Information detection method, device and equipment, computer readable storage medium and computer program product

Abstract

The embodiment of the invention discloses an information detection method. The method comprises the following steps: receiving a first access request for accessing a target application sent by a client; wherein the target application is an application deployed on a zero-trust network framework; the first access request carries information for verifying the identity of a user of the client; generating a first key based on the first access request, and determining a corresponding relationship between the first key and an application credential of the target application; receiving a second access request which is sent by the client and carries first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on a second key and a target parameter of the client; the second key is generated by the client based on the feature information of the client; and based on the application credential and the corresponding relationship, detecting whether the first authentication information in the second access request has a leakage behavior of the application credential. The embodiment of the invention further discloses an information detection device and equipment, a computer readable storage medium and a computer program product.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information detection method, device, equipment, computer-readable storage medium and computer program product. Background Art

[0002] At present, the main methods for detecting whether application credentials have been stolen are: based on Internet Protocol (IP) regional change detection or based on terminal hardware feature code comparison detection; among them, the method based on IP regional change detection specifically detects that there are multiple IPs in the same session and the multiple IP locations are not adjacent, then it can be determined that application credentials have been stolen; the method based on terminal hardware feature code comparison detection specifically reports hardware feature codes regularly through a zero-trust client. If the server receives multiple different hardware feature codes in the same session, it can be determined that application credentials have been stolen; however, judging whether the IP geographical locations are adjacent in the IP regional change detection method strongly depends on the accuracy of the geographical location information database, and it is easy to have false alarms of IP geographical location, resulting in a low accuracy rate of the detection result; and the method based on terminal hardware feature code comparison detection mainly relies on the zero-trust client, but not all operating systems support the zero-trust client, thereby limiting the client's collection of hardware feature codes. Summary of the invention

[0003] To solve the above technical problems, the embodiments of the present application hope to provide an information detection method, apparatus, device, computer-readable storage medium and computer program product, which can solve the problems of low accuracy of detection results in related technologies and limitations on the client's collection of hardware feature codes.

[0004] The technical solution of this application is implemented as follows:

[0005] Receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client;

[0006] generating a first key based on the first access request, and determining a correspondence between the first key and the application credential of the target application;

[0007] receiving a second access request sent by the client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on the second key of the client and target parameters; and the second key is generated by the client based on feature information of the client;

[0008] Based on the application credentials and the corresponding relationship, it is detected whether the first authentication information in the second access request has leaked the application credentials.

[0009] In the above solution, the generating of the first key based on the first access request includes:

[0010] obtaining the characteristic information based on the first access request;

[0011] The first key is generated based on the characteristic information.

[0012] In the above solution, before receiving the second access request sent by the client and carrying the first authentication information corresponding to the client, the method further includes:

[0013] Sending a target script to a client browser so that the client browser intercepts a third access request sent by the client browser through the target script, and adds the first authentication information to the third access request to obtain the second access request; wherein the client includes the client browser.

[0014] In the above solution, the detecting, based on the application credentials and the corresponding relationship, whether the first authentication information in the second access request has leaked the application credentials includes:

[0015] Generate second authentication information corresponding to the server based on the application credential, the corresponding relationship and the second access request;

[0016] Based on the second authentication information, it is detected whether the first authentication information carried in the second access request has leaked the application credentials.

[0017] In the above solution, the generating of the second authentication information based on the application credential, the corresponding relationship and the second access request includes:

[0018] Determine the first key based on the application credential and the corresponding relationship;

[0019] determining the target parameter based on the second access request;

[0020] The second authentication information is generated based on the first key and the target parameter.

[0021] In the above solution, the detecting, based on the second authentication information, whether the first authentication information carried in the second access request has leaked the application credentials includes:

[0022] If the first authentication information is the same as the second authentication information, it is detected that no leakage of the application credentials has occurred;

[0023] If the first authentication information is different from the second authentication information, a leakage of the application credentials is detected.

