Safety protection method and system for preventing blasting attack

Abstract

The invention discloses a safety protection method and system for preventing blasting attacks, and relates to the technical field of data security, and the method comprises the following steps: deploying a bidirectional communication chain between a client and a data rear end through a proxy server; judging a connection request state through a primary verification mechanism, and determining a forward transmission strategy of the two-way communication chain according to the connection request state; judging a response request state through a secondary verification mechanism, and determining a reverse transmission strategy of the two-way communication chain according to the response request state; and executing data security isolation or transmission according to the forward transmission strategy or / and the reverse transmission strategy. The problems of limitation of an account locking mechanism in a high-concurrency scene and conflict with internal security detection in the prior art are solved, and the substantive effects of effectively defending blasting attacks and being compatible with internal security scanning are achieved while stable operation of high-concurrency systems such as middleware and a database is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a security protection method and system for preventing blast attacks. Background Technology

[0002] Brute-force attacks (also known as brute-force attacks) are a type of cyberattack that uses an exhaustive approach to guess usernames and passwords one by one in order to illegally gain access to a system. Attackers use automated tools to try a large number of username and password combinations in a short period of time. The key to their success lies in the target system's insufficient limitation on the number of login attempts or the absence of a lockout mechanism.

[0003] The main existing methods for defending against brute-force attacks are setting login attempt limits and enabling account lockout mechanisms. This means that when the number of failed login attempts reaches a threshold, the account is temporarily or permanently locked. However, this mechanism only applies to personal account access scenarios and has significant drawbacks when application services access middleware and databases. Middleware and databases are core components of application systems, handling high concurrency. If an account lockout mechanism is used, brute-force attacks or misoperations during normal access can lead to account lockout, causing the application system to crash due to the inability to connect to the middleware or database. Furthermore, to ensure security, enterprises regularly perform internal weak password scans on a large number of middleware and databases. These scans, which simulate brute-force attacks, also trigger account lockout mechanisms, leading to abnormal application system interruptions.

[0004] Therefore, there is an urgent need for a method to prevent brute-force attacks that is suitable for middleware and database scenarios, compatible with internal security scanning, and does not affect the normal operation of application systems.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing account lockout mechanisms in high-concurrency access scenarios such as middleware and databases, which can easily lead to system paralysis due to account lockout and incompatibility with internal security scans. This invention proposes a security protection method and system to prevent brute-force attacks. A basic transmission architecture is constructed by deploying a bidirectional communication link between the client and the data backend using a proxy server. This dynamically adjusts and replaces the traditional account lockout mechanism, avoiding the risk of system paralysis due to account lockout. A primary verification mechanism dynamically judges the connection request status to determine the forward transmission strategy, while a secondary verification mechanism analyzes the response request status to determine the reverse transmission strategy. This layered verification mechanism can accurately identify normal access and brute-force attacks, and is compatible with legitimate scenarios such as internal security scans. It overcomes the limitations of existing account lockout mechanisms in high-concurrency scenarios and the conflict with internal security detection. Finally, data security isolation or transmission is flexibly executed based on the forward transmission strategy and / or the reverse transmission strategy. This achieves the substantial effect of effectively defending against brute-force attacks and being compatible with internal security scans while ensuring the stable operation of high-concurrency systems such as middleware and databases (data backends).

[0007] In a first aspect, one technical solution provided in the embodiments of the present invention is: a security protection method against blasting attacks, comprising the following steps: Deploy a two-way communication link between the client and the data backend through a proxy server; The connection request status is determined through a single verification mechanism, and the forward transmission strategy of the bidirectional communication chain is determined based on the connection request status. The response request status is determined through a two-factor authentication mechanism, and the reverse transmission strategy of the bidirectional communication chain is determined based on the response request status. Data security isolation or transmission is performed according to the forward transmission policy and / or the reverse transmission policy.

[0008] Preferably, the deployment of a bidirectional communication link between the client and the data backend via a proxy server includes the following steps: Set the listening port of the data backend as the default listening port of the proxy server, and change the listening address of the data backend to the address of the proxy server. The proxy server presets a whitelist database, a blacklist database, and a feature comparison database based on historical connection information and historical abnormal feature information. It determines the data forwarding channel and the data response channel through the authentication results of the database, and constructs the bidirectional communication chain based on the opening and closing of the data forwarding channel and the data response channel.

[0009] Preferably, the data forwarding channel, combined with a forwarding threshold mechanism, enables unidirectional transmission of connection request data from the client to the data backend; The data response channel, combined with a response threshold mechanism, enables unidirectional transmission of response request data from the data backend to the client; The forwarding threshold mechanism and response threshold mechanism include at least one or more combinations of data transmission rate, data feature matching degree, resource consumption rate, data communication duration, and number of data requests.

