Security verification method based on shutdown request of service gateway

Abstract

The invention discloses a security verification method based on a shutdown request of a service gateway, relates to the technical field of data security, solves the problem that an original data processing mode cannot guarantee data security, and aims at an operated data requester to lock a request feature according to past request data of the data requester, so that the data security is guaranteed. And constructing a data request change curve and determining a change trend interval. Therefore, the system can sensitively perceive abnormal fluctuation of the behavior mode of the requester in real time, and if a normal requester suddenly and greatly increases the request frequency or the data request quantity in a short time and deviates from the set change trend, the system can quickly respond, suspicious requests can be timely suspended, data leakage or malicious occupation of system resources is prevented, and the service life of the requester is prolonged. And the stability and continuity of the service are ensured.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security, in particular to a security check method based on a service gateway machine request. BACKGROUND

[0002] The service gateway machine is the core hub of the entire security check system and bears important responsibilities. On the one hand, it connects a large number of external data requesters and is the first checkpoint for data flowing into the system; on the other hand, it closely cooperates with the internal business system to ensure that legitimate data can be smoothly and safely transmitted to the backend for processing.

[0003] From the hardware level, the service gateway machine is usually equipped with a high-performance processor to quickly process massive request data and instantly complete complex check algorithm operations. A large-capacity memory can cache frequently accessed data and request feature information, reduce data reading delay, and speed up the check process. At the same time, the service gateway machine has redundant network interfaces to ensure the stability of network connection and prevent single-point failure from causing service interruption.

[0004] The application with the publication number CN111935169A discloses a business data access method, device, equipment and storage medium, which is suitable for the security field of cloud technology. The method comprises the following steps: when a business access request is intercepted, a first check credential matched with the business access request is determined based on a first zero-trust access policy issued by a security management server; the first check credential is forwarded to the security management server through an intelligent gateway, so that the security management server performs legality check on the first check credential based on a check auxiliary parameter corresponding to the first check credential, and obtains a legal check result; when the legal check result indicates that the first check credential is legal, a business response result is obtained through the intelligent gateway, and the business response result is output to an application display interface.

[0005] When the service gateway accesses data, it generally directly discriminates based on the IP address of the corresponding data requester. If the corresponding IP address is the recorded address, the corresponding data request is directly allowed; if it is not recorded, the specific process of the data request is not allowed. However, this processing method is not comprehensive. The data requesters who have been allowed may also be subject to data tampering by other software, resulting in problems with the requested data and thus causing data security problems in the data service gateway. SUMMARY

[0006] In view of the deficiencies of the prior art, the application provides a security check method based on a service gateway machine request, which solves the problem that the original data processing method cannot guarantee data security.

[0007] To achieve the above object, the application is implemented by the following technical solutions: A security check method based on service gateway machine request, comprising the following steps: Step one, confirm the data requestor associated with the current service gateway, identify whether the data requestor belongs to the allowed requestor of the service gateway, if yes, execute step two, monitor the request process of the data requestor, if not, execute step three, check and analyze the request data of the data requestor, the specific sub-steps are: S11, confirm the IP address of the data requestor associated with the current service gateway, and mark the confirmed IP address as the address to be checked; S12, compare the address to be checked with the IP address stored in the pre-stored database of the current service gateway, confirm whether there is a comparison result for the address to be checked, if yes, execute step two, if not, execute step three; Step two, confirm the request data associated with the data requestor in the past data request stage, and lock the request characteristics belonging to the data requestor from the confirmed request data, based on the confirmed request characteristics, identify whether the data currently requested by the data requestor is normal, and determine whether the data request process of the data requestor needs to be suspended, the specific method is: S21, take the current time as the reference time, define a set of processing periods, the processing period is a preset period, the processing period belongs to the past period, and the end time of the processing period is the reference time, confirm the request data associated with the data requestor in the processing period, confirm the data request amount associated with the corresponding request times from the confirmed request data, generate the data request change curve belonging to the data requestor based on the different data request amounts associated with different request times, the horizontal coordinate axis of the data request change curve is the time line, and the vertical coordinate axis is the data request amount; S22, confirm the change trend of adjacent data points from the data request change curve of the data requestor: mark the time difference between adjacent data points as Sc, mark the data request amount value difference between adjacent data points as Zc, Zc=|previous data point data request amount-posterior data point data request amount|, and confirm the change trend Q associated with adjacent data points by Q=Zc÷Sc; Confirm the change trend between several groups of adjacent data points in the data request change curve in turn, select the minimum value and the maximum value from the confirmed several groups of change trends, and determine the change trend interval based on the selected minimum value and the maximum value, and take the determined change trend interval as the request characteristics of the data requestor; The specific method for identifying whether the data currently requested by the data requestor is normal is: S23, processing the request data volume associated with different request times of the data requester, and marking the request data volume associated with different request times as L i wherein i represents different request times, and Qb=|L j -L j+1 |÷|T j -T j+1 |confirm the characteristic value Qb, wherein j∈i, wherein T j belongs to the request time associated with the corresponding request times; S24, identifying whether the characteristic value Qb belongs to the change trend interval: if Qb∈change trend interval, continue to monitor; if Qb∉change trend interval, mark this data requester as an abnormal requester; The specific way to determine whether to suspend the data request process of the data requester is: S25, based on the evaluated abnormal requester, confirming the specific data requested by the abnormal requester at the current time and marking it as to-be-managed data, identifying the separation characters of the data from the to-be-managed data, determining the data character volume between the separation characters, and confirming the different data character volumes associated from the several separation characters; S26, identifying whether the several groups of data character volumes confirmed in the to-be-managed data exist in the past request data of the data requester: If all exist, the abnormal requester is re-marked as a normal requester, and continues to be monitored; If the several groups of data character volumes confirmed do not all exist in the past request data of the data requester, the data request process of the abnormal requester is suspended, and the request data of the abnormal requester this time is displayed; Step three, recording the request data of the initial request of the data requester, and performing initial read-write processing on the recorded request data, determining the data registry table of reading and writing, and then based on the specific running process of the corresponding request data, evaluating whether the running process is consistent with the number of data registry table to determine whether there is a hidden registry table, and the specific sub-steps are: S31, recording the request data requested this time, and performing read-write processing on the recorded request data, and recording the number of data registry table G1 after the read-write processing is completed; S32, performing running processing on the request data after the read-write processing is completed, recording the specific number G2 of running process, and identifying whether the specific number G2 of running process is consistent with the number G1 of data registry table: If G1=G2, the data request process of the data requester is allowed; If G1≠G2, it means that there is a hidden registry table, then the data request process of the data requester is suspended, and the request data and data registry table read and written this time are deleted.