[0024] In the above scheme, the information detection method further includes:

[0025] Determine a target access request; wherein the target access request is an access request that cannot carry authentication information;

[0026] Add the target access request to the whitelist.

[0027] An information detection device, applied to a server, comprising:

[0028] A receiving unit, configured to receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client;

[0029] a generating unit, configured to generate a first key based on the first access request, and determine a correspondence between the first key and an application credential of the target application;

[0030] The receiving unit is further configured to receive a second access request sent by the client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on the second key of the client and the attribute information of the client; and the second key is generated by the client based on the feature information of the client;

[0031] The processing unit is used to detect whether the first authentication information in the second access request has leaked the application credentials based on the application credentials and the corresponding relationship.

[0032] A server, comprising: a processor, a memory and a communication bus;

[0033] The communication bus is used to realize the communication connection between the processor and the memory;

[0034] The processor is used to execute the information detection program in the memory to implement the steps of the above-mentioned information detection method.

[0035] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above-mentioned information detection method.

[0036] A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned information detection method are implemented.

[0037] The information detection method, apparatus, device, computer-readable storage medium and computer program product provided in the embodiments of the present application first receive a first access request sent by a client to access a target application, and the target application is an application deployed on a zero-trust network framework, and the first access request carries information for verifying the identity of the user of the client, then generates a first key based on the first access request, and determines the correspondence between the first key and the application credentials of the target application, and then receives a second access request sent by the client carrying the first authentication information corresponding to the client, and the first authentication information is generated by the client based on the second key and the target parameter of the client, and the second key is generated by the client based on the characteristic information of the client, and then based on the application credentials and the correspondence, detects whether the first authentication information in the second access request has leaked the application credentials. In this way, the application credentials and the correspondence of the server and the first authentication information dynamically generated by the client are used to jointly determine whether the first authentication information has leaked the application credentials, instead of requiring the IP geographic location or the hardware feature code collected by the client to detect whether the application credentials have been leaked as in the related art, thereby not only reducing the false alarm rate, but also improving the accuracy of the detection result, and it can be independent of the client, and can be applicable to endless scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of an information detection method provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a flow chart of another information detection method provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of a process for detecting whether application credentials are leaked in an information detection method provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the structure of an information detection device provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0044] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] The present application embodiment provides an information detection method, which can be applied to a server, referring to Figure 1 As shown, the method comprises the following steps:

[0046] Step 101: Receive a first access request for accessing a target application sent by a client.

[0047] Among them, the target application is an application deployed on a zero-trust network framework; the first access request carries information for verifying the identity of the user of the client.

[0048] In an embodiment of the present application, the target application may refer to a web application (i.e., a web application); the client may refer to a zero-trust client; since the web application is deployed on a zero-trust network framework, before accessing the web application, the client may first log in to the zero-trust network framework and then access the web application, and before accessing the web application, a first access request must be sent to the server so that the server can verify the identity of the user of the client accessing the web application.

[0049] It should be noted that by deploying the web application on a zero-trust network architecture and turning on the switch, the web application credential theft protection function can be directly implemented without the administrator having to develop additional credential theft protection functions for their own web applications, thereby reducing the development cost of the web application's own security protection.

[0050] Step 102: Generate a first key based on the first access request, and determine a correspondence between the first key and an application credential of a target application.

[0051] In an embodiment of the present application, the first key is the key corresponding to the server; the corresponding relationship is the relationship between the first key and the application credentials; the first access request can be parsed, and the first key can be generated based on the parsing result, and then the first key can be bound to the application credentials to obtain the corresponding relationship between the first key and the application credentials; it should be noted that the first key can also be cached.

[0052] Step 103: Receive a second access request sent by the client and carrying the first authentication information corresponding to the client.

[0053] The first authentication information is generated by the client based on the second key of the client and the target parameter; the second key is generated by the client based on the characteristic information of the client.

