Session protection method based on browser fingerprint

Abstract

The invention relates to a session protection method based on browser fingerprints, and relates to the technical field of information security, and the session protection method comprises the following steps: generating a to-be-encrypted plaintext comprising an original Cookie under the condition of receiving response information which is returned by a server and carries the original Cookie; generating an encryption key according to the target browser fingerprint information, and encrypting the to-be-encrypted plaintext by using the encryption key to obtain encrypted data; according to the embodiment of the invention, the original Cookie in the response information is replaced by the encrypted data to obtain the replaced response information, and the replaced response information is sent to the client, so that the client authenticates the encrypted data in the replaced response information, thereby improving the security and reducing the state burden of the server.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and particularly relates to a session protection method based on browser fingerprints. BACKGROUND

[0002] At present, existing Web session authentication mechanisms mainly rely on Cookie and the server to perform session management. When a user logs in, the server generates a session ID, which is sent to the client through Cookie, and the Cookie is carried in subsequent requests to maintain the session.

[0003] However, the above scheme has the following problems: Cookie can be migrated and reused, and once an attacker steals Cookie, it can be used to forge requests on other devices. SUMMARY

[0004] (I) Technical problems to be solved

[0005] In view of the above-mentioned defects and deficiencies of the prior art, the present application provides a session protection method based on browser fingerprints, which solves the technical problem that Cookie can be forged in the prior art.

[0006] (II) Technical solutions

[0007] In order to achieve the above-mentioned purposes, the main technical solutions adopted by the present application include:

[0008] In a first aspect, the present application provides a session protection method based on browser fingerprints, which is applied to a WAF device in a session protection system, and the session protection system comprises a client and a WAF device. The client sends a heartbeat packet carrying target browser fingerprint information to the WAF device at regular intervals, and the target browser fingerprint information is unique information for identifying the current browser generated by processing a plurality of characteristic information of the browser of the client. The session protection method comprises the following steps: in the case that response information returned by the server carries original Cookie, generating a to-be-encrypted plaintext comprising the original Cookie; generating an encryption key according to the target browser fingerprint information, and encrypting the to-be-encrypted plaintext by using the encryption key to obtain encrypted data; replacing the original Cookie in the response information with the encrypted data to obtain replaced response information, and sending the replaced response information to the client, so that the client authenticates the encrypted data in the replaced response information.

[0009] In a possible embodiment, the plurality of features of the browser includes mandatory features and optional features, the mandatory features include user agent information, language information, time zone information, browser local encoding information and screen resolution, and the optional features include at least one of a Canvas fingerprint, a WebGL fingerprint, a browser display font, a number of browser plug-ins and a hardware concurrency number.

[0010] In a possible embodiment, the generation process of the target browser fingerprint information includes: performing, by the client, corresponding feature encoding on each feature in the plurality of features to obtain an encoding of each feature; grouping, by the client, all features in the plurality of features to obtain a plurality of feature groups, and constructing a feature vector based on the encodings of all features in a preset arrangement order of all feature groups; wherein the feature vector includes a plurality of subarrays, and each array in the plurality of subarrays corresponds to a feature group; performing, by the client, perturbation processing on each value in the feature vector to obtain a perturbed feature vector; and generating, by the client, the current browser fingerprint information based on the perturbed feature vector.

[0011] In a possible embodiment, the plurality of features includes user agent information, language information and browser local encoding information; the perturbed feature vector is obtained by performing perturbation processing on each value in the feature vector according to a perturbation value by the client; and the perturbation value is obtained by calculating, by the client, a first sum of the encoding of the user agent information, the encoding of the language information and the encoding of the browser local encoding information using a CRC32 function.

