Movatterモバイル変換


[0]ホーム

URL:


CN113301033B - Verification code display method and system for lightweight business intrusion - Google Patents

Verification code display method and system for lightweight business intrusion
Download PDF

Info

Publication number
CN113301033B
CN113301033BCN202110531592.XACN202110531592ACN113301033BCN 113301033 BCN113301033 BCN 113301033BCN 202110531592 ACN202110531592 ACN 202110531592ACN 113301033 BCN113301033 BCN 113301033B
Authority
CN
China
Prior art keywords
target user
verification code
user
trusted
target
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110531592.XA
Other languages
Chinese (zh)
Other versions
CN113301033A (en
Inventor
肖铮
徐辉
陈树华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Dingxiang Technology Co ltd
Original Assignee
Hangzhou Dingxiang Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Dingxiang Technology Co ltdfiledCriticalHangzhou Dingxiang Technology Co ltd
Priority to CN202110531592.XApriorityCriticalpatent/CN113301033B/en
Publication of CN113301033ApublicationCriticalpatent/CN113301033A/en
Application grantedgrantedCritical
Publication of CN113301033BpublicationCriticalpatent/CN113301033B/en
Activelegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Images

Classifications

Landscapes

Abstract

The invention provides a verification code display method and a verification code display system for lightweight business invasion, which are applied to a server; comprising the following steps: acquiring a service request when a target user accesses a target service; the target service is a service accessing to the verification code function; judging whether the target user stores the trusted voucher in the server; the trusted credential is a credential generated based on user environment information of the target user; if so, under the condition that the trusted certificate is detected to be free from abnormality, the verification code is not displayed to the target user. The invention relieves the technical problem of high additional operation cost of users in the prior art.