[0054] In the embodiment of the present application, the first authentication information is authentication information generated by the client, and can be used to detect whether the application credentials are leaked; the second access request may refer to an access request that actually accesses the web application and carries the first authentication information; the second key is the key corresponding to the client; the characteristic information of the client may refer to the basic attribute information of the client browser or the basic configuration information of the client; the client may first generate the second key based on the characteristic information of the client, and then encrypt the second key and the target parameter using an encryption algorithm to generate the first authentication information, and then send the second access request carrying the first authentication information to the server in real time, that is, the server can receive the second access request carrying the first authentication information sent by the client in real time; it should be noted that the first authentication information may specifically be a password, that is, a token; the secret key (that is, the first key and the second key) and the password (the first authentication information and the second authentication information) are not stored locally on the client, but are temporarily generated, so that even if the attacker remotely controls the client, the second secret key can be prevented from being stolen. .

[0055] In a feasible implementation, the target parameter may refer to the client time, the target parameter may refer to the request sequence number of the request sent by the client, or the target parameter may refer to any random number; when the characteristic information of the client refers to the basic attribute information of the client browser, the characteristic information of the client may specifically refer to the basic information such as the browser version and the operating system version; when the characteristic information of the client refers to the basic configuration information of the client, the characteristic information of the client may specifically refer to the screen resolution of the client, and the characteristic information of the client may also refer to the theme color of the client.

[0056] Step 104: Based on the application credentials and the corresponding relationship, detect whether the first authentication information in the second access request has any leakage of the application credentials.

[0057] In an embodiment of the present application, the server can first generate second authentication information of the server based on the application credentials, the corresponding relationship and the second access request sent by the client and received by the server, and then detect whether the first authentication information carried in the second access request has leaked the application credentials (i.e., stolen application credentials) based on the second authentication information.

[0058] It should be noted that by automatically adding anti-credential theft functions to all deployed web applications and adding a zero-trust interface verification mechanism to each web interface request, web applications that are proxied by zero-trust do not need to implement session theft functions additionally, and can support scenarios without zero-trust clients.

[0059] The information detection method provided in the embodiment of the present application jointly determines whether the first authentication information has leaked the application credentials through the application credentials and the corresponding relationship on the server side and the first authentication information dynamically generated by the client, instead of requiring the IP geographic location or the hardware feature code collected by the client to detect whether the application credentials have been leaked as in the related art. This not only reduces the false alarm rate and thus improves the accuracy of the detection results, but also is independent of the client and can be applied to unattended scenarios.

[0060] Based on the above embodiments, the present application provides another information detection method, referring to Figure 2 and Figure 3 As shown, the method may include the following steps:

[0061] Step 201: The server receives a first access request for accessing a target application sent by a client.

[0062] Among them, the target application is an application deployed on a zero-trust network framework; the first access request carries information for verifying the identity of the user of the client.

[0063] In the embodiments of the present application, the server may refer to a zero-trust server; it should be noted that the zero-trust network framework may refer to a security concept of "never trust, always verify", and develop a security framework of "identity-centric, continuous trust assessment, and dynamic access control". The mainstream technical implementations include software-defined perimeter (SDP), unified identity management (IAM) and micro-segmentation (MSG); among them, SDP is a network access control security architecture based on the concept of zero trust, used to protect enterprise applications and services, and is a type of zero-trust access control system. It defines a set of security policies and rules to limit users and devices accessing applications and services, and prevent unauthorized access and attacks. SDP products are generally composed of three major components: SDP control center, proxy gateway (ie, "server") and SDP connection initiation host (ie, "client"). In a feasible implementation method, the concept of "zero trust" in this application can specifically refer to SDP products.

[0064] Step 202: The server obtains characteristic information of the client based on the first access request.

[0065] In the embodiment of the present application, the first access request carries characteristic information of the client (ie, user-agent), and therefore, the first access request can be parsed to obtain the characteristic information of the client.