[0010] Preferably, the step of determining the connection request status through a single verification mechanism includes the following steps: The connection request information is obtained through a preset listening port, and the connection metadata of the connection request information is extracted; the connection metadata includes at least: client source IP address, client source port, connection timestamp, transport layer protocol type, and connection flag bit; The connection request status of the data forwarding channel is determined based on the comparison results between the connection metadata and the blacklist database.

[0011] Preferably, determining the forward transmission strategy of the bidirectional communication chain based on the connection request status includes the following steps: If the client's source IP address exists in the blacklist database, the connection request status is determined to be an abnormal connection. A TCP connection reset packet or a normal close packet is sent to the client to immediately terminate the TCP connection establishment process and record the interception log. If the client's source IP address exists in the whitelist database, the connection request status is determined to be a normal connection. A TCP connection from the proxy server to the data backend is established based on the preset listening port and proxy server address. The client connection is associated with the backend connection to form a unique communication link identifier. The data forwarding channel is opened so that the client's requested data is transmitted to the data backend through the proxy server and the connection log is recorded.

[0012] Preferably, when determining that the connection request status is normal connection processing, the following steps are also included: Real-time risk scores are obtained by calling external threat intelligence interfaces and combining the client's historical attack behavior characteristics, connection behavior characteristics, threat intelligence correlation characteristics, and environmental characteristics. If the risk score exceeds the preset threshold, the client's IP will be temporarily added to the blacklist database and a time limit for lifting the ban will be set.

[0013] Preferably, the step of determining the response request status through a secondary verification mechanism includes the following steps: The system acquires response request information through a preset listening port and extracts response metadata from the response request information; it then determines the response request type based on the response timing characteristics and protocol characteristics of the response metadata. If the response request type is a login response, the proxy server extracts the client's IP address, compares it with the preset whitelist database, and determines the response request status of the data response channel based on the comparison result; If the response request type is a non-login response, the proxy server checks the response data according to the response threshold mechanism. If the response data meets the threshold mechanism requirements, the response data is transmitted to the client through the response channel; if the response data does not meet the threshold mechanism requirements, the response data is immediately intercepted, a preset error message is returned to the client, and an exception log is recorded.

[0014] Preferably, determining the reverse transmission strategy of the bidirectional communication chain based on the response request status includes the following steps: If the client's source IP address exists in the whitelist database, the response request status is determined to be a normal response. The proxy server will directly transmit the login response data to the client through the data response channel and record the response log in real time. If the client's source IP address does not exist in the whitelist database, the response request status is determined to be a login error. The proxy server performs regular expression matching between the login response data and the preset feature comparison database. If any feature expression matches successfully, the response request status is determined to be a login failure response; otherwise, it is determined to be a login success response. If the login is deemed successful, the proxy server will transmit the login response data to the client through the response channel; the response status record will mark the current two-way communication link as authenticated, update the authentication timestamp, and record the response log in real time; If the login failure response is determined, the proxy server counts the number of login failures of the client. If the current number of failures is greater than or equal to the preset threshold, the login failure response data is transmitted to the client through the response channel, the two-way communication chain is terminated, the client's IP address is added to the blacklist database, and the addition time and triggering rules are recorded, as well as the interception log.

[0015] Preferably, the step of performing data security isolation or transmission according to the forward transmission strategy and / or the reverse transmission strategy includes the following steps: Extract data transmission instructions and data isolation instructions for the forward and reverse transmission strategies; the proxy server opens corresponding data response channels and data forwarding channels to perform secure data transmission according to the data transmission instructions; or, The proxy server performs data security isolation by closing the corresponding data response channel and data forwarding channel according to the data isolation instruction.

[0016] Secondly, an embodiment of the present invention also provides a technical solution: a security protection system against blast attacks, applicable to the aforementioned security protection method against blast attacks, comprising: Client: Sends connection request information to the proxy server and receives and parses the response data from the proxy server; Data backend: Responds to connection request information sent by the client through the proxy server and sends the response request information back to the proxy server; Proxy server: Deployed between the client and the data backend to build a two-way communication chain between the client and the data backend. It uses an internal security authentication mechanism to compare and analyze connection request information and response request information to determine the secure transmission strategy of the two-way communication chain.

