A method of detecting communication security and a computing device

Abstract

Embodiments of the present application provide a communication security detection method and a computing device. In the method, in an authentication process between a first computing device and a second computing device, the first computing device obtains authentication behavior data corresponding to the second computing device. In an identity authentication stage of the authentication process, the first computing device obtains an identity authentication request sent by the second computing device; the first computing device determines, according to the authentication behavior data corresponding to the second computing device, whether an authentication behavior to which the identity authentication request belongs is an abnormal behavior; if yes, the first computing device disconnects the connection between the first computing device and the second computing device. The detection accuracy of the abnormal behavior is improved, and the detection accuracy of the communication security is improved.

Description

Technical Field

[0001] This application relates to the field of computing device technology, and in particular to a method for detecting communication security and a computing device. Background Technology

[0002] Secure Shell (SSH) is a network security protocol that uses encryption and authentication mechanisms to enable secure access and file transfer. SSH supports password-based authentication.

[0003] To improve the security of password-based authentication, the first computing device can be set to a maximum number of attempts, M. However, a second terminal device can obtain the password through brute-force attacks, resulting in a low security level in this method. Summary of the Invention

[0004] This application provides a communication security detection method and computing device, which improves the detection accuracy of abnormal behavior and thus improves the detection accuracy of communication security.

[0005] In a first aspect, embodiments of this application provide a communication security detection method, applied to a first computing device, the method comprising:

[0006] During the authentication process between the first computing device and the second computing device, the authentication behavior data corresponding to the second computing device is obtained;

[0007] During the identity authentication phase of the authentication process, the identity authentication request sent by the second computing device is obtained;

[0008] Based on the authentication behavior data corresponding to the second computing device, determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior;

[0009] If so, disconnect the connection between the first computing device and the second computing device.

[0010] In this scheme, the first computing device can obtain authentication behavior data corresponding to the second computing device during the authentication process between the first and second computing devices. The first computing device can also obtain the authentication request sent by the second computing device during the identity authentication phase of the authentication process. Based on the authentication behavior data corresponding to the second computing device, the first computing device can determine the authentication behavior to which the identity authentication request belongs. If the behavior is abnormal, the first computing device can disconnect the connection between the first and second computing devices to prevent the second computing device from brute-forcing passwords through repeated attempts. The method of this embodiment improves the detection accuracy of communication security and enhances authentication security. Furthermore, compared to related technologies that require a long time to configure firewalls to prevent malicious IP addresses from authenticating, and where computing devices may switch IP addresses to bypass firewalls, resulting in low detection accuracy of communication security, the method of this embodiment can utilize authentication behavior data reflecting the authentication behavior of the second computing device to determine whether the authentication behavior is abnormal, improving the detection accuracy of abnormal behavior and thus enhancing the detection accuracy of communication security and authentication security.

[0011] In one implementation, based on the authentication behavior data corresponding to the second computing device, it is determined whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior, including:

[0012] Query the historical anomaly database to retrieve historical anomaly data;

[0013] Determine if historical anomaly data matches authentication behavior data;

[0014] If so, then the authentication behavior is determined to be abnormal.

[0015] If not, the authentication behavior is determined based on the identity authentication result to determine whether it is an abnormal behavior; whereby the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0016] In this scheme, the first computing device can process the authentication request after receiving it, obtaining an authentication result. If the first computing device determines that the second computing device is attempting to brute-force the password by re-establishing a connection and restarting the authentication process, it can also determine that the authentication behavior is abnormal and disconnect the connection between the first and second computing devices. Alternatively, if the first computing device determines that the authentication behavior is abnormal based on the authentication result and determines that the authentication behavior is abnormal, it can also disconnect the connection between the first and second computing devices. By combining the use of authentication behavior data to determine whether an authentication behavior is abnormal with the use of the authentication result, the accuracy of abnormal behavior detection is improved, thereby enhancing the accuracy of communication security detection.

[0017] In one implementation, based on the identity authentication result, it is determined whether the authentication behavior is abnormal, including:

[0018] If the authentication result indicates that the authentication failed, the failure count is incremented by 1 to obtain the updated failure count;

[0019] Determine the number of failures after the update and whether it reaches the preset number;

[0020] If so, the authentication behavior is determined to be abnormal.

[0021] In this scheme, if the authentication result indicates authentication failure, the first computing device can increment the failure count by 1 to obtain an updated failure count. If the updated failure count reaches a preset number, the first computing device can determine that the authentication behavior is abnormal and disconnect the connection between the first and second computing devices. By using the number of authentication failures indicated by the authentication result to determine whether the authentication behavior is abnormal, the accuracy of abnormal behavior detection is improved, thereby improving the accuracy of communication security detection.

[0022] In one implementation, the method also includes:

[0023] The supplemented authentication behavior data is stored as historical anomaly data in the historical anomaly database. The supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0024] In this scheme, the first computing device can store the supplemented authentication behavior data as historical anomaly data in a historical anomaly database. By adding data to the historical anomaly database in this way, if the second computing device restarts the authentication process to attempt a brute-force password cracking, the new authentication behavior of the second computing device can be directly identified as an anomaly based on the historical anomaly data (supplemented authentication behavior data), thus improving the accuracy and efficiency of communication security detection.

[0025] In one implementation, the method also includes:

[0026] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein, the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0027] In this scheme, the second computing device can determine that the authentication behavior is not abnormal if the updated failure count does not reach the preset number, and then designate the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device. Through this method, the authentication behavior data corresponding to the second computing device can accurately and comprehensively reflect the authentication behavior of the second computing device. Therefore, when the second computing device sends a new authentication request, the first computing device can determine whether the authentication behavior is abnormal based on the supplemented authentication behavior data, improving the accuracy of abnormal behavior detection and thus improving the accuracy of communication security detection.

[0028] In one implementation, the authentication behavior data includes device identification;

[0029] Determine whether historical anomaly data matches authentication behavior data, including:

[0030] Determine whether the historical device identifier in the historical anomaly data matches the device identifier;

[0031] If so, then the historical anomaly data is matched with the authentication behavior data.

[0032] This solution can quickly determine whether an authentication behavior is abnormal by comparing the historical device identifiers in historical anomaly data with the device identifiers in authentication behavior data, thereby improving the detection speed of anomalies and thus improving the detection speed of communication security.

[0033] In one implementation, the device identifier is obtained during the connection establishment phase of the authentication process.

[0034] In this solution, the device identifier is obtained during the connection establishment phase of the authentication process, which enables the rapid acquisition of authentication behavior data.

[0035] In one implementation, the authentication behavior data includes device configuration information, which includes the version number used, the algorithm used, and the data volume of at least one response message; the method further includes:

[0036] If not, then determine whether multiple conditions are satisfied separately;

[0037] If not, then it is determined that the historical abnormal data does not match the authentication behavior data;

[0038] Several conditions include:

[0039] The historical version number in the historical anomaly data is consistent with the actual version number.

[0040] The data size of at least one historical response message in the historical anomaly data is consistent with the data size of at least one response message;

[0041] The historical algorithm used in the abnormal data is consistent with the algorithm used in the past.

[0042] In this scheme, based on the device identifier reflecting the actual configuration of the second computing device, the first computing device can further determine whether historical abnormal data matches authentication behavior data from the perspective of device configuration information. That is, it determines whether the historical device configuration information of the computing device corresponding to the historical abnormal data (the abnormal computing device) is consistent with the device configuration information of the second computing device. Therefore, if the historical device configuration information of the abnormal computing device is inconsistent with the device configuration information of the second computing device, it is determined that the first computing device and the abnormal computing device are not the same computing device, and correspondingly, the authentication behavior is determined not to be abnormal. This improves the detection accuracy of abnormal authentication behavior, thereby improving the detection accuracy of communication security and ultimately enhancing authentication security.

[0043] In one implementation,

[0044] The version number is obtained during the version number negotiation phase of the authentication process;

[0045] The algorithm used is obtained during the cryptographic algorithm negotiation phase of the authentication process;

[0046] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volumes of a third and fourth response message obtained during the key negotiation phase of the authentication process.

[0047] In this solution, the above method can be used to obtain various information from the device configuration information during the authentication process, and use the device configuration information as authentication behavior data, thus achieving fast and accurate acquisition of authentication behavior data.

[0048] In one implementation, the authentication behavior data includes the response duration of at least one response message; the method further includes:

[0049] If so, for any response message, calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message.

