Method and terminal for preventing privacy attacks on game data

Abstract

The application relates to the field of game data protection, in particular to a method and a terminal for preventing game data privacy attacks. The method comprises the following steps: obtaining a service step and service data of a target service; generating a service mapping diagram according to the service step and the service data; inserting an event stake in the service mapping diagram, checking the service step through the event stake, and preventing the target service from executing a subsequent service step of the event stake if the checking fails; inserting a data stake in the service mapping diagram, listening to a change state of the service data and a type state of the target service through the data stake, and preventing the target service from executing a subsequent service step of the data stake if the change state of the service data is abnormal or the type state of the target service is abnormal. The application improves the efficiency and reliability of overall security protection while ensuring the real-time transmission efficiency of game data.

Description

Technical Field

[0001] This invention relates to the field of game data protection technology, and in particular to methods and terminals for preventing game data privacy attacks. Background Technology

[0002] In current game security systems, mainstream technologies primarily focus on three layers: protocol-level encryption, data transmission encryption, and SSL certificate authentication. Specifically, for web security, symmetric encryption algorithms such as DES and AES are commonly used to encrypt data packets. For data security, data obfuscation and compression combined with lightweight encryption techniques (such as CRC checksums and multiple XOR operations) are typically used to protect game data. Regarding protocol security, security is enhanced by protecting communication protocol characteristics (such as HTTP / 1.0 and HTTP / 1.1 frameworks) and their extended attributes. IP blacklist filtering is also a common supplementary defense method. However, these existing technologies present significant technical contradictions: First, the real-time transmission characteristics of game data impose strict limitations on data packet size, preventing the use of overly complex encryption algorithms, leading to an irreconcilable conflict between security strength and performance requirements. Second, existing solutions focus only on single-layer protection, either concentrating on data type protection (Web or Socket communication) or solely on the integrity of the protocol itself, lacking a comprehensive solution that can simultaneously address multi-dimensional protection. The fundamental problem with these technological contradictions lies in the structural flaws of existing protection systems: on the one hand, traditional encryption methods primarily protect data content and are ineffective against attacks targeting the protocol layer; on the other hand, security vulnerabilities introduced during protocol extensions (such as HTTP protocol extensions potentially leading to framework defects) are easily exploited by attackers, resulting in serious security risks such as server crashes, data anomalies, and logical jumps. Existing protection schemes fail to form a collaborative defense mechanism across multiple dimensions, including process security, data structures, and communication protocols, leading to multi-dimensional security threats faced by game systems in practical applications. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide a method for preventing game data privacy attacks, which can identify and block protocol layer attacks that may cause system crashes or data anomalies.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A method for preventing game data privacy attacks, the method includes: Obtain the business steps and business data of the target business; Based on the business steps and the business data, a business mapping diagram is generated; An event stub is inserted into the business mapping graph. The business step is validated through the event stub. If the validation fails, the target business is prevented from executing the business steps following the event stub. Insert data stubs into the business mapping graph, and monitor the change status of the business data and the type status of the target business through the data stubs. If the change status of the business data is abnormal, or the type status of the target business is abnormal, prevent the target business from executing the subsequent business steps of the data stub.

[0005] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A terminal for preventing game data privacy attacks includes a memory, a processor, and a computer program stored on the memory and running on the processor. When the processor executes the computer program, it performs the following steps: Obtain the business steps and business data of the target business; Based on the business steps and the business data, a business mapping diagram is generated; An event stub is inserted into the business mapping graph. The business step is validated through the event stub. If the validation fails, the target business is prevented from executing the business steps following the event stub. Insert data stubs into the business mapping graph, and monitor the change status of the business data and the type status of the target business through the data stubs. If the change status of the business data is abnormal, or the type status of the target business is abnormal, prevent the target business from executing the subsequent business steps of the data stub.

