A short message interface anti-brushing method and system based on dynamic double hash signature
By employing a dynamic double hash signature mechanism, and leveraging client authentication, timeliness, and random strings to ensure the uniqueness of requests, the problem of SMS interfaces being easily bypassed and replay attacks is solved, achieving efficient and secure SMS interface protection.
Patent Information
- Application Number
- CN202611207417.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-10
- Publication Date
- 2026-11-06
AI Technical Summary
Existing SMS interface protection solutions are easily bypassed, affect user experience, lack dynamism, and are difficult to prevent replay attacks and resource abuse.
A dynamic double hash signature mechanism is adopted, which ensures the uniqueness of requests through client authentication, time limit control and random string, and generates fixed-length signatures by combining double MD5 hash operation for multiple levels of verification.
It effectively prevents malicious requests, eliminates replay attacks, improves security and efficiency, reduces costs, and achieves a standardized, high-strength verification process.
Smart Images
Figure CN123056080A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a method and system for preventing SMS interface fraud based on dynamic double hash signature. Background Technology
[0002] With the widespread adoption of mobile internet applications, SMS services have become a crucial identity authentication method in scenarios such as user registration, login verification, and password retrieval. However, as a public service endpoint open to clients, the SMS interface has long faced the security threat of being frequently and automatically invoked by malicious programs (i.e., spamming). Attackers use automated tools such as "SMS bombers" to make batch requests to the SMS interface, causing not only direct economic losses to the platform but also severely consuming channel resources and affecting the service experience of normal users.
[0003] Currently, the industry's protection measures for SMS interfaces mainly include the following: First, IP frequency limiting, which controls the maximum number of SMS requests from the same IP address within a unit of time; second, CAPTCHA, which requires users to enter a CAPTCHA before sending SMS messages to distinguish between human and machine operations; and third, simple static token verification, which requires the client to include a pre-assigned static token in the request for identity verification. These existing technical solutions have significant drawbacks in practical applications: IP frequency limiting is easily bypassed by attackers using proxy IP pools; CAPTCHA affects user experience and may be cracked by advanced OCR technology; simple static tokens lack dynamism, and once the token is stolen or leaked, the entire protection interface will be completely exposed, resulting in extremely low security. Furthermore, most existing solutions lack effective verification of request timeliness, allowing legitimate requests to be maliciously reused after being intercepted by the network, leading to replay attacks. Additionally, various protection logics are deployed in a scattered manner, making it difficult to form a standardized, reusable, and high-strength security verification process. Summary of the Invention
[0004] Based on this, the embodiments of this application provide a method and system for preventing SMS interface fraud based on dynamic double hash signature, which can effectively prevent high-frequency malicious calls, eliminate replay attacks, and have a standardized verification process.
[0005] Firstly, a method for preventing SMS fraud based on dynamic double hash signatures is provided, which includes:
[0006] The system receives an HTTP request initiated by a client, extracts the signature parameters, client identifier, expiration time, and random string from the HTTP request, and performs format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the initial legality screening of the request parameters.
[0007] For requests that pass the initial verification, the server salt value, the client identifier, the expiration time, the random string, and the server dynamic token are concatenated in an ordered manner according to a predefined format to generate a pre-signature string. The pre-signature string is subjected to a double MD5 hash operation, and the first N bits of the result are truncated to obtain the server verification signature. The server verification signature is compared with the signature parameters to complete the core verification of the dynamic signature.
[0008] Differential process control is executed based on the consistency comparison results; if the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered; if the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
[0009] Optionally, the signature parameters are subjected to format existence verification, the client identifier is subjected to authorization validity verification, and the expiration time is subjected to timeliness verification, including:
[0010] Check if the signature parameter exists and its length is strictly 12 bits. If it does not exist or the length is incorrect, return a signature missing error and reject the request.
[0011] Verify whether the client identifier exists in the server's pre-set authorization list. If it does not exist, return an invalid client identifier error and reject the request.
