CN102647461B - Communication method, server and terminal based on hypertext transfer protocol - Google Patents

Abstract

The present application provides a network communication method and system, server, and terminal based on the Hypertext Transfer Protocol to resist replay attacks in HTTP network communications. A first timestamp is sent to a terminal upon request by the terminal; network request information sent by the terminal is received; the network request information includes the first timestamp and the corresponding timestamp ciphertext; the timestamp ciphertext is generated by the terminal by encrypting the algorithm factor including the first timestamp according to a preset encryption algorithm; the timestamp ciphertext is verified to be valid according to the preset encryption algorithm; if not, the network request information is an invalid request. By verifying the legitimacy and validity of the timestamp ciphertext containing the timestamp information, the possibility of tampering with the timestamp information in the network request is prevented, and the occurrence of network replay attacks is avoided.

Description

Communication method, server and terminal based on hypertext transfer protocol

technical field

The present application relates to the technical field of network security, in particular to a hypertext transfer protocol-based communication method, server, and terminal.

Background technique

At present, as the Internet affects people's daily work and life more and more deeply, the security of data communication based on the Internet is particularly important.

Among various factors affecting network communication security, replay attacks (ReplayAttacks) are one of the most common attack methods. Replay attack, also known as replay attack, replay attack or freshness attack (Freshness Attacks), refers to that the attacker uses network monitoring or other methods to steal authentication credentials, and then resends the disguised data packet to the server to deceive the system. the goal of. It is mostly used in the identity authentication process, destroying the correctness of authentication. This kind of attack repeats a valid data transmission maliciously or fraudulently. The replay attack can be carried out by the initiator or the enemy who intercepts and resends the data. From this explanation, although data encryption can effectively prevent network request information from being hijacked or tampered with, since replay attacks intercept valid information and resend, even data encryption cannot prevent replay attacks.

In the current network communication technology architecture, Transmission Control Protocol/Internet Protocol (TCP/IP, Transmission Control Protocol/Internet Protocol) is the basis of the entire Internet communication. The TCP/IP protocol adopts a four-layer hierarchical structure: network interface layer, network layer, transport layer, and application layer. Each layer calls the network provided by its next layer to fulfill its own needs. Among them, at the application layer, data communication based on Hypertext Transfer Protocol (HTTP, Hypertext Transfer Protocol) is the main communication method of many current network applications, such as most websites and forums. However, since the HTTP protocol is a connectionless and stateless protocol, that is, the server disconnects after processing the terminal request and receiving the response, and the protocol has no memory ability for transaction processing, so the HTTP protocol sent by the terminal to the server every time There is no connection between the front and back of the network request.

The stateless and connectionless nature of the HTTP protocol has been decided at the beginning of the protocol design. Because the purpose of the HTTP protocol is to support hypertext data transmission, in the process where the terminal browser sends a request to the HTTP server, and then the HTTP server sends the corresponding resources back to the terminal, no matter for the terminal or the server, there is no need to record This process, because each request and response are relatively independent. Generally speaking, a Uniform Resource Locator (URL, UniversalResourceLocator) corresponds to a unique hypertext, and the HTTP server will return the same hypertext according to the received URL request for any request sent by a terminal. It is precisely because of this uniqueness that it is meaningless to record the user's behavior status, so the HTTP protocol is designed as a stateless connection protocol.

Based on the above reasons, once the request information between the terminal and the server is intercepted during the data transmission process, since the server does not record any relevant information such as the status of the request, it is impossible to identify whether the request is intercepted and replayed, and it is unavoidable. occurrence of replay attacks.

In a word, a technical problem that needs to be solved urgently by those skilled in the art is: how to prevent the replay attack on the HTTP protocol communication in the existing network communication technology.

Contents of the invention

The technical problem to be solved in this application is to provide a hypertext transfer protocol-based network communication method, server, and terminal, so as to effectively prevent replay attacks caused by intercepted HTTP network requests and improve the security of HTTP network communication.