[0012] In a second aspect, an embodiment of the present application provides a session protection method based on a browser fingerprint, the session protection method being applied to a client in a session protection system, and the session protection system including a WAF device and the client, and the client being configured to periodically send a heartbeat packet carrying target browser fingerprint information to the WAF device, and the target browser fingerprint information being unique identification information of a current browser generated by processing a plurality of feature information of a browser of the client; and the session protection method including: in a case where the client receives replaced response information carrying encrypted data sent by the WAF device, generating current browser fingerprint information based on the plurality of features of the browser; generating a decryption key using the current browser fingerprint information, and performing a decryption operation on the encrypted data using the decryption key; and in a case where the decryption fails, considering that an original Cookie carried in the response information is illegal.

[0013] In a possible embodiment, the plurality of features of the browser includes mandatory features and optional features, the mandatory features include user agent information, language information, time zone information, browser local encoding information and screen resolution, and the optional features include at least one of a Canvas fingerprint, a WebGL fingerprint, a browser display font, a number of browser plug-ins and a hardware concurrency number.

[0014] In one possible implementation, the current browser fingerprint information is generated based on a plurality of features of a browser, including: performing corresponding feature encoding on each feature in the plurality of features to obtain an encoding of each feature; grouping all features in the plurality of features to obtain a plurality of feature groups, and constructing a feature vector based on the encodings of all features in accordance with a preset arrangement order of all feature groups; wherein the feature vector includes a plurality of sub-arrays, and each array in the plurality of sub-arrays corresponds to a feature group; performing perturbation processing on each value in the feature vector to obtain a perturbed feature vector; and generating the current browser fingerprint information based on the perturbed feature vector.

[0015] In one possible implementation, the plurality of features includes user agent information, language information, and browser local encoding information; and the perturbation processing on each value in the feature vector to obtain the perturbed feature vector includes: calculating a first sum value of the encoding of the user agent information, the encoding of the language information, and the encoding of the browser local encoding information using a CRC32 function to obtain a perturbation value; and performing the perturbation processing on each value in the feature vector according to the perturbation value to obtain the perturbed feature vector.

[0016] In one possible implementation, the current browser fingerprint information is generated based on the perturbed feature vector, including: calculating a second sum value of each element value in the perturbed feature vector and its position value in the corresponding sub-array, and performing a modulo calculation on each sum value to obtain a corresponding remainder for each element value, and replacing each element value in the perturbed feature vector with the corresponding remainder to obtain a replaced feature vector; and mapping each element in the replaced feature vector to a specified length array to obtain the current browser fingerprint information.

[0017] In one possible implementation, the current browser fingerprint information is obtained by mapping each element in the replaced feature vector to a specified length array, including: calculating an element insertion position of each element in the replaced feature vector in the specified length array according to the group number of the sub-array in the replaced feature vector, the position of each element in the corresponding sub-array in the replaced feature vector, a preset fixed interval, and the length of the specified length array; and performing a modulo calculation on a third sum value of each element value in the replaced feature vector and the current value of the element insertion position of the specified length array in the order of all elements in the replaced feature vector from front to back to obtain the current browser fingerprint information.

[0018] In a third aspect, the embodiments of the present application further provide an electronic device, comprising a memory for storing a computer program; and a processor for executing the computer program stored in the memory, when the computer program is executed, the processor is configured to execute the browser fingerprint based session protection method as described above.

[0019] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, comprising computer instructions, when the computer instructions are run on an electronic device, the electronic device is caused to execute the browser fingerprint based session protection method as described above.

[0020] (III) Advantages

[0021] The advantages of the present application are:

[0022] The embodiments of the present application propose a browser fingerprint based session protection method, a key is generated by browser fingerprint information acquired by a WAF device, Cookie content is encrypted, and then the encrypted content is decrypted by a client using a newly generated browser fingerprint, so as to realize that Cookie content can only be decrypted and used in an original generation environment, and also realize strong binding and non-migratable session credentials, thereby improving security and reducing server state burden.

[0023] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application, it should be understood that the following drawings only show some embodiments of the present application, therefore should not be regarded as a limitation to the scope, for those skilled in the art, without creative labor, other related drawings can also be obtained according to these drawings.

