Method for defending injection attack by dynamic verification system based on configuration
Through a configuration-based dynamic verification system, real-time monitoring and intercepting parameters in interface requests, the limitations of the existing technology in defense injection attacks are solved, and high security and flexibility are achieved.
Patent Information
- Application Number
- CN202411771227.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-04
- Publication Date
- 2025-03-18
AI Technical Summary
The existing technology has limitations in defending injection attacks, static rules are difficult to deal with new types of attacks, manual encoding is expensive, error-prone, and difficult to maintain.
A dynamic verification system based on configuration is adopted, through rule configuration, rule loading and system monitoring and interception processing, a global parameter verification rule and unified parameter names and verification logic are established to monitor and intercept parameters in interface requests in real time.
It lowers the threshold for developers to implement anti-injection functions, reduces the possibility of human errors, improves the security and flexibility of the system, and can promptly detect and prevent illegal input.
Smart Images
Figure CN119652595A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network attacks, and in particular to a configuration-based dynamic verification system defense injection attack method. Background Art
[0002] In modern software development, system security and stability are crucial factors. With the continuous evolution and complexity of network attack methods, injection attacks such as SQL injection and cross-site scripting (XSS) pose a serious threat to system security. These attacks usually disrupt the normal operation of the system by inserting malicious code or commands into input fields, or even steal sensitive data. Therefore, how to effectively verify the legitimacy of system parameters and defend against injection attacks has become an urgent problem to be solved.
[0003] Traditional defense measures mainly rely on static rules and manually coded verification logic. This approach is not only costly to develop and difficult to maintain, but also prone to missing potential security risks. In addition, static rules are often powerless in the face of new attacks and cannot respond to changing attack methods in a timely manner.
[0004] Disadvantages of static rule strategy
[0005] Static rules can only identify and respond to known attack methods, which means that static rules are often powerless against unrecorded or newly emerging attack methods.
[0006] Static rules may cause false positives and false negatives during actual operation. False positives refer to the incorrect marking of legitimate, normal input as malicious attacks, which prevents legitimate users from using the system or service normally. False negatives refer to the failure to detect actual malicious input, allowing attackers to successfully invade the system.
[0007] Static rules play an important role in network security, but their own limitations make it difficult for them to independently cope with modern complex network threats. In order to improve the overall security protection capabilities, it is usually necessary to combine other security technologies and strategies to make up for the shortcomings of static rules.
[0008] Disadvantages of Manual Coding Strategies
[0009] Relying on manually coded validation and coding processes can increase development time and complexity. Developers need to invest a lot of time and effort to write and test validation logic to ensure its effectiveness and accuracy. This can lead to project schedule delays or insufficient resources.
[0010] Manually coded validation and encoding processes are prone to human error. Even experienced developers can make mistakes when writing complex validation logic, leading to security vulnerabilities. Therefore, relying solely on manual coding may not completely eliminate the possibility of all injection attacks.
[0011] Manual coding is highly invasive to the code of each system, which makes system maintenance and upgrades difficult. In addition, manual coding is prone to the problem of repeated writing of the same functional modules between different systems, which increases development costs and time consumption, and also increases the possibility of errors.
[0012] The high invasiveness of manual coding also means that any system update or function expansion requires direct modification of the existing code base. Such operations are risky and can easily introduce new errors or cause instability in existing functions. Summary of the invention
[0013] In view of the above problems, the present invention is proposed to provide a configuration-based dynamic verification system defense injection attack method that overcomes the above problems or at least partially solves the above problems.
[0014] According to one aspect of the present invention, a configuration-based dynamic verification system defense injection attack method is provided, the defense injection attack method comprising: rule configuration, rule loading and system monitoring interception processing;
[0015] The rule configuration establishes global parameter verification rules, unified parameter names, and verification logic;
[0016] The rule loading integrates the components into the system according to the integration requirements and sets the entry aspect rules executed by the system;
[0017] The system monitors interception processing. When the system receives an interface request during operation, the component intercepts the parameters based on the interception configuration, performs illegal verification processing on basic parameters, and performs personalized rule verification based on the parameter name matching verification rules.