In order to solve the above problems, the present application discloses a hypertext transfer protocol-based network communication method, including: sending a first timestamp to the terminal at the request of the terminal;

Receiving the network request information sent by the terminal; the network request information includes the first timestamp and the corresponding timestamp ciphertext; the timestamp ciphertext is paired by the terminal according to a preset encryption algorithm to include the first timestamp The algorithm factor encryption generation;

Verifying whether the time stamp ciphertext is valid according to the preset encryption algorithm, if invalid, the network request information is an invalid request.

Preferably, further comprising:

Verifying whether the interval between the first timestamp in the network request information and the current time is within the validity period, and if it exceeds, the network request information is invalid.

Preferably, the preset encryption algorithm is a signature encryption algorithm,

Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

The terminal encrypts the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate a first digital signature to form a timestamp ciphertext;

The verification of whether the timestamp ciphertext is valid includes:

Encrypt the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate a second digital signature;

Verifying whether the second digital signature is consistent with the first digital signature corresponding to the time stamp ciphertext, if not, the time stamp ciphertext is invalid.

Preferably, the preset encryption algorithm is a symmetric encryption algorithm,

Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

The terminal uses the corresponding key to encrypt the algorithm factor including the first timestamp according to the symmetric encryption algorithm to generate an interstamp ciphertext;

The verification of whether the timestamp ciphertext is valid includes:

Use the key corresponding to the symmetric encryption algorithm to decrypt the timestamp ciphertext to obtain the timestamp information therein as a second timestamp, and determine whether the second timestamp is consistent with the first timestamp in the network request information , if inconsistent, the timestamp ciphertext is invalid.

Preferably, the preset encryption algorithm is an asymmetric encryption algorithm,

Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

The terminal uses the corresponding public key to encrypt the algorithm factor including the first timestamp according to the asymmetric encryption algorithm to generate an interstamp ciphertext;

The verification of whether the timestamp ciphertext is valid includes:

The server uses the private key corresponding to the asymmetric encryption algorithm to decrypt the time stamp ciphertext to obtain the time stamp information therein as the second time stamp, and judges whether the second time stamp is consistent with the first time in the network request information Whether the stamps are consistent, if not, the time stamp ciphertext is invalid.

Preferably, the network request information sent by the terminal further includes a credential identifier generated by the terminal; and

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Preferably, the network request information sent by the receiving terminal further includes:

Receive the credential request information from the terminal;

generating a credential identifier corresponding to the credential request information;

Send the credential identifier to the terminal.

preferred,

The received network request information also includes the credential identifier;

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Preferably, the credential identification is dynamically valid, and the method further includes:

If the network request information sent by the terminal includes a credential identifier, the server verifies whether the credential identifier is valid, and if invalid, the network request is an invalid request.

In order to solve the above problems, the application also discloses a network communication method based on hypertext transfer protocol, including:

Get the first timestamp from the server;

Sending network request information to the server; the network request information includes the first timestamp and the corresponding timestamp ciphertext; the timestamp ciphertext is an algorithm that includes the first timestamp according to a preset encryption algorithm Factor encryption generation.

Preferably, the preset encryption algorithm is a signature encryption algorithm,

Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

Encrypting the algorithm factor including the first time stamp according to the signature encryption algorithm to generate a first digital signature to form a time stamp ciphertext.

Preferably, the preset encryption algorithm is a symmetric encryption algorithm,

Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

Using a key corresponding to the symmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext.

Preferably, the preset encryption algorithm is an asymmetric encryption algorithm,

Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes:

Using the public key corresponding to the asymmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext.

Preferably, the network request information also includes a credential identifier; and

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Preferably, before sending the network request information to the server, it also includes:

Send credential request information to the server;

Receive the credential ID sent by the server.

