A network security management method and related products

Abstract

The application discloses a network security management method and related device. The method is applied to a protection device, in which a target network request from a client device is received, a first verification information script is sent to the client device, the first verification information script includes an encoded correct verification answer, a target network request including a second verification information script is received from the client device, the second verification information script includes a to-be-verified answer and an encoded correct verification answer, the to-be-verified answer is verified based on the encoded correct verification answer, if the to-be-verified answer passes verification, the target network request is forwarded to a source device to obtain a network resource requested by the target network request from the source device, and if the to-be-verified answer fails verification, the target network request is protected. In this way, the protection device can replace a verification code server to verify the to-be-verified answer, and will not affect the verification process of the network request, thereby effectively reducing the risk of network attacks.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network security management method and related products. Background Technology

[0002] With the rapid development of network technology, network security has become a crucial issue that cannot be ignored. Taking a Denial of Service (DoS) attack as an example, attackers attempt to temporarily or indefinitely disrupt services connected to the network, rendering network resources unusable for normal users. Therefore, it is necessary to identify whether a network request is from a legitimate user or a request intended to launch a network attack.

[0003] In related technologies, taking the example of a client device sending a network request to the source device through a protection device, after receiving the network request, the protection device sends a verification code to the client device. The client device displays the verification code to the user and, after obtaining the information entered by the user for the verification code, sends it to the verification code server. The verification code server verifies the information entered by the user and returns the verification result to the client device. The client device then sends the network request, including the verification result, back to the protection device. If the protection device parses the verification result and finds that the verification is successful, it determines that the network request is a legitimate request sent by a user and sends it to the source device. If the protection device parses the verification result and finds that the verification is unsuccessful, it determines that the network request is intended for a network attack and protects the network request.

[0004] However, when a CAPTCHA server is exposed and subjected to a cyberattack, it may be unable to verify the information entered by legitimate users. This can prevent the source device from receiving network requests from legitimate users, making network resources unavailable for legitimate users and making it difficult to effectively reduce the risks posed by cyberattacks. Summary of the Invention

[0005] This application provides a network security management method and related products, with the aim of effectively reducing the risk of network attacks.

[0006] The first aspect of this application provides a network security management method, applied to a protection device, the method comprising:

[0007] Receive target network requests from client devices;

[0008] Send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer;

[0009] Receive a target network request from the client device, including a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer.

[0010] Based on the correct verification answer after encoding, the answer to be verified is verified;

[0011] If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device.

[0012] If the verification of the answer to be verified fails, then the target network request is protected.

[0013] A second aspect of this application provides a network security management method applied to a client device, the method comprising:

[0014] Send a target network request to the protection device;

[0015] Receive a first verification information script from the protective device; the first verification information script includes the encoded correct verification answer;

[0016] The verification information is displayed by running the first verification information script;

[0017] In response to the target object's input operation on the verification information, the answer to be verified is captured by the first verification information script, and a second verification information script including the answer to be verified and the encoded correct verification answer is obtained.

[0018] A target network request including the second verification information script is sent to the protection device so that the protection device verifies the answer to be verified based on the encoded correct verification answer.

[0019] A third aspect of this application provides a network security management device, the device comprising:

[0020] The first request receiving module is used to receive target network requests from client devices;

[0021] The script sending module is used to send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer;

[0022] The second request receiving module is configured to receive a target network request from the client device, including a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer.

[0023] The answer verification module is used to verify the answer to be verified based on the encoded correct verification answer;

[0024] The request forwarding module is configured to forward the target network request to the source device if the answer to be verified passes the verification, so as to obtain the network resources requested by the target network request from the source device.

[0025] The request protection module is used to protect the target network request if the verification of the answer to be verified fails.

[0026] A fourth aspect of this application provides a network security management device, the device comprising:

[0027] The first request sending module is used to send target network requests to the protection device;

[0028] A script receiving module is used to receive a first verification information script from the protection device; the first verification information script includes the encoded correct verification answer.

[0029] The information display module is used to display verification information by running the first verification information script;

[0030] The answer capture module is used to respond to the input operation of the target object on the verification information, capture the answer to be verified through the first verification information script, and obtain a second verification information script including the answer to be verified and the encoded correct verification answer;

[0031] The second request sending module is used to send a target network request including the second verification information script to the protection device, so that the protection device can verify the answer to be verified based on the encoded correct verification answer.

[0032] A fifth aspect of this application provides a network security management device, the device comprising a processor and a memory:

[0033] The memory is used to store computer programs and to transfer the computer programs to the processor;

[0034] The processor is used to execute the steps of the network security management method provided in the first or second aspect according to the instructions in the computer program.

[0035] The sixth aspect of this application provides a computer-readable storage medium for storing a computer program that, when executed by a network security management device, implements the steps of the network security management method provided in the first or second aspect.

[0036] The seventh aspect of this application provides a computer program product, including a computer program that, when executed by a network security management device, implements the steps of the network security management method provided in the first or second aspect.

[0037] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0038] In this application's technical solution, the protection device receives a target network request from a client device; then, the protection device sends a first verification information script to the client device, wherein the first verification information script includes an encoded correct verification answer; subsequently, the protection device receives a target network request from the client device including a second verification information script, wherein the second verification information script includes an answer to be verified and an encoded correct verification answer; the protection device then verifies the answer to be verified based on the encoded correct verification answer; if the answer to be verified passes verification, it indicates that the target network request is not under network attack, and the protection device can forward it to the source device, thereby obtaining the network resources requested by the target network request from the source device, which can be used by the client device; if the answer to be verified fails verification, it indicates that the target network request is under network attack, and the protection device can directly protect the target network request, preventing the source device from being attacked by the target network request. Since the protective device in this solution can replace the CAPTCHA server in related technologies to verify the answer to be verified, this application does not require the deployment of a CAPTCHA server, thus avoiding the network attack risk caused by the exposure of the CAPTCHA server. Simultaneously, to reduce the network attack risk caused by the exposure of the protective device to network attacks, the first verification information script returned by the protective device to the client device includes the encoded correct verification answer. This allows the attacking device to still directly perform verification after obtaining the second verification information script, without affecting the verification process of the network request. Ultimately, this protects target network requests susceptible to network attacks. Therefore, the network security management method provided in this application embodiment can protect network requests susceptible to network attacks, effectively reducing the network attack risk caused by network attacks, and thereby achieving the goal of providing network resources to normal users.

[0039] Furthermore, the network security management method provided in this application eliminates the need to deploy a verification code server, which can significantly reduce the cost of attack protection. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of network security management methods in related technologies;

[0041] Figure 2 A scenario architecture diagram of a network security management method provided in this application embodiment;

[0042] Figure 3A flowchart illustrating a network security management method provided in this application embodiment;

[0043] Figure 4 A flowchart illustrating another network security management method provided in this application embodiment;

[0044] Figure 5 A signaling interaction diagram of a specific network security management method provided in this application embodiment;

[0045] Figure 6 An interactive schematic diagram of a network security management method provided in this application embodiment.