[0008] The application provides a security check method based on service gateway machine request. For the data requestor that has been running, the data request change curve is constructed and the change trend interval is determined according to the past request data locking request characteristics, which enables the system to realize real-time and sensitive detection of abnormal fluctuations of the requestor behavior mode. If a normal requestor suddenly increases the request times or data request amount in a short time, deviates from the established change trend, the system can quickly respond, suspend the suspicious request in time, prevent data leakage or malicious occupation of system resources, and ensure the stability and continuity of the service. In the face of initial request or unfamiliar IP address data requestor, the unique read-write processing and registry number comparison mechanism plays a key role. It can accurately detect whether there is hidden registry and hidden running process, which is like a pair of "perspective eyes" for the system, which can find out the risks hidden in the system by hidden means; once the abnormality is found, the request is suspended and the related data is deleted, avoiding the potential risk of data tampering and malicious code implantation, and effectively safeguarding the purity and safety of the system. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 The figure is a schematic diagram of the method of the application; Figure 2 The figure is a schematic diagram of the evaluation of the data request process. DETAILED DESCRIPTION

[0010] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0011] Please refer to Figure 1 The application provides a security check method based on service gateway machine request, comprising the following steps: Step one, confirm the data requestor associated with the current service gateway, identify whether the data requestor belongs to the allowed requestor of the service gateway, if it belongs to, execute step two, monitor the request process of the data requestor, if it does not belong to, execute step three, check and analyze the request data of the data requestor, wherein the specific sub-step for identification is: S11, confirm the IP address of the data requestor associated with the current service gateway, and mark the confirmed IP address as the address to be checked; S12, compare the to-be-verified address with the IP address stored in the pre-stored database of the current service gateway, confirm whether there is a comparison result for the to-be-verified address, if there is a comparison result (that is, the IP address of the data requester has been stored in the database), execute step two, if there is no comparison result (representing that the IP address is not pre-stored in the database, that is, the data requester does not belong to the specific requesters allowed by the service gateway), execute step three; Step two, confirm the request data associated with the data requester in the past data request stage, and lock the request characteristics of the data requester from the confirmed request data, based on the confirmed request characteristics, identify whether the data currently requested by the data requester is normal, and determine whether the data request process of the data requester needs to be suspended, specifically, in the data request process, there are corresponding request times and associated request data volumes, and the same data requester generally has corresponding request characteristics in the data request process, so the current stage of the data request process can be identified based on the confirmed request characteristics, if abnormal, the abnormality needs to be determined, and the access process is suspended synchronously, if not abnormal, no abnormality needs to be determined, and the subsequent monitoring process can be executed; Among them, the specific way to confirm the request characteristics of the data requester is: S21, define a group of processing periods based on the current time as the reference time, the processing period is a pre-set period, the specific value is determined by the operator according to experience, the processing period belongs to the past period, and the end time of the processing period is the reference time, confirm the request data associated with the data requester in the processing period, confirm the data request volume associated with the corresponding request times from the confirmed several groups of request data, and generate the data request change curve of the data requester based on the different data request volumes associated with different request times, the horizontal coordinate axis of the data request change curve is the time line, and the vertical coordinate axis is the data request volume, different request times correspond to different request times, and different request times correspond to different data request volumes, so the corresponding coordinate points can be selected in the two-dimensional coordinate system, and the data request change curve of the data requester can be generated based on the selected several groups of coordinate points; S22, confirm the change trend of adjacent data points from the data request change curve of the data requester: the time difference between adjacent data points is marked as Sc, and the data request value difference between adjacent data points is marked as Zc, Zc=|previous data point data request volume-posterior data point data request volume|, and the change trend Q associated with adjacent