[0018] Optionally, the establishment of global parameter verification rules, unified parameter names, and verification logic specifically include: the mobile phone number corresponds to a number with a length of 11 digits, account numbers, and unified length verification rules, and also includes basic parameter verification rules such as parameter input cannot contain injected illegal scripts.
[0019] Optionally, the rule configuration specifically includes:
[0020] Establish a global parameter verification rule base;
[0021] Define unified parameter names and validation logic;
[0022] Configure basic parameter verification rules;
[0023] Perform detailed configuration and management of all rules.
[0024] Optionally, the verification rule library includes all parameters that need to be verified and corresponding rules.
[0025] Optionally, the rule loading specifically includes:
[0026] Integrate components into the system according to integration requirements and set entry aspect rules for system execution;
[0027] When the service starts, it reads and parses the pre-configured rule file and loads the rules into memory;
[0028] After the rules are loaded, the component starts to enter the monitoring state and is ready to process the interface request;
[0029] When the system receives an interface request, it checks the parameters in the request one by one according to the preset entry aspect rules;
[0030] For each parameter, verify whether it meets the corresponding rule requirements.
[0031] Optionally, the rules include parameter types, value ranges, restrictions on required items, and validation logic for specific parameters.
[0032] Optionally, the system monitoring interception process specifically includes:
[0033] During system operation, when an interface request is received, the parameters are intercepted according to the preset interception configuration;
[0034] According to the parameter name matching verification rules, the system performs personalized rule verification to ensure that each parameter conforms to the expected format and range;
[0035] If all verifications are passed, the system will continue to execute the subsequent transaction process. If any step of the verification fails, the system will return a request error message.
[0036] Optionally, during the operation of the system, when an interface request is received, intercepting parameters according to a preset interception configuration specifically includes:
[0037] Perform illegal verification of basic parameters to prevent injection of unsafe parameters such as scripts;
[0038] The system checks whether the parameters contain malicious code or potential vulnerabilities such as SQL injection or cross-site scripting attacks (XSS).
[0039] The present invention provides a configuration-based dynamic verification system defense injection attack method, the defense injection attack method includes: rule configuration, rule loading and system monitoring interception processing; the rule configuration establishes global parameter verification rules, and unified parameter names and verification logic; the rule loading integrates components into the system according to the integration requirements, and sets the entry section rules executed by the system; the system monitoring interception processing, when the system receives an interface request during operation, the component intercepts the parameters based on the interception configuration, performs illegal verification processing on the basic parameters, and performs personalized rule verification on the parameter name matching verification rules. The configuration-based approach lowers the threshold for developers to implement the anti-injection function and reduces the possibility of human error. At the same time, the component monitors and intercepts the interface request in real time when the system is running, and can promptly detect and prevent illegal input, thereby improving the security of the system.
[0040] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0042] Figure 1 A flowchart of rule configuration provided by an embodiment of the present invention;
[0043] Figure 2 A flowchart of rule loading provided by an embodiment of the present invention;
[0044] Figure 3 A flowchart of the system monitoring interception process provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0045] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0046] The terms "comprises" and "having" and any variations thereof in the description embodiments, claims and drawings of the present invention are intended to cover non-exclusive inclusions, for example, including a series of steps or units.
[0047] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.
[0048] A configuration-based dynamic verification system injection attack defense method, comprising:
[0049] The first step is rule configuration, the second step is rule loading, and the third step is system monitoring interception processing.
[0050] Rule configuration: This step mainly involves component rule configuration. The system needs to establish global parameter verification rules, unified parameter names, verification logic, etc. For example, the length of a mobile phone number is 11 digits, and unified verification rules for account numbers, length, etc. It also includes basic parameter verification rules such as parameter input cannot contain injected illegal scripts. Configure the parameter verification rules.