[0017] The beneficial effects of this invention are: (1) In view of the problem that existing account locking mechanisms are prone to system paralysis in high-concurrency scenarios such as middleware and databases, this application proposes a dynamic control scheme for bidirectional communication links based on proxy servers. The bidirectional communication link between the client and the data backend is deployed through the proxy server as a transmission carrier. The forward transmission strategy is determined by the dynamic judgment of the connection request status through a primary verification mechanism, and the reverse transmission strategy is determined by the analysis of the response request status through a secondary verification mechanism. This replaces the traditional account locking mechanism and realizes that security control can be carried out by dynamically opening and closing the communication link without locking the account during the defense against brute-force attacks. This avoids the risk of system paralysis caused by account locking and ensures the continuous and stable operation of core components in high-concurrency scenarios. (2) In view of the problem that the existing technology is incompatible with internal security scanning, this application proposes a layered verification intelligent identification scheme. The first verification mechanism extracts connection metadata and compares it with the blacklist and whitelist database to achieve the initial screening of connection requests. The second verification mechanism distinguishes between login response and non-login response and combines the feature comparison database and response threshold mechanism for fine verification, forming a multi-layer protection logic of "initial screening of connection requests - subdivision of response types - dynamic rule matching", which accurately identifies normal access and malicious brute-force attacks, so that the simulated requests of legitimate scenarios such as internal security scanning can be executed normally through compliance verification, thus solving the conflict between security protection and internal security detection. (3) In view of the problem that traditional defense methods have fixed protection strategies and insufficient adaptability, this application proposes a dynamic transmission control scheme based on a multi-dimensional threshold mechanism. By integrating multi-dimensional parameters such as data transmission rate, data feature matching degree, and resource consumption rate through forwarding threshold mechanism and response threshold mechanism, and combining the synergistic effect of forward transmission strategy and reverse transmission strategy, the communication link can be dynamically adjusted in real time. It can quickly isolate abnormal requests (close the channel) and ensure efficient transmission of normal requests (open the channel), which significantly improves the adaptability and flexibility of the security protection mechanism to different network environments and different attack modes.

[0018] The above description of the invention is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0020] Figure 1 This is a flowchart of a security protection method for preventing blast attacks according to the present invention.

[0021] Figure 2 This is a structural block diagram of a security protection system for preventing blast attacks according to the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only one preferred embodiment of this invention and are only used to explain this invention. They do not limit the scope of protection of this invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0023] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations (or steps) can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it may also have additional steps not included in the figures; the process may correspond to a method, function, procedure, subroutine, subroutine, etc.

[0024] Example 1: As Figure 1 As shown, a security protection method against blast attacks includes the following steps: A two-way communication link between the client and the data backend is deployed through a proxy server.

[0025] As an optional embodiment, deploying a bidirectional communication link between the client and the data backend through a proxy server includes the following steps: Set the listening port of the data backend as the default listening port of the proxy server, and change the listening address of the data backend to the address of the proxy server. The proxy server presets a whitelist database, a blacklist database, and a feature comparison database based on historical connection information and historical abnormal feature information. It determines the data forwarding channel and the data response channel through the authentication results of the database, and constructs the bidirectional communication chain based on the opening and closing of the data forwarding channel and the data response channel.

[0026] It is understood that this embodiment uses the method of reusing the listening port of the data backend as the preset listening port of the proxy server and modifying the listening address of the data backend to the address of the proxy server. This allows the proxy server to directly receive connection requests from clients and act as an intermediate node connecting clients and the data backend (including middleware and database, which are core components of the application system). At the same time, the proxy server presets a whitelist database, a blacklist database, and a feature comparison database based on historical connection information and historical abnormal feature information. The authentication results of these databases dynamically determine the opening and closing status of the data forwarding channel (client to data backend) and the data response channel (data backend to client) to build a bidirectional communication chain. This achieves seamless takeover and centralized management of the communication link between the client and the data backend by the proxy server. It does not require changing the client's connection habits (compatibility is ensured by reusing ports) and can rely on the preset database to provide a basis for dynamic adjustment of the communication channel. This allows the bidirectional communication chain to flexibly switch transmission status according to the authentication results. This lays the foundation for an adjustable communication architecture for subsequent precise security protection through primary and secondary verification mechanisms, effectively solving the problem of difficult fine-grained security management of the communication process in the traditional direct connection mode.

[0027] As an optional embodiment, the data forwarding channel, combined with a forwarding threshold mechanism, enables unidirectional transmission of connection request data from the client to the data backend; The data response channel, combined with a response threshold mechanism, enables unidirectional transmission of response request data from the data backend to the client; The forwarding threshold mechanism and response threshold mechanism include at least one or more combinations of data transmission rate, data feature matching degree, resource consumption rate, data communication duration, and number of data requests.