In order to solve the above problems, the application also discloses a server based on hypertext transfer protocol, including:

Receiving module, sending module, timestamp generating module and ciphertext verification module;

Wherein said receiving module comprises:

a first receiving unit, configured to receive timestamp request information;

The second receiving unit is configured to receive network request information; the network request information includes a first time stamp and a corresponding time stamp ciphertext; the time stamp ciphertext is based on a preset encryption algorithm that includes the first time Stamp algorithm factor encryption generation;

Wherein the timestamp generating module is configured to generate a first timestamp in response to the timestamp request information;

Wherein said sending module comprises:

The first sending unit is configured to send the first timestamp generated by the timestamp generating module;

Wherein the ciphertext verification module is used to verify whether the time stamp ciphertext is valid according to the preset encryption algorithm, and if invalid, the network request information is an invalid request.

preferred,

The server also includes:

The timestamp verification module is used to verify whether the interval between the first timestamp and the current time in the network request information received by the second receiving unit is within the valid period, and if it exceeds, the network request information is invalid.

Preferably, the preset encryption algorithm is a signature encryption algorithm,

The ciphertext verification module also includes:

A signature generating unit, configured to encrypt an algorithm factor including the first timestamp according to the signature encryption algorithm to generate a second signature;

The first checking unit is used to verify whether the second digital signature generated by the signature generating unit is consistent with the first digital signature corresponding to the timestamp ciphertext received by the second receiving unit, and if not, the timestamp The ciphertext is invalid.

Preferably, the preset encryption algorithm is a symmetric encryption algorithm,

The ciphertext verification module also includes:

The second verification unit is configured to use the key corresponding to the symmetric encryption algorithm to decrypt the time stamp ciphertext received by the second receiving unit to obtain the time stamp information therein as the second time stamp, and determine the second time whether the stamp is consistent with the first timestamp in the network request information received by the second receiving unit; if not, the timestamp ciphertext is invalid.

Preferably, the preset encryption algorithm is an asymmetric encryption algorithm,

The ciphertext verification module also includes:

The third verification unit is configured to use the private key corresponding to the asymmetric encryption algorithm to decrypt the time stamp ciphertext received by the second receiving unit to obtain the time stamp information therein as the second time stamp, and determine the first time stamp Whether the second timestamp is consistent with the first timestamp in the network request information; if not, the timestamp ciphertext is invalid.

Preferably, the receiving module also includes:

a third receiving unit, configured to receive a credential request from the terminal;

The server also includes:

a credential identifier generating unit, configured to generate a credential identifier according to the credential request received by the third receiving unit;

The sending module also includes:

The second sending unit is configured to send the voucher identifier generated by the voucher identifier generating unit.

Preferably, the network request information received by the second receiving unit further includes a credential identifier;

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Preferably, the credential identifier is dynamically valid;

The server also includes:

A credential verification module, configured to verify whether the network request information received by the second receiving unit includes a credential identifier, and if it is included and the credential identifier is invalid, the network request information is invalid.

In order to solve the above problems, this application also discloses a terminal based on hypertext transfer protocol, including:

Sending module, receiving module and ciphertext module;

Wherein said sending module comprises:

a first sending unit, configured to send a first timestamp acquisition request;

The second sending unit is configured to send network request information; the network request information includes the first timestamp received by the receiving module and the corresponding timestamp ciphertext generated by the ciphertext module;

Wherein said receiving module comprises:

a first receiving unit, configured to receive a first timestamp;

Wherein the ciphertext module is used to encrypt the algorithm factor containing the received first time stamp according to a preset encryption algorithm to generate a time stamp ciphertext.

Preferably, the preset encryption algorithm is a signature encryption algorithm;

The ciphertext module also includes:

The first encryption unit is configured to encrypt the algorithm factor including the first time stamp to generate a first digital signature to form a time stamp ciphertext.

Preferably, the preset encryption algorithm is a symmetric encryption algorithm;

The ciphertext module also includes:

The second encryption unit is configured to use a key corresponding to the symmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext.

