Replay attack defense method and device for REST interface

Abstract

The invention provides a replay attack defense method and device for a REST interface, and relates to the technical field of network security. The replay attack defense method comprises the following steps: in response to a detected access request for calling REST interface service, obtaining key verification information synchronized with a server in advance; determining a unique request identifier through a first timestamp at the current moment and the key verification information; encrypting the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; an interaction request parameter is generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interaction request parameter. According to the technical scheme, the replay attack aiming at the REST interface can be accurately detected through the key verification information and the first timestamp, the replay attack is effectively intercepted, and the access security of the REST interface is improved.

Description

Background Art

[0002] With the development of the Internet, the REST (Representational State Transfer) interface has been widely used in Web service and API (Application Programming Interface) design due to its simplicity and efficiency. However, due to its stateless nature, the REST interface is vulnerable to replay attacks and tampering of client-submitted data. A replay attack is when an attacker intercepts a legitimate user's request and directly repeats it at a later time or sends it again after modifying the request parameters, thereby achieving the purpose of illegal access or operation (such as obtaining additional permissions or leaking the entire database data).

[0003] At present, the relevant network interface replay attack defense solutions generally directly add a timestamp to the access request of the network interface to mark and distinguish it. This solution is easy to bypass when used in the replay attack of the REST interface, resulting in low access security of the REST interface.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a replay attack defense method for a REST interface and a replay attack defense device for a REST interface, so as to accurately detect replay attacks against a REST interface and effectively intercept replay attacks, thereby improving the access security of the REST interface.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of an embodiment of the present disclosure, a replay attack defense method for a REST interface is provided, which is applied to a client, and the client is connected to a server providing a REST interface service. The method includes: In response to detecting an access request for invoking a REST interface service, obtaining key verification information pre-synchronized with the server; Determine a unique request identifier by using a first timestamp at a current moment and the key verification information; Encrypt the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; An interaction request parameter is generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts an existing replay attack based on the interaction request parameter.

[0008] In some example embodiments of the present disclosure, based on the aforementioned solution, the key verification information includes a timestamp verification interval and a verification key; and determining a unique request identifier by using the first timestamp at the current moment and the key verification information includes: generating a random number based on the first timestamp; Collecting a second timestamp according to the first timestamp and the timestamp verification interval; A first verification encryption operation is performed on the second timestamp and the random number using the verification key to obtain the unique request identifier.

[0009] In some example embodiments of the present disclosure, based on the aforementioned solution, encrypting the request content of the access request, the unique request identifier, and the first timestamp according to the key verification information to obtain the replay attack verification signature includes: Performing a second verification encryption operation on the request content of the access request, the unique request identifier and the first timestamp using the verification key to obtain the replay attack verification signature; The complexity of the first verification encryption operation is greater than that of the second verification encryption operation.

[0010] According to a second aspect of an embodiment of the present disclosure, a replay attack defense method for a REST interface is provided, which is applied to a server, and the server is used to provide a REST interface service to a client connected to the communication, and the method includes: Obtaining interaction request parameters for the client to access the REST interface service, the interaction request parameters including a replay attack verification signature, request content, a unique request identifier, and a first timestamp; Perform replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; If the replay attack verification result is that a replay attack exists, the access request to the REST interface is rejected.

[0011] In some example embodiments of the present disclosure, based on the aforementioned solution, the key verification information includes a verification key, and the replay attack verification is performed in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result, including: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted first timestamp; In response to detecting that the decrypted first timestamp is consistent with the first timestamp in the interaction request parameter, determining a difference duration between any first timestamp and the latest timestamp currently collected; A preset replay attack detection duration threshold is obtained, and when the difference duration is greater than or equal to the replay attack detection duration threshold, it is determined that the replay attack verification result is that a replay attack exists.

[0012] In some example embodiments of the present disclosure, based on the aforementioned solution, the key verification information includes a timestamp verification interval, and the replay attack verification is performed in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result, further comprising: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted unique request identifier; In response to detecting that the decrypted unique request identifier is consistent with the unique request identifier in the interaction request parameter, decrypting any unique request identifier using the verification key to obtain a second timestamp; Determine a difference time interval between the second timestamp and the first timestamp, and when the difference time interval is inconsistent with the timestamp verification interval, determine that a replay attack verification result is that a replay attack exists.

[0013] In some example embodiments of the present disclosure, based on the foregoing solution, the method further includes: Obtain a historical verification signature set, and compare the historical verification signature set with the replay attack verification signature to determine a comparison result; If the comparison result is that there is a historical verification signature that is consistent with the replay attack verification signature, then the replay attack verification result is determined to be that a replay attack exists.