[0012] Check if the expiration time exists and is a valid number. Convert it into a long integer timestamp and compare it with the server's current system time. If the expiration time is less than the current time, the request is determined to have expired and is immediately rejected.
[0013] Optionally, the step of sequentially concatenating the server-side salt value, the client identifier, the expiration time, the random string, and the server-side dynamic token according to a predefined format includes:
[0014] Using a fixed splicing template, the server-side salt value is used as a prefix, the server-side dynamic token is used as a suffix, and the client identifier, the expiration time, and the random string are embedded in sequence to form a pre-signed string containing static security factors and dynamic request parameters.
[0015] Optionally, performing a double MD5 hash operation on the pre-signed string and truncating the result to the first N bits includes:
[0016] Perform a first MD5 hash operation on the pre-signed string to generate a 32-bit intermediate hash value;
[0017] A second MD5 hash operation is performed on the 32-bit intermediate hash value to generate the final verification signature;
[0018] The first 12 characters of the final verification signature are truncated to obtain a fixed-length server-side verification signature, which is then strictly compared with the signature parameters submitted by the client.
[0019] Optionally, differentiated process control is performed based on the comparison results of the core verification, including:
[0020] When the server verifies that the signature matches the signature parameters, it returns a success status code and allows the subsequent SMS sending business logic to continue.
[0021] If the comparison is inconsistent or any verification item fails in the preliminary verification stage, the processing flow will be immediately interrupted, and the corresponding error code and error message will be returned to the client to prevent this illegal request from entering the SMS sending stage.
[0022] Optionally, after receiving the HTTP request initiated by the client, the method further includes:
[0023] Establish a collaborative anti-replay mechanism that defines the valid time window based on the expiration time and ensures the uniqueness of requests based on the random string;
[0024] Store the combination of the client identifier and the random string in the anti-replay record table. Check whether the combination already exists within the effective time window. If it already exists, determine that the request is a replay request and reject it immediately.
[0025] The expiration time is compared with the server's current system time. If the expiration time is earlier than the current system time, the request is determined to have exceeded the valid time window and is immediately rejected.
[0026] By combining the valid time window with the random string for verification, the same request can only be submitted once within the valid time window and will automatically expire after the valid time window expires, thus achieving dual anti-replay protection for request lifecycle and request uniqueness.
[0027] Optionally, before performing differentiated process control based on the comparison results of the core verification, the method further includes:
[0028] Risk scoring analysis is performed on the request source IP address, device fingerprint, and user behavior sequence. If the risk score exceeds a preset threshold, a secondary challenge verification or direct interception is triggered for the request, even if the core verification passes.
[0029] Secondly, a system for preventing SMS fraud based on dynamic double hash signatures is provided, which includes:
[0030] The receiving and verification module is used to receive HTTP requests initiated by clients, extract signature parameters, client identifier, expiration time, and random string from the HTTP requests, and perform format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the preliminary legality screening of the request parameters.
[0031] The signature generation and core verification module is used to take requests that have passed the initial verification, and in accordance with a predefined format, to sequentially concatenate the server salt value, the client identifier, the expiration time, the random string, and the server dynamic token to generate a pre-signature string. The pre-signature string is then subjected to a double MD5 hash operation, and the first N bits of the result are truncated to obtain the server verification signature. The server verification signature is then compared with the signature parameters to complete the core verification of the dynamic signature.
[0032] The verification and business execution module is used to perform differentiated process control based on the consistency comparison results. If the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered. If the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
[0033] Thirdly, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the methods described in the first aspect above.
[0034] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the first aspect above.
[0035] The beneficial effects of the technical solutions provided in this application include at least the following:
[0036] High-strength anti-fraud measures: Through multiple layers of security including client authentication, time-limited control, random string and dynamic signature, it can effectively identify and block malicious requests initiated by machine scripts, preventing SMS bombing and resource abuse from the source.