[0046] Figure 7 This is a schematic diagram of the structure of a network security management device provided in an embodiment of this application;

[0047] Figure 8 This is a schematic diagram of another network security management device provided in an embodiment of this application;

[0048] Figure 9 This is a schematic diagram of the server structure in an embodiment of this application;

[0049] Figure 10 This is a schematic diagram of the structure of a terminal device in an embodiment of this application. Detailed Implementation

[0050] The embodiments of this application will now be described with reference to the accompanying drawings.

[0051] First, we will explain several terms that may be involved in the embodiments of this application below.

[0052] DoS attack: This refers to a network attack in which an attacker injects excessive network requests into the source device providing network resources, causing the source device to become overloaded and unable to fulfill network requests from some (or all) legitimate users. In addition, there is the Distributed Denial of Service (DDoS) attack, where the attack traffic originates from various sources.

[0053] In this application embodiment, DDoS attacks may include Challenge Collapsar (CC) attacks, User Datagram Protocol Flood Attacks, Domain Name System Amplification Attacks, etc. For ease of understanding, CC attacks will be used as an example for illustrative purposes below.

[0054] CC attacks, or application-layer attacks, involve controlling devices to continuously send forged Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) network requests to the originating device. For example, this might involve frequently requesting a search or login page that consumes significant resources on the originating device, thus depleting its network resources or bandwidth, slowing down its response time, and preventing it from handling legitimate user requests.

[0055] A Layer 7 Load Balancing Cluster (LSBC) is a forwarding cluster composed of multiple Layer 7 reverse proxy servers. Network requests are first resolved to the LSBC, and then forwarded to the origin device. In this embodiment, the LSBC can be deployed on a protection device.

[0056] CC Protection Engine: This is deployed as a service on the protection device (i.e., on the Layer 7 forwarding cluster) to identify and mitigate CC attacks. It should be noted that the protection device can also deploy other protection engines to identify and mitigate other types of network attacks; the CC Protection Engine is used as an example only.

[0057] At present, see Figure 1 This diagram illustrates network security management methods in related technologies. For example... Figure 1 As shown, a client device can send a network request to the source device to request network services. To identify whether the network request will constitute a network attack on the source device, it is first sent to a protection device. The protection device can return a verification code to the client device. The client device uses this verification code to obtain the user's input information. The client device then submits the user's input information to a verification code server. The verification code server verifies the user's input information, obtains the verification result, and sends the result back to the client device. The client device then sends the network request carrying the verification result back to the protection device. The protection device discards network requests with failed verification results, thus protecting against network attacks.

[0058] However, CAPTCHA servers are vulnerable to exposure. For example, since user-entered information is sent to the CAPTCHA server, its address resides on the client device. If the client device is under cyberattack, the CAPTCHA server's address is easily exposed to the attacker, making the CAPTCHA server susceptible to attack. This could result in a large volume of information being sent to the CAPTCHA server, preventing legitimate user input from passing verification and ultimately preventing the source device from receiving legitimate user network requests. In this scenario, increasing the CAPTCHA server's processing power to handle a large amount of information simultaneously would be feasible, but this would be extremely costly, significantly increasing the cost of attack prevention.

[0059] In view of the above problems, this application provides a network security management method and related products, aiming to effectively reduce the network attack risks caused by network attacks. In the technical solution provided in this application, the protection device first receives a target network request from a client device; then, the protection device sends a first verification information script to the client device, wherein the first verification information script includes an encoded correct verification answer; subsequently, the protection device receives a target network request from the client device including a second verification information script, wherein the second verification information script includes an answer to be verified and an encoded correct verification answer; the protection device then verifies the answer to be verified based on the encoded correct verification answer; if the answer to be verified passes verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device; if the answer to be verified fails verification, the target network request is protected.

[0060] Since the protective device can replace the CAPTCHA server in verifying the answer to be verified, this application does not require the deployment of a CAPTCHA server when protecting against network attacks, thus avoiding the network attack risk caused by the exposure of the CAPTCHA server. Meanwhile, considering that the protective device would receive a large number of network requests when exposed to a network attack, if the protective device were to call the stored correct verification answer for verification, it could easily lead to excessive memory consumption, causing the source device to be unable to receive network requests from normal users. Therefore, the first verification information script returned by the protective device to the client device includes the encoded correct verification answer. On the one hand, the protective device can directly perform verification based on the second verification information script, reducing memory usage; on the other hand, it also reduces the risk of the correct verification answer being exposed on the client device, ultimately protecting target network requests that are subject to network attacks. Therefore, the network security management method provided in this application can protect network requests that are subject to network attacks, effectively reducing the network attack risk caused by network attacks, and thus achieving the goal of providing network resources to normal users. Furthermore, the network security management method provided in this application does not require the deployment of a CAPTCHA server, which helps to reduce the cost of attack protection.

[0061] Next, the implementing entity of the network security management method provided in this application embodiment will be specifically introduced.

[0062] The execution subject of the network security management method provided in this application embodiment can be a terminal device, and both the protection device and the client device can be terminal devices. As an example, terminal devices may include, but are not limited to, mobile phones, desktop computers, tablet computers, laptops, PDAs, intelligent voice interaction devices, smart home appliances, vehicle terminals, and aircraft. The execution subject of the network security management method provided in this application embodiment can be a server, and both the protection device and the client device can be servers. As an example, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. Furthermore, the server can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0063] The network security management method provided in this application can also be executed collaboratively by a terminal device and a server. For example, the protection device can be a server, and the client device can be a terminal device. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited herein. Therefore, this application does not limit the implementing entity for the technical solution of this application. Figure 2 An exemplary scenario architecture diagram of a network security management method is shown. Figure 2 This includes protective equipment, which is a server. Figure 2 It also includes various types of terminal devices, and the client device can be any of these terminal devices.

[0064] Furthermore, the protection device and the client device can be the same device. For example, this device can be a data processing device, which can deploy the target application and the protection service. The target application can execute the steps performed by the client device mentioned above, and the protection device can execute the steps performed by the protection device mentioned above through the protection service, which will not be repeated here. The protection service can be provided by the protection engine on the protection device, and the protection device can execute the steps performed by the protection device through the protection service provided by the protection engine.

[0065] The network security management method provided in this application can be applied to attack protection scenarios such as network security services, device security protection, edge computing, and content distribution network security acceleration. This application does not limit the application scenarios.

[0066] Next, the network security management method provided in the embodiments of this application will be described in detail.

[0067] Example 1:

[0068] See Figure 3 This figure is a flowchart of a network security management method provided in an embodiment of this application, which can be applied to protection devices. Figure 3 The network security management method shown includes the following steps:

[0069] S301: The protection device receives a target network request from a client device.

[0070] The target network request sent by the client device will first be received by the protection device to determine whether it is a network request sent by a normal user.

[0071] Based on the above introduction, protection engines such as CC protection engines can be deployed on the protection device to provide protection services. Specifically, they can be used to identify network attacks and mitigate network attacks. The operations performed by the protection device described in Example 1 can be the operations performed by the protection device through the protection engine, which will not be repeated hereafter.