[0014] According to a third aspect of an embodiment of the present disclosure, a replay attack defense device for a REST interface is provided, which is arranged on a client, and the client is communicatively connected with a server providing a REST interface service, and the device includes: A key verification information acquisition module, configured to acquire key verification information pre-synchronized with the server in response to detecting an access request for calling a REST interface service; A request identifier determination module, used to determine a unique request identifier by using a first timestamp at a current moment and the key verification information; A verification signature generation module, configured to encrypt the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; The access request sending module is used to generate an interactive request parameter based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interactive request parameter.

[0015] According to a fourth aspect of an embodiment of the present disclosure, a replay attack defense device for a REST interface is provided, wherein a server is used to provide a REST interface service to a client connected in a communication manner, and the device includes: An access request receiving module, used to obtain interaction request parameters of the client accessing the REST interface service, wherein the interaction request parameters include a replay attack verification signature, request content, a unique request identifier, and a first timestamp; A replay attack verification module, used to perform replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; The access request response module is used to reject the access request of the REST interface if the replay attack verification result is that a replay attack exists.

[0016] According to a fifth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory, wherein computer-readable instructions are stored on the memory, and when the computer-readable instructions are executed by the processor, the replay attack defense method for a REST interface in the first aspect or the second aspect is implemented.

[0017] According to a sixth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the replay attack defense method for a REST interface in the first aspect or the second aspect is implemented.

[0018] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: The replay attack defense method for the REST interface in the example embodiment of the present disclosure can obtain key verification information pre-synchronized with the server when an access request for calling the REST interface service is detected, and determine the unique request identifier through the first timestamp at the current moment and the key verification information. Then, the request content, the unique request identifier and the first timestamp of the access request can be encrypted according to the key verification information to obtain the replay attack verification signature, so that the interaction request parameters can be generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interaction request parameters. On the one hand, determining the unique request identifier based on the system's first timestamp and the key verification information synchronized from the server can effectively ensure the uniqueness of the unique request identifier in each access request and improve the success rate of detecting replay attacks. At the same time, the unique request identifier also includes the first timestamp. Combined with the first timestamp, replay attacks can be further detected, defense against replay attacks can be achieved, and the access security of the REST interface can be improved. On the other hand, the request content, unique request identifier and first timestamp of the access request are encrypted according to the key verification information to obtain a replay attack verification signature. Combined with the replay attack verification signature and the unique request identifier, replay attacks that tamper with data can be effectively avoided, the success rate of detecting replay attacks can be further improved, various types of replay attacks can be intercepted, and the access security of the REST interface can be effectively improved.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0021] Figure 1 A schematic diagram of a system architecture of an exemplary application environment of a method and apparatus for defending against replay attacks on a REST interface according to an embodiment of the present disclosure is shown.

[0022] Figure 2 A flowchart of a replay attack defense method for a REST interface according to some embodiments of the present disclosure is schematically shown.

[0023] Figure 3 A flowchart of implementing replay attack verification according to interaction request parameters according to some embodiments of the present disclosure is schematically shown.

[0024] Figure 4 A schematic diagram of a process for detecting and verifying a replay attack according to some embodiments of the present disclosure is schematically shown.

[0025] Figure 5 Another schematic diagram of detecting and verifying a replay attack according to some embodiments of the present disclosure is schematically shown.

[0026] Figure 6 A schematic diagram of a replay attack defense device for a REST interface according to some embodiments of the present disclosure is schematically shown.

[0027] Figure 7 A schematic diagram of another replay attack defense device for a REST interface according to some embodiments of the present disclosure is schematically shown.

[0028] Figure 8 A schematic diagram of the structure of a computer system of an electronic device according to some embodiments of the present disclosure is schematically shown.

[0029] Fig. 9 A schematic diagram of a computer-readable storage medium according to some embodiments of the present disclosure is schematically shown.

[0030] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0032] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0033] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0034] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0035] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0036] Furthermore, the drawings are only schematic illustrations and are not necessarily drawn to scale. The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0037] Figure 1 A schematic diagram of a system architecture of an exemplary application environment of a method and apparatus for defending against replay attacks on a REST interface according to an embodiment of the present disclosure is shown.