[0006] The beneficial effects of this invention are as follows: By inserting event stubs into the business mapping diagram to verify the business execution order, this invention can ensure the correctness of business logic at the process level, effectively preventing logical jumps or process chaos caused by malicious exploitation of the protocol framework. Compared with traditional methods that rely solely on data encryption or the extended attributes of the protocol itself, it provides proactive protection for business processes. By inserting data stubs to monitor changes in business data and abnormal business types, it can detect and block attack attempts targeting data states and business types in real time, such as data tampering or type obfuscation attacks. Compared with passive hiding methods such as data obfuscation and compression encryption (e.g., CRC, multiple XOR), it significantly improves the proactive perception and defense accuracy of abnormal data states. The provided method, through a dual protection mechanism combining dynamic process verification and data state monitoring, can proactively identify and block potential privacy attacks during business execution, such as illegal data access, tampering, or unauthorized operations, thereby effectively improving the security and privacy protection level of game data. Attached Figure Description

[0007] Figure 1 A flowchart illustrating the steps of a method for preventing game data privacy attacks, as provided in an embodiment of the present invention; Figure 2 A schematic diagram of the structure of a terminal for preventing game data privacy attacks provided in an embodiment of the present invention; Figure 3 A business process diagram of a method for preventing game data privacy attacks provided in an embodiment of the present invention; Figure 4 A flowchart illustrating a method for preventing game data privacy attacks provided in an embodiment of the present invention; Figure 5 A map data flow diagram of a method for preventing game data privacy attacks provided in an embodiment of the present invention; Figure 6 Protocol stub diagram for a method to prevent game data privacy attacks provided in an embodiment of the present invention; Detailed Implementation Definitions:

[0008] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0009] In existing technologies, the mainstream security solutions in current game scenarios mainly focus on three layers: protocol-level encryption, data transmission encryption, and SSL certificate authentication mechanisms. These existing solutions fail to form a collaborative defense mechanism across multiple dimensions, including process security, data structure, and communication protocols, leading to multi-dimensional security threats to game systems in practical applications.

[0010] To at least address the aforementioned issues, this invention constructs a business mapping graph and utilizes event stubs to verify step logic and data stubs to monitor data and type status. In this way, it can replace cumbersome data content encryption with lightweight process and status interception, thereby achieving multi-dimensional collaborative security protection of processes and data without increasing the burden on transmission performance.

[0011] The following describes in detail a method for preventing game data privacy attacks according to the present invention, with reference to the appendix. Figure 1 ,include: Step 101: Obtain the business steps and business data of the target business; where the target business is a game business, such as listing items on the consignment shop. A business step is a textual definition of the logical execution order of the target business, including the business type and the specific execution steps under that type, such as "Open backpack -> Select item -> Select item method -> Item quantity and price -> Complete". The business step is denoted as type_step, where type is the business type and step is the number of steps.

[0012] Obtain the business interface of the target business and the corresponding data type. Each game business will define a series of business interfaces. For example, game business 1 has 10 interfaces, each corresponding to a different function.

[0013] For ease of identification and management, the interface naming follows the format: type_step_ndk (i.e., "business type_step_interface").

[0014] For example, sell_bond_01_04XXXX0E_XXXX_XX_08 means: 04XXXX0E: Item ID (4 bytes) XXXX: Quantity (4 bytes) XX: Category, such as buy / sell In this example, sell_bond_01 represents the first step of the "sell bonds" transaction, which involves three key pieces of information: item ID, quantity, and operation type (buy or sell).

[0015] Business data is denoted as type_step_ndk_object, which represents the data types that each interface in the step can accept, such as text, integers, and decimal points.

[0016] Step 102: Generate a business mapping diagram based on the business steps and business data. The business mapping diagram is a mapping of the underlying implementation of the business steps, which includes the combination relationship between the business logic description and the corresponding code execution interface and data type. It is used to transform the textual business logic into an executable underlying business branch structure. For example, "open backpack -> select item" is transformed into the corresponding underlying interface call combination "open backpack corresponding interface -> select item corresponding interface".