data points is confirmed by Q=Zc÷Sc; The changing trends between several groups of adjacent data points in the data request change curve are confirmed in turn, and the minimum and maximum values ​​are selected from the confirmed groups of changing trends. The changing trend interval is determined based on the selected minimum and maximum values, and the determined changing trend interval is used as the request feature of this data requester. The specific way to identify whether the data requested by this data requester is valid is as follows: S23. Process the amount of request data associated with different numbers of subsequent requests from the data requester, and label the amount of request data associated with different numbers of requests as L. i Where i represents the number of different requests, using: Qb=|L j -L j+1 |÷|T j -T j+1 |Confirm the eigenvalue Qb, where j∈i, and T j The request time associated with the corresponding number of requests; S24. Identify whether the feature value Qb belongs to the trend range: If Qb∈The trend range, continue monitoring; if Qb∉The trend range, mark this data requester as an abnormal requester. Specifically, the abnormality determination of the data requester is based on the stage characteristics generated in the past. The data requester has different data request characteristics. Based on these data request characteristics, it can be assessed whether the data request process of this data requester is in a normal state. If the characteristic trend of the data request deviates greatly from the past request characteristics, it means that the data requested by this data requester is abnormal. The number of data requests is based on the set frequency, that is, the time change between data requests is almost the same. The amount of data requests also has relevant characteristics, so the corresponding data request characteristics can be locked. The specific method for determining whether the data request process of this data requester needs to be suspended is as follows: S25. Based on the assessed abnormal requester, confirm the specific data requested by the abnormal requester at the current moment and mark it as data to be managed. Identify the data separator characters from the data to be managed. The separator characters can be directly identified by the service gateway. Determine the amount of data characters between the separator characters. Identify the different amounts of data characters associated with several separator characters. S26. Identify whether several sets of data character quantities confirmed in the data to be managed exist in the past request data of this data requester (in its past request data, there are also different data quantities associated with different delimiter characters, all of which are already generated data characteristics): If all exist, then this abnormal requester will be reclassified as a normal requester and monitored continuously; Conversely, the data request process of the abnormal request party is suspended, and the request data of the abnormal request party is displayed for external maintenance personnel to view and assess whether the request data of the abnormal request party is abnormal, and the request data of the abnormal request party is processed (if the data has a security problem, the IP address of the data request party is pulled to the blacklist).

[0012] Step three, combination Figure 2 The request data of the initial request of the data request party is recorded, and the recorded request data is read and written to determine the data registry, and based on the specific running process of the corresponding request data, it is determined whether the running process is consistent with the number of data registry to determine whether there is a hidden registry. The specific sub-steps for determining are: S31, record the request data requested this time, and record the request data for read-write processing. After the read-write processing is completed, the number of data registry G1 is recorded. S32, the request data after read-write processing is run, and the specific number G2 of running process is recorded. The specific number G2 of running process is identified whether it is consistent with the number G1 of data registry: If G1=G2, the data request process of the data request party is allowed, and the operation personnel sends an IP address permission adaptation signal to the data request party, and the IP address of the data request party is recorded in the database associated with the system. If G1≠G2 (representing that there is a hidden data registry and a corresponding hidden running process, so the request data may have data risk, and access suspension is needed), the data request process of the data request party is suspended, and the request data and data registry read and written this time are deleted, and the data request party and the request data associated this time are displayed, and the corresponding operation personnel assesses whether the IP address of the data request party needs to be pulled into the blacklist.

[0013] Some of the data in the above formula are dimensionless numerical calculations, and the contents not described in detail in the specification are all prior art known to those skilled in the art.

[0014] The above embodiments are only used to illustrate the technical method of the present application and are not limited. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical method of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical method of the present application.