[0050] Calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message;

[0051] Calculate the matching coefficient based on the average duration difference rate;

[0052] If the matching coefficient reaches a preset threshold, historical abnormal data is matched with authentication behavior data.

[0053] In this scheme, the response duration of at least one response message reflects the network distance between the first and second computing devices, as well as the computation time of the second computing device. If the first computing device's configuration information matches the historical configuration information of the abnormal computing device, it can further determine whether historical abnormal data matches authentication behavior data based on a matching coefficient (which reflects the degree of matching between the response duration of at least one response message and the response duration of at least one historical response message). In other words, it determines whether the computing device corresponding to the historical abnormal data (the abnormal computing device) is the same computing device as the second computing device corresponding to the authentication behavior data. If they are determined to be the same computing device, the authentication behavior of the second computing device is identified as abnormal, and the connection between the first and second computing devices is disconnected. This improves the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security and ultimately enhancing authentication security.

[0054] In one implementation, the response duration of at least one response message includes at least one of the following:

[0055] The response duration of the first response message obtained during the version number negotiation phase of the authentication process;

[0056] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0057] The response duration of the third response message and the response duration of the fourth response message obtained during the key negotiation phase of the authentication process;

[0058] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0059] The response time of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0060] In this scheme, the response duration of at least one response message can be obtained during the authentication process. Based on the response duration of at least one response message, it can be determined whether the authentication behavior of the second computing device is abnormal, thereby improving the detection accuracy of abnormal behavior, which in turn improves the detection accuracy of communication security and thus enhances the security of authentication.

[0061] In one implementation, the device identifier includes the Internet Protocol (IP) address of the second computing device.

[0062] In this scheme, the device identifier may include the Internet Protocol (IP) address of the second computing device, so that the identifier of the second computing device can reflect the identity of the second computing device. This allows the first computing device to determine whether the authentication behavior of the second computing device is abnormal based on the IP address of the second computing device and the IP addresses of abnormal computing devices included in historical abnormal data. This improves the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security and thus improving the security of authentication.

[0063] Secondly, embodiments of this application provide a communication security detection device, applied to a first computing device, the device comprising:

[0064] The processing module is used to obtain the authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device;

[0065] The acquisition module is used to acquire the identity authentication request sent by the second computing device during the identity authentication phase of the authentication process.

[0066] The processing module is also used to determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0067] The processing module is also used to disconnect the connection between the first computing device and the second computing device if the condition is met.

[0068] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0069] In one implementation, the processing module is specifically used for:

[0070] Query the historical anomaly database to retrieve historical anomaly data;

[0071] Determine if historical anomaly data matches authentication behavior data;

[0072] If so, then the authentication behavior is determined to be abnormal.

[0073] If not, the authentication behavior is determined based on the identity authentication result to determine whether it is an abnormal behavior; whereby the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0074] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0075] In one implementation, the processing module is specifically used for:

[0076] If the authentication result indicates that the authentication failed, the failure count is incremented by 1 to obtain the updated failure count;

[0077] Determine the number of failures after the update and whether it reaches the preset number;

[0078] If so, the authentication behavior is determined to be abnormal.

[0079] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0080] In one implementation, the processing module is also used for:

[0081] The supplemented authentication behavior data is stored as historical anomaly data in the historical anomaly database. The supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0082] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0083] In one implementation, the processing module is also used for:

[0084] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein, the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0085] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0086] In one implementation, the authentication behavior data includes device identification;

[0087] The processing module is specifically used for:

[0088] Determine whether the historical device identifier in the historical anomaly data matches the device identifier;

[0089] If so, then the historical anomaly data is matched with the authentication behavior data.

[0090] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0091] In one implementation, the device identifier is obtained during the connection establishment phase of the authentication process.

[0092] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0093] In one implementation, the authentication behavior data includes device configuration information, which includes the version number used, the algorithm used, and the data volume of at least one response message; the processing module is further configured to:

[0094] If not, then determine whether multiple conditions are satisfied separately;

[0095] If not, then it is determined that the historical abnormal data does not match the authentication behavior data;

[0096] Several conditions include:

[0097] The historical version number in the historical anomaly data is consistent with the actual version number.

[0098] The data size of at least one historical response message in the historical anomaly data is consistent with the data size of at least one response message;

[0099] The historical algorithm used in the abnormal data is consistent with the algorithm used in the past.

[0100] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0101] In one implementation,

[0102] The version number is obtained during the version number negotiation phase of the authentication process;

[0103] The algorithm used is obtained during the cryptographic algorithm negotiation phase of the authentication process;

[0104] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volumes of a third and fourth response message obtained during the key negotiation phase of the authentication process.

[0105] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0106] In one implementation, the authentication behavior data includes the response duration of at least one response message; the processing module is further configured to:

[0107] If so, for any response message, calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message.

[0108] Calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message;

[0109] Calculate the matching coefficient based on the average duration difference rate;

[0110] If the matching coefficient reaches a preset threshold, historical abnormal data is matched with authentication behavior data.

[0111] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0112] In one implementation, the response duration of at least one response message includes at least one of the following:

[0113] The response duration of the first response message obtained during the version number negotiation phase of the authentication process;

[0114] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0115] The response duration of the third response message and the response duration of the fourth response message obtained during the key negotiation phase of the authentication process;

[0116] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0117] The response time of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0118] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0119] In one implementation, the device identifier includes the Internet Protocol (IP) address of the second computing device.

[0120] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0121] Thirdly, embodiments of this application provide a computing device, which includes a memory and a processor;

[0122] The memory is coupled to the processor;

[0123] Memory is used to store computer instructions;

[0124] The processor is used to execute computer instructions to enable the computing device to implement the method of the first aspect.

[0125] The computing device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0126] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of the first aspect.

[0127] When the computer-executable instructions in the computer-readable storage medium provided in this application are executed by a processor, the technical solutions shown in the above method embodiments can be implemented. The implementation principle and beneficial effects are similar, and will not be repeated here.

[0128] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, is used to implement the method of the first aspect.

[0129] When the computer program in the computer program product provided in this application is executed by a processor, it can implement the technical solution shown in the above method embodiments. The implementation principle and beneficial effects are similar, and will not be repeated here. Attached Figure Description

[0130] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0131] Figure 1 A schematic diagram illustrating an encrypted transmission scenario based on the SSH protocol, provided as an embodiment of this application;

[0132] Figure 2 A schematic diagram illustrating a scenario for a communication security detection method provided in an embodiment of this application;

[0133] Figure 3a A flowchart illustrating a communication security detection method according to an embodiment of this application;

[0134] Figure 3b A flowchart illustrating an authentication process provided in an embodiment of this application;

[0135] Figure 3c This is a schematic diagram illustrating the acquisition of authentication behavior data provided in an embodiment of this application;

[0136] Figure 4 A flowchart illustrating a second embodiment of a communication security detection method provided in this application;

[0137] Figure 5 This is a flowchart illustrating a third embodiment of a communication security detection method provided in this application.

[0138] Figure 6 A flowchart illustrating a fourth embodiment of a communication security detection method provided in this application;

[0139] Figure 7 This is a schematic diagram of the structure of a communication security detection device provided in an embodiment of this application;

[0140] Figure 8 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0141] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments made by those skilled in the art under the guidance of these embodiments are within the scope of protection of this application.

[0142] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0143] Definitions:

[0144] Transmission Control Protocol (TCP) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol, primarily used to establish reliable communication connections between two computing devices in a network.

[0145] Plaintext transmission refers to the transmission of data in an unencrypted form when sending or receiving data over a network. This means that any third party that intercepts the data can directly read or understand its content.

[0146] Encrypted transmission: Encrypted transmission is a security measure that uses encryption algorithms to convert data into ciphertext that only authorized users can decipher, thereby protecting the privacy and integrity of data during transmission over a network. This method prevents unauthorized third parties from intercepting and reading data.

[0147] Password authentication: Password authentication is a common security mechanism used to verify user identity. In this authentication process, users must provide a secret sequence of characters, known as a password, to prove they have the right to access the system or service. This method is based on the assumption that only legitimate users know the correct password.

[0148] Public key authentication: Public key authentication is an authentication mechanism based on asymmetric encryption that uses a pair of keys—a public key and a private key. In this mechanism, the public key can be securely shared publicly, while the private key must be kept secret and known only to the owner.

[0149] Brute-force attack: This is a method of decrypting and guessing passwords where the attacker tries a large number of possibilities to crack the password, encryption key, or other security mechanism. This attack does not rely on vulnerabilities or design flaws; instead, it simply tries all possible combinations until the correct answer is found.