Description

Verification code display method and system for lightweight business intrusion
Technical Field
The invention relates to the technical field of information security, in particular to a verification code display method and system for lightweight business invasion.
Background
The existing verification code technology can invade the flow of a service system in a strong mode, and blocks normal interactive operation of a user, so that extra operation cost of the common user is caused, and the use experience of the user is reduced.
Disclosure of Invention
In view of the above, the present invention aims to provide a verification code display method and system for lightweight business intrusion, so as to alleviate the technical problem of high additional operation cost of users in the prior art.
In a first aspect, an embodiment of the present invention provides a verification code display method for lightweight service intrusion, which is applied to a server; comprising the following steps: acquiring a service request when a target user accesses a target service; the target service is a service accessing to the verification code function; judging whether the target user stores a trusted voucher in the server; the trusted credential is a credential generated based on user environment information of the target user; if so, under the condition that the trusted credential is detected to have no abnormality, the verification code is not displayed to the target user.
Further, before acquiring the service request when the target user accesses the target service, the method further includes: acquiring user environment information of the target user; the user environment information includes: operating system, browser version, network conditions, hardware information; determining a security score for the target user based on the user environment information; the security score is an index for representing the security performance of the user environment information; generating a trusted voucher of the target user when the security score is greater than a first preset score; and storing the trusted certificate in the server, and performing persistence operation on the trusted certificate.
Further, the method further comprises: if the target user is judged to store the trusted voucher in the server and the trusted voucher is detected to be abnormal, acquiring user environment information of the target user; determining a security score for the target user based on the user environment information; judging whether the safety score is larger than a second preset score or not; if yes, the verification code is not displayed to the target user; and if not, displaying the verification code to the target user.
Further, the method further comprises: and adjusting the second preset score based on the current service security logic of the target service.
Further, the method further comprises: if the target user is judged to not store the trusted voucher in the server, judging whether the current service security logic of the target service needs to display a verification code to the target user or not; if yes, showing a verification code to the target user; and if not, not displaying the verification code to the target user.
In a second aspect, the embodiment of the invention also provides a verification code display system for lightweight business invasion, which is applied to a server; comprising the following steps: the display device comprises an acquisition module, a judgment module and a display module; the acquisition module is used for acquiring a service request when a target user accesses a target service; the target service is a service accessing to the verification code function; the judging module is used for judging whether the target user stores the trusted certificate in the server or not; the trusted credential is a credential generated based on user environment information of the target user; and the display module is used for not displaying the verification code to the target user under the condition that the trusted credential is detected to be not abnormal if the trusted credential is judged to be stored in the server by the target user.
Further, the system further comprises: the generation module is used for acquiring the user environment information of the target user; the user environment information includes: operating system, browser version, network conditions, hardware information; determining a security score for the target user based on the user environment information; the security score is an index for representing the security performance of the user environment information; and generating a trusted voucher of the target user when the security score is greater than a first preset score.
Further, the system further comprises: and the storage module is used for storing the trusted certificate in the server and carrying out persistence operation on the trusted certificate.
In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, where the processor executes the computer program to implement the steps of the method described in the first aspect.
In a fourth aspect, embodiments of the present invention also provide a computer readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method of the first aspect.
The invention provides a verification code display method and a verification code display system for lightweight business invasion, which can greatly reduce the cost of a trusted user for verification by repeatedly passing through a verification code by setting a trusted certificate of a target user, reduce the cost of a normal user used by a common user, alleviate the technical problem of high additional operation cost of the user in the prior art, and improve the use experience of the user.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings that are needed in the description of the embodiments or the prior art will be briefly described, and it is obvious that the drawings in the description below are some embodiments of the present invention, and other drawings can be obtained according to the drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flowchart of a verification code display method for lightweight service intrusion provided by an embodiment of the present invention;
fig. 2 is a schematic diagram of a verification code display method for lightweight service intrusion provided in an embodiment of the present invention;
fig. 3 is a schematic diagram of another verification code display system for lightweight service intrusion according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made apparent and fully in view of the accompanying drawings, in which some, but not all embodiments of the invention are shown. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Embodiment one:
fig. 1 is a flowchart of a verification code display method for lightweight service intrusion, which is applied to a server according to an embodiment of the present invention. As shown in fig. 1, the method specifically includes the following steps:
step S102, obtaining a service request when a target user accesses a target service; the target service is a service accessing to the verification code function.
Step S104, judging whether the target user stores the trusted voucher in the server; the trusted credential is a credential generated based on user context information of the target user.
Step S106, if yes, under the condition that the trusted certificate is detected to be free from abnormality, the verification code is not displayed to the target user.
Optionally, the validity period of the trusted credential of the target user exists, and the detection of whether the trusted credential is abnormal or not can be achieved by monitoring whether the trusted credential is within the validity period or whether the use environment of the target user is consistent with the use environment of the target user when the trusted credential is generated.
The invention provides a verification code display method for lightweight business invasion, which can greatly reduce the cost of a trusted user for verification by repeatedly passing through a verification code by setting a trusted certificate of a target user, reduce the cost of a normal user used by a common user, alleviate the technical problem of high additional operation cost of the user in the prior art, and promote the use experience of the user.
Optionally, before step S102, the method provided by the embodiment of the present invention further includes generating a trusted credential of the target user, specifically including the following steps:
step S11, obtaining user environment information of a target user; the user environment information includes: operating system, browser version, network conditions, hardware information.
Step S12, determining the security score of the target user based on the user environment information; the security score is an indicator that characterizes the security performance of the user context information.
And S13, when the security score is larger than a first preset score, generating a trusted voucher of the target user. Alternatively, the trusted voucher needs to be obtained by the user by accessing the specified link address and in case the security score passes.
Step S14 stores the trusted voucher in the server and performs a persistence operation on the trusted voucher.
Optionally, if in step S104, it is determined that the target user stores the trusted credential in the server, and an abnormality is detected in the trusted credential, for example: and judging the security score of the target user again if the validity period of the trusted voucher is expired or the environment of the trusted voucher in use is inconsistent with the acquired environment.
Specifically, user environment information of a target user is obtained; determining a security score for the target user based on the user environment information; judging whether the safety score is larger than a second preset score or not; if yes, the verification code is not displayed to the target user; if not, the verification code is displayed to the target user.
Optionally, the method provided by the embodiment of the invention further includes: and adjusting a second preset score based on the current service security logic of the target service. That is, the safety threshold (i.e., the second preset score) in the embodiment of the present invention may be dynamically adjusted or set according to the actual needs.
The security of the network information in the prior art cannot be effectively ensured completely based on the trusted certificates or only through the setting of security rules or security scores. Therefore, the method provided by the embodiment of the invention realizes the dynamic treatment of the security risk by combining the trusted certificate with the security score of the user and configuring the security threshold, and reduces the experience blocking and the use cost of the verification code to the common user.
Optionally, in the embodiment of the present invention, if it is determined that the target user does not store the trusted credential in the server, it is determined whether the current service security logic of the target service needs to display the verification code to the target user; if yes, showing the verification code to the target user; if not, the verification code is not displayed to the target user.
Specifically, the target service with the verification code function is docked, the security risk threshold can be dynamically set according to the security index requirement of the current service logic, and if the security index of the current service logic needs to reduce interception setting, the verification code is not displayed to the target user; and if the security index of the current business logic and the detected security index reach the security risk threshold, displaying the verification code.
According to the verification code display method for lightweight service intrusion, the triggering threshold value (namely the second preset score) of the verification code can be set through the security score, the cost that trusted users need to repeatedly verify through the verification code can be greatly reduced through the trusted certificates, the cost of normal service use of common users is reduced, and the use experience of users is provided.
Embodiment two:
fig. 2 is a schematic diagram of a verification code display system for lightweight service intrusion, which is applied to a server according to an embodiment of the present invention. As shown in fig. 2, the system includes: the system comprises an acquisition module 10, a judgment module 20 and a display module 30.
Specifically, the acquiring module 10 is configured to acquire a service request when the target user accesses the target service; the target service is a service accessing to the verification code function.
A judging module 20, configured to judge whether the target user stores the trusted certificate in the server; the trusted credential is a credential generated based on user context information of the target user.
And the display module 30 is configured to not display the verification code to the target user if it is determined that the target user stores the trusted credential in the server and if it is detected that the trusted credential does not have an abnormality.
The invention provides a verification code display system for lightweight business invasion, which can greatly reduce the cost of a trusted user for verification by repeatedly passing through a verification code by setting a trusted certificate of a target user, reduce the cost of a normal user used by a common user, alleviate the technical problem of high additional operation cost of the user in the prior art, and promote the use experience of the user.
Optionally, the display module 30 is further configured to, if it is determined that the target user stores the trusted certificate in the server and it is detected that the trusted certificate is abnormal, re-determine the security score of the target user. Specifically, user environment information of a target user is obtained; determining a security score for the target user based on the user environment information; judging whether the safety score is larger than a second preset score or not; if yes, the verification code is not displayed to the target user; if not, the verification code is displayed to the target user.
Optionally, the display module 30 is further configured to adjust the second preset score based on the current service security logic of the target service.
Optionally, the display module 30 is further configured to determine whether the current service security logic of the target service needs to display the verification code to the target user if it is determined that the target user does not store the trusted credential in the server; if yes, showing the verification code to the target user; if not, the verification code is not displayed to the target user.
Optionally, fig. 3 is a schematic diagram of another verification code display system for lightweight business intrusion provided according to an embodiment of the present invention. As shown in fig. 3, the system further includes: a generating module 40, configured to obtain user environment information of a target user; the user environment information includes: operating system, browser version, network conditions, hardware information; determining a security score for the target user based on the user environment information; the security score is an index for representing the security performance of the user environment information; and when the security score is greater than the first preset score, generating a trusted voucher of the target user.
As shown in fig. 3, the system provided by the embodiment of the present invention further includes: the storage module 50 is configured to store the trusted certificate in the server and perform a persistence operation on the trusted certificate.
The embodiment of the invention also provides an electronic device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the computer program to realize the steps of the method in the first embodiment.
The present invention also provides a computer-readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method of the first embodiment.
Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present invention, and not for limiting the same; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit of the invention.