[0025] Figure 1 A schematic diagram of a session protection system proposed by the embodiments of the present application is shown;

[0026] Figure 2 A flowchart of a browser fingerprint based session protection method provided by the embodiments of the present application is shown;

[0027] Figure 3 A structural block diagram of an electronic device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0028] For better explaining the present application, in order to facilitate understanding, the following specific embodiments are combined with the drawings to make a detailed description of the present application.

[0029] At present, in addition to the problem of Cookie forgery, the existing method also has the problem of being unable to bind the device environment, so that the server cannot identify whether it is the original environment of Cookie, resulting in a security risk.

[0030] In order to solve the problems of Cookie forgery, migration and lack of environment binding in the prior art, the embodiment of the present application proposes a session protection method based on browser fingerprint, generates a key through browser fingerprint information obtained by a WAF (Web Application Firewall) device, encrypts the Cookie content, and then decrypts the encrypted content using the newly generated browser fingerprint by the client, thereby realizing that the Cookie content can only be decrypted and used in the original generation environment, and also realizing a strongly bound and non-migratable session credential, thereby improving security and reducing the server state burden.

[0031] In order to better understand the above technical solutions, the exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer, more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0032] Please refer to Figure 1 , Figure 1 A schematic diagram of a session protection system according to an embodiment of the present application is shown. As Figure 1 shown, the session protection system can include a client, a WAF device and a server. The WAF device is connected to the client and the server, respectively.

[0033] It should be noted that, although Figure 1 is described with one client as an example, those skilled in the art should understand that it can include more clients, and the embodiments of the present application are not limited thereto.

[0034] Continuing to refer to Figure 2 , Figure 2 A flowchart of a session protection method based on browser fingerprint according to an embodiment of the present application is shown. Specifically, the session protection method includes:

[0035] Step S210, in the case of receiving the response information returned by the server carrying the original Cookie, the WAF device generates the to-be-encrypted plaintext including the original Cookie.

[0036] Specifically, after the client sends a first request to the WAF device, the WAF device sends the request to the server and receives response information returned by the server, which carries an original Cookie. The response information includes a Set-Cookie response header, and the original Cookie is a Cookie value carried in the Set-Cookie response header.

[0037] In addition, since the client periodically sends a heartbeat packet carrying target browser fingerprint information and a browser fingerprint state to the WAF device, the WAF device can dynamically update the expiration time of the target browser fingerprint information based on the browser fingerprint state. The target browser fingerprint information is unique information generated by processing a plurality of characteristic information of the browser of the client, and the browser fingerprint state can indicate the expiration time of the target browser fingerprint information.

[0038] To facilitate understanding of the generation process of the target browser fingerprint information, specific embodiments are described below.

[0039] Specifically, the client encodes each characteristic in the plurality of characteristics to obtain the encoding of each characteristic. The client groups all characteristics in the plurality of characteristics to obtain a plurality of characteristic groups, and constructs a characteristic vector based on the encoding of all characteristics according to a preset arrangement order of all characteristic groups. The characteristic vector includes a plurality of subarrays, and each array in the plurality of subarrays corresponds to a characteristic group. The client performs perturbation processing on each value in the characteristic vector to obtain a perturbed characteristic vector. The client generates the current browser fingerprint information based on the perturbed characteristic vector.

[0040] It should be understood that the specific characteristics of the plurality of characteristics can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0041] Optionally, the WAF device can periodically collect a plurality of characteristic information of the browser of the client. The plurality of characteristics of the browser include mandatory characteristics and optional characteristics. The mandatory characteristics include User-Agent information, language information displayed by the browser, time zone information, browser local encoding information, and screen resolution. The optional characteristics include at least one of Canvas fingerprint, WebGL fingerprint, browser display font, browser plug-in number, and hardware concurrency number. That is, the plurality of characteristics of the browser can include only mandatory characteristics, or can include mandatory characteristics and optional characteristics.