[0037] Effective defense against replay attacks: The mechanism based on expires and nonce ensures the uniqueness and timeliness of each request, and intercepted legitimate requests cannot be reused after they expire.
[0038] Significantly enhanced security: The signature scheme of "salt value + dynamic parameters + double hash + truncation verification" makes the signature extremely difficult to forge or collide with, and its security is far higher than that of static tokens or simple signatures.
[0039] Standardization and Automation: Complex security logic is encapsulated into standardized processes, which automates the review process without human intervention and achieves millisecond-level processing speed, greatly improving efficiency.
[0040] Reduce costs: Effectively reduces SMS fee losses caused by malicious data fraud, and saves the manpower costs required for traditional manual or simple rule-based maintenance. Attached Figure Description
[0041] To more clearly illustrate the embodiments of this application or the technical solutions in the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.
[0042] Figure 1 A flowchart illustrating the steps of a method for preventing SMS interface fraud based on dynamic double hash signature, as provided in this application embodiment;
[0043] Figure 2 A system block diagram of a method for preventing SMS interface fraud based on dynamic double hash signature provided in this application embodiment;
[0044] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation
[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0046] In the description of this application, the terms "comprising," "having," and any variations thereof are intended to cover non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those steps or units that are expressly listed, but may also include other steps or units that are not expressly listed but are inherent to these processes, methods, products, or apparatuses, or steps or units added based on further optimizations conceived in this application.
[0047] In view of the problems existing in the background art, the technical problems actually solved by this application include:
[0048] How to effectively prevent SMS interfaces from being frequently and automatically called by malicious programs (i.e., "brushing").
[0049] How to ensure the uniqueness and timeliness of each request to fundamentally prevent replay attacks.
[0050] How to build a high-strength security verification process without sacrificing user experience (such as inputting CAPTCHAs).
[0051] How to implement a standardized and scalable signature verification mechanism to ensure that requests from different clients are processed according to a unified security standard.
[0052] First, let me explain the ellipsis and key terms that appear in this application:
[0053] An HTTP request is the basic protocol unit for a client to send data to a server, and it includes parameters.
[0054] Signature: A short string generated by the client to verify the integrity and validity of the request; in this scheme, it is a fixed-length string of 12 characters.
[0055] Client Identifier: A string used to uniquely identify and authenticate the client.
[0056] Expiration time: The valid deadline timestamp for the request, used to prevent request replay.
[0057] Random string: A one-time random string to ensure the uniqueness of the signature for each request.
[0058] Salt value: A fixed string held by the server to enhance signature security.
[0059] MD5 signature: A utility method for generating a signature by performing an MD5 hash operation on a string.
[0060] The core of this solution lies in an ordered, progressive multi-signature verification process. Please refer to [the relevant documentation / reference]. Figure 1 The document illustrates a flowchart of a method for preventing SMS interface fraud based on dynamic double hash signatures, as provided in an embodiment of this application. This method may include the following steps:
[0061] S1 Request Parameter Reception and Preliminary Verification: Receives HTTP requests initiated by clients, extracts signature parameters, client identifier, expiration time, and random string from the HTTP request, and performs format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the preliminary legality screening of the request parameters.
[0062] In this step, the HTTP request initiated by the client is received, and four key parameters are extracted sequentially: the signature parameter (sign), the client identifier (clientId), the expiration time (expires), and the random string (nonce). Then, a progressive multi-factor verification is initiated.
[0063] First, check if the signature parameter exists and its length is strictly 12 characters. If it does not exist or the length is incorrect, return a signature missing error and reject the request.
[0064] Next, verify whether the client identifier exists in the server's pre-set authorization list. If it is not in the authorization list, return an invalid client identifier error and reject the request.
[0065] Finally, check if the expiration time exists and is a valid number. Convert it into a long integer timestamp and compare it with the server's current system time. If the expiration time is earlier than the current time, the request is determined to have expired and is rejected immediately.