[0150] Open Secure Shell (OpenSSH) is a free suite of tools for encrypted network communication. It implements the SSH protocol and provides secure remote login, file transfer, and network services. OpenSSH is a free and open-source implementation of the SSH protocol and is widely used in various operating systems, including Linux, macOS, and Windows.

[0151] A firewall is a network security system that monitors and controls the flow of data packets entering and leaving a computer network or system. Firewalls can be deployed as hardware, software, or a combination of both. Their primary purpose is to create a barrier to protect an internal network from unauthorized access from external networks (such as the Internet).

[0152] The following section uses the SSH protocol as an example to explain the encrypted transmission process in related technologies.

[0153] Figure 1 This is a schematic diagram illustrating a scenario of encrypted transmission based on the SSH protocol, provided as an embodiment of this application. Figure 1 As shown, Secure Shell (SSH) is a network security protocol that enables secure access and file transfer through encryption and authentication mechanisms to prevent packet sniffing software (such as sniffer) running on a second computing device from intercepting and reading data.

[0154] SSH supports multiple authentication methods, the most common being password authentication and public key authentication. Among these, password authentication is widely used due to its ease of use and lack of additional configuration.

[0155] To improve password authentication security, in related technologies, the first computing device can set a maximum number of attempts M (e.g., MaxAuthTries M) in a configuration file (e.g., the MaxAuthTries configuration item). It should be noted that M is a positive integer greater than or equal to 1; for example, M can be 3. However, a second terminal device can obtain the password through brute-force attacks, thus causing the methods in these technologies to have low security.

[0156] Based on the above-mentioned technical problems, this application provides a communication security detection method, which can obtain authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device; during the identity authentication stage of the authentication process, obtain the identity authentication request sent by the second computing device, and determine the authentication behavior to which the identity authentication request belongs based on the authentication behavior data corresponding to the second computing device. If the behavior is abnormal, disconnect the connection between the first computing device and the second computing device.

[0157] The above methods improve the accuracy of abnormal behavior detection, thereby improving the accuracy of communication security detection.

[0158] The communication security detection method of this application embodiment will be described in detail below.

[0159] Figure 2 This is a schematic diagram illustrating a scenario for a communication security detection method provided in an embodiment of this application. For example... Figure 2 As shown, the scenario includes a first computing device 10 and a second computing device 20.

[0160] The first computing device 10 can be a terminal device, a server, or a server cluster.

[0161] When the first computing device 10 is a server, from an architectural perspective, the server can be a rack server, a high-density server, a tower server, or a full rack server; from a functional perspective, the server can be a general-purpose server or an artificial intelligence server (AI server), for example, an artificial intelligence server can be an image processing server (GPU server).

[0162] When the first computing device 10 is a terminal device, the terminal device may be, but is not limited to, various personal computers, laptops, smartphones, and tablets.

[0163] The second computing device 20 can be a terminal device, a server, or a server cluster; this application embodiment does not limit this.

[0164] The first computing device 10 can run server-side software. The second computing device 20 can run client-side software.

[0165] exist Figure 2 In the scenario shown, during the authentication process between the first computing device 10 and the second computing device 20, the authentication behavior data corresponding to the second computing device 20 is obtained.

[0166] During the identity authentication phase of the authentication process, the first computing device 10 can obtain the identity authentication request sent by the second computing device 20.

[0167] The first computing device 10 can determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device 20.

[0168] If so, the first computing device 10 can disconnect the connection between the first computing device 10 and the second computing device 20.

[0169] It should be noted that, Figure 2 This is a schematic diagram of a scenario provided in an embodiment of this application. This embodiment of the application does not necessarily represent... Figure 2 The document does not limit the actual form of the various devices included, nor does it specify the form of the devices. Figure 2 The interaction methods between devices are limited, and can be set according to actual needs when applying the solution.

[0170] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0171] Figure 3a This is a schematic flowchart illustrating a communication security detection method according to an embodiment of this application. See also... Figure 3a The method specifically includes the following steps:

[0172] S301: During the authentication process between the first computing device and the second computing device, obtain the authentication behavior data corresponding to the second computing device.

[0173] Figure 3b This is a flowchart illustrating an authentication process provided in an embodiment of this application. Figure 3c This is a schematic diagram illustrating an embodiment of the present application for obtaining authentication behavior data.

[0174] First, combined Figure 3b and Figure 3cThis document describes the process by which the first computing device obtains authentication behavior data corresponding to the second computing device during the authentication process between the first and second computing devices. It should be noted that the method described in this application embodiment can be applied to the SSH authentication process, as well as to the authentication processes of other protocols; this application embodiment does not limit this application.

[0175] like Figure 3b As shown, the authentication process includes a connection establishment phase, a version number negotiation phase, an encryption algorithm negotiation phase, a key negotiation phase, and an identity authentication phase.

[0176] During the connection establishment phase of the authentication process:

[0177] (1) The first computing device can establish a TCP connection with the second computing device. Specifically, the first computing device can listen for connection requests. The second computing device can send a connection request (first handshake message) to the first computing device. The connection request may include the device identifier of the second computing device. After receiving the first handshake message, the first computing device can reply with a second handshake message. The second computing device can send a third handshake message to the first computing device. Through the above methods, the first computing device and the second computing device establish a TCP connection.

[0178] During the connection establishment phase of the authentication process, the first computing device can obtain authentication behavior data corresponding to the second computing device, wherein the authentication behavior data may include:

[0179] Device identifier; wherein, the device identifier can be the Internet Protocol (IP) address of the second computing device, and the device identifier can be the IP address and port number of the second computing device;

[0180] Connection initiation time (T) start It should be noted that the connection initiation time is the moment when the first computing device receives the connection request.

[0181] During the version number negotiation phase of the certification process:

[0182] (2) The first computing device may send a first message to the second computing device, wherein the first message includes a version number supported by the first computing device (e.g., SSH version number).

[0183] (3) In response to the first message, the second computing device may determine the version number to be used. The version number may be the same as a version number supported by the first computing device, or it may be a version number compatible with a version number supported by the first computing device. The second computing device may send a first response message to the first computing device, wherein the first response message includes the version number to be used.

[0184] (4) The first computing device can determine whether it supports the version number used by the second computing device. If not, the connection between the first computing device and the second computing device is disconnected. If yes, the version number negotiation result is determined (indicating successful version number negotiation), and a second message is sent to the second computing device. The second message includes the version number negotiation result. After sending the second message to the second computing device, the first computing device can enter the encryption algorithm negotiation phase.

[0185] During the version number negotiation phase of the authentication process, the first computing device can obtain the authentication behavior data corresponding to the second computing device, wherein the authentication behavior data may include:

[0186] Use the version number;

[0187] Response time of the first response message (T) versionA The response duration of the first response message is the time between the moment the first computing device sends the first message to the second computing device and the moment the first computing device receives the first response message.

[0188] The data size of the first response message (Bytes) versionA ).

[0189] During the encryption algorithm negotiation phase of the authentication process:

[0190] (5) After receiving the second message sent by the first computing device, the second computing device may send a second response message (e.g., SSH_MSG_KEXINIT) to the first computing device. The second response message includes algorithms supported by the second computing device. The algorithms supported by the second computing device include at least one or more of the following: key exchange algorithm, host key algorithm, symmetric encryption algorithm, message authentication algorithm, and compression algorithm.

[0191] (6) The first computing device may send a third message (e.g., SSH_MSG_KEXINIT) to the second computing device. The third message includes the algorithms supported by the first computing device.

[0192] Both the second computing device and the first computing device can determine the algorithm to use (the algorithm obtained after negotiation) based on the algorithms supported by their own end and the algorithms supported by the other end.

[0193] During the encryption algorithm negotiation phase of the authentication process, the first computing device can obtain the authentication behavior data corresponding to the second computing device, wherein the authentication behavior data may include:

[0194] Use algorithms;

[0195] Response time of the second response message (T) kexinitAThe response duration of the second response message is the time between the moment the first computing device sends the second message to the second computing device and the moment the first computing device receives the second response message.

[0196] The data size of the second response message (Bytes) kexinitA ).

[0197] During the key negotiation phase of the authentication process:

[0198] (7) The second computing device may send a third response message (e.g., SSH_MSG_KEXDH_INIT) to the first computing device. In one implementation, after receiving the third message, the second computing device may generate a temporary key pair and calculate its public key. The second computing device may generate a third response message, wherein the third response message includes the public key of the second computing device.