Preferably, the preset encryption algorithm is an asymmetric encryption algorithm;

The ciphertext module also includes:

The third encryption unit is configured to use the public key corresponding to the asymmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext.

Preferably, it also includes:

A credential identification generating module, configured to generate a credential identification;

The algorithm factor including the first timestamp also includes the credential identification generated by the credential identification module;

The algorithm factor is composed of the first time stamp and the credential identifier according to preset rules.

preferred,

The sending unit also includes:

a third sending unit, configured to send credential request information;

The receiving module also includes:

The second receiving unit is used to receive the credential identification;

The network request information sent by the second sending unit also includes the credential identifier received by the third receiving unit;

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Compared with the prior art, the present application has the following advantages:

Considering that the existing HTTP-based network communication has connectionless and stateless characteristics, and the server cannot recognize this problem after the request information is intercepted and replayed, we propose to add a timestamp to the request information sent by the terminal to the server, and the server passes Verify whether the time interval between the timestamp in the network request information and the current time is within its validity period. If the time interval exceeds the validity period, it is considered that the current network request is intercepted and replayed, which is an invalid request, so it can effectively avoid HTTP communication occurrence of replay attacks.

Furthermore, in the solution provided by this application, the terminal obtains the time stamp from the server, generates a digital signature for the character string containing the time stamp according to the agreed signature algorithm rules, and puts the digital signature in the network request sent to the server information. The server generates a digital signature according to the same signature algorithm rules, and verifies whether the digital signature generated by the server is consistent with the digital signature carried in the network request information. The web request is invalid. In this way, the possibility of attempting to disguise valid information to deceive the server by tampering with the time stamp in the network request information is avoided, thereby further avoiding the occurrence of replay attacks.

Description of drawings

Fig. 1 is a flowchart of a network communication method based on the HTTP protocol described in Embodiment 1 of the present application;

Fig. 2 is the flow chart of a kind of network communication method based on HTTP protocol described in the second embodiment of the application;

Fig. 3 is a flow chart of a network communication method based on the HTTP protocol described in Embodiment 3 of the present application;

Fig. 4 is a schematic structural diagram of an HTTP server based on the hypertext transfer protocol described in the embodiment of the present application;

FIG. 5 is a schematic structural diagram of a hypertext transfer protocol-based HTTP terminal according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an HTTP-based network communication system according to an embodiment of the present application.

detailed description

In order to make the above objects, features and advantages of the present application more obvious and comprehensible, the present application will be further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

Referring to FIG. 1 , it shows a schematic flow diagram of Embodiment 1 of a communication method based on HTTP protocol provided by the present application. The communication method based on HTTP protocol of this embodiment includes the following steps:

Step 101, the terminal sends a timestamp request to the server.

Step 102, the server generates a first timestamp.

The server may obtain the current time according to international standard rules to generate the first time stamp.

Step 103, the server sends the first timestamp to the terminal.

Step 104, the server receives the network request information sent by the terminal; the network request information includes the first timestamp and the corresponding timestamp ciphertext; the timestamp ciphertext is encrypted by the terminal according to a preset encryption algorithm containing the The algorithm factor encryption generation of the first timestamp.

Step 105, the server verifies whether the timestamp ciphertext is valid according to the preset encryption algorithm, and if invalid, the network request information is an invalid request.

Step 106, the server verifies whether the interval between the first timestamp in the network request information and the current time is within the valid period, and if it exceeds, the network request information is invalid. This step is optional.

Encrypt the algorithm factor containing the first timestamp to generate a timestamp ciphertext, and the server verifies that the ciphertext is valid according to the encryption algorithm agreed with the terminal. If it is invalid, it can be considered that the timestamp ciphertext may be intercepted or tampered with during transmission , so it can be further determined that the first timestamp and the corresponding network request are invalid.

For the convenience of description, this paper refers to the timestamp generated by the server in response to the terminal request and the timestamp directly included in the network request information as the first timestamp, and the timestamp in the algorithm factor that generates the timestamp ciphertext as the second timestamp. timestamp.