Claims

1. A security verification method based on service gateway requests, characterized in that, Includes the following steps: Step 1: Confirm the data requester associated with the current service gateway and identify whether the data requester is an allowed requester of the service gateway. If it is, proceed to Step 2: Monitor the request process of the data requester. If it is not, proceed to Step 3: Verify and analyze the request data of the data requester. Step 2: Confirm the request data associated with the data requester in the previous data request stages, and lock the request characteristics belonging to this data requester from the confirmed request data. Based on the confirmed request characteristics, identify whether the data currently requested by this data requester is normal, and determine whether it is necessary to suspend the data request process of this data requester. Step 3: Record the initial request data from the data requester, perform initial read and write processing on the recorded request data, determine the data registry to be read and written, and then, based on the specific running process of the corresponding request data, evaluate whether its running process is consistent with the number of data registry entries to determine whether there is a hidden registry.

2. The security verification method based on service gateway requests according to claim 1, characterized in that, In step one, the specific sub-steps for identifying whether the data requester is a permitted requester of the service gateway are as follows: S11. Confirm the IP address of the data requester associated with the current service gateway, and mark the confirmed IP address as the address to be verified; S12. Compare the address to be verified with the IP address stored in the current service gateway's pre-stored database to confirm whether there is a comparison result for this address to be verified. If there is a comparison result, proceed to step two; if there is no comparison result, proceed to step three.

3. The security verification method based on service gateway requests according to claim 1, characterized in that, In step two, the specific method for confirming the data requester's request characteristics is as follows: S21. Using the current time as the base time, define a set of processing cycles. The processing cycle is a preset cycle and belongs to the past cycle. The end time of the processing cycle is the base time. Confirm several sets of request data associated with the data requester within the processing cycle. From the confirmed sets of request data, confirm the data request quantity associated with the corresponding number of requests. Based on the different data request quantities associated with different number of requests, generate a data request change curve for the data requester. The horizontal axis of this data request change curve is the time line, and its vertical axis is the data request quantity. S22. From the data request change curve of the data requester, confirm the change trend of adjacent data points: mark the time difference between adjacent data points as Sc, mark the difference of data request amount between adjacent data points as Zc, where Zc = |data request amount of the previous data point - data request amount of the subsequent data point|, and use Q = Zc ÷ Sc to confirm the change trend Q associated with adjacent data points. The changing trends between several groups of adjacent data points in the data request change curve are confirmed sequentially. The minimum and maximum values ​​are selected from the confirmed changing trends, and the changing trend interval is determined based on the selected minimum and maximum values. The determined changing trend interval is used as the request feature of this data requester.

4. The security verification method based on service gateway requests according to claim 3, characterized in that, In step two, the specific method for identifying whether the data requested by the data requester is valid is as follows: S23. Process the amount of request data associated with different numbers of subsequent requests from the data requester, and label the amount of request data associated with different numbers of requests as L. i Where i represents the number of different requests, using: Qb=|L j -L j+1 |÷|T j -T j+1 |Confirm the eigenvalue Qb, where j∈i, and T j The request time associated with the corresponding number of requests; S24. Identify whether the feature value Qb belongs to the trend range: If Qb∈the trend range, then continue monitoring.

5. The security verification method based on service gateway requests according to claim 4, characterized in that, In step S24, if Qb ∉ the change trend range, then this data requester is marked as an abnormal requester.

6. The security verification method based on service gateway requests according to claim 5, characterized in that, In step two, the specific method for determining whether the data request process of the data requester needs to be paused is as follows: S25. Based on the assessed abnormal requester, confirm the specific data requested by the abnormal requester at the current moment and mark it as data to be managed. Identify the data separator characters from the data to be managed, determine the amount of data characters between the separator characters, and identify the associated different amounts of data characters from several separator characters. S26. Identify whether several sets of data characters identified in the data to be managed exist in the past request data of this data requester: If all exist, the abnormal requester will be reclassified as a normal requester and monitored continuously.

7. A security verification method based on a service gateway request according to claim 6, characterized in that, In step S26, if not all of the confirmed sets of data characters exist in the past request data of this data requester, then the data request process of this abnormal requester is paused, and the request data of this abnormal requester is displayed.

8. The security verification method based on service gateway requests according to claim 1, characterized in that, In step three, the specific sub-steps for determining whether a hidden registry entry exists are as follows: S31. Record the requested data for this request, and perform read and write processing on the recorded request data. After the read and write processing is completed, record the number of data registry entries G1. S32. Process the requested data after the read / write process is completed, and record the specific number of running processes G2. Check whether the specific number of running processes G2 is consistent with the number of data entries in the registry G1: If G1=G2, the data request process of this data requester is allowed; If G1≠G2, it means that a hidden registry exists. In this case, the data request process of this data requester will be paused, and the requested data and the data registry will be deleted.

Images