[0199] (8) The first computing device may send a fourth message (e.g., SSH_MSG_KEXDH_REPLY) to the second computing device. In one implementation, after receiving the third response message, the first computing device generates a temporary key pair and calculates its public key. The first computing device calculates a shared key based on the second computing device's public key and its private key. The first computing device generates its signature based on its public key, private key, and shared key, and encapsulates the signature into the fourth message.

[0200] (9) The first computing device may send a fifth message (e.g., SSH_MSG_NEWKEYS) to the second computing device after sending the fourth message, wherein the fifth message is used to indicate that the first computing device can communicate using a shared key.

[0201] (10) After receiving the fourth message sent by the first computing device, the second computing device may send a fourth response message (e.g., SSH_MSG_NEWKEYS) to the first computing device. In one implementation, after receiving the fourth message sent by the first computing device, the second computing device may use the public key of the first computing device and the private key of the second computing device to calculate a shared key. After verifying the signature of the first computing device, the second computing device may send a fourth response message (e.g., SSH_MSG_NEWKEYS) to the first computing device. The fourth response message is used to indicate that the second computing device can use the shared key for communication.

[0202] During the key negotiation phase of the authentication process, the first computing device can obtain the authentication behavior data corresponding to the second computing device, wherein the authentication behavior data may include:

[0203] Response time of the third response message (T) kexdh1A The response duration of the third response message is the time between the moment when the first computing device sends the third message (e.g., SSH_MSG_KEXINIT) to the second computing device and the moment when the first computing device receives the third response message (e.g., SSH_MSG_KEXDH_INIT).

[0204] Response time of the fourth response message (T) kexdh2A The response duration of the fourth response message is the time between the moment when the first computing device sends the fourth message (e.g., SSH_MSG_KEXDH_REPLY) to the second computing device and the moment when the first computing device receives the fourth response message (e.g., SSH_MSG_NEWKEYS).

[0205] The data size of the third and fourth response messages (in bytes) kexdhA ); where the data volume of the third response message and the fourth response message is the sum of the data volume of the third response message and the data volume of the fourth response message.

[0206] During the identity authentication phase of the authentication process:

[0207] (11) The second computing device may send a fifth response message—an authentication request—to the first computing device. The authentication request includes a password.

[0208] (12) The first computing device can perform authentication processing on the authentication request (e.g., SSH2_MSG_USERAUTH_REQUEST) and obtain the authentication result. If the authentication result indicates that the authentication failed, the first computing device can encapsulate the authentication result into authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) and send the authentication failure information to the second computing device.

[0209] (13) The second computing device may send a retry response message—a new authentication request (e.g., SSH2_MSG_USERAUTH_REQUEST)—to the first computing device based on the authentication failure information. The new authentication request includes a new password.

[0210] (14) The first computing device can perform authentication processing on the new authentication request and obtain a new authentication result. If the new authentication result indicates successful authentication, the first computing device can encapsulate the authentication result into authentication success information (e.g., SSH2_MSG_USERAUTH_SUCCESS) and send the authentication success information to the second computing device.

[0211] During the identity authentication phase of the authentication process, the first computing device can obtain authentication behavior data corresponding to the second computing device, wherein the authentication behavior data may include:

[0212] Response time of the fifth response message (T) auth1A The response duration of the fifth response message is the time between the moment when the first computing device sends the fifth message (e.g., SSH_MSG_NEWKEYS) to the second computing device and the moment when the first computing device receives the fifth response message (e.g., SSH2_MSG_USERAUTH_REQUEST).

[0213] In addition, if the first authentication fails, the first computing device can also record the response time (T) of the retry response message upon receiving a new authentication request. auth2nA The response duration of the retry response message is the time between the moment when the first computing device sends the authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) to the second computing device and the moment when the first computing device receives a new authentication request (e.g., SSH2_MSG_USERAUTH_REQUEST).

[0214] It should be noted that n refers to the nth time the second computing device sends a new authentication request, that is, n refers to the nth time the second computing device retryes the password.

[0215] Understandably, when the computing device sends a new authentication request for the nth time, the second computing device sends an authentication request for the n+1th time.

[0216] Based on the above, we can obtain the authentication behavior data table (Table 1).

[0217] Table 1 Certification Behavior Data Table

[0218]

[0219]

[0220] S302: During the identity authentication phase of the authentication process, obtain the identity authentication request sent by the second computing device.

[0221] In this embodiment, during the identity authentication phase of the authentication process, the first computing device can obtain the identity authentication request sent by the second computing device. Where password authentication is supported during the identity authentication phase, the identity authentication request may include a password used to verify the identity of the second computing device.

[0222] It should be noted that, in one implementation, the authentication request is sent by the second computing device in response to the fifth message (e.g., SSH_MSG_NEWKEYS) sent by the first computing device.

[0223] In one implementation, the authentication request is sent by the second computing device in response to the authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) sent by the first computing device.

[0224] S303: Based on the authentication behavior data corresponding to the second computing device, determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior.

[0225] In this embodiment, all actions of the second computing device during an authentication process are considered authentication actions.

[0226] During the authentication process, the data corresponding to the authentication actions is called authentication action data.

[0227] Authentication behavior data may include at least one of the following:

[0228] Equipment identification;

[0229] Equipment configuration information;

[0230] The response time of at least one response message.

[0231] In one implementation, the authentication behavior data may also include the connection initiation time.

[0232] It should be noted that the response duration of at least one response message may include at least one of the following: the response duration of the first response message, the response duration of the second response message, the response duration of the third response message, the response duration of the fourth response message, the response duration of the fifth response message, and the response duration of the retry response message (at least one retry response duration). It should also be noted that the response duration of at least one response message may reflect the network distance between the first and second computing devices, and the computation time consumed by the second computing device.

[0233] It should be noted that the device configuration information may include the version number used, the algorithm used, and the data volume of at least one response message. It should also be noted that the data volume of at least one response message may include at least one of the following: the data volume of the first response message, the data volume of the second response message, and the data volumes of the third and fourth response messages (the sum of the data volumes of the third and fourth response messages). Furthermore, it should be noted that the data volume of at least one response message is related to the configuration of the second computing device. Finally, it should be noted that the device configuration information of different computing devices may be the same or different.

[0234] When the first computing device receives an authentication request, it can determine whether the authentication behavior to which the authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0235] If so, then execute S304.

[0236] If not, then execute S305.

[0237] The following section explains the process by which the first computing device determines whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0238] In one implementation:

[0239] The first computing device can query the historical anomaly database to obtain historical anomaly data.

[0240] The first computing device can determine whether historical anomaly data matches authentication behavior data.

[0241] If so, the first computing device can determine that the authentication behavior is abnormal.

[0242] If not, the first computing device can determine whether the authentication behavior is abnormal based on the authentication result. It should be noted that the authentication result is obtained by the first computing device through the authentication processing of the authentication request. The authentication result can indicate successful authentication or authentication failure.

[0243] The following explains why the first computing device can determine that the authentication behavior is abnormal when it matches the historical abnormal data.

[0244] If the second computing device attempts to brute-force the password through repeated attempts, then the device configuration information of the second computing device, as well as the response time of the response message (the response time is affected by the network distance between the first and second computing devices and the computation time of the second computing device), remain fixed. Furthermore, if the second computing device does not change its IP address, its IP address remains fixed.

[0245] In other words, the authentication behavior data of the second computing device remains constant. Therefore, the first computing device can determine that the computing device corresponding to the historical abnormal data is the same as the second computing device, provided that the historical abnormal data matches the authentication behavior data (including at least one of the following: device identifier, device configuration information, and the response duration of at least one response message). Since the historical abnormal data corresponds to abnormal behavior, the authentication behavior of the second computing device is accordingly abnormal.

[0246] S304: Disconnect the first computing device from the second computing device.

[0247] In this embodiment, the first computing device can disconnect the connection between the first computing device and the second computing device if it determines that the authentication behavior is abnormal.

[0248] S305: Send the authentication result to the second computing device.

[0249] In this embodiment, the first computing device can send an authentication result to the second computing device if the authentication behavior is determined to be normal. The authentication result can indicate successful authentication or authentication failure.

[0250] It should be noted that the identity authentication result is obtained by the first computing device performing identity authentication processing on the identity authentication request.