[0042] It should be understood that the characteristics included in the mandatory characteristics and the characteristics included in the optional characteristics can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0043] For example, on the basis of the above-mentioned optional features, mouse movement mode and WebDriver information can be added in the optional features. The mouse movement mode can refer to the mouse movement setting of the operating system, for example, pointer speed / sensitivity, etc.

[0044] It should also be understood that the specific process of the client encoding each feature in the plurality of features can also be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0045] Optionally, for the language information displayed by the browser, the user agent information, the browser local encoding information and the browser display font, a pre-defined mapping number (or encoding) can be used for encoding.

[0046] For example, in the case of using a language code to represent the language information displayed by the browser, a corresponding mapping number can be set for each language through a language mapping table (for example, in the case of using “zh-CN” to represent that the language displayed by the browser is Chinese, the corresponding mapping number of the Chinese can be 27).

[0047] In addition, for the time zone information, the number of hardware concurrency and the number of browser plug-ins, a corresponding linear scaling mapping formula can be used to calculate the corresponding encoding.

[0048] For example, for the time zone information, the time zone linear scaling mapping formula is: ((TZ+12) / 26)*255. Wherein, TZ represents the city.

[0049] In addition, for the screen resolution, the screen resolution can be hashed to obtain a hash value, and the hash value can be taken modulo to obtain the encoding corresponding to the screen resolution.

[0050] In addition, for the Canvas fingerprint and the WebGL fingerprint, the Canvas fingerprint and the WebGL fingerprint can be encoded by using Hex encoding to obtain the encoding corresponding to the Canvas fingerprint and the WebGL fingerprint.

[0051] In addition, through the above-mentioned feature encoding mapping processing mode, each feature can be converted into an encoding number (0-255) in a unified interval.

[0052] It should also be understood that the specific way of grouping all features in the plurality of features can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0053] Optionally, all the features in the plurality of features can be divided into four groups, and the four groups of features are display class, rendering class, language class and security class respectively. The features in the display class can include screen resolution and browser display font; the features in the rendering class can include Canvas fingerprint and WebGL fingerprint; the features in the language class can include language information, time zone information and browser native encoding information; and the features in the security class can include user agent information, browser plug-in number and hardware concurrency number.

[0054] It should also be understood that the specific process of constructing the feature vector based on the encoding of all the features according to the preset arrangement order of the groups of all the features can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0055] Optionally, in the case where the preset arrangement order of the groups of all the features is display class, rendering class, language class and security class, the constructed feature vector is:

[0056] [display class encoding, rendering class encoding, language class encoding, security class encoding];

[0057] And the display class encoding, the rendering class encoding, the language class encoding and the security class encoding are four sub-arrays of the feature vector, and the arrangement order of the elements in each sub-array can be set according to actual needs. For example, in the case where the encoding of the Canvas fingerprint is 159 and the encoding of the WebGL fingerprint is 196, the rendering class encoding is [159, 196].

[0058] It should also be understood that the specific process of perturbing each value in the feature vector can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0059] Optionally, the first sum of the encoding of the user agent information, the encoding of the language information and the encoding of the browser native encoding information is calculated by using the CRC32 function to obtain a perturbation value; and each value in the feature vector is perturbed according to the perturbation value to obtain a perturbed feature vector.

[0060] The calculation formula of the perturbation value is: S=CRC32(encoding of user agent information+encoding of language information+encoding of browser native encoding information); S represents the perturbation value.

[0061] The calculation formula of the perturbation processing of each value in the feature vector is: Val’=(Val+current value in the constructed feature vector position value%5)%256; Val’ represents the perturbed value corresponding to the current value, Val represents the current value, and % represents the remainder.

[0062] For example, in the case of the feature vector being [

[173] , [159, 198], [27, 212, 19], [1, 3, 12, 3]], if 198 is disturbed, the position value of 198 in the constructed feature vector is 3.

[0063] Therefore, each value in the feature vector can be processed by the above two formulas to obtain the disturbed feature vector.