[0028] It is understood that this embodiment combines a data forwarding channel with a forwarding threshold mechanism that includes at least one or more combined parameters such as data transmission rate and data feature matching degree to achieve unidirectional transmission of connection request data from the client to the data backend. Simultaneously, it combines a data response channel with a response threshold mechanism that combines similar parameters to achieve unidirectional transmission of response request data from the data backend to the client. By setting multi-dimensional dynamic judgment criteria for each of the two unidirectional channels, the proxy server can accurately identify normal communication and abnormal attack behavior based on parameters such as the real-time transmission data rate and feature matching degree. When the connection request data meets the forwarding threshold requirements, the forwarding channel transmits smoothly to ensure normal access; when the response request data exceeds the response threshold range, the response channel can promptly restrict transmission to intercept abnormal responses. This achieves independent and refined control over the two unidirectional transmission directions in the bidirectional communication chain, ensuring efficient transmission of legitimate data while also enabling targeted interception of abnormal data, thus improving the accuracy and flexibility of security protection.

[0029] For example, the multi-dimensional parameter combination involved in the forwarding threshold mechanism and the response threshold mechanism is designed based on the attack and defense characteristics of high-concurrency scenarios such as middleware and databases: In response to the characteristic of brute-force attacks, which typically exhibit a large number of repeated requests in a short period of time, a "data request count" parameter is introduced. By setting a threshold for the number of requests per unit time, high-frequency attack behavior can be quickly identified; Considering the difference in data transmission patterns between normal access and attack behavior, "data transmission rate" and "data communication duration" parameters are introduced. When the transmission rate fluctuates abnormally or the communication duration deviates from the normal interaction cycle, it can be determined as a potential attack; To accurately distinguish the data packet characteristics of legitimate requests (such as internal security scans) from those of malicious attacks, a "data feature matching degree" parameter is introduced. By comparing the request data with a preset normal feature library, the legitimacy of the request is verified; At the same time, to avoid excessive consumption of system resources by attack behavior, a "resource consumption rate" parameter is introduced. When the resource consumption of a connection exceeds the normal range, transmission can be restricted in a timely manner to protect the data backend. These parameters are not isolated but flexibly combined according to the actual scenario. For example, when defending against distributed brute-force attacks, "number of data requests" and "data transmission rate" can be combined to form a dual verification. When the number of requests from a certain client IP exceeds the threshold and the transmission rate spikes abnormally, the forwarding threshold mechanism is triggered to block the request. When dealing with special legitimate scenarios such as internal security scans, "data feature matching degree" can be used for priority verification. If the characteristics of the scanned data packet highly match the legitimate characteristics in the whitelist, even if the number of requests is high, the response threshold mechanism will not be triggered, thereby achieving compatibility between security protection and legitimate scenarios.

[0030] The connection request status is determined through a single verification mechanism, and the forward transmission strategy of the bidirectional communication chain is determined based on the connection request status.

[0031] As an optional embodiment, the step of determining the connection request status through a one-time verification mechanism includes the following steps: The connection request information is obtained through a preset listening port, and the connection metadata of the connection request information is extracted; the connection metadata includes at least: client source IP address, client source port, connection timestamp, transport layer protocol type, and connection flag bit; The connection request status of the data forwarding channel is determined based on the comparison results between the connection metadata and the blacklist database.

[0032] It is understood that this embodiment employs a technical means of acquiring connection request information through a preset listening port and extracting connection metadata, including the client's source IP address and client's source port, and then comparing the connection metadata with a blacklist database to determine the connection request status of the data forwarding channel. This enables the proxy server to quickly verify the source and characteristics of the request based on key metadata at the initial stage of connection establishment. When the client's source IP address exists in the blacklist, it can be directly identified as an abnormal connection and interception can be triggered. When the IP address is not in the blacklist, it enters the subsequent processing flow, thereby achieving preliminary screening and rapid response to connection requests. This not only blocks connection requests from known malicious sources in the first instance, but also leaves processing space for further verification of normal connections and requests from unknown sources, improving the response efficiency and accuracy of the forward transmission strategy, and building the first dynamic defense line for the security protection of the bidirectional communication chain.

[0033] As an optional embodiment, determining the forward transmission strategy of the bidirectional communication chain based on the connection request status includes the following steps: If the client's source IP address exists in the blacklist database, the connection request status is determined to be an abnormal connection. A TCP connection reset packet or a normal close packet is sent to the client to immediately terminate the TCP connection establishment process and record the interception log. If the client's source IP address exists in the whitelist database, the connection request status is determined to be a normal connection. A TCP connection from the proxy server to the data backend is established based on the preset listening port and proxy server address. The client connection is associated with the backend connection to form a unique communication link identifier. The data forwarding channel is opened so that the client's requested data is transmitted to the data backend through the proxy server and the connection log is recorded.