[0072] In this application's embodiments, a target network request refers to a request made by a client device to request network resources on a source device. Taking a browser application as an example, when a user enters a URL in the browser, the browser application sends a network request to request the HyperText Markup Language (HTML) file of the webpage at that URL; alternatively, images, videos, and audio files in the browser also need to send network requests to obtain them from the source device. Taking a social media application as an example, a user may need to upload or download files, both of which require sending network requests to the source device; this application does not limit this specific action.

[0073] Furthermore, in the example where the protection device deploys a Layer 7 forwarding cluster, this Layer 7 forwarding cluster can store network resources. When the network resources requested by the target network request received by the protection device are stored in the Layer 7 forwarding cluster, that is, when the target network request hits the Layer 7 forwarding cluster, it indicates that the target network request can be directly responded to without being forwarded to the source device, and therefore will not affect the source device. Therefore, after executing S301, the protection device can directly send network resources to the client device without performing subsequent steps.

[0074] In addition, in some embodiments, the network security management method provided in the embodiments of this application may be executed for each network request by the user configuration; or the number of network requests that the source device can process per second may be measured, and when it is determined that the number of network requests that the source device needs to process per second exceeds a preset number, the network security management method provided in the embodiments of this application may be executed. This application does not limit this.

[0075] S302: The protection device sends the first verification information script to the client device.

[0076] In this embodiment of the application, the first verification information script refers to a piece of code or instruction returned to the client device, which is used to generate corresponding verification information. This verification information is to ensure that the network request is a network request sent by a normal user, rather than a network attack executed by an automated program (such as a robot).

[0077] The first verification information script can be written in any programming language. For example, it can be a JavaScript script; this application does not limit the language type of the first verification information script. The execution of the first verification information script will be described in detail in Embodiment 2 below, and will not be elaborated upon here.

[0078] It is understandable that client devices need to send network requests to the protection device first. Therefore, client devices have the address of the protection device. If the client device is attacked, the address of the protection device is also at risk of being exposed and thus vulnerable to network attacks. If the protection device is attacked, it will also receive a large number of network requests.

[0079] Assuming that the correct verification answer is stored in the protection device, it means that the protection device will respond with a verification information script for each network request and record the correspondence between the network request and the corresponding correct verification answer. This way, when a network request with an answer to be verified is received, the corresponding correct verification answer can be retrieved for verification. This means that the protection device will call memory for verification. However, a large number of network requests will cause the protection device to consume a lot of memory, which will put memory pressure on the protection device and make it impossible to mitigate network attacks.

[0080] To address this issue, the correct verification answer is proposed to be directly added to the first verification information script. Furthermore, considering that the correct verification answer might be exposed upon receiving the first verification information script during a network attack on the client device, this application adds the encoded correct verification answer to the first verification information script; that is, the first verification information script includes the encoded correct verification answer. The encoding method for the correct verification answer will be described in detail in later embodiments and will not be discussed here.

[0081] Therefore, when using protective equipment to replace CAPTCHA servers for verification, the risk of network attacks on the protective equipment or client devices can be effectively reduced.

[0082] Furthermore, assuming the correct verification answer is stored in the protection device as described above, if the stored information is the correspondence between the application initiating the network request and the corresponding correct verification answer, and the application initiates a large number of network requests simultaneously, but the protection device returns different verification information scripts for each network request, then one application will be associated with multiple correct verification answers. The protection device will find it difficult to determine the accurate corresponding correct verification answer for verification, and may mistakenly identify network requests from normal users as network requests used for network attacks, thus causing the risk of false positives. Therefore, adding the correct verification answer directly to the first verification information script can also effectively solve the problem of false positives.

[0083] Next, we will continue to introduce the method for generating the first verification information script. In one possible implementation of this application, the protection device can store a verification information script template. The script processing logic of the verification information script template is configured to display verification information and capture input operations related to the verification information. This indicates that the client device or other device is running the first verification information script generated based on the verification information script template, which can generate and display verification information, and can also record user input operations related to the verification information, such as keyboard input, mouse dragging, etc.

[0084] Accordingly, the first verification information script can be generated in the following way: the protection device can synthesize the correct verification answer, the verification information corresponding to the correct verification answer, and the verification information script template to obtain the first verification information script. The verification information and the correct verification answer corresponding to the verification information are added to the verification information script template to synthesize the first verification information script including the encoded correct verification answer.

[0085] Verification information refers to information displayed to the user to confirm whether a network request was initiated by a legitimate user. It can be understood as a task presented to the user, who needs to provide corresponding input to prove they are a legitimate user and not an automated program. Verification information can take many forms; for example, it can be verification information for numerical operations in graphics, verification information for sliding puzzles, or verification information for click selection. This application does not limit the specific form of verification information.

[0086] The correct verification answer corresponding to the verification information refers to the pre-determined correct input operation for the verification information, which is used to compare with the user's input operation for the verification information. For example, when the verification information is a numerical operation verification information in a graphic, the corresponding correct verification answer is the correct numerical operation result information; when the verification information is a sliding puzzle verification information, the corresponding correct verification answer is the correct sliding position information; when the verification information is a click selection verification information, the corresponding correct verification answer is the correct click order information. This application does not limit this.

[0087] In some embodiments, the verification information and the corresponding correct verification answer may be stored in the database or configuration file of the protection device, so that the protection device can obtain them and synthesize them with the verification information script template. S303: The protection device receives a target network request from the client device including the second verification information script.

[0088] In this embodiment of the application, after receiving the first verification information script, the client device will perform some processing (see the detailed description of Embodiment 2) and then send the second verification information script to the protection device. The second verification information script includes the answer to be verified and the encoded correct verification answer.

[0089] The "answer to be verified" represents the input operation performed by the target object in response to the verification information. Taking a sliding puzzle verification as an example, the "answer to be verified" is the sliding position information of the target object when it performs a sliding operation in response to the verification information. The target object refers to any object that initiates the target network request; it is not specifically defined as a particular object. For example, the target object could refer to a user.

[0090] S304: The protective device verifies the answer to be verified based on the correct verification answer after encoding.

[0091] The protection device can parse the latest received target network request to obtain a second verification information script, and then parse the second verification information script to obtain the answer to be verified and the encoded correct verification answer. Subsequently, it can verify the answer to be verified based on the encoded correct verification answer to determine whether the target network request was initiated by a normal user or a network request used for network attack, and thus protect against network requests that are used for network attack (also known as network requests used for network attack).

[0092] S305: If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device.

[0093] It should be understood that normal network requests need to be sent to the origin device to realize the business processing of the normal network request. The protection device is used to perform security filtering on each network request, reducing the possibility of the origin device being subjected to network attacks. Therefore, if the verification of the answer to be verified passes, it indicates that the target network request is a normal network request and there is no network attack. The protection device can forward the target network request to the origin device. The origin device stores various network resources. After receiving the target network request, the origin device can provide the network resources requested by the target network request for the client device to obtain and use, so as to realize the business processing of the target network request.