[0251] It should also be noted that the first computing device can first determine whether the authentication behavior is abnormal based on the authentication behavior data, and then determine the identity authentication result. Alternatively, the first computing device can first determine the identity authentication result, and then determine whether the authentication behavior is abnormal based on the authentication behavior data. Or, the first computing device can simultaneously determine the identity authentication result and the authentication behavior data to determine whether the authentication behavior is abnormal. This application embodiment does not limit this approach.

[0252] The following describes the process by which the first computing device processes an identity authentication request.

[0253] In one implementation, the first computing device can determine whether the password in the authentication request matches the password stored in the first computing device. If yes, the first computing device can determine that the authentication result indicates successful authentication; if no, the first computing device can determine that the authentication result indicates failed authentication.

[0254] It should be noted that if the authentication result indicates successful authentication, the first computing device can encapsulate the authentication result into authentication success information (e.g., SSH2_MSG_USERAUTH_SUCCESS) and send the authentication success information to the second computing device.

[0255] If the authentication result indicates authentication failure, the first computing device can encapsulate the authentication result into authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) and send the authentication failure information to the second computing device.

[0256] The beneficial effects of this embodiment are as follows: In this embodiment, the first computing device can obtain authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device. The first computing device can obtain the identity authentication request sent by the second computing device during the identity authentication phase of the authentication process. Based on the authentication behavior data corresponding to the second computing device, the first computing device can determine the authentication behavior to which the identity authentication request belongs. If the authentication behavior is abnormal, the first computing device can disconnect the connection between the first computing device and the second computing device to prevent the second computing device from brute-forcing passwords through continuous attempts. The method of this embodiment improves the detection accuracy of communication security and enhances authentication security. Furthermore, compared to related technologies that require a long time to configure firewalls to prevent malicious IP addresses from authenticating, and where computing devices may switch IP addresses to bypass firewalls, resulting in low detection accuracy of communication security, the method of this embodiment can utilize authentication behavior data reflecting the authentication behavior of the second computing device to determine whether the authentication behavior is abnormal, improving the detection accuracy of abnormal behavior and thus improving the detection accuracy of communication security and enhancing authentication security.

[0257] Figure 4 This is a flowchart illustrating a second embodiment of a communication security detection method provided in this application. See also... Figure 4 The method specifically includes the following steps:

[0258] S401: During the authentication process between the first computing device and the second computing device, obtain the authentication behavior data corresponding to the second computing device.

[0259] In this embodiment, during the authentication process between the first computing device and the second computing device, the first computing device can obtain the authentication behavior data corresponding to the second computing device.

[0260] The specific implementation process is the same as that of S301, and will not be described in detail here.

[0261] S402: During the identity authentication phase of the authentication process, obtain the identity authentication request sent by the second computing device.

[0262] In this embodiment, during the identity authentication phase of the authentication process, the first computing device can obtain the identity authentication request sent by the second computing device.

[0263] The authentication request may include a password.

[0264] S403: Query the historical anomaly database to retrieve historical anomaly data.

[0265] In this embodiment, at least one piece of historical abnormal data is stored in the historical abnormal database (also known as the abnormal behavior record database).

[0266] The first computing device can query the historical anomaly database to obtain historical anomaly data. It should be noted that, in one implementation, the first computing device can run the historical anomaly database directly. Alternatively, other computing devices in the computing device cluster can run the historical anomaly data, and the first computing device can query the historical anomaly database to obtain historical anomaly data through communication with other computing devices.

[0267] In one implementation, the first computing device can acquire all historical anomaly data from the historical anomaly database. It should be noted that, in one implementation, each piece of historical anomaly data may include the historical connection initiation time, and the first computing device can periodically delete target historical anomaly data. Specifically, target historical anomaly data refers to historical anomaly data where the time interval between the historical connection initiation time and the current time is greater than a first preset time interval.

[0268] In one implementation, each piece of historical anomaly data may include the historical connection initiation time, and the authentication behavior data may include the connection initiation time. The first computing device can obtain historical anomaly data from the historical anomaly database whose time interval between the historical connection initiation time and the connection initiation time is less than a second preset time interval.

[0269] The following section uses the historical anomaly database of the first computing device as an example to explain the process of establishing the historical anomaly database of the first computing device.

[0270] For any historical computing device, the first computing device can obtain the authentication behavior data corresponding to that historical computing device during the authentication process between the first computing device and the historical computing device. During the identity authentication phase, the first computing device can obtain the identity authentication request sent by the historical computing device. If the identity authentication result corresponding to the identity authentication request indicates authentication failure, the first computing device can increment the failure count by 1 to obtain the updated failure count. Additionally, if the identity authentication result corresponding to the identity authentication request indicates authentication failure, the first computing device can supplement the authentication behavior data based on the response time of the identity authentication request to obtain supplemented authentication behavior data. The first computing device can determine whether the updated failure count has reached a preset number. If the first computing device determines that the updated failure count has reached the preset number, it can store the supplemented authentication behavior data as historical anomaly data in a historical anomaly database.

[0271] It should be noted that the historical computing device can be the same computing device as the second computing device, or they can be different computing devices.

[0272] S404: Determine whether historical anomalous data matches authentication behavior data.

[0273] In this embodiment, the first computing device can determine whether the historical abnormal data matches the authentication behavior data after acquiring the historical abnormal data.

[0274] If so, then execute S405.

[0275] If not, then execute S406;

[0276] It should be noted that, in one implementation, when the first computing device acquires multiple historical anomaly data, the first computing device can determine whether at least one of the historical anomaly data matches the authentication behavior data. If yes, then S405 is executed; if no, then S406 is executed.

[0277] The following section explains the process by which the first computing device determines whether historical abnormal data matches authentication behavior data.

[0278] In one implementation:

[0279] When the authentication behavior data includes a device identifier, the first computing device can determine whether the historical device identifier in the historical anomaly data is consistent with the device identifier.

[0280] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0281] If not, the first computing device can determine that the historical anomaly data does not match the authentication behavior data.

[0282] In one implementation:

[0283] When the authentication behavior data includes device configuration information, the first computing device can determine whether multiple conditions are met respectively. The device configuration information includes the version number used, the algorithm used, and the data volume of at least one response message.

[0284] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0285] If not, the first computing device can determine that the historical anomaly data does not match the authentication behavior data.

[0286] Several of the conditions include:

[0287] The historical version number in the historical anomaly data is consistent with the actual version number.

[0288] The data size of at least one historical response message in the historical anomaly data is consistent with the data size of at least one response message;

[0289] The historical algorithm used in the abnormal data is consistent with the algorithm used in the past.

[0290] In one implementation:

[0291] When the authentication behavior data includes the response duration of at least one response message, for any response message, the first computing device can calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message.

[0292] The first computing device can calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message. The first computing device can then calculate the matching coefficient based on the average duration difference rate.

[0293] The first computing device can determine whether the matching coefficient has reached a preset threshold.

[0294] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0295] If not, the first computing device can determine that the historical anomaly data does not match the authentication behavior data.

[0296] In one implementation:

[0297] When the authentication behavior data includes device identifier, device configuration information, and the response duration of at least one response message, the first computing device can determine whether the historical device identifier in the historical anomaly data is consistent with the device identifier.

[0298] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0299] If not, the first computing device can determine whether multiple conditions are met individually. If not, it is determined that the historical anomaly data and authentication behavior data do not match; if so, for any response message, the first computing device can calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message. The first computing device can calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message. The first computing device can calculate the matching coefficient based on the average duration difference rate. The first computing device can determine that the historical anomaly data and authentication behavior data match if the matching coefficient reaches a preset threshold.

[0300] In one implementation:

[0301] When the authentication behavior data includes device identifier, device configuration information, and the response duration of at least one response message, the first computing device can determine whether the historical device identifier in the historical anomaly data is consistent with the device identifier.

[0302] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0303] If not, for any response message, the first computing device can calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to a historical response message. The first computing device can calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message. The first computing device can calculate the matching coefficient based on the average duration difference rate.

[0304] The first computing device can determine whether the matching coefficient has reached a preset threshold.

[0305] If not, the first computing device can determine that the historical anomaly data does not match the authentication behavior data.

[0306] If yes, the first computing device can determine whether multiple conditions are met individually. If yes, it determines that the historical anomaly data matches the authentication behavior data; if not, the first computing device can determine that the historical anomaly data does not match the authentication behavior data.

[0307] S405: The authentication behavior has been determined to be abnormal.