[0066] Step 203: The server generates a first key based on the characteristic information.

[0067] In the embodiment of the present application, the first key is a key dynamically generated according to the characteristic information of the client (ie, a dynamic key), and Figure 3 As shown, after the first key is generated, the first key can also be stored in the cache space of the server; it should be noted that the first key is generated according to the user-agent and is a fixed value during the application session period, and needs to be kept strictly confidential to prevent theft.

[0068] Step 204: The server determines a correspondence between the first key and the application credentials of the target application.

[0069] In the embodiment of the present application, the first key can be bound to the application credential to obtain a corresponding relationship between the first key and the application credential; it should be noted that there is a one-to-one correspondence between the first key and the application credential.

[0070] It should be noted that if Figure 3 As shown, application credentials may refer to server-side access web application credentials that can be used in a zero-trust network framework, and the server may also send application credentials to the client, and generally in the form of a small text file (ie, Cookie).

[0071] Step 205: The server sends the target script to the client browser, so that the client browser intercepts the third access request sent by the client browser through the target script, and adds the first authentication information to the third access request to obtain the second access request.

[0072] The client includes a client browser.

[0073] In the embodiment of the present application, the target script may refer to a zero-trust web script; the server may send the zero-trust web script to the client browser, and then the client browser may intercept the third access request sent by the client browser through the target script, and add the first authentication information to the third access request to obtain the second access request, so that the network access request (i.e., the second access request) of the web application deployed in the zero-trust network framework can be proxied by the target script; it should be noted that, if Figure 3 As shown, before the target script intercepts the third access request sent by the client browser, the target script may be initialized first.

[0074] Step 206: The server receives a second access request sent by the client and carrying the first authentication information corresponding to the client.

[0075] The first authentication information is generated by the client based on the second key of the client and the target parameter; the second key is generated by the client based on the characteristic information of the client.

[0076] It should be noted that if Figure 3 As shown, after generating the second key, the client may also store the second key in the client's memory.

[0077] Step 207: The server generates second authentication information corresponding to the server based on the application credentials, the corresponding relationship and the second access request.

[0078] In an embodiment of the present application, processing may be performed first based on the application credentials and the corresponding relationship, and then the second access request may be processed to generate second authentication information corresponding to the server.

[0079] It should be noted that step 207 can be implemented in the following ways:

[0080] Step 207A1: The server determines a first key based on the application credentials and the corresponding relationship.

[0081] In the embodiment of the present application, the key bound to the application credential, that is, the first key, can be determined from the corresponding relationship according to the application credential.

[0082] Step 207A2: The server determines target parameters based on the second access request.

[0083] In the embodiment of the present application, the second access request may carry a target parameter, and therefore, the second access request may be parsed to obtain the target parameter;

[0084] Step 207A3: The server generates second authentication information based on the first key and the target parameter.

[0085] In an embodiment of the present application, an encryption algorithm can be used to encrypt the first key and the target parameter to generate second authentication information, and the second authentication information can specifically be a password, that is, a token; it should be noted that the encryption algorithm used to generate the first authentication information is the same as the encryption algorithm used to generate the second authentication information.

[0086] In a feasible implementation, when the target parameter is the client's time, a time-based one-time password algorithm (TOTP) can be used to encrypt the first key and the client's time, so that the second authentication information obtained changes dynamically over time.

[0087] Step 208: The server detects, based on the second authentication information, whether the first authentication information carried in the second access request has any application credential leakage.

[0088] In the embodiment of the present application, the first authentication information and the second authentication information may be compared to determine whether the first authentication information has been leaked in the form of application credentials.

[0089] It should be noted that when the application request (i.e., the second access request) is captured and replayed by an attacker, or the application credentials are imported into the attacker's browser, the zero-trust server can determine whether the application credentials have been stolen based on the existence, expiration, and correctness of the password (i.e., the first authentication information).

