to the client.

[0076] Step 302: Send calculation parameters to the client, where the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters.

[0077] Step 303, receiving the computing power indicator and verification information sent by the client, wherein the computing power indicator is used to characterize the client's ability to perform calculations according to the calculation parameters, and the verification information includes at least one of the following information: first information for verifying the client, and second information for verifying the application associated with the access request sent by the client.

[0078] Step 304: perform verification according to the verification information.

[0079] Step 305: If the verification is passed, analysis is performed based on the computing power index.

[0080] Step 306: Protect the client according to the analysis result.

[0081] Step 307: If the verification fails, at least one of the following protection processes is performed on the client: blocking the client, blocking the IP address of the client.

[0082] In this way, on the basis of the above-mentioned embodiment, the verification information is further updated periodically, which increases the difficulty of cracking the verification information, improves the security of information verification, and thus further improves the reliability and accuracy of protection.

[0083] To facilitate better understanding of those skilled in the art Figure 5 The steps of the embodiment shown will be explained below. Among them, steps 302 to 307 are substantially the same as steps 201 to 206 in the above embodiment, and will not be described one by one here.

[0084] In step 301, the verification information corresponding to the client is periodically updated and synchronized to the client. That is, the verification information is assigned to the client by the server, and the server will periodically update it during the application process, wherein the update cycle can be described by time, for example, once every 3 hours, a day, a month, etc., or it can be described by the number of visits, for example, the update of the verification information is triggered every 100, 350, etc. visits of the same client. In addition, each update can be generated by the server according to certain rules or randomly generated. The update cycle and update method of the verification information will not be described here one by one.

[0085] It should be noted that Figure 5 The execution order of the steps shown is only an example. In some embodiments, the synchronization of the first information and / or the second information to the client can be implemented together with the sending of the calculation parameters, etc. Or the update and synchronization of the first information and / or the second information can occur at any time when the update conditions are met, etc., which will not be described one by one here.

[0086] It should also be noted that Figure 4 and Figure 5 Only for Figure 3 On the basis of the illustrated embodiment, an example of further combining information verification is provided. The above is only an example description of combining information verification. In some embodiments, information verification may also include verifying time information, for example, the server verifies the time taken by the client to calculate according to the calculation parameters. Among them, the time taken by the client to calculate according to the calculation parameters can be represented by the time between the server sending the calculation parameters and receiving the computing power index returned by the client. In this way, the starting event and the end time of the time taken by the client to calculate according to the calculation parameters are determined by the server, avoiding the protection error caused by the client tampering with the data. The time taken by the client to calculate according to the calculation parameters can also be represented by the time taken by the client to receive the calculation parameters to complete the calculation. In this way, the time taken by the client to calculate according to the calculation parameters can eliminate the influence of the communication process, avoid the interference of the client to the time taken by the client to calculate according to the calculation parameters due to problems such as uneven network quality, so that the client can calculate the time taken according to the calculation parameters more accurately and reliably, thereby further improving the reliability and accuracy of the protection. Of course, the above is only an example. In some embodiments, other information can also be used for verification, which will not be repeated here.

[0087] In some embodiments, the protection method provided in any of the above embodiments may be further combined with verification of the calculation results. In this way, the client can be further verified by verification of the calculation results to prevent malicious users from forging the results obtained by calculation based on the calculation parameters in other ways. Figure 1 Based on the embodiment shown, an example is given in combination with the calculation result verification. In some embodiments, Figure 6 As shown, the process of the protection method includes the following steps:

[0088] Step 401: Send calculation parameters to the client, where the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters.

[0089] Step 402, receiving the computing power indicator and calculation results sent by the client, wherein the calculation results include at least two results obtained by the client according to the calculation parameters.

[0090] Step 403: verify at least one of the at least two results according to the calculation parameters.

[0091] Step 404: If the verification is successful, analysis is performed based on the computing power index.

[0092] Step 405: Protect the client according to the analysis result.

[0093] In this way, the client is further checked through calculation result verification to prevent malicious users from forging the results obtained by calculation based on the calculation parameters in other ways. In addition, when verifying, it is not required to verify all results, so the amount of calculation required by the server can be reduced, the efficiency of server protection can be accelerated, and the waiting time of users can be reduced, thereby improving the user experience.

[0094] To facilitate better understanding of those skilled in the art Figure 6 The embodiment shown, the steps of which will be explained below.

[0095] In step 401, the implementation of sending the calculation parameters to the client is substantially the same as step 101 in the aforementioned embodiment, and will not be described in detail here.