[0051] Rule loading: During the development of each system, components need to be integrated into the system according to the integration requirements. Generally, it is necessary to set the entry aspect rules executed by the system to facilitate the component to monitor the parameter values passed by the interface input. When the service is started, the component will load the global rule information configured by the rule and monitor the interface request information of the application.
[0052] System monitoring interception processing: When the system is running, an interface request is received and the component intercepts the parameters based on the interception configuration. First, illegal verification of basic parameters is performed to prevent the injection of unsafe parameters such as scripts. Secondly, personalized rule verification is performed based on the parameter name matching verification rules.
[0053] like Figure 1 As shown, the rule configuration:
[0054] The component needs to establish a global parameter validation rule library. This library should contain all parameters that need to be validated and their corresponding rules. For example, for a mobile phone number, the rule is "must be 11 digits"; for an account number, the rule can be "the length must be within a specified range." In this way, it can be ensured that all modules follow the same validation logic, avoiding errors caused by inconsistencies in different modules.
[0055] Components need to define unified parameter names and validation logic. Different modules may have similar parameters, so these parameters need to be named in a standardized way and their validation logic needs to be unified. This not only helps improve the maintainability of the code, but also reduces problems caused by inconsistent parameter names or different validation logic. For example, if multiple modules need to verify the user's age, they should be named "userAge" and have unified validation logic, such as "must be greater than or equal to 18 and less than 100".
[0056] The component needs to configure basic parameter validation rules. In addition to validation rules for specific parameters, some general validation rules need to be configured to prevent illegal parameters from being passed into the system. For example, parameter input cannot contain injected illegal scripts, which is a very important security measure. By configuring these basic rules, common network attacks such as SQL injection and XSS attacks can be effectively prevented.
[0057] The component needs to configure and manage all these rules in detail. Through configuration files and visual interfaces, developers can easily add, modify, and delete rules. At the same time, it is also necessary to provide a test function to verify the rules to ensure that the configured rules can take effect correctly. Through detailed configuration and management, the robustness and security of the system are guaranteed, and the occurrence of human errors is reduced.
[0058] like Figure 2 As shown, the rules are loaded:
[0059] When developing each system, components need to be integrated into the system according to the integration requirements. Usually, it is necessary to set the entry aspect rules for system execution so that the components can monitor the parameter values passed by the interface input parameters.
[0060] When the service starts, the component will first read and parse the pre-configured rule file and load these rules into memory. These rules may include parameter types, value ranges, mandatory items and other restrictions, as well as validation logic for specific parameters. Once the rules are loaded, the component begins to enter the monitoring state and is ready to process interface requests at any time.
[0061] When the system receives an interface request, the component will check the parameters in the request one by one according to the preset entry aspect rules. For each parameter, the component will verify whether it meets the corresponding rule requirements. For example, if the rule specifies that a parameter must be a non-empty string, the component will automatically filter out all empty values or invalid inputs during the check.
[0062] To improve the scalability and maintainability of the system, rules are managed and updated through external configuration files without modifying the system source code. Developers can flexibly adjust and optimize rule configurations based on actual needs to adapt to different application scenarios and business needs.
[0063] like Figure 3 As shown, the system monitors interception processing:
[0064] When the system is running, when an interface request is received, the component will intercept the parameters according to the preset interception configuration. First, the basic parameter illegal verification process is performed to prevent the injection of unsafe parameters such as scripts. The system will check whether the parameters contain malicious code or potential vulnerabilities, such as SQL injection or cross-site scripting (XSS). The purpose of this step is to ensure that the parameters passed in will not pose a security threat to the system.
[0065] The system will perform personalized rule verification for parameter name matching verification rules. This process mainly verifies whether the parameters comply with business logic and data specifications, ensuring that each parameter meets the expected format and range.