[0038] like Figure 1 As shown, the system architecture 100 may include one or more terminal devices (such as a computer 101, a laptop 102, a smart phone 103), a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal device and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The terminal device may be a variety of electronic devices with communication capabilities, including but not limited to desktop computers, laptop computers, smart phones, and tablet computers, etc. It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0039] The replay attack defense method for the REST interface provided in the embodiment of the present disclosure can be executed by the terminal device, and accordingly, the replay attack defense device for the REST interface is generally set in the terminal device. However, it is easy for those skilled in the art to understand that the replay attack defense method for the REST interface provided in the embodiment of the present disclosure can also be executed by the server 105, and accordingly, the replay attack defense device for the REST interface can also be set in the server 105, which is not particularly limited in this exemplary embodiment.

[0040] In this example embodiment, a replay attack defense method for a REST interface is first provided. The replay attack defense method for a REST interface can be applied to a client, and the client can be connected to a server that provides a REST interface service. Figure 2 The following is a schematic diagram of a replay attack defense method for a REST interface according to some embodiments of the present disclosure. Figure 2 As shown, the replay attack defense method for the REST interface may include the following steps: Step S210, in response to detecting an access request for calling a REST interface service, obtaining key verification information pre-synchronized with the server; Step S220, determining a unique request identifier by using the first timestamp at the current moment and the key verification information; Step S230, encrypting the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; Step S240: Generate an interaction request parameter based on the replay attack verification signature, the request content, the unique request identifier, and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interaction request parameter.

[0041] According to the replay attack defense method for the REST interface in this example embodiment, on the one hand, the unique request identifier is determined based on the system's first timestamp and the key verification information synchronized from the server, which can effectively ensure the uniqueness of the unique request identifier in each access request, thereby improving the success rate of detecting replay attacks. At the same time, the unique request identifier also includes a first timestamp, which is combined with the first timestamp to further detect replay attacks, thereby achieving defense against replay attacks and improving the access security of the REST interface. On the other hand, the request content, the unique request identifier and the first timestamp of the access request are encrypted according to the key verification information to obtain a replay attack verification signature, which is combined with the replay attack verification signature and the unique request identifier to effectively avoid replay attacks that tamper with data, thereby further improving the success rate of detecting replay attacks, thereby achieving interception of various types of replay attacks and effectively improving the access security of the REST interface.

[0042] Next, the replay attack defense method for the REST interface in this example embodiment will be further described.

[0043] In step S210, in response to detecting an access request for invoking a REST interface service, key verification information pre-synchronized with the server is obtained.

[0044] In an example embodiment of the present disclosure, an access request refers to a request generated when a client interacts with a server. For example, an access request can be a GET request for calling a REST interface service to a server via a URL address, or a POST request for calling a REST interface service to a server via a Form. This example embodiment does not specifically limit the type of access request for calling a REST interface service.

[0045] Key verification information refers to information pre-set on the server side for interface encryption verification issued to the client. For example, key verification information can be a verification key for digital signature encryption. The server side can pre-set verification keys corresponding to different client identification information to ensure that the verification key of each client is unique. Key verification information can also be a pre-determined timestamp verification interval, which is used to generate verification information with at least two different timestamps, thereby further improving the uniqueness and security of interaction request parameters based on timestamp private verification. Similarly, the timestamp verification interval corresponding to each client is different. Of course, key verification information can also be other types of agreed information between the server and the server for encryption verification, and this example embodiment does not make any special restrictions on this.

[0046] When an access request to call a REST interface service is detected, key verification information that was pre-synchronized with the server can be obtained. For example, the server can distribute the corresponding key verification information to each client based on the identification information of each client. When the client receives the key verification information, it can store the key verification information and call the stored key verification information when the access request to call the REST interface service is detected.

[0047] In step S220, a unique request identifier is determined by using the first timestamp at the current moment and the key verification information.

[0048] In an example embodiment of the present disclosure, the first timestamp refers to the system timestamp collected when the client detects an access request for calling a REST interface service. For example, the first timestamp can be a Unix timestamp or a normal timestamp, as long as the system timestamp of the client and the system timestamp of the server can be synchronized. This example embodiment does not specifically limit the type of the first timestamp.

[0049] The unique request identifier refers to identification information generated based on the first timestamp and the key verification information for detecting a replay attack. The first timestamp and the key verification information can be combined to generate a unique access request. For example, the first timestamp can be encrypted with the key verification information to obtain the unique request identifier, or the key verification information and the first timestamp can be combined to obtain new unique verification information, and the new unique verification information can be encrypted to obtain the unique request identifier. This exemplary embodiment does not specifically limit this.