[0096] In step 402, the implementation of receiving the computing power index and calculation results sent by the client is roughly the same as step 102 in the aforementioned embodiment, and the main difference is that the received information also includes the calculation results, and the parts that are the same as step 102 will not be repeated here. Among them, as mentioned above, when the client performs calculations according to the calculation parameters, it may involve multiple calculations. When multiple calculations are involved, each calculation will generate at least one calculation result (including the final result of the current calculation, and sometimes may also include intermediate results). At this time, the calculation results received by the server may include all results or some results. For example, when the client performs 10 calculations according to the calculation parameters, the number of calculation results received by the server may be 10, or it may be 2, 4, 5, 7, etc., which will not be repeated here.

[0097] In step 403, at least one of the at least two results is verified according to the calculation parameters. That is, the server also performs corresponding calculations, and verifies the results sent by the client according to the results calculated by the server itself. It should be noted that the embodiment of the present application does not limit the number of verifications. For example, all received calculation results can be verified, or part of the calculation results can be verified. Assuming that the server receives all the calculation results currently calculated according to the calculation parameters sent by the client, at this time, some of the calculation results can be selected for verification by random sampling. In this way, since some results are randomly verified, the malicious client cannot predict which results will be verified by the server. Therefore, it is more difficult for the malicious client to forge the calculation results, so that although all results will not be verified, the reliability of the verification can still be guaranteed, thereby ensuring the reliability of the protection. Assuming that the client receives a partial result sent by the server, in order to reduce the amount of data transmitted by communication, the client can be configured or a monitoring script can be set to select some results from the obtained results according to certain rules as calculation results to feed back to the server. For example, the 1st, rand(N), N / 2, and Nth results are selected from all results as calculation results and sent to the server, where rand(N) represents a random number selected from 1-N, and N is the number of calculations currently performed by the client according to the calculation parameters.

[0098] In this way, by verifying some of the calculation results, asymmetric computing power is performed on the server and the client, so that the computing power consumption on the server is less than that on the client, which is beneficial for the server to use resources to support other functions, such as CDN node servers can better support acceleration service functions.

[0099] In step 404, the implementation of the analysis based on the computing power index is substantially the same as step 103 in the aforementioned embodiment, the main difference being that the implementation of step 404 has a prerequisite of passing the verification, which will not be described in detail here.

[0100] It should be noted that Figure 6 The execution order of the steps shown is only an example. For example, in some embodiments, verifying at least one of the at least two results according to the calculation parameters and analyzing according to the computing power index can also be steps executed independently of each other, and the subsequent protection is determined according to the execution results of the above two steps, etc., which will not be repeated here.

[0101] It should also be noted that Figure 6 Only for Figure 3 Based on the illustrated embodiment, combined with the example of verifying the calculation results, in some embodiments, all the results may also be verified, etc., which will not be described in detail here.

[0102] In addition, in the above embodiments, only examples are given for handling situations where the check (or verification) fails, and it does not mean that operations such as IP blocking and client blocking must be adopted. For example, when the check (or verification) fails, a different computing power indicator analysis threshold value can be selected from the case where the check (or verification) passes, etc., which will not be elaborated here.

[0103] Of course, the above is only an explanation of combining relevant strategies to verify whether the computing power characteristics are legal and valid through relevant strategies, so as to avoid malicious clients from falsifying computing power indicators and further improve the protection effect. In some embodiments, other strategies can also be combined for protection, which will not be repeated here.

[0104] Accordingly, another aspect of the present application embodiment provides a protection method, which is applied to a client. It should be noted that the client can be any terminal that can initiate a request, such as a mobile phone, a tablet, etc. in a mobile terminal, or a desktop computer in a non-mobile terminal (such as a PC terminal). Figure 7 The flowchart shown illustrates the protection method applied to the client.

[0105] In some embodiments, Figure 7 As shown, the protection method applied to the client may include the following steps:

[0106] Step 501, receiving calculation parameters sent by the server, wherein the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters.

[0107] Step 502, performing calculations according to the calculation parameters to obtain a computing power indicator, wherein the computing power indicator is used to characterize the ability of the client to perform calculations according to the calculation parameters.

[0108] Step 503, sending computing power indicators to the server.

[0109] In this way, by receiving the calculation parameters sent by the server, the calculation on the client is supported, and in the process of calculating according to the calculation parameters, the computing power index is obtained and fed back to the server, so that the server can realize protection by analyzing according to the computing power index. In this protection implementation process, it no longer relies on control information, dynamic update code, etc. to achieve, thereby avoiding the problem of protection failure caused by the restrictions of control information, dynamic update code, etc., and realizing more reliable and effective security protection. At the same time, it no longer relies solely on verifying the calculation results of the client to achieve protection, so that the server no longer needs to spend a lot of computing resources to verify the calculation results, reducing the resource consumption of the server, especially avoiding the problem of malicious users cracking the calculation parameters and using other methods to calculate, resulting in malicious requests being missed and causing protection errors, making the protection more reliable and accurate, and the protection effect is better.