[0308] In this embodiment, the first computing device can determine that the authentication behavior is abnormal if it finds that the historical abnormal data matches the authentication behavior data.

[0309] The first computing device can execute S407 after executing S405.

[0310] S406: Based on the identity authentication result, determine whether the authentication behavior is abnormal.

[0311] In this embodiment, the first computing device can determine whether the authentication behavior is abnormal based on the identity authentication result if it is determined that the historical abnormal data and the authentication behavior data do not match.

[0312] If so, then execute S407.

[0313] If not, then execute S408.

[0314] The following section explains the process by which the first computing device determines whether the authentication behavior is abnormal based on the identity authentication result.

[0315] In one implementation:

[0316] The first computing device can increment the failure count by 1 if the authentication result indicates that the authentication has failed, thus obtaining an updated failure count.

[0317] The first computing device can determine whether the number of failures after the update has reached the preset number.

[0318] If so, the first computing device can determine that the authentication behavior is abnormal. In other words, if the number of failed attempts after the update reaches a preset number, the first computing device can determine that the second computing device is a brute-force password-breaking device, and the first computing device can determine that the authentication behavior of the second computing device is abnormal.

[0319] If not, the first computing device can determine that the authentication behavior is not abnormal.

[0320] S407: Disconnect the first computing device from the second computing device.

[0321] In this embodiment, the first computing device can disconnect the connection between the first computing device and the second computing device if it determines that the authentication behavior is abnormal.

[0322] S408: Send the authentication result to the second computing device.

[0323] In this embodiment, the first computing device may send an authentication result to the second computing device if it determines that the authentication behavior is not abnormal. The authentication result may indicate successful authentication or authentication failure.

[0324] The beneficial effects of this embodiment are as follows: In this embodiment, the first computing device can perform identity authentication processing on the identity authentication request after obtaining it, and obtain an identity authentication result. If the first computing device determines that the second computing device is a device that is brute-forcing the password by re-establishing a connection to restart the SSH authentication process, it can determine that the authentication behavior is abnormal and disconnect the connection between the first and second computing devices. If the first computing device determines that the authentication behavior is abnormal based on the identity authentication result, it can also disconnect the connection between the first and second computing devices if the historical abnormal data and authentication behavior data do not match. By combining the determination of whether an authentication behavior is abnormal using authentication behavior data with the determination of whether an authentication behavior is abnormal using the identity authentication result, the accuracy of abnormal behavior detection is improved, thereby improving the accuracy of communication security detection.

[0325] Figure 5 This is a flowchart illustrating a third embodiment of a communication security detection method provided in this application. See also... Figure 5 The method specifically includes the following steps:

[0326] S501: During the authentication process between the first computing device and the second computing device, obtain the authentication behavior data corresponding to the second computing device.

[0327] In this embodiment, during the authentication process between the first computing device and the second computing device, the first computing device can obtain the authentication behavior data corresponding to the second computing device.

[0328] The specific implementation process is the same as that of S301, and will not be described in detail here.

[0329] S502: During the identity authentication phase of the authentication process, obtain the identity authentication request sent by the second computing device.

[0330] In this embodiment, during the identity authentication phase of the authentication process, the first computing device can obtain the identity authentication request sent by the second computing device.

[0331] The authentication request may include a password used to verify the identity of the second computing device.

[0332] S503: Query the historical anomaly database to obtain historical anomaly data.

[0333] In this embodiment, the first computing device can query the historical anomaly database to obtain historical anomaly data.

[0334] S504: Determine whether historical anomalous data matches authentication behavior data.

[0335] In this embodiment, the first computing device can acquire historical abnormal data.

[0336] The first computing device can determine whether historical anomaly data matches authentication behavior data.

[0337] If so, then execute S505.

[0338] If not, then execute S506;

[0339] S505: The authentication behavior has been determined to be abnormal.

[0340] In this embodiment, the first computing device can determine that the authentication behavior is abnormal if it finds that the historical abnormal data matches the authentication behavior data.

[0341] The first computing device can execute S510 after executing S505.

[0342] S506: If the authentication result indicates that the authentication failed, increment the failure count by 1 to obtain the updated failure count.

[0343] In this embodiment, the first computing device can determine the identity authentication result and indicate whether authentication has failed if it finds that the historical abnormal data does not match the authentication behavior data.

[0344] The first computing device can increment the failure count by 1 if the authentication result indicates that the authentication has failed, thus obtaining an updated failure count.

[0345] S507: Determine the number of failures after the update and whether the preset number has been reached.

[0346] In this embodiment, the first computing device can determine whether the updated number of failures has reached a preset number.

[0347] If so, then execute S508;

[0348] If not, then execute S511.

[0349] S508: The authentication behavior is determined to be abnormal.

[0350] In this embodiment, the first computing device can determine that the authentication behavior is abnormal if the number of failures after the update reaches a preset number.

[0351] S509: Store the supplemented authentication behavior data as historical anomaly data in the historical anomaly database.

[0352] In this embodiment, if the number of failures after the update is determined to be a preset number, the first computing device may also store the supplemented authentication behavior data as historical anomaly data in the historical anomaly database.

[0353] It should be noted that the supplemented authentication behavior data is obtained by the first computing device supplementing the authentication behavior data based on the response time of the authentication request when the authentication result indicates that the authentication has failed.

[0354] The following describes the process by which the first computing device supplements the authentication behavior data based on the response time of the identity authentication request to obtain the supplemented authentication behavior data.

[0355] The first computing device can obtain the response time of the authentication request.

[0356] In one implementation, when an authentication request is a response message (fifth response message) sent by the second computing device in response to receiving a fifth message (e.g., SSH_MSG_NEWKEYS) sent by the first computing device, the first computing device can determine the response duration of the authentication request based on the time when the first computing device sends the fifth message and the time when the first computing device receives the authentication request (fifth response message).

[0357] In one implementation, when an authentication request is sent by the second computing device in response to receiving authentication failure information (e.g., SSH2_MSG_USERAUTH_FAILURE) from the first computing device, the first computing device can determine the response duration of the authentication request based on the time when the first computing device sent the authentication failure message and the time when the first computing device received the authentication request (retry response message).

[0358] The first computing device can supplement the authentication behavior data during the response time of obtaining the identity authentication request to obtain supplemented authentication behavior data.

[0359] The following explains why the first computing device stores the supplemented authentication behavior data as historical anomaly data in the historical anomaly database.

[0360] During the new authentication process, when the first computing device receives a new authentication request from the second computing device, it can query the historical anomaly database to obtain historical anomaly data (supplemented authentication behavior data). The first computing device can determine whether the historical anomaly data (supplemented authentication behavior data) matches the corresponding authentication behavior data of the second computing device (the data corresponding to the new authentication behavior in the new authentication process). If so, the first computing device can directly determine that the new authentication behavior (the authentication behavior to which the new authentication request belongs) is an anomaly. The first computing device can then disconnect from the second computing device.

[0361] By employing the above methods, the method of restarting the authentication process and re-authenticating the user can be avoided, thus preventing brute-force password cracking. This improves the accuracy of communication security detection and enhances the security of the authentication process.

[0362] S510: Disconnect the first computing device from the second computing device.

[0363] In this embodiment, the first computing device can disconnect the connection between the first computing device and the second computing device if it determines that the authentication behavior is abnormal.

[0364] It should be noted that the first computing device may execute S509 first and then S510, or it may execute S510 first and then S509, or it may execute S509 and S510 simultaneously. This application embodiment does not limit the execution order of S509 and S510.

[0365] S511: Determine that the authentication behavior is not abnormal.

[0366] In this embodiment, the first computing device can determine that the authentication behavior is not abnormal if the number of failures after the update has not reached the preset number.

[0367] S512: The supplemented authentication behavior data is determined as the authentication behavior data corresponding to the second computing device.

[0368] In this embodiment, the first computing device may also determine the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device if the number of failures after the update has not reached the preset number.

[0369] It should be noted that when the first computing device receives a new authentication request from the second computing device, it can query the historical anomaly database to retrieve historical anomaly data. The first computing device can determine whether the historical anomaly data matches the corresponding authentication behavior data (supplemented authentication behavior data) of the second computing device. If so, the first computing device can directly determine that the authentication behavior is an anomaly. The first computing device can then disconnect from the second computing device.

[0370] It should also be noted that the supplemented authentication behavior data is obtained by supplementing the authentication behavior data based on the response time of the authentication request when the authentication result indicates that the authentication has failed.

[0371] S513: Send the authentication result to the second computing device.