[0017] Step 103: Insert event stubs into the business mapping diagram. Verify business steps using these event stubs. If verification fails, prevent the target business from executing subsequent business steps linked to the event stub. An event stub is an event inserted into the business process; its failure to accept the event prevents further execution of subsequent business steps, thus preventing users from simplifying the process for data submission. Verifying business steps determines whether the user is executing the process in the correct order.

[0018] Step 104: Insert data stubs into the business mapping diagram. These data stubs monitor the change status of business data and the type status of the target business. If the change status of the business data or the type status of the target business is abnormal, the subsequent business steps of the target business will be prevented from executing. The data stub is a mechanism for monitoring changes in business data types within the business process. When a change in data type is detected, a false response is returned, and the process is prevented from continuing, thus preventing malicious data manipulation by users. An abnormal change status in business data means that a change in business data is detected, but the changed data does not exist in the current business environment. An abnormal type status in the target business means that an abnormality is detected in the type of the business being analyzed.

[0019] As described above, by acquiring the business steps and data of the target business and generating a business mapping diagram accordingly, a precise model of the business execution process is constructed. By inserting event stubs into the business mapping diagram, logical verification of the business steps is achieved, intercepting execution paths that do not conform to the preset process. Simultaneously, the inserted data stubs continuously monitor the change status of business data and the type status of the target business, enabling real-time detection of data anomalies or business type anomalies. When an event stub fails verification, or when a data stub detects an anomaly in the change status of business data or the target business type status, the system will prevent the target business from executing subsequent business steps. Therefore, the method provided in this embodiment, through a dual protection mechanism combining dynamic process verification and data status monitoring, can proactively identify and block potential privacy attacks during business execution, such as unauthorized data access, tampering, or unauthorized operations, thereby effectively improving the security and privacy protection level of game data.

[0020] In one embodiment of this application, step 102, generating a business mapping diagram based on business steps and business data, includes: Step 201: Parse the business steps to obtain the business type and business process description of the target business; whereby the business type is the specific classification of the business. The business process description is a textual definition of the execution order of the target business logic.

[0021] Step 202: Obtain the set of business interfaces and the set of business data types corresponding to the business type. The set of business interfaces is a combination of business interfaces present in each game business, consisting of the business type, steps, and interfaces. For example, the first step of the "selling items" step involves the item ID, quantity, and operation type (buy or sell). The set of business data types is the set of data types that each interface in the step can accept, such as text, integers, and decimal points.

[0022] Step 203: Combine and map the business process description, the business interfaces in the business interface set, and the business data types in the business data type set to generate a business mapping diagram; As described above, by parsing business steps to obtain business types and business process descriptions, and then matching these with corresponding sets of business interfaces and business data types, accurate identification of business logic and targeted resource acquisition are achieved. Subsequently, the business process descriptions, business interfaces, and business data types are combined and mapped to construct a structured business mapping diagram. This process systematically integrates and visualizes previously scattered business elements, enabling complex business logic to be presented in a clear and standardized graphical manner. Therefore, this invention can automatically and accurately construct a mapping diagram reflecting the overall business picture, improving the standardization and efficiency of business analysis, and providing a reliable and intuitive data foundation for subsequent business process optimization, system development, or monitoring.

[0023] In one embodiment of this application, step 103 involves inserting an event stub in the service mapping graph, validating the service steps using the event stub, and preventing the target service from executing subsequent service steps of the event stub if the validation fails. This includes: Step 301: Obtain the execution context of the currently executing node in the business mapping graph; wherein, the execution context is the context environment information of the current business mapping graph.

[0024] Step 302: Based on the execution context of the current execution node, insert event stubs into the preset execution nodes of the business mapping graph; Step 303: When the event stub is triggered, obtain the current business step of the target business; Step 304: Determine whether the current business step matches the standard process order corresponding to the execution context of the current execution node; wherein, the standard process order is the preset standard process execution order.