[0094] In some embodiments, the protection device is deployed between the client device and the source device. The protection device can act as a reverse proxy or gateway. The protection device is the entry and exit point for network traffic between the two. Any interaction between the client device and the source device will pass through the protection device. For example, when the client device sends a target network request to the source device, the target network request will be sent to the protection device first. The network resources provided by the source device to the client device will also be sent to the protection device first.

[0095] As an example, the target address of the target network request is the Internet Protocol (IP) address of the protection device. Therefore, the protection device will receive the target network request first. The protection device stores the IP address of the source device. Therefore, after the protection device determines that the answer to be verified has been verified, the protection device can change the target address of the target network request to the IP address of the source device, thereby forwarding the target network request.

[0096] S306: If the verification of the answer to be verified fails, then protect the target network request.

[0097] Contrary to what is described in S305, if the verification of the answer to be verified fails, it indicates that the target network request is a network request subject to a network attack, and therefore it is necessary to prevent it from reaching the source device. The protection device can protect against the target network request.

[0098] As an example, after the protection device determines that the verification of the answer to be verified has failed, the protection device can directly discard the target network request, and the target network request can be terminated after the client device times out. Alternatively, the protection device can send a rejection response to the client device, and the client device, upon receiving the rejection response, will terminate the target network request. Alternatively, the protection device can close the network connection between itself and the client device, interrupting the target network request. Alternatively, the protection device can send a cancellation signal to the client device, interrupting the network connection between itself and the client device. This application does not limit the protection method of the protection device for the target network request; it can perform one or more of the above examples. For example, the protection device can directly discard the target network request and send a rejection response to the client device.

[0099] In one possible implementation of this application, the network attacker protection method may further include step 1: performing a verification operation based on preset characters and the correct verification answer to obtain the encoded correct verification answer.

[0100] For example, a preset character can include a preset number, a preset letter, or a preset punctuation mark. For example, a preset number can be "3", a preset letter can be "a", or a preset punctuation mark can be ".". Alternatively, a preset character can be composed of at least two of the preset number, preset letter, or preset punctuation mark, such as a preset character that is "3a".

[0101] In examples where the preset characters include preset numerical values, the preset numerical values ​​may include preset prime numbers, preset rational numbers, or preset irrational numbers, etc. This application does not limit this.

[0102] Furthermore, in some embodiments, a fixed preset character can be used to encode the correct verification answer for all verification information, or different preset characters can be used to encode the correct verification answer for different types of verification information (such as numerical calculation verification information in graphics, sliding puzzle verification information, and click selection verification information described above). This application does not limit this.

[0103] In this way, even if the correct verification answer after encoding is exposed to an attacker, the attacker will still be unable to determine the meaning of the preset characters after decoding, thus ensuring the security of the correct verification answer.

[0104] In some embodiments, the identification information of the target network request, preset characters, and the correct verification answer can be combined to perform a verification operation to obtain the encoded correct verification answer.

[0105] If the target network request can carry identification information, then after the protection device executes S301, it can parse the target network request to obtain the identification information, and then execute step 1 to obtain the encoded correct verification answer.

[0106] For example, the identification information of the target network request can be the device address of the client device. Alternatively, when the target network request is a network request of the target application, the identification information of the target network request can be the identification information of the target application; this application does not impose any limitations on this.

[0107] In some embodiments, the verification operation based on preset characters and the correct verification answer described above can be a cyclic redundancy check (CRC) operation, or a hash function operation or a checksum operation, etc. This application does not limit the type of verification operation, that is, it does not limit the encoding method of the correct verification answer.

[0108] It should be noted that the type of verification operation performed on the target network request's identification information, preset characters, and correct verification answer is similar and will not be elaborated further.

[0109] Accordingly, S304 may specifically include: performing a verification operation based on a preset character and the answer to be verified to obtain an encoded answer to be verified; S305 may specifically include: if the encoded correct verification answer is the same as the encoded answer to be verified, then the target network request is determined to be a normal network request, and the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device; S306 may specifically include: if the encoded correct verification answer is different from the encoded answer to be verified, then the target network request is determined to be used for network attack, and the target network request is protected. Wherein, the source device provides the network resources requested by the target network request.

[0110] It should be noted that in the example where the verification operation is performed based on the preset characters and the correct verification answer, the preset characters and the answer to be verified are also verified. Similarly, in the example where the verification operation is performed together based on the target network request's identifier information, the preset characters, and the correct verification answer, the target network request's identifier information, the preset characters, and the answer to be verified are also verified together. This indicates that the data types used for the verification operation should be the same. Furthermore, the type of verification operation should also be the same, such as performing a CRC operation. This ensures that the comparison results between the encoded correct verification answer and the encoded answer to be verified are reliable.

[0111] If the encoded correct verification answer is the same as the encoded answer to be verified, it can be determined that the target network request is a network request initiated by a normal user and its needs must be met. Therefore, the target network request can be forwarded to the source device, so that the source device responds to the target network request and sends the corresponding network resources to the protection device first, and then the protection device sends the network resources to the client device.

[0112] Similar to the forwarding of target network requests by the protection device described above, the protection device can also forward network resources. As an example, the target address of the network resource is the protection device's Internet Protocol (IP) address. Therefore, the protection device will first receive the network resource. Since the protection device stores the client device's IP address, it can modify the target address of the network resource to the client device's IP address, thus enabling the forwarding of the network resource.

[0113] If the encoded correct verification answer differs from the encoded answer to be verified, then the target network request is determined to be used for a network attack. That is, it is not a network request initiated by a normal user, but by an automated program. Therefore, it does not need to be forwarded to the source device, and the protection device can protect the target network request.

[0114] Thus, on the one hand, the protection device can parse the answer to be verified and the encoded correct verification answer from the second verification information script and perform verification directly, which reduces memory usage and helps to effectively protect against network attacks. On the other hand, the encoded correct verification answer is based on preset characters, so even if it is exposed to attackers, they cannot determine the meaning of the preset characters, which helps to ensure the security of the correct verification answer and thus achieves effective protection against network attacks.

[0115] In one possible implementation of this application, the target network request can be a network request from the client device for a target application; after the protection device determines that the target network request is a normal network request, the network security management method may further include: the protection device creates security identification information for the target application and sends the security identification information to the client device, wherein the security identification information is used to indicate that the target application passes the verification.

[0116] It should be understood that if the target network request passes authentication, and this target network request is directed to the target application, it indicates that the target application is also secure. Therefore, when subsequent protection devices recognize this security identifier information, they can determine that the target network request previously sent by the target application passed authentication, thus confirming that the target application is secure, and any subsequent network requests sent to it will also be secure.

[0117] In other words, the client device can use this security identification information to identify subsequent network requests, thus indicating that the network request is secure. Therefore, in some embodiments, after receiving the security identification information, the client device can store it. When the client device subsequently sends a network request for the target application to the protection device again, it can carry the security identification information, thereby identifying the network request as a legitimate request initiated by a normal user.