[0372] In this embodiment, the first computing device can send an authentication result to the second computing device if the updated number of failures has not been reached. The authentication result can indicate successful authentication or authentication failure.

[0373] It should be noted that the first computing device may execute S512 first and then S513, or it may execute S513 first and then S512, or it may execute S512 and S513 simultaneously. This application embodiment does not limit the execution order of S512 and S513.

[0374] The beneficial effects of this embodiment are as follows: When the authentication result indicates authentication failure, the first computing device can increment the failure count by 1 to obtain an updated failure count. If the updated failure count reaches a preset number, the first computing device can determine that the authentication behavior is abnormal and disconnect the connection between the first and second computing devices. The first computing device can also store the supplemented authentication behavior data as historical abnormal data in a historical abnormal database. Through the above method, the historical abnormal database can be updated, so that if the second computing device restarts the authentication process to attempt a brute-force password cracking, the new authentication behavior of the second computing device can be directly determined as abnormal based on the historical abnormal data (supplemented authentication behavior data), improving the accuracy and efficiency of communication security detection. Furthermore, if the updated failure count does not reach a preset number, the second computing device can determine that the authentication behavior is not abnormal and identify the supplemented authentication behavior data as the authentication behavior data corresponding to the second computing device. By using the above method, the authentication behavior data corresponding to the second computing device can accurately and comprehensively reflect the authentication behavior of the second computing device. Therefore, when the second computing device sends a new identity authentication request, the first computing device can determine whether the authentication behavior is abnormal based on the authentication behavior data (the supplemented authentication behavior data), thereby improving the detection accuracy of abnormal behavior and thus improving the detection accuracy of communication security.

[0375] Building upon the technology of Embodiment 2, the following describes, through Method Embodiment 4, the process by which the second computing device determines whether historical abnormal data matches authentication behavior data. It is understood that Method Embodiment 4 is a description of one implementation of S404 of Method Embodiment 2.

[0376] Figure 6 This is a flowchart illustrating a fourth embodiment of a communication security detection method provided in this application. See also... Figure 6 The method specifically includes the following steps:

[0377] S601: Determine whether the historical device identifier in the historical abnormal data is consistent with the device identifier.

[0378] In this embodiment, the authentication behavior data includes the device identifier. It should be noted that the device identifier is obtained during the connection establishment phase of the authentication process.

[0379] The first computing device can determine whether the historical device identifier in the historical abnormal data is consistent with the device identifier.

[0380] If so, then execute S602;

[0381] If not, then execute S603.

[0382] S602: Determine the match between historical abnormal data and authentication behavior data.

[0383] In this embodiment, the first computing device can determine that the historical abnormal data matches the authentication behavior data if the historical device identifier in the historical abnormal data is consistent with the device identifier.

[0384] S603: Determine whether multiple conditions are satisfied individually.

[0385] In this embodiment, the authentication behavior data includes device configuration information. This device configuration information includes the version number used, the algorithm used, and the data volume of at least one response message.

[0386] Historical anomaly data includes historical device configuration information. This information includes the historical version number, the historical algorithm used, and the data volume of at least one historical response message.

[0387] It should be noted that the version number is obtained during the version number negotiation phase of the certification process.

[0388] The algorithm used is obtained during the cryptographic algorithm negotiation phase of the authentication process.

[0389] At least one response message includes at least one of the following data types:

[0390] The amount of data in the first response message obtained during the version number negotiation phase of the authentication process;

[0391] The amount of data in the second response message obtained during the cryptographic algorithm negotiation phase of the authentication process;

[0392] The amount of data obtained in the third and fourth response messages during the key negotiation phase of the authentication process.

[0393] The first computing device can determine whether multiple conditions are met if the historical device identifier in the historical abnormal data is inconsistent with the device identifier.

[0394] Several of the conditions include:

[0395] The historical version number negotiation result in the historical abnormal data is consistent with the version number negotiation result.

[0396] The data size of at least one historical response message in the historical anomaly data is consistent with the data size of at least one response message;

[0397] The historical algorithm negotiation results in the historical abnormal data are consistent with the algorithm negotiation results.

[0398] If not, then execute S604;

[0399] If so, then execute S605.

[0400] S604: It has been determined that there is a mismatch between historical abnormal data and authentication behavior data.

[0401] In this embodiment, the first computing device can determine that the historical abnormal data does not match the authentication behavior data if at least one condition is not met, that is, if the device configuration information in the authentication behavior data is inconsistent with the historical device configuration information in the historical abnormal data.

[0402] S605: For any response message, calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data.

[0403] S606: Calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message.

[0404] S607: Calculate the matching coefficient based on the average duration difference rate.

[0405] In this embodiment, the authentication behavior data includes the response duration of at least one response message.

[0406] Historical anomaly data includes the response time of at least one historical response message.

[0407] It should be noted that the response duration of at least one response message includes at least one of the following:

[0408] The response duration of the first response message obtained during the version number negotiation phase of the authentication process;

[0409] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0410] The response duration of the third response message and the response duration of the fourth response message obtained during the key negotiation phase of the authentication process;

[0411] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0412] The response time of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0413] The first computing device can, under the condition that multiple conditions are met, calculate the duration difference rate corresponding to any response message based on the response duration of the response message and the response duration of historical response messages in historical anomaly data. Here, the response message corresponds to a historical response message.

[0414] The first computing device can calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message.

[0415] The first computing device can calculate the matching coefficient based on the average duration difference rate.

[0416] The process of calculating the matching coefficient by the first computing device will be explained below.

[0417] The first computing device can calculate the matching coefficient using the following formula:

[0418]

[0419]

[0420] Where P is the matching coefficient; N is the number of retry response messages sent by the first computing device (new authentication requests resent by the second computing device); T versionA T is the response time for the first response message. versionB A1 represents the response time of the first response message in history; A1 represents the time difference rate corresponding to the first response message; T kexinitA T is the response time for the second response message. kexinitB A1 represents the response time of the second response message in history; A2 represents the time difference rate corresponding to the second response message; T represents the response time of the second response message in history. kexdh1A The response time for the third response message; T kexdh1B A3 represents the response time of historical third-response messages; A3 represents the time difference rate corresponding to the third-response messages; T kexdh2A T represents the response time for the fourth response message. kexdh2B A4 represents the response time of the historical fourth response message; T represents the time difference rate corresponding to the fourth response message; auth1A T is the response time for the fifth response message. auth1B A5 represents the response time of the fifth response message in history; A5 represents the time difference rate corresponding to the fifth response message; T auth2nA The response duration for the retry response message; T auth2nB A1 represents the response time of historical retry response messages; A2 represents the sum of the time difference rates corresponding to at least one retry response message.

[0421] S608: If the matching coefficient reaches a preset threshold, determine the matching between historical abnormal data and authentication behavior data.

[0422] In this embodiment, the first computing device can determine whether the matching coefficient reaches a preset threshold after obtaining the matching coefficient. For example, the preset threshold can be 0.95.

[0423] If so, the first computing device can determine that the historical anomaly data matches the authentication behavior data.

[0424] The beneficial effects of this embodiment are as follows: In this embodiment, the first computing device can determine whether historical abnormal data matches authentication behavior data from the perspectives of device identifier, device configuration information (reflecting the actual configuration of the second computing device), and the response time of at least one response message (reflecting the network distance between the first and second computing devices and the computation time of the second computing device). That is, it determines whether the computing device corresponding to the historical abnormal data (the abnormal computing device) is the same computing device as the second computing device corresponding to the authentication behavior data. Then, if it is determined that the two are the same computing device, the authentication behavior of the second computing device is identified as abnormal behavior, and the connection between the first and second computing devices is disconnected, which improves the detection accuracy of abnormal behavior, thereby improving the detection accuracy of communication security, and thus improving the security of authentication (such as SSH authentication).

[0425] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0426] Figure 7 This is a schematic diagram of a communication security detection device provided in an embodiment of this application. The communication security detection device 70 is applied to a first computing device.

[0427] like Figure 7 As shown, the communication security detection device 70 includes a processing module 71 and an acquisition module 72. Among them,

[0428] Processing module 71 is used to obtain authentication behavior data corresponding to the second computing device during the authentication process between the first computing device and the second computing device;

[0429] The acquisition module 72 is used to acquire the identity authentication request sent by the second computing device during the identity authentication phase of the authentication process;

[0430] The processing module 71 is also used to determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device.

[0431] The processing module 71 is also used to disconnect the connection between the first computing device and the second computing device if the condition is met.