[0050] Optionally, the key verification information may include a timestamp verification interval and a verification key, such as a timestamp verification interval of 100ms or 10ms, but the present embodiment is not limited thereto. A second timestamp may be collected after waiting for the length of the timestamp verification interval based on the first timestamp, and the second timestamp may be encrypted by the verification key to obtain a unique request identifier. In this way, the unique request identifier and the first timestamp may be used separately as replay attack verification information for the access request, while the first timestamp and the second timestamp included in the unique request identifier, as well as the timestamp verification interval, constitute a set of replay attack verification information for the access request, further improving the detection success rate of the replay attack, avoiding bypassing verification, effectively improving the access security of the REST interface service, and improving the security of the server-side information.

[0051] In step S230, the request content of the access request, the unique request identifier and the first timestamp are encrypted according to the key verification information to obtain a replay attack verification signature.

[0052] In an example embodiment of the present disclosure, the key verification information may include a verification key, and the request content, the unique request identifier, and the first timestamp of the access request may be encrypted by the verification key in combination with a preset encryption algorithm to obtain a replay attack verification signature. The verification key may effectively improve the security of the replay attack verification signature, and the replay attack of the content tampering type may be effectively detected by the replay attack verification signature, thereby effectively improving the access security of the REST interface service.

[0053] In step S240, an interaction request parameter is generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interaction request parameter.

[0054] In an example embodiment of the present disclosure, after obtaining the replay attack verification signature, the replay attack verification signature, the request content, the unique request identifier and the first timestamp can be used to generate an interaction request parameter, and an access request including the interaction request parameter can be sent to the server. The server can detect and intercept possible replay attacks based on the interaction request parameter verification and the key verification information corresponding to the client.

[0055] By determining the unique request identifier through the system's first timestamp and the key verification information synchronized from the server, the uniqueness of the unique request identifier in each access request can be effectively guaranteed, thereby improving the success rate of detecting replay attacks. At the same time, the unique request identifier also includes the first timestamp. Combined with the first timestamp, replay attacks can be further detected, defense against replay attacks can be achieved, and the access security of the REST interface can be improved. The request content, unique request identifier and first timestamp of the access request are encrypted through the key verification information to obtain a replay attack verification signature. Combined with the replay attack verification signature and the unique request identifier, replay attacks that tamper with data can be effectively avoided, further improving the success rate of detecting replay attacks, intercepting various types of replay attacks, and effectively improving the access security of the REST interface.

[0056] Steps S210 to S240 are described in detail below.

[0057] In an exemplary embodiment of the present disclosure, the key verification information includes a timestamp verification interval and a verification key; the determination of the unique request identifier may be achieved through the following steps, which may specifically include: A random number may be generated based on the first timestamp, and a second timestamp may be collected according to the first timestamp and the timestamp verification interval, and a first verification encryption operation may be performed on the second timestamp and the random number using a verification key to obtain a unique request identifier.

[0058] Among them, the second timestamp refers to the new timestamp information collected based on the first timestamp and the timestamp verification interval. The first timestamp, the second timestamp and the timestamp verification interval constitute a verification information pair that can be mutually verified. In this way, even if the attacker tampers with the timestamp, the replay attack operation can be accurately detected, which effectively improves the detection success rate of various types of replay attacks, reduces the possibility of access requests being intercepted as replay attacks, and improves the access security of the REST interface.

[0059] The first verification encryption operation refers to an operation used to encrypt the second timestamp to obtain a unique request identifier. For example, the first verification encryption operation can be an encryption operation that uses the HMAC-SHA256 encryption algorithm to encrypt the second timestamp, or it can be an encryption operation that uses the 3DES encryption algorithm to encrypt the second timestamp. Of course, it can also be an encryption operation that uses multiple encryption algorithms for multiple encryptions, and this embodiment is not limited to this.

[0060] By generating a random number through the first timestamp, collecting the second timestamp according to the first timestamp and the timestamp verification interval, and then performing the first verification encryption operation on the second timestamp and the random number, the entropy of the unique request identifier can be effectively improved to prevent it from being cracked, thereby improving the security of the unique request identifier; at the same time, the first timestamp and the second timestamp included in the unique request identifier, and the timestamp verification interval constitute a set of replay attack verification information as an access request, further improving the detection success rate of replay attacks, avoiding bypassing verification, effectively improving the access security of REST interface services, and improving the security of server-side information.

[0061] Optionally, the following steps may be performed to encrypt the request content, the unique request identifier, and the first timestamp of the access request according to the key verification information to obtain the replay attack verification signature, which may specifically include: A second verification encryption operation may be performed on the request content, the unique request identifier and the first timestamp of the access request using the verification key to obtain a replay attack verification signature; wherein the complexity of the first verification encryption operation is greater than that of the second verification encryption operation.