[0090] It should be noted that step 208 can be implemented by the following step 208B1 or step 208B2:

[0091] Step 208B1: If the first authentication information is the same as the second authentication information, the server detects that no leakage of the application credentials has occurred.

[0092] Step 208B2: If the first authentication information is different from the second authentication information, the server detects that a leakage of application credentials has occurred.

[0093] In the embodiments of the present application, since the SDP product is based on traffic identification technology, all network connections carry user identity information. Therefore, after a threat is detected (i.e., the theft of application credentials is detected), automated disposal actions such as directly disconnecting the client's Internet connection, disconnecting the client's intranet connection, and locking the client's corresponding user account can be performed to prevent further attacks and losses.

[0094] It should be noted that the above embodiment may further include the following steps:

[0095] Step 209: The server determines the target access request.

[0096] The target access request is an access request that cannot carry authentication information.

[0097] In an embodiment of the present application, the access request that cannot carry authentication information can be automatically determined based on the historical access habits of the target application (that is, the parameters carried by the deployed web application interface can be automatically learned).

[0098] Step 210: The server adds the target access request to the whitelist.

[0099] In an embodiment of the present application, access requests that cannot carry authentication information can be automatically added to a whitelist based on the historical access habits of the target application, which can effectively prevent the generation of false alarms and thus reduce the probability of false alarms.

[0100] The information detection method provided in the embodiment of the present application jointly determines whether the first authentication information has leaked the application credentials through the application credentials and the corresponding relationship on the server side and the first authentication information dynamically generated by the client, instead of requiring the IP geographic location or the hardware feature code collected by the client to detect whether the application credentials have been leaked as in the related art. This not only reduces the false alarm rate and thus improves the accuracy of the detection results, but also is independent of the client and can be applied to unattended scenarios.

[0101] Based on the above embodiments, the present application provides an information detection device, which can be applied to Figure 1 and Figure 2 In the information detection method provided in the corresponding embodiment, refer to Figure 4 As shown, the information detection device 3 may include: a receiving unit 31, a generating unit 32 and a processing unit 33, wherein:

[0102] The receiving unit 31 is used to receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client;

[0103] A generating unit 32, configured to generate a first key based on the first access request, and determine a correspondence between the first key and an application credential of a target application;

[0104] The receiving unit 31 is further configured to receive a second access request sent by a client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on a second key of the client and attribute information of the client; and the second key is generated by the client based on feature information of the client;

[0105] The processing unit 33 is used to detect whether the first authentication information in the second access request has any leakage of application credentials based on the application credentials and the corresponding relationship.

[0106] In other embodiments of the present application, the generating unit 32 is further configured to perform the following steps:

[0107] obtaining characteristic information based on the first access request;

[0108] A first key is generated based on the characteristic information.

[0109] In other embodiments of the present application, the generating unit 32 is further configured to perform the following steps:

[0110] Sending a target script to a client browser so that the client browser intercepts a second access request sent by the client browser through the target script, and adding the first authentication information to the second access request to obtain the second access request; wherein the client includes the client browser.

[0111] In other embodiments of the present application, the processing unit 33 is further configured to perform the following steps:

[0112] Generate second authentication information corresponding to the server based on the application credentials, the corresponding relationship and the second access request;

[0113] Based on the second authentication information, it is detected whether the first authentication information carried in the second access request has any application credential leakage.

[0114] In other embodiments of the present application, the processing unit 33 is further configured to perform the following steps:

[0115] Determine a first key based on the application credential and the corresponding relationship;

[0116] determining a target parameter based on the second access request;

[0117] Based on the first key and the target parameter, second authentication information is generated.

[0118] In other embodiments of the present application, the processing unit 33 is further configured to perform the following steps:

[0119] If the first authentication information is the same as the second authentication information, it is detected that no leakage of the application credentials has occurred;

[0120] If the first authentication information is different from the second authentication information, a leakage of the application credentials is detected.