[0118] For example, security identification information can be session identification information (Session Identifier, SessionID), etc., and this application does not limit it.

[0119] Understandably, if the network request of the target application passes verification, it indicates that the target application is being used by a normal user on the client device and has not been subjected to a network attack. Therefore, subsequent network requests of the target application can be directly forwarded to the source device without further verification. Thus, security identification information can be created to identify subsequent network requests of the target application.

[0120] In some embodiments, the security identification information may be time-sensitive. For example, the security identification information may have a corresponding timer or time indication information. Before the timer expires or before the time indicated by the time indication information is reached, the network requests of the target application do not need to be verified and can be directly forwarded to the source device. After the timer expires or after the time indicated by the time indication information is reached, the protection device can continue to verify the network requests of the target application.

[0121] In some embodiments, after determining that the target network request is a legitimate network request, the protection device can set a cookie and a security identifier, a Session ID, so that the protection device can store the Session ID on the client device via the cookie. The Session ID will remain stored in the target application until its expiration date, and will be carried by the target application whenever it initiates a network request.

[0122] In this way, network requests from security-targeting applications can be marked with security identification information, enabling protection devices to accurately distinguish them.

[0123] For ease of understanding, this section uses the example of a protection device having a protection engine installed and a browser application as the target application to illustrate the interaction between the protection device and the client device.

[0124] In one possible implementation of this application, the "creating security identification information for the target application" described above can specifically be: the protection device creates security identification information for the browser application through the protection engine; the "sending the security identification information to the client device" described above can specifically be: sending the security identification information to the client device through the protection engine. Other steps are similar and will not be described in detail here.

[0125] In one possible implementation of this application, the network security management method further includes: the protection device receiving a network request from the target application of the client device again; the protection device can parse the network request, determine whether it carries security identification information, and if it is determined that the network request carries security identification information, it can directly determine that the network request is a normal network request and forward the network request to the source device to directly obtain the network resources requested by the network request from the source device without further verification of the network request.

[0126] It should be noted that the forwarding process of network requests by the protection device can be found in the description of its forwarding process of target network requests above, and will not be repeated here.

[0127] In this way, network requests from identified secure target applications do not need to be processed by the protection equipment, reducing the processing load on the protection equipment and allowing it to handle more network requests from other applications or other devices, which helps to further mitigate network attacks.

[0128] In one possible implementation of this application, the target network request may include the device address of the client device. Therefore, the phrase "performing a verification operation based on a preset character and a correct verification answer to obtain the encoded correct verification answer" described above can specifically be: performing a verification operation based on the preset character, the device address of the client device, and the correct verification answer to obtain the encoded correct verification answer. Correspondingly, "performing a verification operation based on the preset character and the answer to be verified to obtain the encoded answer to be verified" can specifically be: performing a verification operation based on the preset character, the device address of the client device, and the answer to be verified to obtain the encoded answer to be verified.

[0129] It should be noted that, for details, please refer to the above introduction on "completing the verification operation of the target network request's identifier information, preset characters, and correct verification answer together to obtain the encoded correct verification answer". The implementation method here is an example where the identifier information of the target network request is the device address of the client device, which will not be repeated here.

[0130] Accordingly, the above-described "combining the encoded correct verification answer, the verification information corresponding to the correct verification answer, and the verification information script template to obtain the first verification information script" can specifically be: adding the encoded correct verification answer and the verification information corresponding to the correct verification answer as code to the verification information script template to obtain the first verification information script. In other words, the encoded correct verification answer and verification information can be used as part of the code in the first verification information script to achieve the fusion of these three elements.

[0131] In this way, on the one hand, when performing verification calculations on the correct verification answer, adding preset characters and the device address of the client device further enhances the confidentiality of the correct verification answer; on the other hand, there is a pre-set verification information script template, and the encoded correct verification answer and the corresponding verification information can be directly added as code, which helps to improve the generation speed of the first verification information script and avoids the repetitive work of generating corresponding verification information scripts separately when handling multiple network requests, thus reducing the development burden.

[0132] Example 2:

[0133] See Figure 4This figure is a flowchart of another network security management method provided in an embodiment of this application, which can be applied to client devices. Figure 4 The network security management method shown includes the following steps:

[0134] S401: The client device sends a target network request to the protection device.

[0135] In some embodiments, the target object may operate on the client device according to its own needs, causing the client device to respond to the target object's operation by sending a target network request to the protection device.

[0136] For example, if the target's requirement is to access a webpage, the target can enter a URL into the browser application on the client device, and the client device can then send a target network request to the protection device to request the display of the webpage.

[0137] S402: The client device receives the first verification information script from the protection device.

[0138] The first verification information script includes the encoded correct verification answer.

[0139] It should be noted that the specific implementation methods of S401-S402 can be found in the introduction of S301-S302, and will not be repeated here.

[0140] S403: The client device displays the verification information by running the first verification information script.

[0141] Based on the above introduction, the first verification information script refers to a piece of code or instruction returned to the client device. The client device can run the first verification information script so that the client device can display the verification information.

[0142] It should be noted that the first verification information script and the description of the verification information can be found in the corresponding content in S302, and will not be repeated here.

[0143] S404: In response to the target object's input operation on the verification information, the client device captures the answer to be verified through the first verification information script and obtains a second verification information script that includes the answer to be verified and the encoded correct verification answer.

[0144] The target object can input the verification information. In response to the input operation, the client device can continue to execute the processing logic of the first verification information script, capture the input operation to obtain the answer to be verified, and then add the answer to be verified to the first verification information script to obtain a second verification information script that includes the answer to be verified and the encoded correct verification answer.

[0145] In some embodiments, after receiving the answer to be verified, the client device can write it to a cookie and add it to a first verification information script to obtain a second verification information script.

[0146] It should be noted that the input operation of the target object on the verification information and the description of the answer to be verified in S404 can be found in the description of the corresponding content in S303, and will not be repeated here.

[0147] S405: The client device sends a target network request including the second verification information script to the protection device, so that the protection device verifies the answer to be verified based on the encoded correct verification answer.

[0148] After obtaining the second verification information script, the client device can initiate a target network request again and add the second verification information script to the target network request. Then, the client device sends the target network request including the second verification information script to the protection device so that the protection device executes S304 as described above.

[0149] It should be noted that the specific implementation of S405 can be found in the introduction of S304-S306, and will not be repeated here.

[0150] In one possible implementation of this application, the target network request can be a network request from a client device for a target application; then the network security management method may further include: the client device receiving security identification information from a protection device; the security identification information can be used to instruct the target application to pass authentication.

[0151] In one possible implementation of this application, when the target application subsequently initiates another network request to the protection device, the security identification information can be added to the network request. This allows the network request sent by the client device to the protection device to carry the security identification information, enabling the protection device to directly determine that the network request is a normal network request based on the security identification information and forward the network request to the source device to directly obtain the requested network resources from the source device. No verification by the protection device is required.