[0034] Understandably, this embodiment employs a technique of differentiated processing of connection request status based on the matching results of the client's source IP address in a blacklist or whitelist database. When the client's source IP address is in the blacklist, the connection establishment is immediately terminated and an interception log is recorded by sending a TCP connection reset packet or a normal close packet. When the client's source IP address is in the whitelist, a TCP connection is established from the proxy server to the data backend, and a unique communication link identifier is formed by associating the client with the backend connection. A data forwarding channel is opened to transmit request data and a connection log is recorded. This achieves rapid classification and handling of connection requests: abnormal requests from blacklisted IPs are blocked immediately, intercepting known malicious connections at the source; normal requests from whitelisted IPs are ensured to transmit efficiently through link association and channel opening, while traceability is achieved through log recording. This not only improves the response speed and security of the forward transmission strategy but also ensures the smooth transmission of legitimate requests, providing clear and dynamic control logic for forward data transmission of the bidirectional communication chain.

[0035] As an optional embodiment, when determining that the connection request status is normal connection processing, the following steps are further included: Real-time risk scores are obtained by calling external threat intelligence interfaces and combining the client's historical attack behavior characteristics, connection behavior characteristics, threat intelligence correlation characteristics, and environmental characteristics. If the risk score exceeds the preset threshold, the client's IP will be temporarily added to the blacklist database and a time limit for lifting the ban will be set.

[0036] Understandably, historical attack behavior characteristics refer to the operational traces related to attack behavior recorded on the client within a historical period (such as the last 30 days), including but not limited to the number of attempts to brute-force login, the frequency of sending abnormal data packets, and historical records of triggering security interception mechanisms. Based on the client's historical attack events in the local log system, a quantitative value of 0-100 is obtained by weighting and summing the attack behavior according to its severity (e.g., 2 points / attempt for brute-force attack, 5 points / attempt for successful intrusion) and the time of occurrence (recent behavior has a higher weight, such as 0.7 for behavior in the last 7 days, and 0.3 for behavior in the last 8-30 days). The higher the score, the higher the risk of historical attacks.

[0037] As can be understood, connection behavior characteristics refer to the client's connection pattern characteristics before and after the current connection request, including but not limited to the number of connection requests per unit time, the fluctuation range of connection duration, the structural characteristics of request data packets (such as field integrity and protocol compliance), and the distribution of connection time (such as whether it is concentrated in non-working hours). The deviation is calculated by comparing the client's connection behavior with a preset normal connection model (built based on historical normal access data). For example, the number of requests per unit time exceeding the normal threshold by a multiple, the ratio of the standard deviation of connection duration to the normal standard deviation, and the number of abnormal data packet structures are weighted and integrated into a score of 0-100 (the higher the deviation, the higher the score).

[0038] Understandably, threat intelligence correlation features refer to the degree of matching between client information (such as IP address, port, and request characteristics) and malicious characteristics returned by external threat intelligence interfaces. This includes, but is not limited to, whether the IP is in an external blacklist, whether the request characteristics match those of known attack tools, and whether it is associated with an active attack group. The number of matching external threat intelligence items is counted, and a weighted sum is calculated based on the threat level of the intelligence (e.g., 5 points for high-risk intelligence, 3 points for medium-risk intelligence), resulting in a score from 0 to 100 (the more matching items and the higher the level, the higher the score).

[0039] Understandably, environmental characteristics refer to the risk attributes of the network environment in which the client is located, including but not limited to the geographical location of the client's IP (e.g., whether it is in a known high-risk area), network access method (e.g., whether it uses an anonymous proxy or VPN), terminal device fingerprint (e.g., whether it is a device infected with malware), and network protocol configuration (e.g., whether it uses abnormal ports or non-standard protocols). Each environmental factor is assigned a preset risk level (e.g., 20 points for high-risk areas, 30 points for using anonymous proxies, and 15 points for abnormal protocol configurations), and the sum is standardized to a score of 0-100 (the higher the environmental risk, the higher the score).