Claims (6)

CN202110531592.XA2021-05-142021-05-14Verification code display method and system for lightweight business intrusionActiveCN113301033B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN202110531592.XACN113301033B (en)2021-05-142021-05-14Verification code display method and system for lightweight business intrusion

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN202110531592.XACN113301033B (en)2021-05-142021-05-14Verification code display method and system for lightweight business intrusion

Publications (2)

Publication NumberPublication Date
CN113301033A CN113301033A (en)2021-08-24
CN113301033Btrue CN113301033B (en)2023-05-02

Family

ID=77322241

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN202110531592.XAActiveCN113301033B (en)2021-05-142021-05-14Verification code display method and system for lightweight business intrusion

Country Status (1)

CountryLink
CN (1)CN113301033B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN114048449B (en)*2022-01-112022-05-13北京顶象技术有限公司Method and device for improving security of verification code by combining cache information

Citations (7)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
EP2394388A1 (en)*2009-02-032011-12-14Inbay Technologies Inc.Network transaction verification and authentication
CN104348809A (en)*2013-08-022015-02-11深圳市腾讯计算机系统有限公司Network security monitoring method and system
CN107404491A (en)*2017-08-142017-11-28腾讯科技(深圳)有限公司Terminal environments method for detecting abnormality, detection means and computer-readable recording medium
CN109977641A (en)*2019-03-252019-07-05山东浪潮云信息技术有限公司A kind of authentication processing method and system of Behavior-based control analysis
CN109981567A (en)*2019-02-132019-07-05平安科技(深圳)有限公司Sending method, device, storage medium and the server of network authorization data
CN111586028A (en)*2020-04-302020-08-25广州市百果园信息技术有限公司Abnormal login evaluation method and device, server and storage medium
CN112187702A (en)*2019-07-022021-01-05北京京东尚科信息技术有限公司Method and device for verifying client