[0152] In this way, once the target application is determined to be secure, all subsequent network requests will carry this security identification information, enabling the protection device to recognize the network request as a legitimate network request without requiring further verification. This reduces the processing load on the protection device and further mitigates network attacks in the event of an attack.

[0153] It should be noted that the specific implementation method of this step can be found in the description of the corresponding content in Example 1, and will not be repeated here.

[0154] Example 3:

[0155] For ease of understanding, combined with Figure 5 and Figure 6 This application provides a detailed, interactive description of the network security management method offered in its embodiments. Figure 5 A signaling interaction diagram for a specific network security management method provided in this application embodiment. Figure 6 This is an interactive schematic diagram of a network security management method provided in an embodiment of this application. Figure 5 Specifically, the following steps are included:

[0156] S501: The client device sends a target network request to the protection device, and the protection device receives the target network request from the client device.

[0157] Combination Figure 6 As shown, this could be a scenario where the target device enters the URL "Https: / / www.example.com" into page 2 of a browser application on the client device. The client device then sends a network request to the protection device to request the HTML file of the webpage at that URL. Subsequently... Figure 6 The client device, protection device, and source device can interact using the steps described later, which will not be repeated here.

[0158] S502: The protection device sends the first verification information script to the client device, and the client device receives the first verification information script from the protection device.

[0159] S503: The client device displays the verification information by running the first verification information script.

[0160] S504: In response to the target object's input operation on verification information, the client device captures the answer to be verified through the first verification information script and obtains a second verification information script that includes the answer to be verified and the encoded correct verification answer.

[0161] S505: The client device sends a target network request including a second authentication information script to the protection device, and the protection device receives the target network request including the second authentication information script from the client device.

[0162] S506: Protective equipment verifies the answer to be verified based on the coded correct verification answer.

[0163] S507: If the encoded correct verification answer is the same as the encoded answer to be verified, the protection device determines that the target network request is a normal network request and forwards the target network request to the source device. Correspondingly, the source device receives the target network request from the protection device.

[0164] S508: In response to the target network request, the source device sends the network resources requested by the target network request to the protection device, and the protection device receives the network resources from the source device accordingly.

[0165] S509: The protection device sends network resources to the client device, and the client device receives the network resources from the protection device.

[0166] S510: Client devices operate network resources.

[0167] S511: If the encoded correct verification answer is different from the encoded answer to be verified, the protection device determines that the target network request is used for network attack and protects the target network request.

[0168] It should be noted that the specific implementation methods of S501-S511 can be found in the descriptions of Embodiment 1 and Embodiment 2, and will not be repeated here.

[0169] Based on Embodiments 1 to 3 described above, the network security management method provided in this application can avoid the network attack risk caused by network attacks on the verification code server. Furthermore, by carrying the encoded correct verification answer in the first verification information script, it can effectively mitigate network attacks suffered by the protection device or the client device, ensure that normal network requests are responded to normally, and thus improve the user experience on the client device side.

[0170] Based on the network security management method provided in the foregoing embodiments, this application also provides a corresponding network security management device. The network security management device provided in the embodiments of this application will be described in detail below.

[0171] See Figure 7 This figure is a schematic diagram of the structure of a network security management device provided in an embodiment of this application. Figure 7 As shown, the network security management device 700 may specifically include:

[0172] The first request receiving module 710 is used to receive a target network request from a client device;

[0173] The script sending module 720 is used to send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer.

[0174] The second request receiving module 730 is configured to receive the target network request from the client device, which includes a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer.

[0175] The answer verification module 740 is used to verify the answer to be verified based on the encoded correct verification answer;

[0176] The request forwarding module 750 is used to forward the target network request to the source device if the answer to be verified passes the verification, so as to obtain the network resources requested by the target network request from the source device;

[0177] The request protection module 760 is used to protect the target network request if the verification of the answer to be verified fails.

[0178] As one implementation, the network security management device 800 may further include:

[0179] The calculation module is used to perform verification calculations based on preset characters and the correct verification answer to obtain the encoded correct verification answer.

[0180] Correspondingly, the answer verification module 740 can be used for:

[0181] A verification operation is performed based on the preset characters and the answer to be verified to obtain the encoded answer to be verified.

[0182] Correspondingly, the request forwarding module 750 can be used specifically for:

[0183] If the encoded correct verification answer is the same as the encoded answer to be verified, then the target network request is determined to be a normal network request, and the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device;

[0184] Accordingly, the protection module 760 is requested, which can be used specifically for:

[0185] If the encoded correct verification answer is different from the encoded answer to be verified, it is determined that the target network request is under attack, and the target network request is protected.

[0186] In one implementation, the target network request is a network request from the client device for a target application; the network security management device 800 may further include:

[0187] The information creation module is used to create security identification information for the target application;

[0188] The information sending module is used to send the security identification information to the client device; the security identification information is used to indicate that the target application has passed the verification.

[0189] As one implementation, the network security management device 800 may further include:

[0190] The third request receiving module is used to receive network requests from the client device for the target application again.

[0191] The network request forwarding module is configured to determine that the network request is a normal network request if it is determined that the network request carries the security identification information, and forward the network request to the source device to obtain the network resources requested by the network request from the source device.

[0192] In one implementation, the protective device stores a verification information script template, the script processing logic of which is configured to display verification information and capture input operations related to the verification information; the first verification information script is generated by the following unit:

[0193] The synthesis unit is used to synthesize the encoded correct verification answer, the verification information corresponding to the correct verification answer, and the verification information script template to obtain the first verification information script.

[0194] In one implementation, the target network request includes the device address of the client device; the computing module can specifically be used for:

[0195] A verification operation is performed based on the preset character, the device address of the client device, and the correct verification answer to obtain the encoded correct verification answer;

[0196] Accordingly, the answer verification module 740 can be used for:

[0197] A verification operation is performed based on the preset character, the device address of the client device, and the answer to be verified to obtain the encoded answer to be verified.

[0198] Accordingly, the synthesis unit can specifically be used for:

[0199] The encoded correct verification answer and the corresponding verification information are added as code to the verification information script template to obtain the first verification information script.

[0200] In one implementation, the protection device is equipped with a protection engine, and the target application is a browser application; correspondingly, the information creation module can be specifically used for:

[0201] The protection engine creates security identification information for the browser application.

[0202] Accordingly, the information sending module can specifically be used for:

[0203] The security identification information is sent to the client device through the protection engine.

[0204] See Figure 8 This figure is a schematic diagram of the structure of another network security management device provided in an embodiment of this application. Figure 8 As shown, the network security management device 800 may specifically include:

[0205] The first request sending module 810 is used to send a target network request to the protection device;

[0206] The script receiving module 820 is used to receive a first verification information script from the protection device; the first verification information script includes the encoded correct verification answer.

[0207] Information display module 830 is used to display verification information by running the first verification information script;

[0208] The answer capture module 840 is used to respond to the input operation of the target object on the verification information, capture the answer to be verified through the first verification information script, and obtain a second verification information script including the answer to be verified and the encoded correct verification answer;

[0209] The second request sending module 850 is used to send a target network request including the second verification information script to the protection device, so that the protection device can verify the answer to be verified based on the encoded correct verification answer.