[0110] It is not difficult to find that this embodiment is a method embodiment corresponding to the embodiment of the protection method applied to the server, and this embodiment can be implemented in conjunction with the embodiment of the protection method applied to the server. The relevant technical details mentioned in the embodiment of the protection method applied to the server are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the embodiment of the protection method applied to the server.

[0111] For example, in some embodiments, sending a computing power indicator to a server can be implemented in the following manner: sending a computing power indicator and at least one of the following information to a server: verification information, calculation results; wherein the verification information includes at least one of the following information: first information for verifying a client, second information for verifying an application associated with an access request sent by the client, the first information and / or the second information being periodically updated by the server; and the calculation results including the results corresponding to each iteration. The above-mentioned related features are described in the aforementioned protection method for the server, and will not be described one by one here.

[0112] In order to facilitate those skilled in the art to better understand the security protection method provided by the above embodiment, the following will be described in conjunction with the interaction between the server and the client. It is assumed that the server is a CDN edge node server. At this time, the process of the protection method is as follows: Figure 8 As shown, the following steps are included:

[0113] Step 601: The client sends an access request to the CDN node server.

[0114] Step 602: The CDN node server triggers a calculation parameter generation algorithm according to the access request to generate calculation parameters and verification information.

[0115] The server may determine the calculation parameters according to the following algorithm:

[0116] The structure of calculation parameters: check value, calculation factor, number of iterations.

[0117] Verification information = fn (client ID, applet ID, time). The fn algorithm is a one-time password (OTP) algorithm, that is, the content generated within a period of time is the same, so that the verification value has timeliness.

[0118] Input parameter = Md5([random_str()]*20). This is the result of sampling 20 random characters and performing md5.

[0119] Calculation times = [base*log(M, N)], where base is the reference calculation times corresponding to the client, M is the preset parameter, and N is the risk level determined historically by the client.

[0120] Step 603: The server sends calculation parameters and verification information to the client.

[0121] Step 604: The client performs calculations based on the calculation parameters and collects computing power indicators.

[0122] Among them, taking the operator as hash chain calculation as an example, assuming that the number of calculations is the number of executions of a single hash algorithm involved in the hash chain calculation, at this time, the client's calculation is performed according to the following function:

[0123]

[0124] Among them, the initial value of Res is the input parameter, and the initial value of level is the number of calculations.

[0125] Step 605: The client sends computing power indicators and verification information to the CDN node server.

[0126] Step 606: The CDN node server performs verification according to the verification information.

[0127] Among them, the server can be verified through the following function:

[0128]

[0129]

[0130] That is to say, an asymmetric computing power feature verification algorithm is used for local verification, specifically, level=0, rand(n), n / 2, and n-layer computing power features in the feature are verified.

[0131] Step 607: When the verification information passes the verification, analysis is performed based on the computing power index.

[0132] Among them, the server can perform analysis through the following functions:

[0133]

[0134] Among them, in the case of time validity verification, the verification condition is that the difference between the first characteristic time and the current server time does not exceed 3*log(n) seconds, where n is a preset value.

[0135] Step 608: When the client is determined to be risky according to the analysis result, the CDN node server increases the risk level of the client.

[0136] Step 609: When the client is determined to be abnormal according to the analysis result, the CDN node server blocks the client and the IP address of the client.

[0137] In this way, the server generates calculation parameters for different computing power requirements according to the current risk level and passes them to the client through the request response. After receiving the calculation parameters, the client can calculate the computing power index based on the computing power consumed by the calculation parameters, and then send it to the server through a normal request. The server receives the computing power index and verification information sent by the client. On the one hand, the server verifies the legitimacy and timeliness through the verification information, and can immediately intercept the illegally constructed request. At the same time, the server also analyzes the computing power index of the client with legitimate verification information. If it meets the computing power characteristics of the attacking device, the corresponding risk level is adjusted, thereby adjusting the consumption of the next operator computing power and increasing the computing cost of the attacker to launch the next attack. The analysis of legitimate operators and computing power characteristics can also be used as the data basis for subsequent analysis. For example, when the computing power characteristics and device characteristics do not match, the device and the corresponding IP are banned. Therefore, in special environment scenarios such as WeChat applets, it is still possible to support integrity verification of each request and determine the computing power characteristics of the current request. The validity and legitimacy of the computing power characteristics are calculated according to the statistical algorithm on the server, so as to identify abnormal requests and achieve the purpose of security protection. At the same time, for scenarios where codes that cannot be dynamically obfuscated are illegally called by attackers, the computing intensity of the operator is dynamically adjusted to increase the computing power consumption of attackers or risky users, thereby increasing the attack cost and reducing the number of attack requests, thereby reducing the load pressure on the server and reducing costs.