[0064] Optionally, considering that the feature vector includes display class encoding, rendering class encoding, language class encoding, and security class encoding, a calculation method of the disturbance value can be set for each class of encoding, and the calculation is performed in the following manner:

[0065] The display class disturbance value: S0=CRC32(encoding of user agent information + encoding of language information + encoding of browser local encoding information);

[0066] The rendering class disturbance value: S1=CRC32(S0+render_salt); render_salt represents a rendering class salt value, and is a fixed salt value. For example, the render_salt can be a value determined by the year and the browser version number (for example, a hash value obtained by hashing the two values by the MD5 algorithm, etc.); The language class disturbance value: S2=CRC32(S1+lang_salt); lang_salt represents a language class salt value, and is a fixed salt value. For example, the render_salt can be a value determined by the encoding of language information, the encoding of time zone information, and the browser version number (for example, a hash value obtained by hashing the three values by SHA-2, etc.);

[0067] The security class disturbance value: S3=CRC32(S2+sec_salt); sec_salt represents a security class salt value, and is a fixed salt value. For example, the length of the security class disturbance value can be 16-24 bytes.

[0068] In the case where the display class disturbance value, the rendering class disturbance value, the language class disturbance value, and the security class disturbance value are obtained, the disturbed feature vector can be determined based on the calculation formula of the disturbance processing of each value in the above feature vector.

[0069] It should also be understood that the specific process of generating the current browser fingerprint information by the client based on the disturbed feature vector can also be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0070] Optionally, the client calculates the second sum value of each element value in the perturbed feature vector and its position value within the corresponding sub-array, and performs a modulo calculation on each sum value to obtain the remainder corresponding to each element value, and replaces each element value in the perturbed feature vector with the corresponding remainder to obtain a replaced feature vector, which can be calculated by the following formula: Fi = (current element value + its position value within the corresponding sub-array) % 256; Fi represents the remainder corresponding to each element value, and % represents the modulo. For example, in the case of a feature vector [

[173] , [159, 198], [27, 212, 19], [1, 3, 12, 3]], the position of the element value 3 within the corresponding sub-array is 2.

[0071] In addition, the client calculates the element insertion position of each element in the replaced feature vector within the specified length array according to the group number of the sub-array in the replaced feature vector, the position of each element in the replaced feature vector within the corresponding sub-data group, the preset fixed interval, and the length of the specified length array; and the client sequentially performs a third sum value of each element value in the replaced feature vector and the current value of the element insertion position of the element in the specified length array modulo calculation to obtain the current browser fingerprint information. The specific interval of the preset fixed interval and the specific length of the specified length array can be set according to actual needs, and the embodiments of the present application are not limited thereto. For example, the fixed interval can be 3, and the length of the specified length array is 16 bytes.

[0072] In the formula, pos represents the element insertion position of the current element within the specified length array, and the group number is the group number of the sub-data group where the current element is located (for example, the group numbers of the display class sub-array, the rendering class sub-array, the language class sub-array, and the security class sub-array are 0, 1, 2, and 3, respectively).

[0073] In addition, the insertion value of the element insertion position of each element within the specified length array is calculated by the formula: the insertion value of the element insertion position of the current element within the specified length array = (the current value of the current insertion position within the specified length array + the current element value) % 256; % represents the modulo.

[0074] It should be noted that although the specified length array starts with an empty array, since the insertion position of the specified element may have been inserted with a value before, the current value of the current insertion position within the specified length array is needed for calculation.

[0075] And, since the timestamp is carried in the response information, the WAF device can take the original Cookie, the timestamp, and the target browser fingerprint information within the valid time range as the plaintext to be encrypted.

[0076] It should be understood that, although the above is described by taking the original Cookie, the timestamp, and the target browser fingerprint information as the plaintext to be encrypted, those skilled in the art should understand that the plaintext to be encrypted can also be set according to actual needs, as long as it includes the original Cookie, and the embodiments of the present application are not limited thereto.

[0077] For example, the plaintext to be encrypted can also include the signature data of the client, etc.