[0210] In one implementation, the target network request is a network request from a target application of the client device; the network security management device 800 may further include:

[0211] An information receiving module is used to receive security identification information from the protection device; the security identification information is used to indicate that the target application has passed the verification.

[0212] As one implementation, the network security management device 800 may further include:

[0213] The third request sending module is used to send the network request of the target application carrying the security identification information to the protection device again, so that the protection device determines the network request as a normal network request based on the security identification information, and forwards the network request to the source device to obtain the network resources requested by the network request from the source device.

[0214] The various network security management devices provided in this application embodiment have the same beneficial effects as the corresponding network security management methods provided in the above embodiments, and therefore will not be described again.

[0215] As an example, the network security management system provided in this application embodiment may include the protection devices and client devices described above.

[0216] The client device is used to send a target network request to the protection device;

[0217] The protection device is used to receive a target network request from the client device; and send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer;

[0218] The client device is configured to receive a first verification information script from the protection device, display verification information by running the first verification information script, and in response to the target object's input operation on the verification information, capture the answer to be verified through the first verification information script to obtain a second verification information script including the answer to be verified and the encoded correct verification answer; and send a target network request including the second verification information script to the protection device.

[0219] The protection device is used to receive the target network request from the client device, which includes a second verification information script; to verify the answer to be verified based on the encoded correct verification answer; if the answer to be verified passes the verification, the device forwards the target network request to the source device to obtain the network resources requested by the target network request from the source device; if the answer to be verified fails the verification, the device protects the target network request.

[0220] As one implementation method, the network security management system may also include a source device, which can be found in [reference needed]. Figure 6 The content shown.

[0221] The source device is used to receive network requests from the protection device; in response to the network request, obtain the network resources requested by the network request; and send the network resources to the client device via the protection device.

[0222] It should be noted that, in this network security management system, the steps performed by the protection device can be referred to the description of Embodiment 1 above, and the steps performed by the client device can be referred to the description of Embodiment 2 above, and will not be repeated here.

[0223] The network security management system provided in this application has the same beneficial effects as the network security management method provided in the above embodiments, and therefore will not be described again.

[0224] This application provides a network security management device, which can be a server. Figure 9This is a schematic diagram of a server structure provided in an embodiment of this application. The server 900 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 922 (e.g., one or more processors) and memory 932, and one or more storage media 930 (e.g., one or more mass storage devices) for storing application programs 942 or data 944. The memory 932 and storage media 930 can be temporary or persistent storage. The program stored in the storage media 930 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the server. Furthermore, the CPU 922 may be configured to communicate with the storage media 930 and execute the series of instruction operations in the storage media 930 on the server 900.

[0225] Server 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input / output interfaces 958, and / or one or more operating systems 941, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0226] When server 900 is a protection device, CPU 922 is used to perform the following steps:

[0227] Receive target network requests from client devices;

[0228] Send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer;

[0229] The system receives a target network request from the client device, which includes a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer.

[0230] Based on the correct verification answer after encoding, the answer to be verified is verified;

[0231] If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device;

[0232] If the verification of the answer to be verified fails, then the target network request is protected.

[0233] When server 900 is a client device, CPU 922 is used to perform the following steps:

[0234] Send a target network request to the protection device;

[0235] Receive a first verification information script from the protective device; the first verification information script includes the encoded correct verification answer;

[0236] The verification information is displayed by running the first verification information script;

[0237] In response to the target object's input operation on the verification information, the answer to be verified is captured by the first verification information script, and a second verification information script including the answer to be verified and the encoded correct verification answer is obtained.

[0238] A target network request including the second verification information script is sent to the protection device so that the protection device verifies the answer to be verified based on the encoded correct verification answer.

[0239] This application also provides another network security management device, which can be a terminal device. For example... Figure 10 As shown, for ease of explanation, only the parts related to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. Taking a mobile phone as an example:

[0240] Figure 10 The diagram shown is a block diagram of a portion of the structure of a mobile phone provided in an embodiment of this application. (Reference) Figure 10 The mobile phone includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090, etc. Those skilled in the art will understand that... Figure 10 The mobile phone structure shown does not constitute a limitation on the mobile phone and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0241] The following is combined Figure 10 A detailed introduction to each component of a mobile phone:

[0242] The RF circuit 1010 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with the processor 1080; additionally, it transmits uplink data to the base station. Typically, the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, the RF circuit 1010 can also communicate wirelessly with networks and other devices. The aforementioned wireless communications may use any communication standard or protocol, including but not limited to Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, and Short Messaging Service (SMS).

[0243] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various mobile phone functions and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0244] The input unit 1030 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 1031), and drive the corresponding connection devices according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 1080, and can also receive and execute commands sent by the processor 1080. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may also include other input devices 1032. Specifically, other input devices 1032 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0245] The display unit 1040 can be used to display information input by the user or information provided to the user, as well as various menus of the mobile phone. The display unit 1040 may include a display panel 1041, which may optionally be configured as a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), or similar display panel 1041. Further, a touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it transmits the information to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in Figure 10 In this embodiment, the touch panel 1031 and the display panel 1041 are two separate components to realize the input and output functions of the mobile phone. However, in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0246] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 1041 according to the ambient light level, and the proximity sensor can turn off the display panel 1041 and / or the backlight when the phone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, taps), etc. Other sensors that may be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0247] The audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the mobile phone. The audio circuit 1060 converts the received audio data into electrical signals and transmits them to the speaker 1061, where the speaker 1061 converts them into sound signals for output. On the other hand, the microphone 1062 converts the collected sound signals into electrical signals, which are then received by the audio circuit 1060, converted into audio data, and then processed by the processor 1080 before being transmitted via the RF circuit 1010 to, for example, another mobile phone, or the audio data can be output to the memory 1020 for further processing.

[0248] WiFi is a short-range wireless transmission technology. Through the WiFi module 1070, mobile phones can help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access. Although Figure 10 The WiFi module 1070 is shown, but it is understood that it is not an essential component of a mobile phone and can be omitted as needed without changing the essence of the invention.

[0249] The processor 1080 is the control center of the mobile phone, connecting various parts of the phone through various interfaces and lines. It executes software programs and / or modules stored in the memory 1020 and calls data stored in the memory 1020 to perform various functions and process data, thereby collecting overall data and information from the phone. Optionally, the processor 1080 may include one or more processing units; preferably, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1080.

[0250] The mobile phone also includes a power supply 1090 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0251] Although not shown, mobile phones may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0252] When the mobile phone is used as a protective device, the processor 1080 also has the following functions:

[0253] Receive target network requests from client devices;

[0254] Send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer;

[0255] The system receives a target network request from the client device, which includes a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer.

[0256] Based on the correct verification answer after encoding, the answer to be verified is verified;

[0257] If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device;

[0258] If the verification of the answer to be verified fails, then the target network request is protected.