[0062] Among them, the second verification encryption operation refers to an encryption operation for encrypting the data in all access requests to obtain a replay attack verification signature. For example, the second verification encryption operation can be an encryption operation on the request content, unique request identifier and first timestamp of the access request using the HMAC-SHA1 encryption algorithm, or it can be an encryption operation on the request content, unique request identifier and first timestamp of the access request using the DES encryption algorithm or the MD5 encryption algorithm. Of course, it can also be an encryption operation for multiple encryption using multiple encryption algorithms, and the present embodiment is not limited to this.

[0063] Optionally, the encryption complexity of the second verification encryption operation may generally be smaller than that of the first verification encryption operation. For example, if the first verification encryption operation may be an encryption operation using the HMAC-SHA256 encryption algorithm, then the second verification encryption operation may be an encryption operation using the HMAC-SHA1 encryption algorithm; if the first verification encryption operation may be an encryption operation using the 3DES encryption algorithm, then the second verification encryption operation may be an encryption operation using the DES encryption algorithm; of course, if the first verification encryption operation may be an encryption operation using the AES encryption algorithm, then the second verification encryption operation may be an encryption operation using the MD5 encryption algorithm; in some embodiments, the first verification encryption operation may also be a triple encryption operation using three encryption algorithms, and accordingly, the second verification encryption operation may be a double encryption operation using two encryption algorithms.

[0064] Verification encryption operations with inconsistent encryption complexity are used to encrypt the unique request identifier and the replay attack verification signature respectively. On the one hand, since the unique request identifier requires less data to be encrypted and the replay attack verification signature requires more data to be encrypted, the second timestamp and the random number are encrypted through a first verification encryption operation with higher complexity to obtain the unique request identifier, and the request content of the access request, the unique request identifier and the first timestamp are encrypted through a second verification encryption operation with lower complexity to obtain the replay attack verification signature, which can effectively improve the encryption efficiency while ensuring the encryption security; on the other hand, since the encryption complexity of the first verification encryption operation is greater than that of the second verification encryption operation, even if the attacker cracks the replay attack verification signature, the unique request identifier cannot be cracked; at the same time, the encryption complexity of the first verification encryption operation is lower, and the replay attack verification signature already contains the necessary parameters required for the access request, reducing the possibility of the attacker cracking the unique request identifier contained therein, thereby effectively improving the security of the unique request identifier, thereby ensuring the security of the access request.

[0065] In an example embodiment of the present disclosure, a replay attack defense method for a REST interface is also provided. The replay attack defense method for a REST interface can be applied to a server, which is used to provide a REST interface service to a client connected to the communication. Figure 3 The following is a schematic diagram of a replay attack defense method for a REST interface according to some embodiments of the present disclosure. Figure 3 As shown, the replay attack defense method for the REST interface may include the following steps: Step S310, obtaining interaction request parameters for the client to access the REST interface service, wherein the interaction request parameters include a replay attack verification signature, request content, a unique request identifier, and a first timestamp; Step S320, performing replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; Step S330: If the replay attack verification result is that a replay attack exists, the access request to the REST interface is rejected.

[0066] The interaction request parameters refer to the relevant parameters sent by the client to the server for calling the REST interface service. For example, the interaction request parameters may include a replay attack verification signature, request content, a unique request identifier, and a first timestamp.

[0067] Replay attack verification can be performed based on key verification information pre-synchronized with the client and the received interaction request parameters to obtain a replay attack verification result; for example, the replay attack verification signature in the interaction request parameters can be decrypted using the key verification information, and the information contained therein can be compared for consistency with the corresponding parameters in the interaction request parameters. When the parameter information is inconsistent, or when the interval between the included first timestamp and the currently collected timestamp is long, it can be considered that a replay attack exists; when the parameter information is consistent, or when the interval between the included first timestamp and the currently collected timestamp is within a predetermined time interval, it can be considered that no replay attack exists.

[0068] When it is determined that the replay attack verification result is that a replay attack exists, the access request of the REST interface can be rejected, effectively ensuring the access security of the REST interface of the server and ensuring the data security of the server.

[0069] Optionally, key authentication information includes an authentication key, which can be obtained through Figure 4 The steps in the embodiment combine the key verification information pre-synchronized with the client and the interaction request parameters to perform replay attack verification, and obtain the replay attack verification result, refer to Figure 4 As shown, it may specifically include: Step S410, decrypting the replay attack verification signature according to the verification key to obtain a decrypted first timestamp; Step S420, in response to detecting that the decrypted first timestamp is consistent with the first timestamp in the interaction request parameter, determining the difference between any first timestamp and the latest timestamp currently collected; Step S430, obtaining a preset replay attack detection duration threshold, and when the difference duration is greater than or equal to the replay attack detection duration threshold, determining that the replay attack verification result is that a replay attack exists.