[0121] In other embodiments of the present application, the processing unit 33 is further configured to perform the following steps:

[0122] Determine a target access request; wherein the target access request is an access request that cannot carry authentication information;

[0123] Add the target access request to the whitelist.

[0124] It should be noted that the specific implementation process of the steps performed by each module in the embodiment of the present application can be referred to Figure 1 and Figure 2 The implementation process of the information detection method provided in the corresponding embodiment will not be repeated here.

[0125] The information detection device provided in the embodiment of the present application jointly determines whether the first authentication information has leaked the application credentials through the application credentials and the corresponding relationship of the server and the first authentication information dynamically generated by the client, instead of requiring the IP geographic location or the hardware feature code collected by the client to detect whether the application credentials have been leaked as in the related art. This not only reduces the false alarm rate and thus improves the accuracy of the detection results, but also is independent of the client and can be applied to endless scenarios.

[0126] Based on the above embodiments, the embodiments of the present application provide a server, which can be applied to Figure 1 and Figure 2 In the information detection method provided in the corresponding embodiment, refer to Figure 5 As shown, the server 4 may include: a processor 41, a memory 42 and a communication bus 43, wherein:

[0127] The communication bus 43 is used to realize the communication connection between the processor 41 and the memory 42;

[0128] The processor 41 is used to execute the information detection program in the memory 42 to implement the following steps:

[0129] Receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client;

[0130] Generate a first key based on the first access request, and determine a correspondence between the first key and an application credential of the target application;

[0131] Receiving a second access request sent by a client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on a second key of the client and a target parameter; and the second key is generated by the client based on characteristic information of the client;

[0132] Based on the application credentials and the corresponding relationship, it is detected whether the first authentication information in the second access request has any leakage of the application credentials.

[0133] In other embodiments of the present application, the processor 41 is used to execute the information detection program in the memory 42 to generate a first key based on the first access request, so as to implement the following steps:

[0134] Obtaining feature information based on the first access request

[0135] A first key is generated based on the characteristic information.

[0136] In other embodiments of the present application, the processor 41 is used to execute the information detection program in the memory 42 before receiving the second access request sent by the client and carrying the first authentication information corresponding to the client, so as to implement the following steps:

[0137] Sending a target script to a client browser so that the client browser intercepts a second access request sent by the client browser through the target script, and adding the first authentication information to the second access request to obtain the second access request; wherein the client includes the client browser.

[0138] In other embodiments of the present application, the processor 41 is used to execute the information detection program in the memory 42 to detect whether the first authentication information in the second access request has leaked the application credentials based on the application credentials and the corresponding relationship, so as to implement the following steps:

[0139] Generate second authentication information corresponding to the server based on the application credentials, the corresponding relationship and the second access request;

[0140] Based on the second authentication information, it is detected whether the first authentication information carried in the second access request has any application credential leakage.

[0141] In other embodiments of the present application, the processor 41 is used to execute the information detection program in the memory 42 based on the application credentials, the corresponding relationship and the second access request to generate the second authentication information to implement the following steps:

[0142] Determine a first key based on the application credential and the corresponding relationship;

[0143] determining a target parameter based on the second access request;

[0144] Based on the first key and the target parameter, second authentication information is generated.

[0145] In other embodiments of the present application, the processor 41 is used to execute the information detection program in the memory 42 to detect whether the first authentication information carried in the second access request has leaked the application credentials based on the second authentication information, so as to implement the following steps:

[0146] If the first authentication information is the same as the second authentication information, it is detected that no leakage of the application credentials has occurred;

[0147] If the first authentication information is different from the second authentication information, a leakage of the application credentials is detected.

[0148] In other embodiments of the present application, the processor 41 is used to execute the information detection method of the information detection program in the memory 42 to implement the following steps:

[0149] Determine a target access request; wherein the target access request is an access request that cannot carry authentication information;

[0150] Add the target access request to the whitelist.