[0040] This embodiment employs a method where, upon determining that a connection request is a normal connection request, an external threat intelligence interface is invoked to obtain associated data (the associated data obtained externally refers to external threat information related to the client obtained through invoking the external threat intelligence interface, including but not limited to known malicious IP address databases, global attack event signature databases, characteristics of commonly used attack tools by hacker organizations, and characteristics of recently emerging vulnerability exploits, etc., which are used to supplement local database information and improve the comprehensiveness of client risk assessment). This data is then combined with the client's historical attack behavior characteristics (denoted as A, 0-100 points, higher scores indicate higher risk), connection behavior characteristics (denoted as B, 0-100 points), threat intelligence associated characteristics (denoted as C, 0-100 points), and environmental characteristics (denoted as D, 0-100 points). The real-time risk score is calculated using the weighted summation formula "Real-time Risk S = w1×A + w2×B + w3×C + w4×D" (where w1 + w2 + w3 + w4 = 1, and the weights are dynamically allocated according to the importance of the features). If S exceeds a preset threshold (e.g., 80 points), the client IP is temporarily added to the blacklist and a time limit for lifting the ban is set. This technology enables dynamic risk reassessment of clients in the whitelist. It accurately quantifies potential risks through multi-dimensional feature weighted calculation and avoids long-term blocking of legitimate access while intercepting sudden risks through temporary blacklisting and automatic lifting mechanisms. This makes up for the shortcomings of static blacklists and whitelists in responding to unknown risks with lag, and improves the forward transmission strategy's ability to predict potential threats and the dynamic adaptability of security protection.

[0041] The response request status is determined through a two-factor authentication mechanism, and the reverse transmission strategy of the bidirectional communication chain is determined based on the response request status.

[0042] As an optional embodiment, the step of determining the response request status through a two-factor authentication mechanism includes the following steps: The system acquires response request information through a preset listening port and extracts response metadata from the response request information; it then determines the response request type based on the response timing characteristics and protocol characteristics of the response metadata. If the response request type is a login response, the proxy server extracts the client's IP address, compares it with the preset whitelist database, and determines the response request status of the data response channel based on the comparison result; If the response request type is a non-login response, the proxy server checks the response data according to the response threshold mechanism. If the response data meets the threshold mechanism requirements, the response data is transmitted to the client through the response channel; if the response data does not meet the threshold mechanism requirements, the response data is immediately intercepted, a preset error message is returned to the client, and an exception log is recorded.

[0043] It is understood that this embodiment employs a technical approach of acquiring response request information and extracting response metadata through a preset listening port, determining the response request type based on the response timing characteristics and protocol characteristics of the response metadata, and then performing differentiated verification for login responses and non-login responses. For login responses, the client IP address is extracted and compared with a whitelist database to determine the response request status; for non-login responses, the response data is checked according to a response threshold mechanism. If it meets the requirements, it is transmitted; otherwise, it is intercepted, an error message is returned, and a log is recorded. This achieves refined control over the reverse transmission process: by differentiating response types and adapting different verification logic, it ensures both the security and compliance of login responses and the legality of non-login response transmission through the response threshold mechanism, effectively intercepting abnormal response data. At the same time, it provides accurate basis for the formulation of subsequent reverse transmission strategies, improves the security and controllability of reverse transmission in the bidirectional communication chain, and makes up for the shortcomings of a single verification mechanism in adapting to complex response scenarios.

[0044] As an optional embodiment, determining the reverse transmission strategy of the bidirectional communication link based on the response request status includes the following steps: If the client's source IP address exists in the whitelist database, the response request status is determined to be a normal response. The proxy server will directly transmit the login response data to the client through the data response channel and record the response log in real time. If the client's source IP address does not exist in the whitelist database, the response request status is determined to be a login error. The proxy server performs regular expression matching between the login response data and the preset feature comparison database. If any feature expression matches successfully, the response request status is determined to be a login failure response; otherwise, it is determined to be a login success response. If the login is deemed successful, the proxy server will transmit the login response data to the client through the response channel; the response status record will mark the current two-way communication link as authenticated, update the authentication timestamp, and record the response log in real time; If the login failure response is determined, the proxy server counts the number of login failures of the client. If the current number of failures is greater than or equal to the preset threshold, the login failure response data is transmitted to the client through the response channel, the two-way communication chain is terminated, the client's IP address is added to the blacklist database, and the addition time and triggering rules are recorded, as well as the interception log.

[0045] It is understandable that this embodiment employs a technique of differentiated processing of login responses based on whether the client's source IP address is in the whitelist database. IPs within the whitelist directly transmit login response data and record logs; IPs outside the whitelist determine login success or failure through feature comparison and regular expression matching in the database. If successful, data is transmitted, the link is marked as authenticated, and the timestamp and logs are updated. If failure occurs and the number of attempts exceeds a threshold, a failure response is transmitted, the link is terminated, the IP is added to the blacklist, and relevant information is recorded. This achieves dynamic adaptation to the reverse transmission strategy: the whitelist mechanism ensures efficient response transmission from trusted clients, feature matching and failure count statistics accurately identify and block brute-force attacks from untrusted clients, and log recording and status marking enable full-process traceability. This ensures smooth transmission of legitimate login responses while specifically blocking malicious login attempts, improving the security and controllability of reverse transmission, and effectively balancing protection strength and access efficiency in high-concurrency scenarios.