[0078] Step S220, the WAF device generates an encryption key according to the target browser fingerprint information, and encrypts the plaintext to be encrypted by using the encryption key to obtain encrypted data, and replaces the original Cookie in the response information with the encrypted data to obtain the replaced response information.

[0079] Specifically, the WAF device can use the HKDF key derivation algorithm to process the target browser fingerprint information to obtain the encryption key. Wherein, the salt value salt used in the HKDF key derivation algorithm is a fixed value, so that the client can generate the current browser fingerprint information based thereon. And, the client encrypts the plaintext to be encrypted by using the encryption key to obtain the encrypted data.

[0080] Step S230, the WAF device sends the replaced response information to the client.

[0081] For example, when the replaced response information exceeds the browser limit, the WAF device can slice the encrypted data to send to the client in multiple times, and the client can assemble the encrypted data.

[0082] Step S240, the client generates the current browser fingerprint information based on the plurality of characteristics of the browser when receiving the replaced response information carrying the encrypted data sent by the WAF device.

[0083] It should be understood that the generation process of the current browser fingerprint information and the generation process of the target browser fingerprint information are the same, and specific descriptions can be referred to the generation process of the target browser fingerprint information.

[0084] It should be noted that, here, the current browser fingerprint information is described in order to distinguish the browser fingerprint information stored in the WAF device.

[0085] Step S250, the client generates a decryption key by using the current browser fingerprint information, and performs a decryption operation on the encrypted data by using the decryption key.

[0086] Specifically, the client can process the current browser fingerprint information by using the HKDF key derivation algorithm to obtain a decryption key. The salt value used in the HKDF key derivation algorithm here is the same as the salt value used in the HKDF key derivation algorithm in step S220.

[0087] In step S260, in the case of decryption failure, the client considers that the original Cookie carried in the response information is illegal.

[0088] Specifically, the client decrypts the encrypted data by using the decryption key. If the decryption is successful, the current browser fingerprint information and the target browser fingerprint information are compared. If the comparison result is consistent, it is considered that the response information is legal. In the subsequent process of interacting with the WAF device, the encrypted data can be added to the related message according to the indication of the Set-Cookie response header. Otherwise, it is considered that the original Cookie carried in the response information is illegal, and a blank page is displayed.

[0089] In addition, in the subsequent process of interacting with the WAF device, the WAF device can perform the following operations: if the request does not contain the encrypted data or the encrypted data decryption fails, it is directly rejected; the browser fingerprint information in the encrypted data is checked for expiration; and it is checked whether the accessed resource matches the role permission. If all the checks are passed, the request is released.

[0090] In addition, the role-based access permission control includes: role definition: the administrator configures the role and the accessible API list thereof; role binding: the WAF device embeds the role information to which the user belongs in the encrypted data; request verification: the WAF device extracts the role information after decrypting the encrypted data to determine whether there is access permission, and if there is no permission, the access is rejected; dynamic permission change: the role permission is adjusted in real time, and the client is required to re-authenticate.

[0091] Therefore, by means of the above technical solutions, the browser fingerprint information obtained by the WAF device is used to generate a key, the Cookie content is encrypted, and then the encrypted content is decrypted by the client using the newly generated browser fingerprint, so that the Cookie content can only be decrypted and used in the original generation environment, and a strongly bound and non-migratable session credential is also realized, thereby improving the security and reducing the state burden of the server.

[0092] In addition, the present application also has the following technical effects:

[0093] Non-migration: Cookie ciphertext can only be decrypted in the original browser environment, migration is invalid; No server state burden: no need for the server to save Session, only to parse and verify encrypted cookies can complete authentication; Anti-forgery / tamper-proof: encrypted cookies with timestamp, to prevent replay or forgery; Compatible with multiple business models: support encryption / encapsulation / signature and other mode configuration.

[0094] It should be understood that the above-mentioned browser fingerprint-based session protection method is only exemplary, and those skilled in the art can make various modifications according to the above-mentioned method, and the scheme after the modification also belongs to the protection scope of the present application.