[0066] This step filters obviously illegal requests at the entry point through a fast-fail mechanism, providing a pre-cleaned set of parameters with basic legitimacy for subsequent dynamic signature verification. At the same time, it uses timeliness checks to block expired requests from entering the core verification process at the earliest stage.
[0067] In this application embodiment, a mechanism based on expires and nonce is also included to ensure the uniqueness and timeliness of each request, for example:
[0068] After receiving the HTTP request initiated by the client, it also includes:
[0069] Establish a collaborative anti-replay mechanism that defines the valid time window based on the expiration time and ensures the uniqueness of requests using random strings;
[0070] Store the combination of the client identifier and the random string in the anti-replay record table. Check whether the combination already exists within the valid time window. If it already exists, determine that the request is a replay request and reject it immediately.
[0071] The expiration time is compared with the server's current system time. If the expiration time is earlier than the current system time, the request is determined to have exceeded the valid time window and is rejected immediately.
[0072] By combining a valid time window with a random string for verification, the same request can only be submitted once within the valid time window and will automatically expire after the valid time window expires, thus achieving dual anti-replay protection for both the request lifecycle and the uniqueness of the request.
[0073] S2 Dynamic Signature Generation and Core Verification: For requests that pass the initial verification, the server-side salt value, client identifier, expiration time, random string, and server-side dynamic token are sequentially concatenated according to a predefined format to generate a pre-signature string.
[0074] Perform a double MD5 hash operation on the pre-signed string and truncate the first N bits of the result to obtain the server-side verification signature. Compare the server-side verification signature with the signature parameters to complete the core verification of the dynamic signature.
[0075] In this step, after passing the initial verification in step S1, the core signature verification process begins:
[0076] First, the salt value held by the server, the client identifier, the expiration time, the random string, and the server dynamic token are concatenated in an orderly manner according to the predefined format template to generate a pre-signed string;
[0077] The pre-signed string is then subjected to a first MD5 hash operation to generate a 32-bit intermediate hash value, and then subjected to a second MD5 hash operation to generate the final verification signature.
[0078] Finally, the first 12 characters of the final verification signature are truncated to obtain a fixed-length server-side verification signature, which is then strictly compared with the signature parameters sent in the client request. If they match, the verification passes; otherwise, an illegal access error is returned and the process is aborted. This step optimizes comparison efficiency while ensuring signature unpredictability through double hashing and fixed-length truncation.
[0079] S3 verification result return and business execution: Differentiated process control is executed based on the consistency comparison result; if the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered; if the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
[0080] In this step, differentiated process control is implemented: if the server-side signature verification matches the client-side signature parameters, a success status code is returned to the client and the subsequent SMS sending business logic is triggered; if the comparison does not match or verification fails at any stage of S1, the processing flow is immediately interrupted, and the corresponding error code and error message are returned to the client, preventing this illegal or abnormal request from consuming SMS resources. This step serves as the final execution checkpoint of the entire anti-fraud mechanism, transforming the verification conclusion into a clear business allow or deny action, ensuring that only legitimate requests that pass all progressive verifications can ultimately call the SMS interface, achieving closed-loop control across the entire chain from parameter reception, preliminary verification, dynamic signature verification to business execution.
[0081] Additionally, in optional embodiments of this application, it may also include:
[0082] Introducing a risk control engine: It can integrate risk control modules to comprehensively analyze request IPs, device fingerprints, user behavior sequences, etc., and can perform secondary challenges or directly block high-risk requests even if the signature verification passes.
[0083] Configurable signature algorithms: Signature algorithms (such as MD5, SHA-256) can be designed as configurable options, facilitating smooth upgrades to encryption strength in the future and addressing potential algorithm vulnerabilities.
[0084] In summary, the key points of this application are:
[0085] Progressive Multi-Verification Process: The core of this invention lies in its rigorous and orderly verification chain. This process does not simply verify a single factor, but rather performs progressive verification in the order of "basic signature format → client identity → request timeliness → random string standardization → dynamic signature consistency." Failure at any stage immediately terminates the subsequent processes. This "fail-fast" mechanism ensures security while minimizing unnecessary computational resource consumption, forming a highly efficient and robust overall defense.