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US8839433B2 (en)*2010-11-182014-09-16Comcast Cable Communications, LlcSecure notification on networked devices
CN106130998A (en)*2016-06-302016-11-16珠海市魅族科技有限公司A kind of identifying code transmission method and device
CN107872438B (en)*2016-09-282021-02-05腾讯科技(深圳)有限公司Verification method, device and terminal
CN107749836B (en)*2017-09-152020-07-31江苏大学Mobile sensing system and mobile sensing method for user privacy protection and data reliability
CN110276183B (en)*2019-06-192020-11-03同盾控股有限公司Reverse Turing verification method and device, storage medium and electronic equipment

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
EP2394388A1 (en)*2009-02-032011-12-14Inbay Technologies Inc.Network transaction verification and authentication
CN104348809A (en)*2013-08-022015-02-11深圳市腾讯计算机系统有限公司Network security monitoring method and system
CN107404491A (en)*2017-08-142017-11-28腾讯科技(深圳)有限公司Terminal environments method for detecting abnormality, detection means and computer-readable recording medium
CN109981567A (en)*2019-02-132019-07-05平安科技(深圳)有限公司Sending method, device, storage medium and the server of network authorization data
CN109977641A (en)*2019-03-252019-07-05山东浪潮云信息技术有限公司A kind of authentication processing method and system of Behavior-based control analysis
CN112187702A (en)*2019-07-022021-01-05北京京东尚科信息技术有限公司Method and device for verifying client
CN111586028A (en)*2020-04-302020-08-25广州市百果园信息技术有限公司Abnormal login evaluation method and device, server and storage medium

Also Published As

Publication numberPublication date
CN113301033A (en)2021-08-24

Similar Documents

PublicationPublication DateTitle
US11743290B2 (en)System and method for detecting cyberattacks impersonating legitimate sources
US20220357992A1 (en)Score calculations for probabilities of types of accessibilities to data resources
US11658994B2 (en)Techniques for efficient network security for a web server using anomaly detection
US9485275B2 (en)Detection of spoofing of remote client system information
US8079087B1 (en)Universal resource locator verification service with cross-branding detection
US8019689B1 (en)Deriving reputation scores for web sites that accept personally identifiable information
US8667294B2 (en)Apparatus and method for preventing falsification of client screen
US10148683B1 (en)ATO threat detection system
CN111711617A (en)Method and device for detecting web crawler, electronic equipment and storage medium
US20120210435A1 (en)Web content ratings
CN112653679B (en)Dynamic identity authentication method, device, server and storage medium
CN108256322B (en)Security testing method and device, computer equipment and storage medium
US12200013B2 (en)System and method for detecting cyberattacks impersonating legitimate sources
CN115917541A (en)User interface for web server risk awareness
WO2021027777A1 (en)Terminal credibility identification method, apparatus and device, and computer readable storage medium
CN111770086A (en) Phishing user simulation collection method, device, system and computer-readable storage medium
CN113301033B (en)Verification code display method and system for lightweight business intrusion
US20140101733A1 (en)System and method for secure user authentication with a single action
CN111949363B (en) Business access management method, computer equipment, storage medium and system
US20220035914A1 (en)Information processing device, control method, and program
CN110647736A (en)Plug-in agent system login method and device, computer equipment and storage medium
CN105404796A (en)JavaScript source file protection method and apparatus
CN118400151A (en) Main server-honey detection server password leakage dual detection method
CN112434292A (en)Method and equipment for protecting Web cache against virus exposure
CN114676020A (en)Performance monitoring method and device of cache system, electronic equipment and storage medium

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
CB02Change of applicant information

Address after:Room 601, Building 4, No. 165 Wuchang Avenue, Wuchang Street, Yuhang District, Hangzhou City, Zhejiang Province, 311100

Applicant after:Hangzhou Dingxiang Technology Co.,Ltd.

Address before:Room 603b, building 19, No. 998, Wenyi West Road, Wuchang Street, Yuhang District, Hangzhou City, Zhejiang Province

Applicant before:Top Elephant Technology Co.,Ltd.

CB02Change of applicant information
GR01Patent grant
GR01Patent grant

[8]ページ先頭

©2009-2025 Movatter.jp