[0432] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0433] In one implementation, processing module 71 is specifically used for:

[0434] Query the historical anomaly database to retrieve historical anomaly data;

[0435] Determine if historical anomaly data matches authentication behavior data;

[0436] If so, then the authentication behavior is determined to be abnormal.

[0437] If not, the authentication behavior is determined based on the identity authentication result to determine whether it is an abnormal behavior; whereby the identity authentication result is obtained by performing identity authentication processing on the identity authentication request.

[0438] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0439] In one implementation, processing module 71 is specifically used for:

[0440] If the authentication result indicates that the authentication failed, the failure count is incremented by 1 to obtain the updated failure count;

[0441] Determine the number of failures after the update and whether it reaches the preset number;

[0442] If so, the authentication behavior is determined to be abnormal.

[0443] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0444] In one implementation, the processing module 71 is further configured to:

[0445] The supplemented authentication behavior data is stored as historical anomaly data in the historical anomaly database. The supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0446] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0447] In one implementation, the processing module 71 is further configured to:

[0448] If not, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein, the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

[0449] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0450] In one implementation, the authentication behavior data includes device identification;

[0451] Processing module 71 is specifically used for:

[0452] Determine whether the historical device identifier in the historical anomaly data matches the device identifier;

[0453] If so, then the historical anomaly data is matched with the authentication behavior data.

[0454] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0455] In one implementation, the device identifier is obtained during the connection establishment phase of the authentication process.

[0456] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0457] In one implementation, the authentication behavior data includes device configuration information, which includes the version number used, the algorithm used, and the data volume of at least one response message; the processing module 71 is further configured to:

[0458] If not, then determine whether multiple conditions are satisfied separately;

[0459] If not, then it is determined that the historical abnormal data does not match the authentication behavior data;

[0460] Several conditions include:

[0461] The historical version number in the historical anomaly data is consistent with the actual version number.

[0462] The data size of at least one historical response message in the historical anomaly data is consistent with the data size of at least one response message;

[0463] The historical algorithm used in the abnormal data is consistent with the algorithm used in the past.

[0464] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0465] In one implementation,

[0466] The version number is obtained during the version number negotiation phase of the authentication process;

[0467] The algorithm used is obtained during the cryptographic algorithm negotiation phase of the authentication process;

[0468] The data volume of at least one response message includes at least one of the following: the data volume of a first response message obtained during the version number negotiation phase of the authentication process, the data volume of a second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volumes of a third and fourth response message obtained during the key negotiation phase of the authentication process.

[0469] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0470] In one implementation, the authentication behavior data includes the response duration of at least one response message; the processing module 71 is further configured to:

[0471] If so, for any response message, calculate the duration difference rate corresponding to the response message based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message.

[0472] Calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message;

[0473] Calculate the matching coefficient based on the average duration difference rate;

[0474] If the matching coefficient reaches a preset threshold, historical abnormal data is matched with authentication behavior data.

[0475] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0476] In one implementation, the response duration of at least one response message includes at least one of the following:

[0477] The response duration of the first response message obtained during the version number negotiation phase of the authentication process;

[0478] The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process;

[0479] The response duration of the third response message and the response duration of the fourth response message obtained during the key negotiation phase of the authentication process;

[0480] The response time of the fifth response message obtained during the identity authentication phase of the authentication process;

[0481] The response time of at least one retry response message obtained during the identity authentication phase of the authentication process.

[0482] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0483] In one implementation, the device identifier includes the Internet Protocol (IP) address of the second computing device.

[0484] The communication security detection device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0485] Figure 8 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Figure 8 As shown, the computing device 80 includes a processor 81 and a memory 82; wherein the processor 81 is coupled to the memory 82, and the memory 82 is used to store computer instructions; the processor 81 is used to execute the computer instructions to cause the computing device 80 to perform the technical solutions in the aforementioned method embodiments.

[0486] Optionally, the memory 82 can be either standalone or integrated with the processor 81. Optionally, when the memory 82 is a device independent of the processor 81, the first computing device 80 may further include a bus 83 for connecting the aforementioned devices.

[0487] The processor is used to execute the technical solutions in the aforementioned method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0488] This application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the technical solutions provided in the aforementioned method embodiments.

[0489] This application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement the technical solutions provided in the aforementioned method embodiments.

[0490] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as volatile memory and non-volatile memory.

[0491] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting communication security, characterized in that, Applied to a first computing device, the method includes: During the authentication process between the first computing device and the second computing device, authentication behavior data corresponding to the second computing device is obtained. The authentication behavior data includes device identifier and device configuration information. The device configuration information includes the version number used, the algorithm used, and the data volume of at least one response message. During the identity authentication phase of the authentication process, the identity authentication request sent by the second computing device is obtained; Based on the authentication behavior data corresponding to the second computing device, determine whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior; If abnormal behavior is determined, disconnect the first computing device from the second computing device; The step of determining whether the authentication behavior to which the identity authentication request belongs is an abnormal behavior based on the authentication behavior data corresponding to the second computing device includes: Query the historical anomaly database to retrieve historical anomaly data; Determine whether the historical device identifier in the historical abnormal data is consistent with the device identifier; If it is determined that the historical device identifier is inconsistent with the device identifier, it is determined whether multiple conditions are satisfied respectively. The multiple conditions include: the historical usage version number in the historical abnormal data is consistent with the usage version number; the data volume of at least one historical response message in the historical abnormal data is consistent with the data volume of at least one response message; and the historical usage algorithm in the historical abnormal data is consistent with the usage algorithm. If it is determined that the above multiple conditions are not met, it is determined that the historical abnormal data does not match the authentication behavior data; If it is determined that the historical abnormal data does not match the authentication behavior data, the authentication behavior is determined to be an abnormal behavior based on the identity authentication result; wherein, the identity authentication result is obtained by performing identity authentication processing on the identity authentication request; If the historical abnormal data matches the authentication behavior data, the authentication behavior is determined to be abnormal behavior.

2. The method according to claim 1, characterized in that, The step of determining whether the authentication behavior is abnormal based on the identity authentication result includes: If the authentication result indicates that the authentication failed, the failure count is incremented by 1 to obtain the updated failure count; Determine whether the updated number of failures has reached the preset number; If a preset number of attempts is reached, the authentication behavior is determined to be abnormal.

3. The method according to claim 2, characterized in that, The method further includes: If the preset number of attempts is not reached, the supplemented authentication behavior data will be determined as the authentication behavior data corresponding to the second computing device; wherein, the supplemented authentication behavior data is obtained by supplementing the authentication behavior data according to the response time of the identity authentication request when the identity authentication result indicates authentication failure.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: If the historical device identifier is found to be consistent with the device identifier, the historical abnormal data is determined to match the authentication behavior data.

5. The method according to claim 1, characterized in that, The version number used is obtained during the version number negotiation phase of the authentication process; The algorithm used is obtained during the encryption algorithm negotiation phase of the authentication process; The data volume of the at least one response message includes at least one of the following: the data volume of the first response message obtained during the version number negotiation phase of the authentication process, the data volume of the second response message obtained during the encryption algorithm negotiation phase of the authentication process, and the data volume of the third and fourth response messages obtained during the key negotiation phase of the authentication process.

6. The method according to claim 1, characterized in that, The authentication behavior data also includes the response duration of the at least one response message; the method further includes: If the above conditions are met, for any response message, the duration difference rate corresponding to the response message is calculated based on the response duration of the response message and the response duration of historical response messages in the historical anomaly data; the response message corresponds to the historical response message. Calculate the average duration difference rate based on the duration difference rate corresponding to at least one response message; Calculate the matching coefficient based on the average duration difference rate; If the matching coefficient reaches a preset threshold, the historical abnormal data is determined to match the authentication behavior data.

7. The method according to claim 1, characterized in that, The response duration of the at least one response message includes at least one of the following: The response duration of the first response message obtained during the version number negotiation phase of the authentication process; The response duration of the second response message obtained during the encryption algorithm negotiation phase of the authentication process; The response duration of the third response message and the response duration of the fourth response message obtained during the key negotiation phase of the authentication process; The response time of the fifth response message obtained during the identity authentication phase of the authentication process; The response duration of at least one retry response message obtained during the identity authentication phase of the authentication process.

8. A computing device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory is used to store computer-executed instructions; The processor is configured to execute computer execution instructions stored in the memory to implement the method according to any one of claims 1-7.

Images