[0086] A dynamic signature mechanism based on double hashing and truncation: This scheme's signature generation and verification method is highly innovative. First, a pre-signature string (preSign) is generated, then subjected to two consecutive MD5 hash operations. This double hashing significantly increases the difficulty of reverse engineering and collision attacks. Finally, the first 12 bits of the generated 32-bit complete MD5 signature are truncated and compared with the client's signature. This "double hashing + fixed-length truncation" mode ensures signature unpredictability while generating a short and secure signature, optimizing network transmission and comparison efficiency.
[0087] Time Window and One-Time Random Number Collaborative Anti-Replay Mechanism: This invention innovatively combines expiration time (expires) with a random string (nonce) to form a highly efficient anti-replay attack mechanism. The expires parameter defines the valid time window of the request, ensuring that the request is only valid near the current time and automatically invalidates expired requests. The nonce ensures that within the same time window, each request cannot be reused due to its uniqueness. Together, they form a dual guarantee against request lifecycle and uniqueness, fundamentally eliminating the possibility of replay attacks.
[0088] like Figure 2 This application also provides a system for preventing SMS fraud based on dynamic double hash signatures, which may include:
[0089] The receiving and verification module is used to receive HTTP requests initiated by clients, extract signature parameters, client identifier, expiration time, and random string from the HTTP requests, and perform format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the preliminary legality screening of the request parameters.
[0090] The signature generation and core verification module is used to take requests that have passed the initial verification, and in accordance with a predefined format, to sequentially concatenate the server salt value, the client identifier, the expiration time, the random string, and the server dynamic token to generate a pre-signature string. The pre-signature string is then subjected to a double MD5 hash operation, and the first N bits of the result are truncated to obtain the server verification signature. The server verification signature is then compared with the signature parameters to complete the core verification of the dynamic signature.
[0091] The verification and business execution module is used to perform differentiated process control based on the consistency comparison results. If the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered. If the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
[0092] Specific limitations regarding the SMS interface anti-fraud system based on dynamic double hash signatures can be found in the limitations of the SMS interface anti-fraud method based on dynamic double hash signatures mentioned above, and will not be repeated here. Each module in the aforementioned SMS interface anti-fraud system based on dynamic double hash signatures can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0093] In one embodiment, an electronic device is provided, which may be a computer, and its internal structure diagram may be as follows: Figure 3 As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for SMS interface anti-scraping data. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an SMS interface anti-scraping method.
[0094] Those skilled in the art will understand that, Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0095] In one embodiment of this application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the above-described SMS interface anti-fraud method based on dynamic double hash signature.
[0096] In one embodiment of this application, a computer program product is provided, including a computer program / instructions, which, when executed by a processor, implements the steps of the above-described SMS interface anti-fraud method based on dynamic double hash signature.
[0097] The computer-readable storage medium and computer program product provided in this embodiment are similar in implementation principle and technical effect to the above method embodiments, and will not be described again here.
[0098] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.
[0099] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0100] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. A method for preventing SMS interface fraud based on dynamic double hash signature, characterized in that, The method includes: The system receives an HTTP request initiated by a client, extracts the signature parameters, client identifier, expiration time, and random string from the HTTP request, and performs format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the initial legality screening of the request parameters. For requests that pass the initial verification, the server salt value, the client identifier, the expiration time, the random string, and the server dynamic token are concatenated in an ordered manner according to a predefined format to generate a pre-signature string. The pre-signature string is subjected to a double MD5 hash operation, and the first N bits of the result are truncated to obtain the server verification signature. The server verification signature is compared with the signature parameters to complete the core verification of the dynamic signature. Differential process control is executed based on the consistency comparison results; if the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered; if the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
2. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, The signature parameters are validated for format existence; the client identifier is validated for authorization validity; and the expiration time is validated for timeliness, including: Check if the signature parameter exists and its length is strictly 12 bits. If it does not exist or the length is incorrect, return a signature missing error and reject the request. Verify whether the client identifier exists in the server's pre-set authorization list. If it does not exist, return an invalid client identifier error and reject the request. Check if the expiration time exists and is a valid number. Convert it into a long integer timestamp and compare it with the server's current system time. If the expiration time is less than the current time, the request is determined to have expired and is immediately rejected.
3. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, The step of sequentially concatenating the server-side salt value, the client-side identifier, the expiration time, the random string, and the server-side dynamic token according to a predefined format includes: Using a fixed splicing template, the server-side salt value is used as a prefix, the server-side dynamic token is used as a suffix, and the client identifier, the expiration time, and the random string are embedded in sequence to form a pre-signed string containing static security factors and dynamic request parameters.
4. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, Perform a double MD5 hash operation on the pre-signed string and truncate the result to the first N bits, including: Perform a first MD5 hash operation on the pre-signed string to generate a 32-bit intermediate hash value; A second MD5 hash operation is performed on the 32-bit intermediate hash value to generate the final verification signature; The first 12 characters of the final verification signature are truncated to obtain a fixed-length server-side verification signature, which is then strictly compared with the signature parameters submitted by the client.
5. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, Based on the comparison results of the core verification, differentiated process control is performed, including: When the server verifies that the signature matches the signature parameters, it returns a success status code and allows the subsequent SMS sending business logic to continue. If the comparison is inconsistent or any verification item fails in the preliminary verification stage, the processing flow will be immediately interrupted, and the corresponding error code and error message will be returned to the client to prevent this illegal request from entering the SMS sending stage.
6. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, Following the HTTP request initiated by the receiving client, the following is also included: Establish a collaborative anti-replay mechanism that defines the valid time window based on the expiration time and ensures the uniqueness of requests based on the random string; Store the combination of the client identifier and the random string in the anti-replay record table. Check whether the combination already exists within the effective time window. If it already exists, determine that the request is a replay request and reject it immediately. The expiration time is compared with the server's current system time. If the expiration time is earlier than the current system time, the request is determined to have exceeded the valid time window and is immediately rejected. By combining the valid time window with the random string for verification, the same request can only be submitted once within the valid time window and will automatically expire after the valid time window expires, thus achieving dual anti-replay protection for request lifecycle and request uniqueness.
7. The SMS interface anti-fraud method based on dynamic double hash signature according to claim 1, characterized in that, Before performing differentiated process control based on the comparison results of the core verification, the process also includes: Risk scoring analysis is performed on the request source IP address, device fingerprint, and user behavior sequence. If the risk score exceeds a preset threshold, a secondary challenge verification or direct interception is triggered for the request, even if the core verification passes.
8. A SMS interface anti-fraud system based on dynamic double hash signature, characterized in that, The system includes: The receiving and verification module is used to receive HTTP requests initiated by clients, extract signature parameters, client identifier, expiration time, and random string from the HTTP requests, and perform format existence verification on the signature parameters, authorization validity verification on the client identifier, and timeliness verification on the expiration time to complete the preliminary legality screening of the request parameters. The signature generation and core verification module is used to take requests that have passed the initial verification, and in accordance with a predefined format, to sequentially concatenate the server salt value, the client identifier, the expiration time, the random string, and the server dynamic token to generate a pre-signature string. The pre-signature string is then subjected to a double MD5 hash operation, and the first N bits of the result are truncated to obtain the server verification signature. The server verification signature is then compared with the signature parameters to complete the core verification of the dynamic signature. The verification and business execution module is used to perform differentiated process control based on the consistency comparison results. If the comparison is consistent, a success status code is returned and the subsequent SMS sending business logic is triggered. If the comparison is inconsistent or the verification fails in the preliminary verification stage, the process is immediately interrupted and the corresponding error information is returned.
9. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.