[0025] Step 305: If there is no match, prevent the target business from executing subsequent business steps of the event stub; As described above, by obtaining the execution context of the current execution node and inserting event stubs into the preset execution node, dynamic monitoring of the business execution process is achieved. When an event stub is triggered, the system obtains the current business step of the target business and matches it with the standard process order corresponding to the execution context. If the current business step does not match the standard process order, the system prevents the target business from executing the subsequent business steps of the event stub. By dynamically inserting event stubs into the execution context, precise control over the business execution path is achieved, improving the reliability and compliance of the business process.

[0026] In one embodiment of this application, in step 104, a data stub is inserted into the business mapping graph. The data stub is used to monitor the change status of business data and the type status of the target business. If the change status of the business data is abnormal, or the type status of the target business is abnormal, the target business is prevented from executing subsequent business steps of the data stub, including: Step 401: Insert data stubs in the business mapping diagram; Step 402: Monitor whether business data has changed through data stubs; Step 403: If the business data changes, verify whether the changed business data exists and whether the type of the target business is abnormal. Step 404: If the modified business data does not exist, or the type of the target business is abnormal, a false response message is returned, and the target business is prevented from executing subsequent business steps of the data stub; wherein, the false response message is false execution result information, used to deceive the attacker.

[0027] As described above, this system enables dual monitoring of changes in business data and business types. It can promptly halt processes in case of data or business type anomalies, preventing the continuation of erroneous or illegal business operations, thereby enhancing the security and reliability of the business system. Furthermore, by returning false response information, it avoids exposing internal system information due to abnormal states, thus strengthening the system's anti-interference and protection capabilities.

[0028] In one embodiment of this application, the method further includes: Step 501: Obtain the network communication protocol environment currently running for the target service; wherein, the network communication protocol environment is the network communication framework in which the game is located, and this communication framework is used to agree on the data transmission format.

[0029] Step 502: Create a virtual machine cloud based on the network communication protocol environment and obtain the Internet Protocol address of the virtual machine cloud; wherein, the virtual machine cloud is a virtual container created by replicating the current protocol environment, that is, establishing a replica server to store the current protocol environment, and is a virtual runtime container independently configured for this protocol framework. The Internet Protocol address is Internet Protocol Address.

[0030] Step 503: Obtain the protocol data to be detected and transmit the protocol data to be detected to the Internet Protocol address; wherein, the protocol data to be detected is the protocol data that needs to be detected.

[0031] Step 504: Set a waiting time in the virtual machine cloud, and perform security checks on the protocol data to be tested within the waiting time, then obtain the security check results; the waiting time is a timeout period used to determine dead loop anomalies. The security check protects the protocol data during execution, and performs multiple filtering steps after execution in the virtual machine cloud.

[0032] As described above, by obtaining the network communication protocol environment currently running on the target service, creating a virtual machine cloud based on this environment, and obtaining its Internet Protocol address, a detection platform consistent with the actual network environment of the target service can be constructed. The protocol data to be detected is transmitted to this Internet Protocol address, and a waiting time is set in the virtual machine cloud for security detection. This achieves dynamic and isolated security analysis of protocol data in an environment simulating the real network protocol stack. This method can effectively identify attack behaviors targeting specific network communication protocol environments, improve the accuracy and targeting of security detection, and avoid interference and risks to the actual business system during the detection process.

[0033] In one embodiment of this application, step 504, setting a waiting time in the virtual machine cloud, and performing security detection on the protocol data to be detected during the waiting time, includes: Step 601: Extract the protocol function identifiers contained in the protocol data to be detected; wherein, the protocol function identifiers are the actual function identifiers used in the protocol. For example, if the protocol contains function 1, function 2, function 3, function 4, and function 5, and function 1, function 2, and function 3 are currently actually used, then function 1, function 2, and function 3 are the protocol function identifiers, and other requests that are not actually used are filtered out.