[0046] Data security isolation or transmission is performed according to the forward transmission policy and / or the reverse transmission policy.

[0047] As an optional embodiment, the step of performing data security isolation or transmission according to the forward transmission strategy and / or reverse transmission strategy includes the following steps: Extract data transmission instructions and data isolation instructions for the forward and reverse transmission strategies; the proxy server opens corresponding data response channels and data forwarding channels to perform secure data transmission according to the data transmission instructions; or, The proxy server performs data security isolation by closing the corresponding data response channel and data forwarding channel according to the data isolation instruction.

[0048] It is understood that this embodiment employs the technique of extracting data transmission instructions and data isolation instructions from the forward and reverse transmission strategies. The proxy server opens the corresponding data response channel and data forwarding channel according to the transmission instructions to perform secure data transmission, or closes the corresponding channel according to the isolation instructions to perform secure data isolation. By directly controlling the opening and closing states of the two unidirectional channels in the bidirectional communication chain, the final control over the data transmission process is achieved. When verification is successful, the channel is opened to ensure efficient data flow; when an anomaly is detected, the channel is closed to prevent the spread of risk. This ensures the smooth transmission of legitimate data in the bidirectional communication chain and enables precise isolation of malicious attack-related data. The security control logic of the forward and reverse transmission strategies is transformed into executable communication link state adjustments, thereby achieving dynamic security protection for data transmission in high-concurrency scenarios such as middleware and databases, effectively balancing system availability and security.

[0049] Example 2, another technical solution provided in this embodiment of the invention is: a security protection system against blast attacks, applicable to the aforementioned security protection method against blast attacks, such as... Figure 2 As shown, it includes: Client: Sends connection request information to the proxy server and receives and parses the response data from the proxy server; Data backend: Responds to connection request information sent by the client through the proxy server and sends the response request information back to the proxy server; Proxy server: Deployed between the client and the data backend to build a two-way communication chain between the client and the data backend. It uses an internal security authentication mechanism to compare and analyze connection request information and response request information to determine the secure transmission strategy of the two-way communication chain.

[0050] It is understood that this embodiment adopts a collaborative architecture consisting of a client, a data backend, and a proxy server. The client is responsible for initiating connection requests and receiving and parsing response data. The data backend is responsible for responding to requests forwarded by the proxy server and providing feedback. The proxy server, as an intermediate node, deploys a bidirectional communication chain and uses an internal security authentication mechanism to analyze connection requests and response requests to determine secure transmission strategies, forming a closed-loop communication link of "client request initiation - proxy server strategy control - data backend response feedback". The client and the data backend do not interact directly. All data is transmitted or isolated through the dynamic strategies of the proxy server. This achieves centralized control over the data interaction process in high-concurrency scenarios and accurately distinguishes between legitimate access and brute-force attacks through the security authentication mechanism of the proxy server. This effectively avoids protection blind spots caused by direct communication and ensures the normal operation of legitimate scenarios such as internal security scanning. Thus, it improves the protection capability against brute-force attacks while ensuring system stability.

[0051] The specific embodiments described above are preferred embodiments of the security protection method and system for preventing blast attacks according to the present invention, and are not intended to limit the specific scope of the present invention. The scope of the present invention includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape and structure of the present invention are within the protection scope of the present invention.

Claims

1. A security protection method against blast attacks, characterized in that: Includes the following steps: Deploy a two-way communication link between the client and the data backend through a proxy server; The connection request status is determined through a single verification mechanism, and the forward transmission strategy of the bidirectional communication chain is determined based on the connection request status. The response request status is determined through a two-factor authentication mechanism, and the reverse transmission strategy of the bidirectional communication chain is determined based on the response request status. Data security isolation or transmission is performed according to the forward transmission policy and / or the reverse transmission policy.

2. The security protection method against blast attacks according to claim 1, characterized in that: The deployment of a bidirectional communication link between the client and the data backend via a proxy server includes the following steps: Set the listening port of the data backend as the default listening port of the proxy server, and change the listening address of the data backend to the address of the proxy server. The proxy server presets a whitelist database, a blacklist database, and a feature comparison database based on historical connection information and historical abnormal feature information. It determines the data forwarding channel and the data response channel through the authentication results of the database, and constructs the bidirectional communication chain based on the opening and closing of the data forwarding channel and the data response channel.

3. The security protection method against blast attacks according to claim 2, characterized in that: The data forwarding channel, combined with a forwarding threshold mechanism, enables unidirectional transmission of connection request data from the client to the data backend; The data response channel, combined with a response threshold mechanism, enables unidirectional transmission of response request data from the data backend to the client; The forwarding threshold mechanism and response threshold mechanism include at least one or more combinations of data transmission rate, data feature matching degree, resource consumption rate, data communication duration, and number of data requests.