[0070] Among them, the replay attack detection time threshold refers to a preset time length for detecting a replay attack. For example, the replay attack detection time threshold can be 60s or 30s. It can be customized according to the actual network conditions and communication environment to achieve the purpose of effectively screening out replay attacks. This example embodiment is not limited to this.

[0071] When it is determined that the decrypted first timestamp is consistent with the first timestamp in the interaction request parameters, and the difference between any first timestamp and the latest timestamp currently collected is greater than or equal to the replay attack detection duration threshold, it can be considered that the replay attack verification result of the access request is that a replay attack exists, and therefore the access request can be rejected.

[0072] Optionally, key verification information can include a timestamp verification interval and can be Figure 5 The steps in the implementation combine the key verification information and interaction request parameters pre-synchronized with the client to perform replay attack verification and obtain the replay attack verification result. Figure 5 As shown, it may specifically include: Step S510, decrypting the replay attack verification signature according to the verification key to obtain a decrypted unique request identifier; Step S520, in response to detecting that the decrypted unique request identifier is consistent with the unique request identifier in the interaction request parameter, decrypting any unique request identifier using the verification key to obtain a second timestamp; Step S530: determine a difference time interval between the second timestamp and the first timestamp, and when the difference time interval is inconsistent with the timestamp verification interval, determine that the replay attack verification result is that a replay attack exists.

[0073] When it is determined that the decrypted unique request identifier is consistent with the unique request identifier in the interaction request parameter, any unique request identifier can be decrypted by using the verification key to obtain a second timestamp, and the difference time interval between the second timestamp and the first timestamp is compared with the timestamp verification interval. Since the second timestamp is collected on the client in combination with the first timestamp and the timestamp verification interval, only when the difference time interval is consistent with the timestamp verification interval, it can be considered that there is no problem with the access request. At this time, the replay attack verification result can be determined to be that there is no replay attack; if the difference time interval is inconsistent with the timestamp verification interval, it can be determined that the replay attack verification result is that there is a replay attack.

[0074] The hidden verification information group composed of the first timestamp, the second timestamp included in the unique request identifier, and the timestamp verification interval can effectively prevent attackers from digging and cracking it, and use it as replay attack verification information for access requests, further improving the success rate of replay attack detection, avoiding verification bypass, and effectively improving the access security of REST interface services and the security of server-side information.

[0075] In an example embodiment of the present disclosure, a pre-stored historical verification signature set can be obtained, and the historical verification signature set can be compared with the replay attack verification signature to determine a comparison result; if the comparison result is that there is a historical verification signature that is consistent with the replay attack verification signature, then it can be considered that the same access request has existed before, and this is a replay attack of the previous access request, and the replay attack verification result can be determined to be the existence of a replay attack.

[0076] By storing a set of historical verification signatures, the set of historical verification signatures can be compared with the replay attack verification signature to quickly screen out access requests that may involve replay attacks, thereby effectively improving the efficiency and success rate of detecting replay attacks. For example, when an access request is received, the set of historical verification signatures can be compared with the replay attack verification signature in advance. When it is determined that a replay attack exists, there is no need to perform the decryption verification operation in the aforementioned embodiment, thereby effectively improving the efficiency of detecting replay attacks.

[0077] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0078] In addition, in this exemplary embodiment, a replay attack defense device for a REST interface is also provided, which can be set on a client, and the client is connected to a server that provides a REST interface service. Figure 6 As shown, the replay attack defense device 600 for the REST interface includes: a key verification information acquisition module 610, a request identifier determination module 620, a verification signature generation module 630 and an access request sending module 640. Among them: The key verification information acquisition module 610 may be used to, in response to detecting an access request for calling a REST interface service, acquire key verification information pre-synchronized with the server; The request identifier determination module 620 may be configured to determine a unique request identifier using a first timestamp at a current moment and the key verification information; The verification signature generation module 630 may be used to encrypt the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; The access request sending module 640 can be used to generate an interactive request parameter based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interactive request parameter.

[0079] In an exemplary embodiment of the present disclosure, based on the aforementioned solution, the key verification information includes a timestamp verification interval and a verification key; the request identifier determination module 620 is configured to: generating a random number based on the first timestamp; Collecting a second timestamp according to the first timestamp and the timestamp verification interval; A first verification encryption operation is performed on the second timestamp and the random number using the verification key to obtain the unique request identifier.