[0034] Step 602: Filter out protocol data other than protocol function identifiers, and execute the protocol data to be detected corresponding to the protocol function identifiers in the virtual machine cloud; Step 603: Verify whether the identity and permission status in the virtual machine cloud has changed before and after executing the protocol data to be tested; where the identity and permission status refers to the current user's operation permission status. When there is a problem with the protocol framework, a privilege escalation operation will be generated to elevate the current user's operation permission.

[0035] Step 604: If the identity and permission status changes, it is determined that the protocol data to be detected has an identity anomaly; where the identity anomaly is an anomaly in the privilege escalation caused by a vulnerability in the protocol framework.

[0036] As described above, by extracting the protocol function identifier and filtering other protocol data, the focus can be placed on the execution of core functional logic, reducing interference from irrelevant data in the virtual machine cloud and thus improving detection efficiency. Subsequently, executing the protocol data corresponding to this identifier in the virtual machine cloud simulates a real function call process. By verifying whether the identity and permission status in the virtual machine cloud changes before and after execution, it can be identified whether the protocol data attempts to illegally escalate or tamper with permissions. If the identity and permission status changes, an identity anomaly is directly determined, achieving targeted detection of unauthorized or impersonated behavior in the protocol data.

[0037] In one embodiment of this application, step 504, setting a waiting time in the virtual machine cloud, and performing security detection on the protocol data to be detected during the waiting time, includes: Step 701: During the security detection of the protocol data to be detected, refresh and extract the content of the protocol data to be detected at predetermined time intervals. Step 702: Determine whether the content of the protocol data to be detected has changed; Step 703: If the content of the protocol data to be detected changes, it is determined that there is an injection anomaly in the protocol data to be detected; wherein, the injection anomaly is an anomaly that causes the server to malfunction by forcibly inserting incorrect data.

[0038] As described above, a dynamic detection method for protocol data injection attacks is provided. By introducing a time-interval-based active content refresh and comparison mechanism in virtual machine clouds, the method overcomes the shortcomings of traditional static detection in detecting intermediate injection attacks in continuous sessions. This improves the accuracy and real-time performance of security detection of protocol data streams in cloud virtualization environments and enhances the system's defense capabilities against threats such as data tampering and malicious injection.

[0039] In one embodiment of this application, step 504, setting a waiting time in the virtual machine cloud, and performing security detection on the protocol data to be detected during the waiting time, includes: Step 801: Monitor the execution time of the security detection of the protocol data to be detected in the virtual machine cloud; where the execution time is the length of time for performing the security detection.

[0040] Step 802: Determine whether the execution time is greater than or equal to the waiting time; Step 803: If the execution time is greater than or equal to the waiting time, it is determined that the protocol data to be detected has an infinite loop exception, and the protocol data to be detected is rejected; wherein, the infinite loop exception is an exception caused by an escaping error or parsing error in the protocol framework.

[0041] As described above, by introducing a time-based infinite loop detection mechanism, the problem of virtual machine cloud security detection process being suspended indefinitely due to malicious or abnormal protocol data is effectively avoided, thereby improving the security detection efficiency and system resource availability of virtual machine cloud, and enhancing the reliability and responsiveness of the entire security detection process.

[0042] In one embodiment of this application, step 504, setting a waiting time in the virtual machine cloud, and performing security detection on the protocol data to be detected during the waiting time, includes: Step 901: Establish an access log in the virtual machine cloud; wherein, the access log is a log that records the data access behavior that accompanies the protocol access.

[0043] Step 902 involves accessing the log records to monitor the read behavior of the protocol data to be tested within the log recording mode of the network communication protocol environment; where the log recording mode is the log mode of the protocol framework. The read behavior refers to the actions performed on the incoming data.

[0044] Step 903: Compare whether the reading behavior matches the preset access content of the protocol data to be detected; wherein, the access content is the preset access content.

[0045] Step 904: If there is no match, the security check result is determined to be empty; where empty security check result means returning empty content.

[0046] As described above, by monitoring and comparing the real-time reading behavior of protocol data with preset access patterns, abnormal access behavior during protocol interaction can be quickly and accurately identified. This enables efficient and secure detection and filtering of network protocol data in a virtual machine cloud environment, improving the targeting and response speed of detection and reducing unnecessary detection overhead.