[0259] When the mobile phone is used as a client device, the processor 1080 also has the following functions:

[0260] Send a target network request to the protection device;

[0261] Receive a first verification information script from the protective device; the first verification information script includes the encoded correct verification answer;

[0262] The verification information is displayed by running the first verification information script;

[0263] In response to the target object's input operation on the verification information, the answer to be verified is captured by the first verification information script, and a second verification information script including the answer to be verified and the encoded correct verification answer is obtained.

[0264] A target network request including the second verification information script is sent to the protection device so that the protection device verifies the answer to be verified based on the encoded correct verification answer.

[0265] This application also provides a computer-readable storage medium for storing a computer program that, when run on a network security management device, causes the network security management device to perform any one of the implementation methods of a network security management method described in the foregoing embodiments.

[0266] This application also provides a computer program product including a computer program, which, when run on a network security management device, causes the network security management device to execute any one of the implementation methods of a network security management method described in the foregoing embodiments.

[0267] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the system and equipment described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0268] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of the system is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple systems may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0269] The system described as separate components may or may not be physically separate. Components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0270] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0271] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing computer programs.

[0272] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0273] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network security management method, characterized in that, Applied to protective equipment, the method includes: Receive target network requests from client devices; Send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer; Receive a target network request from the client device, including a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer. Based on the correct verification answer after encoding, the answer to be verified is verified; If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device; If the verification of the answer to be verified fails, then the target network request is protected.

2. The method according to claim 1, characterized in that, The method further includes: A verification operation is performed based on preset characters and the correct verification answer to obtain the encoded correct verification answer; The verification of the answer to be verified based on the encoded correct verification answer includes: A verification operation is performed based on the preset characters and the answer to be verified to obtain the encoded answer to be verified. If the answer to be verified passes the verification, the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device, including: If the encoded correct verification answer is the same as the encoded answer to be verified, then the target network request is determined to be a normal network request, and the target network request is forwarded to the source device to obtain the network resources requested by the target network request from the source device; If the verification of the answer to be verified fails, the protection of the target network request includes: If the encoded correct verification answer is different from the encoded answer to be verified, it is determined that the target network request is under attack, and the target network request is protected.

3. The method according to claim 2, characterized in that, The target network request is a network request from the client device for the target application. After determining that the target network request is a normal network request and forwarding the target network request to the source device to obtain the network resources requested by the target network request from the source device, the method further includes: Create security identification information for the target application; The security identification information is sent to the client device; the security identification information is used to indicate that the target application has passed the verification.

4. The method according to claim 3, characterized in that, The method further includes: Receive another network request from the client device for the target application; If it is determined that the network request carries the security identification information, then the network request is determined to be a normal network request, and the network request is forwarded to the source device to obtain the network resources requested by the network request from the source device.

5. The method according to any one of claims 1-4, characterized in that, The protective device stores a verification information script template. The script processing logic of the verification information script template is configured to display the verification information and capture input operations related to the verification information. The first verification information script is generated in the following manner: The encoded correct verification answer, the verification information corresponding to the correct verification answer, and the verification information script template are combined to obtain the first verification information script.

6. The method according to claim 5, characterized in that, The target network request includes the device address of the client device; the verification operation based on preset characters and the correct verification answer to obtain the encoded correct verification answer includes: A verification operation is performed based on the preset character, the device address of the client device, and the correct verification answer to obtain the encoded correct verification answer; The step of performing a verification operation based on the preset character and the answer to be verified to obtain the encoded answer to be verified includes: A verification operation is performed based on the preset character, the device address of the client device, and the answer to be verified to obtain the encoded answer to be verified. The step of synthesizing the encoded correct verification answer, the verification information corresponding to the correct verification answer, and the verification information script template to obtain the first verification information script includes: The encoded correct verification answer and the corresponding verification information are added as code to the verification information script template to obtain the first verification information script.

7. The method according to claim 3, characterized in that, The protection device is equipped with a protection engine, and the target application is a browser application; the step of creating security identification information for the target application includes: The protection engine creates security identification information for the browser application. Sending the security identification information to the client device includes: The security identification information is sent to the client device through the protection engine.

8. A network security management method, characterized in that, Applied to a client device, the method includes: Send a target network request to the protection device; Receive a first verification information script from the protective device; the first verification information script includes the encoded correct verification answer; The verification information is displayed by running the first verification information script; In response to the target object's input operation on the verification information, the answer to be verified is captured by the first verification information script, and a second verification information script including the answer to be verified and the encoded correct verification answer is obtained. A target network request including the second verification information script is sent to the protection device so that the protection device verifies the answer to be verified based on the encoded correct verification answer.

9. The method according to claim 8, characterized in that, The target network request is a network request from the client device for a target application; the method further includes: Receive security identification information from the protective device; the security identification information is used to indicate that the target application has passed the verification.

10. The method according to claim 9, characterized in that, The method further includes: The protection device sends a network request carrying the security identification information for the target application to the protection device again, so that the protection device determines the network request as a normal network request based on the security identification information, and forwards the network request to the source device to obtain the network resources requested by the network request from the source device.

11. A network security management device, characterized in that, Applied to protective equipment, the device includes: The first request receiving module is used to receive target network requests from client devices; The script sending module is used to send a first verification information script to the client device; the first verification information script includes the encoded correct verification answer; The second request receiving module is configured to receive a target network request from the client device, including a second verification information script; the second verification information script includes the answer to be verified and the encoded correct verification answer. The answer verification module is used to verify the answer to be verified based on the encoded correct verification answer; The request forwarding module is used to forward the target network request to the source device if the answer to be verified passes the verification, so as to obtain the network resources requested by the target network request from the source device; The request protection module is used to protect the target network request if the verification of the answer to be verified fails.

12. A network security management device, characterized in that, Applied to a client device, the device includes: The first request sending module is used to send target network requests to the protection device; A script receiving module is used to receive a first verification information script from the protection device; the first verification information script includes the encoded correct verification answer. The information display module is used to display verification information by running the first verification information script; The answer capture module is used to respond to the input operation of the target object on the verification information, capture the answer to be verified through the first verification information script, and obtain a second verification information script including the answer to be verified and the encoded correct verification answer; The second request sending module is used to send a target network request including the second verification information script to the protection device, so that the protection device can verify the answer to be verified based on the encoded correct verification answer.

13. A network security management device, characterized in that, The device includes a processor and a memory: The memory is used to store computer programs and to transfer the computer programs to the processor; The processor is configured to execute the steps of the network security management method according to any one of claims 1 to 7, or to execute the steps of the network security management method according to any one of claims 8 to 10, based on instructions in the computer program.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, which, when executed by a network security management device, implements the steps of the network security management method according to any one of claims 1 to 7, or implements the steps of the network security management method according to any one of claims 8 to 10.

15. A computer program product, characterized in that, It includes a computer program that, when executed by a network security management device, implements the steps of the network security management method according to any one of claims 1 to 7, or implements the steps of the network security management method according to any one of claims 8 to 10.

Images