[0095] Figure 3 A structural block diagram of an electronic device provided by an embodiment of the present application is shown. As shown in Figure 3 The electronic device 300 can include one or more of the following components: a processor 310, a memory 320 coupled with the processor 310, wherein the memory 320 can store one or more computer programs, and the one or more computer programs can be configured to be executed by the one or more processors 310 to implement the method described in the above embodiments.

[0096] The processor 310 can include one or more processing cores. The processor 310 connects various parts in the entire electronic device 300 by various interfaces and lines, and performs various functions of the electronic device 300 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 320, and calling data stored in the memory 320. Optionally, the processor 310 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 310 can integrate a combination of one or several of a central processing unit (CPU), a graphics processor (GPU), and a modem. Among them, the CPU mainly processes operating systems, user interfaces, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 310, but can be implemented by a separate communication chip.

[0097] The memory 320 may include random access memory (RAM) or read-only memory (ROM). The memory 320 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 320 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described above. The data storage area may also store data created by the electronic device 300 during use.

[0098] Understandably, electronic device 300 may include more or fewer structural elements than those shown in the above block diagram, such as power supply, input buttons, camera, speaker, screen, Wi-Fi (Wireless Fidelity) module, Bluetooth module, sensor, etc., and may not be limited herein.

[0099] This application discloses a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the session protection method based on browser fingerprints as described above.

[0100] This application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program, when executed by a processor, implements the session protection method based on browser fingerprints as described above.

[0101] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0103] It should be noted that the description of the application is not limited to the embodiments described above. It is possible to make various modifications and variations to the embodiments described above without departing from the scope of the application. The application is therefore not limited to the embodiments described above, but can also include any modifications and variations within the scope of the application. It should be noted that in the claims the word comprising does not exclude other elements not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the claims the word "comprising" does not exclude other elements being present in addition to the elements listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The word "first", "second" and the like do not imply any order, quantity, or importance, but rather are used to identify individual elements. The terms "including", "containing", "comprising", "having" and the like are used herein to mean including but not limited to.

[0104] Furthermore, it is noted that the specific features, structures, materials or characteristics described in the specification are to be interpreted as illustrative only and are not to be taken in a limiting sense. The specific features, structures, materials or characteristics are to be considered one of the many respects which can be varied in many ways by those skilled in the art. Therefore, the application should not be construed as being limited to the particular forms described and shown in this specification.

[0105] While the application has been described in connection with specific embodiments thereof, it will be understood that it is capable of further modifications and this application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the application pertains.

[0106] It will be obvious to a person skilled in the art that, as the technology advances, the basic ideas of the application can be implemented in various ways. The application and its embodiments are thus not limited to the examples described above but can vary within the scope of the claims.

Claims

1. A session protection method based on browser fingerprinting, characterized in that, The session protection method is applied to a WAF device in a session protection system, and the session protection system includes a client and the WAF device. The client periodically sends heartbeat packets carrying target browser fingerprint information to the WAF device, and the target browser fingerprint information is a unique identifier of the current browser generated after processing multiple feature information of the client's browser; the session protection method: Upon receiving a response from the server containing the original cookie, generate plaintext to be encrypted, including the original cookie. An encryption key is generated based on the target browser fingerprint information, and the plaintext to be encrypted is encrypted using the encryption key to obtain encrypted data; The original cookie in the response information is replaced with the encrypted data to obtain the replaced response information, and the replaced response information is sent to the client so that the client can authenticate the encrypted data in the replaced response information.

2. The session protection method according to claim 1, characterized in that, The browser's multiple features include mandatory features and optional features. The mandatory features include user agent information, language information, time zone information, browser local encoding information, and screen resolution. The optional features include at least one of the following: Canvas fingerprint, WebGL fingerprint, browser display font, number of browser plugins, and hardware concurrency.