[0047] The method and terminal for preventing game data privacy attacks described above are applicable to game data protection, especially for multi-dimensional security protection of game business processes, data and protocols. The following is a description of specific implementation methods.

[0048] Step A, refer to the appendix Figure 3 The system retrieves the game's business type and corresponding business steps, generating a business step identifier `type_step`. Here, `type` represents the business type, and `step` represents the specific steps within that business type. For example, when a player lists items for sale, the business type is "sell," and the business steps include opening the inventory, selecting items, selecting item selection method, setting the item quantity and price, and completing. This corresponds to step 101 above. Step B: Obtain the business interface for each game business step and generate a business interface identifier `type_step_ndk`. This identifier consists of the business type, business step, and interface name. The business interface includes the interface function and corresponding parameter fields. The parameter fields include the item identifier, quantity, and operation type. For example, the interface identifier for the first step of the selling business is "sell_bond_01_04XXXX0E_XXXX_XX_08", where "04XXXX0E" represents the item ID (4 bytes), "XXXX" represents the quantity (4 bytes), and "XX" represents the buy or sell operation type. This corresponds to step 101 above.

[0049] Step C: Obtain the data types that each business interface can accept and generate a data object identifier type_step_ndk_object. This identifier consists of the business type, business step, business interface, and data object, and is used to represent the specific data types accepted by the interface, such as text, integers, or decimal points.

[0050] Step D: Create a business map to describe the final result of the business process, and generate a business map to combine and expand the business steps and business interfaces to form specific business process details and code components. The business map consists of multiple business branches. The business map is used to obtain the business description and its corresponding business type and steps. For example, for a player listing items on the consignment shop, creating a business map describes the result of listing on the consignment shop, and generating a business map expands it into a specific combination of interfaces: open_pack_01 (open inventory), select_item_04 (select item), set_item_num / value (set item quantity and price), end (complete). This corresponds to step 102 above.

[0051] Step E, refer to the appendix Figure 4 In the business map process, event stubs are inserted. Event stubs are event nodes used to determine whether the process is executed in sequence. The current business type (type), current business step (step), current business map, and current business map context are obtained. An event notification identifier, Type_step_notify, is inserted based on the current business map and context. If the current operation does not execute the preceding steps in the standard process order, the event stub determines that the event has not been accepted, preventing subsequent business operations from continuing. For example, when a player lists items on the consignment shop, the normal steps are: open the inventory, select an item, select the item method, and set the item quantity and price. If the cheat program directly executes the item selection and subsequent steps, since the inventory opening operation is not performed, the event stub determines that the event has not been accepted, preventing all subsequent operations. This corresponds to step 103 above.

[0052] Step F, refer to Appendix Figure 5In the business process, data stubs are inserted. These stubs are nodes used to monitor data changes. They monitor whether the data corresponding to the data object identifier `type_step_ndk_object` has changed, and whether the business type is abnormal. When a change in business data is detected, it checks whether the changed data exists or is abnormal. If the changed data does not exist or the business type is abnormal, a false message is returned, and the current process is prevented from continuing. For example, if a non-existent item ID is passed to the sale business interface "sell_bond_01_04XXXX0E", and the data stub detects a data change and finds that the item ID does not exist, it returns a false message indicating successful purchase or sale, indicating execution failure and preventing the process from continuing. This corresponds to step 104 above.

[0053] Step G, refer to Appendix Figure 6 This involves replicating the current protocol environment, specifically the network communication framework currently used by the game. This framework is a protocol framework that defines the data transmission format. A replica server with the same protocol framework as the real server is built in the virtual machine cloud. The virtual machine cloud is a virtual container environment used to isolate and detect protocol data. A virtual cloud IP is generated, and the received protocol data is transmitted to the replica server in the virtual machine cloud. A waiting time is then set in the virtual machine cloud.