4. The security protection method against blast attacks according to claim 2, characterized in that: The method of determining the connection request status through a single verification mechanism includes the following steps: The connection request information is obtained through a preset listening port, and the connection metadata of the connection request information is extracted; the connection metadata includes at least: client source IP address, client source port, connection timestamp, transport layer protocol type, and connection flag bit; The connection request status of the data forwarding channel is determined based on the comparison results between the connection metadata and the blacklist database.

5. A security protection method against blast attacks according to claim 4, characterized in that: The step of determining the forward transmission strategy of the bidirectional communication chain based on the connection request status includes the following steps: If the client's source IP address exists in the blacklist database, the connection request status is determined to be an abnormal connection. A TCP connection reset packet or a normal close packet is sent to the client to immediately terminate the TCP connection establishment process and record the interception log. If the client's source IP address exists in the whitelist database, the connection request status is determined to be a normal connection. A TCP connection from the proxy server to the data backend is established based on the preset listening port and proxy server address. The client connection is associated with the backend connection to form a unique communication link identifier. The data forwarding channel is opened so that the client's requested data is transmitted to the data backend through the proxy server and the connection log is recorded.

6. The security protection method against blast attacks according to claim 5, characterized in that: When determining that the connection request status is normal connection processing, the following steps are also included: Real-time risk scores are obtained by calling external threat intelligence interfaces and combining the client's historical attack behavior characteristics, connection behavior characteristics, threat intelligence correlation characteristics, and environmental characteristics. If the risk score exceeds the preset threshold, the client's IP will be temporarily added to the blacklist database and a time limit for lifting the ban will be set.

7. A security protection method against blast attacks according to claim 5, characterized in that: The process of determining the response request status through a two-factor authentication mechanism includes the following steps: The system acquires response request information through a preset listening port and extracts response metadata from the response request information; it then determines the response request type based on the response timing characteristics and protocol characteristics of the response metadata. If the response request type is a login response, the proxy server extracts the client's IP address, compares it with the preset whitelist database, and determines the response request status of the data response channel based on the comparison result; If the response request type is a non-login response, the proxy server checks the response data according to the response threshold mechanism. If the response data meets the threshold mechanism requirements, the response data is transmitted to the client through the response channel. If the response data does not meet the threshold mechanism requirements, the response data will be immediately intercepted, a preset error message will be returned to the client, and an exception log will be recorded.

8. A security protection method against blast attacks according to claim 7, characterized in that: The step of determining the reverse transmission strategy of the bidirectional communication link based on the response request status includes the following steps: If the client's source IP address exists in the whitelist database, the response request status is determined to be a normal response. The proxy server will directly transmit the login response data to the client through the data response channel and record the response log in real time. If the client's source IP address does not exist in the whitelist database, the response request status is determined to be a login error. The proxy server performs regular expression matching between the login response data and the preset feature comparison database. If any feature expression matches successfully, the response request status is determined to be a login failure response; otherwise, it is determined to be a login success response. If the login is deemed successful, the proxy server will transmit the login response data to the client through the response channel; the response status record will mark the current two-way communication link as authenticated, update the authentication timestamp, and record the response log in real time; If the login failure response is determined, the proxy server counts the number of login failures of the client. If the current number of failures is greater than or equal to the preset threshold, the login failure response data is transmitted to the client through the response channel, the two-way communication chain is terminated, the client IP address is added to the blacklist database, and the addition time and triggering rules are recorded, as well as the interception log.

9. A security protection method against blast attacks according to claim 5 or 8, characterized in that: The process of performing data security isolation or transmission according to the forward transmission strategy and / or reverse transmission strategy includes the following steps: Extract data transmission instructions and data isolation instructions for the forward and reverse transmission strategies; the proxy server opens corresponding data response channels and data forwarding channels to perform secure data transmission according to the data transmission instructions; or, The proxy server performs data security isolation by closing the corresponding data response channel and data forwarding channel according to the data isolation instruction.

10. A security protection system against blast attacks, applicable to the security protection method against blast attacks as described in any one of claims 1 to 9, characterized in that: include: Client: Sends connection request information to the proxy server and receives and parses the response data from the proxy server; Data backend: Responds to connection request information sent by the client through the proxy server and sends the response request information back to the proxy server; Proxy server: Deployed between the client and the data backend to build a two-way communication chain between the client and the data backend. It uses an internal security authentication mechanism to compare and analyze connection request information and response request information to determine the secure transmission strategy of the two-way communication chain.

Images