[0151] It should be noted that the specific description of the steps performed by the processor can be referred to Figure 1 and Figure 2 The implementation process of the information detection method provided in the corresponding embodiment will not be repeated here.

[0152] The server provided in the embodiment of the present application jointly determines whether the first authentication information has been leaked with the application credentials through the application credentials and the corresponding relationship on the server side and the first authentication information dynamically generated by the client, instead of requiring the IP geographic location or the hardware feature code collected by the client to detect whether the application credentials have been leaked as in the related art. This not only reduces the false alarm rate and thus improves the accuracy of the detection results, but also is independent of the client and can be applied to endless scenarios.

[0153] Based on the foregoing embodiments, the embodiments of the present application further provide a computer program product, including a computer program, which can be executed by the processor 41 of the server 4 to implement the steps of the above-mentioned information detection method.

[0154] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement Figure 1 , 2and 3 corresponding to the steps in the data processing method provided in the embodiment. It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0155] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0156] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0157] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0158] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An information detection method, characterized in that: Applied to the server, the method includes: Receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client; generating a first key based on the first access request, and determining a correspondence between the first key and the application credential of the target application; receiving a second access request sent by the client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on the second key of the client and target parameters; and the second key is generated by the client based on feature information of the client; Based on the application credentials and the corresponding relationship, it is detected whether the first authentication information in the second access request has leaked the application credentials.

2. The method according to claim 1, characterized in that The generating a first key based on the first access request includes: obtaining the characteristic information based on the first access request; The first key is generated based on the characteristic information.

3. The method according to claim 1, characterized in that Before receiving the second access request sent by the client and carrying the first authentication information corresponding to the client, the method further includes: Sending a target script to a client browser so that the client browser intercepts a third access request sent by the client browser through the target script, and adding the first authentication information to the third access request to obtain the first access request; wherein the client includes the client browser.

4. The method according to claim 1, characterized in that: The detecting, based on the application credentials and the corresponding relationship, whether the first authentication information in the second access request has leaked the application credentials includes: Generate second authentication information corresponding to the server based on the application credential, the corresponding relationship and the first access request; Based on the second authentication information, it is detected whether the first authentication information carried in the second access request has leaked the application credentials.

5. The method according to claim 4, characterized in that The generating second authentication information based on the application credential, the corresponding relationship and the second access request includes: Determine the first key based on the application credential and the corresponding relationship; determining the target parameter based on the second access request; The second authentication information is generated based on the first key and the target parameter.

6. The method according to claim 4, characterized in that The detecting, based on the second authentication information, whether the first authentication information carried in the second access request has leaked the application credentials includes: If the first authentication information is the same as the second authentication information, it is detected that no leakage of the application credentials has occurred; If the first authentication information is different from the second authentication information, a leakage of the application credentials is detected.

7. The method according to claim 1, characterized in that The method further comprises: Determine a target access request; wherein the target access request is an access request that cannot carry authentication information; Add the target access request to the whitelist.

8. An information detection device, characterized in that: Applied to the server, the device comprises: A receiving unit, configured to receive a first access request sent by a client to access a target application; wherein the target application is an application deployed on a zero-trust network framework; and the first access request carries information for verifying the identity of a user of the client; a generating unit, configured to generate a first key based on the first access request, and determine a correspondence between the first key and an application credential of a target application; The receiving unit is further configured to receive a second access request sent by the client and carrying first authentication information corresponding to the client; wherein the first authentication information is generated by the client based on the second key of the client and the attribute information of the client; and the second key is generated by the client based on the feature information of the client; The processing unit is used to detect whether the first authentication information in the second access request has leaked the application credentials based on the application credentials and the corresponding relationship.

9. A server, characterized in that: The server includes: a processor, a memory and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information detection program in the memory to implement the steps of the information detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the information detection method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the steps of the information detection method according to any one of claims 1 to 7.

Images