[0054] Step H: Perform identity rule detection in the virtual machine cloud, extract the protocol data portion, filter out unused protocol function requests, retain only the currently used protocol function data, execute the retained protocol function data in the virtual machine cloud, check the permissions and logs after execution, and determine whether privilege escalation has occurred. Privilege escalation refers to unauthorized behavior that exceeds the current user's operating permissions. For example, if the current protocol framework has 1 to 5 functions, and only functions 1, 2, and 3 are currently used, then filter out other requests and only put the data of functions 1, 2, and 3 into the virtual cloud for execution, and check whether the data of functions 1, 2, and 3 exploits a framework vulnerability to cause unauthorized escalation of user privileges.

[0055] Step 1: Perform injection rule detection in the virtual machine cloud. Verify whether the protocol data type framework is satisfied, extract the protocol data, and check whether suspicious data has been forcibly inserted into the protocol data. If the protocol data has changed, it is determined that there is suspicious data injection.

[0056] Step J: Perform crash error detection in the virtual machine cloud. If an escape or parsing error occurs in the protocol framework, causing an infinite loop, and the execution time exceeds the set waiting time, a crash error is determined to have occurred, and the protocol data is directly rejected to avoid actual server crashes.

[0057] Step K: Perform abnormal access detection in the virtual machine cloud, establish access logs, read the content in the protocol framework log mode, obtain the behavior log of the incoming data execution, and if the actual access content does not match the expected access content, it is determined that there is unauthorized reading behavior, and empty content is returned directly. For example, if the protocol framework has a vulnerability of unauthorized reading of table a or table b, the content of the incoming data read is recorded through the access log in the virtual cloud, and if it does not match the expectation, empty content is returned.

[0058] Step L: Return the detection results of protocol stubs, execution results of event stubs, and execution results of data stubs in the virtual machine cloud to the processing end. Protocol stubs are a protocol detection mechanism composed of identity rules, injection rules, crash error detection, and abnormal access detection.

[0059] Please refer to Figure 2 The present invention also provides a terminal 210 for preventing game data privacy attacks, including a memory 211, a processor 212, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of a method for preventing game data privacy attacks as described above.

[0060] The beneficial effects of the terminal of the present invention are the same as those of the method described above, and will not be repeated here.

[0061] In summary, this invention, by inserting event stubs into the business mapping graph to verify the business execution order, ensures the correctness of business logic at the process level, effectively preventing logical jumps or process disruptions caused by malicious exploitation of the protocol framework. Compared to traditional methods that rely solely on data encryption or the protocol's own extended attributes, it provides proactive protection for business processes. By inserting data stubs to monitor changes in business data and anomalies in business types, it can detect and block attack attempts targeting data states and business types in real time, such as data tampering or type obfuscation attacks. Compared to passive hiding methods such as data obfuscation and compression encryption (e.g., CRC, multiple XOR), it significantly improves the proactive perception and defense accuracy of abnormal data states. By replicating the protocol environment and performing security testing in the created virtual machine cloud, it achieves dynamic and isolated analysis of the transmission protocol. Any malicious attempts to exploit the protocol framework are confined to the sandbox environment. It can accurately identify and intercept protocol-layer attacks that could cause downtime or data anomalies without affecting the main business process, solving the problems of mutual interference between security testing and business operation, and the difficulty in dealing with unknown protocol vulnerabilities in traditional solutions. While ensuring the efficiency of real-time game data transmission, it improves the overall efficiency and reliability of security protection.

[0062] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for preventing game data privacy attacks, characterized in that, include: Obtain the business steps and business data of the target business; Based on the business steps and the business data, a business mapping diagram is generated; An event stub is inserted into the business mapping graph. The business step is validated through the event stub. If the validation fails, the target business is prevented from executing the business steps following the event stub. Insert data stubs into the business mapping graph, and monitor the change status of the business data and the type status of the target business through the data stubs. If the change status of the business data is abnormal, or the type status of the target business is abnormal, prevent the target business from executing the subsequent business steps of the data stub.