[0066] If all checks are passed, the system will continue to execute the subsequent transaction process. If any step of the check fails, the system will return a request error message. This design can effectively filter out illegal requests and improve the stability and security of the system. At the same time, through clear verification rules and detailed error feedback, problems can be quickly located, making it easier for developers and operation and maintenance personnel to debug and optimize.
[0067] Beneficial effects:
[0068] 1. High security: Through globally unified parameter verification rules and real-time monitoring and interception processing, common injection attacks such as SQL injection and XSS attacks can be effectively prevented. This solution reduces the threshold for developers to implement anti-injection functions through a configuration-based approach, reducing the possibility of human errors. At the same time, the component monitors and intercepts interface requests in real time when the system is running, which can promptly detect and prevent illegal input, thereby improving the security of the system.
[0069] 2. Strong flexibility and maintainability: Allow application system developers to flexibly adjust verification rules according to actual needs, without modifying the core code of the framework, and only need to update the configuration file to adapt to different security needs. As business needs change, injection attack methods are also constantly evolving. This solution makes it easier to update and maintain rules in the form of configuration files.
[0070] The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A configuration-based dynamic verification system defense injection attack method, characterized in that: The injection attack defense method includes: rule configuration, rule loading and system monitoring interception processing; The rule configuration establishes global parameter verification rules, unified parameter names, and verification logic; The rule loading integrates the components into the system according to the integration requirements and sets the entry aspect rules executed by the system; The system monitors interception processing. When the system receives an interface request during operation, the component intercepts the parameters based on the interception configuration, performs illegal verification processing on basic parameters, and performs personalized rule verification based on the parameter name matching verification rules.
2. According to claim 1, a configuration-based dynamic verification system defense injection attack method is characterized in that: The establishment of global parameter verification rules, unified parameter names, and verification logic specifically include: the mobile phone number corresponds to a number with a length of 11 digits, account numbers, and unified length verification rules, and also includes basic parameter verification rules such as parameter input cannot contain injected illegal scripts.
3. According to claim 1, a configuration-based dynamic verification system defense injection attack method is characterized in that: The rule configuration specifically includes: Establish a global parameter verification rule base; Define unified parameter names and validation logic; Configure basic parameter verification rules; Perform detailed configuration and management of all rules.
4. According to claim 3, a configuration-based dynamic verification system defense injection attack method is characterized in that: The verification rule base includes all parameters that need to be verified and corresponding rules.
5. According to claim 1, a configuration-based dynamic verification system defense injection attack method is characterized in that: The rule loading specifically includes: Integrate components into the system according to integration requirements and set entry aspect rules for system execution; When the service starts, it reads and parses the pre-configured rule file and loads the rules into memory; After the rules are loaded, the component starts to enter the monitoring state and is ready to process the interface request; When the system receives an interface request, it checks the parameters in the request one by one according to the preset entry aspect rules; For each parameter, verify whether it meets the corresponding rule requirements.
6. According to claim 5, a configuration-based dynamic verification system defense injection attack method is characterized in that: The rules include parameter types, value ranges, restrictions on required items, and validation logic for specific parameters.
7. According to claim 1, a configuration-based dynamic verification system defense injection attack method is characterized in that: The system monitoring interception process specifically includes: During system operation, when an interface request is received, the parameters are intercepted according to the preset interception configuration; According to the parameter name matching verification rules, the system performs personalized rule verification to ensure that each parameter conforms to the expected format and range; If all verifications are passed, the system will continue to execute the subsequent transaction process. If any step of the verification fails, the system will return a request error message.
8. According to claim 1, a configuration-based dynamic verification system injection attack defense method is characterized in that: During the operation of the system, when an interface request is received, the parameters are intercepted according to the preset interception configuration, specifically including: Perform illegal verification of basic parameters to prevent injection of unsafe parameters such as scripts; The system checks whether the parameters contain malicious code or potential vulnerabilities such as SQL injection or cross-site scripting attacks (XSS).