[0080] In an exemplary embodiment of the present disclosure, based on the above solution, the verification signature generation module 630 is configured as follows: Performing a second verification encryption operation on the request content of the access request, the unique request identifier and the first timestamp using the verification key to obtain the replay attack verification signature; The complexity of the first verification encryption operation is greater than that of the second verification encryption operation.

[0081] In this exemplary embodiment, a replay attack defense device for a REST interface is also provided. The device can be set at a server end, and the server end is used to provide a REST interface service to a client end of a communication connection. Figure 7 As shown, the replay attack defense device 700 for the REST interface includes: an access request receiving module 710, a replay attack verification module 720 and an access request response module 730. Among them: An access request receiving module 710 is used to obtain interaction request parameters of the client accessing the REST interface service, wherein the interaction request parameters include a replay attack verification signature, request content, a unique request identifier, and a first timestamp; A replay attack verification module 720, configured to perform replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; The access request response module 730 is configured to reject the access request of the REST interface if the replay attack verification result is that a replay attack exists.

[0082] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the replay attack defense device 700 for the REST interface also includes a data cache module, which can be used to store the replay attack verification signature whose replay attack verification result is that there is no replay attack, including a first data cache unit and a second data cache unit. Every preset switching time, the first data cache unit storing the replay attack verification signature is switched to the second data cache unit for continued caching, and the first data cache unit is cleared. Through multiple data cache units, the storage of historical replay attack verification signatures on the server side can be effectively improved. Under the premise of ensuring that the replay attack is not affected, the storage capacity of the server side for the historical verification signature set can be effectively improved, thereby improving the detection success rate of replay attacks.

[0083] In an exemplary embodiment of the present disclosure, based on the aforementioned solution, the key verification information may include a verification key, and the replay attack verification module 720 may be configured as follows: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted first timestamp; In response to detecting that the decrypted first timestamp is consistent with the first timestamp in the interaction request parameter, determining a difference duration between any first timestamp and the latest timestamp currently collected; A preset replay attack detection duration threshold is obtained, and when the difference duration is greater than or equal to the replay attack detection duration threshold, it is determined that the replay attack verification result is that a replay attack exists.

[0084] In an exemplary embodiment of the present disclosure, based on the aforementioned solution, the key verification information may include a timestamp verification interval, and the replay attack verification module 720 may also be configured as follows: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted unique request identifier; In response to detecting that the decrypted unique request identifier is consistent with the unique request identifier in the interaction request parameter, decrypting any unique request identifier using the verification key to obtain a second timestamp; Determine a difference time interval between the second timestamp and the first timestamp, and when the difference time interval is inconsistent with the timestamp verification interval, determine that a replay attack verification result is that a replay attack exists.

[0085] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the replay attack defense device 700 for the REST interface may further include a replay attack detection module, which is configured to: Obtain a historical verification signature set, and compare the historical verification signature set with the replay attack verification signature to determine a comparison result; If the comparison result is that there is a historical verification signature that is consistent with the replay attack verification signature, then the replay attack verification result is determined to be that a replay attack exists.

[0086] The specific details of each module of the above-mentioned replay attack defense device for REST interface have been described in detail in the corresponding replay attack defense method for REST interface, so they will not be repeated here.

[0087] It should be noted that although several modules or units of the replay attack defense device for REST interface are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0088] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned replay attack defense method for a REST interface is also provided.

[0089] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0090] Refer to the following Figure 8 800 according to this embodiment of the present disclosure is described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0091] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include but are not limited to: the at least one processing unit 810, the at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.

[0092] The storage unit stores a program code, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 810 can perform the following steps: Figure 2 In step S210 shown in the figure, in response to detecting an access request for calling a REST interface service, key verification information pre-synchronized with the server is obtained; in step S220, a unique request identifier is determined through a first timestamp at a current moment and the key verification information; in step S230, a request content of the access request, the unique request identifier and the first timestamp are encrypting according to the key verification information to obtain a replay attack verification signature; in step S240, interaction request parameters are generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts existing replay attacks based on the interaction request parameters.

[0093] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 821 and / or a cache memory unit 822 , and may further include a read-only memory unit (ROM) 823 .

[0094] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, such program modules 825 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0095] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0096] The electronic device 800 may also communicate with one or more external devices 870 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device 800 to communicate with one or more other computing devices. Such communication may be performed through an input / output (I / O) interface 850. In addition, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 through a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0097] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0098] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0099] refer to Fig. 9 As shown, a program product 900 for implementing the above-mentioned replay attack defense method for a REST interface according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus, or a device.