3. The session protection method according to claim 1, characterized in that, The process of generating the target browser fingerprint information includes: The client performs corresponding feature encoding on each of the plurality of features to obtain the encoding of each feature; The client groups all features among the multiple features to obtain multiple feature groups, and constructs a feature vector based on the encoding of all features according to a preset arrangement order of all feature groups; wherein, the feature vector includes multiple subarrays, and each of the multiple subarrays corresponds to a feature group; The client performs perturbation processing on each value in the feature vector to obtain the perturbed feature vector; The client generates the current browser fingerprint information based on the perturbed feature vector.

4. The session protection method according to claim 3, characterized in that, The multiple features include user agent information, language information, and browser local encoding information; the perturbed feature vector is obtained by the client perturbing each value in the feature vector according to the perturbation value; wherein, the perturbation value is obtained by the client using the CRC32 function to calculate the first sum of the encoding of the user agent information, the encoding of the language information, and the encoding of the browser local encoding information.

5. A session protection method based on browser fingerprinting, characterized in that, The session protection method is applied to a client in a session protection system, and the session protection system includes a WAF device and the client. The client periodically sends a heartbeat packet carrying the target browser fingerprint information to the WAF device, and the target browser fingerprint information is a unique identifier of the current browser generated after processing multiple feature information of the client's browser; the session protection method: Upon receiving the replaced response information carrying encrypted data sent by the WAF device, the current browser fingerprint information is generated based on multiple features of the browser. A decryption key is generated using the current browser fingerprint information, and the encrypted data is decrypted using the decryption key. If decryption fails, the original cookie carried in the response information is considered invalid.

6. The session protection method according to claim 5, characterized in that, The browser's multiple features include mandatory features and optional features. The mandatory features include user agent information, language information, time zone information, browser local encoding information, and screen resolution. The optional features include at least one of the following: Canvas fingerprint, WebGL fingerprint, browser display font, number of browser plugins, and hardware concurrency.

7. The session protection method according to claim 5, characterized in that, The process of generating current browser fingerprint information based on multiple features of the browser includes: Each of the plurality of features is encoded accordingly to obtain the code for each feature; All features among the plurality of features are grouped to obtain a plurality of feature groups, and a feature vector is constructed based on the encoding of all features according to a preset arrangement order of all the feature groups; wherein, the feature vector includes a plurality of subarrays, and each of the plurality of subarrays corresponds to a feature group; Each value in the feature vector is perturbed to obtain the perturbed feature vector; Based on the perturbed feature vector, the current browser fingerprint information is generated.

8. The session protection method according to claim 7, characterized in that, The multiple features include user agent information, language information, and browser local encoding information; the perturbation process for each value in the feature vector to obtain the perturbed feature vector includes: The perturbation value is obtained by using the CRC32 function to calculate the first sum of the encodings of the user agent information, the language information, and the browser local encoding information. The perturbation value is used to perturb each value in the feature vector to obtain the perturbed feature vector.

9. The session protection method according to claim 7, characterized in that, The step of generating the current browser fingerprint information based on the perturbed feature vector includes: Calculate the second sum of each element value in the perturbed feature vector and its position value in the corresponding subarray, and perform a remainder calculation on each sum value to obtain the remainder corresponding to each element value. Then, replace each element value in the perturbed feature vector with the corresponding remainder to obtain the replaced feature vector. Each element in the replaced feature vector is mapped to an array of a specified length to obtain the current browser fingerprint information.

10. The session protection method according to claim 9, characterized in that, The step of mapping each element in the replaced feature vector to an array of a specified length to obtain the current browser fingerprint information includes: Based on the group number of the subarray in the replaced feature vector, the position of each element in the replaced feature vector within the corresponding subdata group, the preset fixed spacing, and the length of the specified length array, calculate the element insertion position of each element in the replaced feature vector within the specified length array; According to the order of all elements in the replaced feature vector from front to back, the modulo operation is performed on the third sum of the current value of the specified length array for each element value in the replaced feature vector and its insertion position, to obtain the current browser fingerprint information.

Images