2. The method according to claim 1, characterized in that, The step of generating a business mapping diagram based on the business steps and the business data includes: The business steps are analyzed to obtain the business type and business process description of the target business; Obtain the set of business interfaces and the set of business data types corresponding to the business type; The business process description, the business interfaces in the business interface set, and the business data types in the business data type set are combined and mapped to generate a business mapping diagram.

3. The method according to claim 1, characterized in that, The step of inserting event stubs into the business mapping graph and verifying the execution order of the target business through the event stubs, and preventing the target business from executing the business steps following the event stub if the verification fails, includes: Obtain the execution context of the currently executing node in the business mapping graph; Based on the execution context of the current execution node, insert event stubs into the preset execution node of the business mapping graph; When the event stub is triggered, the current business step of the target business is obtained; Determine whether the current business step matches the standard process sequence corresponding to the execution context of the current execution node; If there is a mismatch, the target service will be prevented from executing subsequent business steps of the event stub.

4. The method according to claim 1, characterized in that, The step involves inserting data stubs into the business mapping diagram, using these data stubs to monitor the change status of the business data and the type status of the target business. If the change status of the business data is abnormal, or the type status of the target business is abnormal, the subsequent business steps of the target business are prevented from being executed by the data stub. This includes: Insert data stubs into the business mapping diagram; The data stubs are used to monitor whether the business data has changed. If the business data changes, then verify whether the changed business data exists and whether the type of the target business is abnormal. If the modified business data does not exist, or the type of the target business is abnormal, a false response message will be returned, and the target business will be prevented from executing subsequent business steps of the data stub.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the network communication protocol environment currently in operation for the target service; A virtual machine cloud is created based on the network communication protocol environment, and the Internet Protocol address of the virtual machine cloud is obtained; Acquire the protocol data to be detected and transmit the protocol data to be detected to the Internet Protocol address; Set a waiting time in the virtual machine cloud, and perform security detection on the protocol data to be detected within the waiting time to obtain the security detection result.

6. The method according to claim 5, characterized in that, The step of setting a waiting time in the virtual machine cloud and performing security checks on the protocol data to be detected during the waiting time includes: Extract the protocol function identifier contained in the protocol data to be detected; Filter out protocol data other than the protocol function identifier, and execute the protocol data to be detected corresponding to the protocol function identifier in the virtual machine cloud; Verify whether the identity and permission status in the virtual machine cloud has changed before and after executing the protocol data to be detected; If the identity and permission status changes, it is determined that the protocol data to be detected has an identity anomaly.

7. The method according to claim 5, characterized in that, The step of setting a waiting time in the virtual machine cloud and performing security checks on the protocol data to be detected during the waiting time includes: During the security detection of the protocol data to be detected, the content of the protocol data to be detected is refreshed and extracted at predetermined time intervals; Determine whether the content of the protocol data to be detected has changed; If the content of the protocol data to be detected changes, it is determined that the protocol data to be detected has an injection anomaly.

8. The method according to claim 5, characterized in that, The step of setting a waiting time in the virtual machine cloud and performing security checks on the protocol data to be detected during the waiting time includes: Monitor the execution time of the security detection performed on the protocol data to be detected by the virtual machine cloud; Determine whether the execution time is greater than or equal to the waiting time; If the execution time is greater than or equal to the waiting time, the protocol data to be detected is determined to have an infinite loop anomaly, and the protocol data to be detected is rejected.

9. The method according to claim 5, characterized in that, The step of setting a waiting time in the virtual machine cloud and performing security checks on the protocol data to be detected during the waiting time includes: Establish access logs in the virtual machine cloud; The access log records the reading behavior of the protocol data to be detected in the log recording mode of the network communication protocol environment; Compare whether the reading behavior matches the preset access content of the protocol data to be detected; If there is no match, the security check result is determined to be empty.

10. A terminal for preventing game data privacy attacks, characterized in that, The terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 9.

Images