[0100] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0101] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0102] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0103] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0104] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0105] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0106] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0107] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A replay attack defense method for a REST interface, applied to a client, the client is connected to a server providing the REST interface service, characterized in that: include: In response to detecting an access request for invoking a REST interface service, obtaining key verification information pre-synchronized with the server; Determine a unique request identifier by using a first timestamp at a current moment and the key verification information; Encrypt the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; An interaction request parameter is generated based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts an existing replay attack based on the interaction request parameter.

2. The replay attack defense method according to claim 1, characterized in that: The key verification information includes a timestamp verification interval and a verification key; Determining the unique request identifier by using the first timestamp at the current moment and the key verification information includes: generating a random number based on the first timestamp; Collecting a second timestamp according to the first timestamp and the timestamp verification interval; A first verification encryption operation is performed on the second timestamp and the random number using the verification key to obtain the unique request identifier.

3. The replay attack defense method according to claim 2, characterized in that: The step of encrypting the request content of the access request, the unique request identifier, and the first timestamp according to the key verification information to obtain a replay attack verification signature includes: Performing a second verification encryption operation on the request content of the access request, the unique request identifier and the first timestamp using the verification key to obtain the replay attack verification signature; The complexity of the first verification encryption operation is greater than that of the second verification encryption operation.

4. A replay attack defense method for a REST interface, applied to a server, the server is used to provide the REST interface service to a client connected to the communication, characterized in that: include: Obtaining interaction request parameters for the client to access the REST interface service, the interaction request parameters including a replay attack verification signature, request content, a unique request identifier, and a first timestamp; Perform replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; If the replay attack verification result is that a replay attack exists, the access request to the REST interface is rejected.

5. The replay attack defense method according to claim 4, characterized in that: The key verification information includes a verification key, and the replay attack verification is performed in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result, including: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted first timestamp; In response to detecting that the decrypted first timestamp is consistent with the first timestamp in the interaction request parameter, determining a difference duration between any first timestamp and the latest timestamp currently collected; A preset replay attack detection duration threshold is obtained, and when the difference duration is greater than or equal to the replay attack detection duration threshold, it is determined that the replay attack verification result is that a replay attack exists.

6. The replay attack defense method according to claim 5, characterized in that: The key verification information includes a timestamp verification interval, and the replay attack verification is performed in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result, and further includes: Decrypting the replay attack verification signature according to the verification key to obtain a decrypted unique request identifier; In response to detecting that the decrypted unique request identifier is consistent with the unique request identifier in the interaction request parameter, decrypting any unique request identifier using the verification key to obtain a second timestamp; Determine a difference time interval between the second timestamp and the first timestamp, and when the difference time interval is inconsistent with the timestamp verification interval, determine that a replay attack verification result is that a replay attack exists.

7. The replay attack defense method according to any one of claims 4 to 6, characterized in that: The method further comprises: Obtain a historical verification signature set, and compare the historical verification signature set with the replay attack verification signature to determine a comparison result; If the comparison result is that there is a historical verification signature that is consistent with the replay attack verification signature, then the replay attack verification result is determined to be that a replay attack exists.

8. A replay attack defense device for a REST interface, arranged on a client, the client being communicatively connected to a server providing the REST interface service, characterized in that: include: A key verification information acquisition module, configured to acquire key verification information pre-synchronized with the server in response to detecting an access request for calling a REST interface service; A request identifier determination module, used to determine a unique request identifier by using a first timestamp at a current moment and the key verification information; A verification signature generation module, configured to encrypt the request content of the access request, the unique request identifier and the first timestamp according to the key verification information to obtain a replay attack verification signature; The access request sending module is used to generate an interactive request parameter based on the replay attack verification signature, the request content, the unique request identifier and the first timestamp, and the server verifies and intercepts the existing replay attack based on the interactive request parameter.

9. A replay attack defense device for a REST interface, arranged at a server, the server being used to provide the REST interface service to a client connected in a communication manner, characterized in that: include: An access request receiving module, used to obtain interaction request parameters of the client accessing the REST interface service, wherein the interaction request parameters include a replay attack verification signature, request content, a unique request identifier, and a first timestamp; A replay attack verification module, used to perform replay attack verification in combination with the key verification information pre-synchronized with the client and the interaction request parameter to obtain a replay attack verification result; The access request response module is used to reject the access request of the REST interface if the replay attack verification result is that a replay attack exists.

10. The replay attack defense device according to claim 9, characterized in that: The device also includes: A data cache module is used to store the replay attack verification signature whose replay attack verification result is that there is no replay attack, including a first data cache unit and a second data cache unit. Every preset switching time, the first data cache unit storing the replay attack verification signature is switched to the second data cache unit for continued caching, and the first data cache unit is cleared.

Images