[0138] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0139] Another aspect of the present application embodiment further provides an electronic device, such as Fig. 9 As shown, it includes: at least one processor 901; and a memory 902 that is communicatively connected to the at least one processor 901; wherein the memory 902 stores instructions that can be executed by the at least one processor 901, and the instructions are executed by the at least one processor 901 so that the at least one processor 901 can execute the protection method described in any of the above method embodiments.

[0140] Among them, the memory 902 and the processor 901 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 901 and the memory 902 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 901 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 901.

[0141] The processor 901 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 902 can be used to store data used by the processor 901 when performing operations.

[0142] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0143] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0144] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A protection method, characterized in that: Applied to a server, the method comprises: Sending calculation parameters to the client, wherein the calculation parameters include at least one of the following parameters: operator, number of calculations, and input parameters; Receiving a computing power indicator sent by the client, wherein the computing power indicator is used to characterize the ability of the client to perform calculations according to the calculation parameters; Analyze according to the computing power indicators; Based on the analysis result, protection is performed on the client.

2. The protection method according to claim 1, characterized in that: The correlation relationship between the calculation parameter of the client and the risk level of the client's history acquisition includes at least one of the following relationships: the higher the risk level of the client's history acquisition, the more complex the operator and / or the input parameter; the higher the risk level of the client's history acquisition, the greater the number of calculations; and / or, The client includes a mobile terminal and a non-mobile terminal, and the association relationship between the different types of the client and the calculation parameters includes at least one of the following relationships: when the risk levels obtained historically are the same, the frequency of sending the calculation parameters to the mobile terminal is lower than the frequency of sending the calculation parameters to the non-mobile terminal; when the risk levels obtained historically are the same, the number of calculations of the mobile terminal is less than the number of calculations of the non-mobile terminal; when the risk levels obtained historically are the same, the operator and / or the input parameters of the non-mobile terminal are more complex than the operator and / or the input parameters of the mobile terminal; when analyzing according to the computing power indicator, the conditionality of the non-mobile terminal's judgment on the existence of risk is more relaxed than the conditionality of the mobile terminal's judgment on the existence of risk.

3. The protection method according to claim 1, characterized in that: The number of calculations is determined based on at least one of the following information: the risk level historically acquired by the client, the reference number of calculations corresponding to the client, and the user status of the client, wherein the reference number of calculations corresponding to the client is obtained based on empirical values ​​and / or experimental values ​​of the same device as the client.

4. The protection method according to claim 1, characterized in that: The protecting the client according to the analysis result includes: According to the different risk levels indicated by the analysis results, the risk level of the client is updated and protection processing is performed on the access request initiated by the client, wherein the protection processing includes at least one of the following: banning the client, banning the IP address of the client, and responding normally to the client's request.

5. The protection method according to any one of claims 1 to 4, characterized in that: The analysis according to the computing power indicator includes: Comparing the computing power indicator with a reference computing power indicator, wherein the reference computing power indicator includes an experience indicator, an experimental indicator, and / or a historical indicator; and / or, According to the computing power indicator, the hardware usage of the client is compared.

6. The protection method according to any one of claims 1 to 4, characterized in that: The receiving the computing power indicator sent by the client includes: Receiving the computing power indicator and verification information sent by the client, wherein the verification information includes at least one of the following information: first information for verifying the client, and second information for verifying an application associated with an access request sent by the client; Before analyzing according to the computing power indicator, the method further includes: Perform verification according to the verification information; The analysis according to the computing power indicator includes: If the verification is passed, analysis is performed based on the computing power indicators.

7. The protection method according to claim 6, characterized in that: The method further comprises: The verification information corresponding to the client is updated periodically and synchronized to the client.

8. The protection method according to any one of claims 1 to 4, characterized in that: The receiving the computing power indicator sent by the client includes: Receiving the computing power indicator and calculation result sent by the client, wherein the calculation result includes at least two results calculated by the client according to the calculation parameters; Before protecting the client according to the analysis result, the method further includes: At least one of the at least two results is verified based on the calculation parameter.

9. A protection method, characterized in that: Applied to a client, the method comprises: Receiving calculation parameters sent by the server, wherein the calculation parameters include at least one of the following parameters: an operator, a number of calculations, and an input parameter; Performing calculations according to the calculation parameters to obtain a computing power indicator, wherein the computing power indicator is used to characterize the ability of the client to perform calculations according to the calculation parameters; Send the computing power indicator to the server.

10. The protection method according to claim 9, characterized in that: The sending the computing power indicator to the server includes: Sending the computing power indicator and at least one of the following information to the server: verification information and calculation results; Among them, the verification information includes at least one of the following information: first information used to verify the client, second information used to verify the application associated with the access request sent by the client, the first information and / or the second information are periodically updated by the server; the calculation result includes the result corresponding to each iteration.

11. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the protection method according to any one of claims 1 to 8, or the protection method according to claim 9 or 10.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the computer program implements the protection method according to any one of claims 1 to 8, or the protection method according to claim 9 or 10.

Images