Since the time stamp is uniformly generated by the server, it can be guaranteed that the time stamp has strict accuracy. The server may set the valid period of the time stamp corresponding to the terminal according to the network application environment where the terminal is located. The timestamp validity period is usually a length of time, such as 0.5 seconds, which means that the time it takes for the terminal to obtain the timestamp from the server and send the network request containing the timestamp to the server should be within 0.5 seconds. If it exceeds, then It is considered that the network request is delayed during transmission, may be intercepted or a replay attack has occurred, and it is an invalid network request.

Those skilled in the art can easily understand that the validity period of the timestamp corresponding to this type of terminal can be set according to the region where the terminal is located and the complexity of the application.

Step 107, the server returns the response information of the network request to the terminal.

If it is verified that the network request information is valid, the response information returned by the server to the terminal should include valid information corresponding to the network request, such as webpage resources, etc.; otherwise, the response information will include notification information of network request failure.

Referring to FIG. 2 , it shows a schematic flow diagram of Embodiment 2 of a communication method based on the HTTP protocol provided by the present application. The communication method based on the HTTP protocol of this embodiment includes the following steps:

Step 201, the terminal generates a credential identifier.

The terminal can choose the composition method of the credential identifier according to the actual application, such as obtaining the terminal's IP address and port number, the network card identifier and the current time to form the credential identifier, etc., as long as the network requests of different terminals or multiple rounds of network requests of the same terminal are used. The ID of the certificate must be unique.

Step 202, the terminal sends a time stamp request to the server; the time stamp request information includes the credential identifier of the terminal.

Since the existing network communication based on the HTTP protocol is connectionless and stateless communication, there is no connection between multiple requests sent by the terminal to the server. Therefore, we add a unified credential identifier to the multiple network requests sent by the terminal to the server, so that the network requests associated with multiple contents before and after can be linked through the credential identifier, which is convenient for the terminal and the server to manage multiple content-related network request.

In step 203, the server generates a first time stamp; stores configuration information, the configuration information stores the credential identifier corresponding to the current network request information, the first time stamp and the corresponding validity period of the first time stamp.

Every time the server receives the timestamp acquisition request from the terminal, it stores the new second timestamp and validity period identified by the current credential, and can also clear the record of the valid period of the second timestamp before the credential identifier.

Step 204, the server sends the first timestamp to the terminal.

Step 205, the server receives the network request information sent by the terminal; the network request information includes the first timestamp and the corresponding timestamp ciphertext; the timestamp ciphertext is encrypted by the terminal according to a preset encryption algorithm containing the The algorithm factor encryption generation of the first time stamp and the credential identification.

In step 206, the server verifies whether the timestamp ciphertext is valid, and if invalid, the network request information is invalid.

Step 207, the server verifies whether the first timestamp in the network request is valid, and if invalid, the network request information is invalid.

The server obtains the valid period corresponding to the first timestamp from the stored configuration information through the credential identifier and the first timestamp in the current network request, and then judges whether the time interval between the timestamp in the current network request and the current time of the server is within If the corresponding validity period exceeds the validity period, the timestamp of the current network request is considered invalid, and the network request is an illegal request.

Preferably, the credential identifier is dynamically valid. The server can judge whether the credential identifier is valid according to certain conditions, such as whether the terminal corresponding to the credential identifier is offline, disconnected, or has not responded for a long time, or exceeds the validity period, etc. If the invalid condition is met, the server can set the credential identifier as invalid state, and interrupt the follow-up processing of the current network request and return the response information of request failure to the terminal, so that even if the credential identifier is stolen or used by others, it cannot communicate legally, which effectively improves the security of the communication process.

Step 208, the server returns response information to the terminal.

In Embodiment 1, the server can only use a fixed period of validity for a certain type of terminal to judge whether its network request timestamp is valid. In the above-mentioned Embodiment 2, the server stores the timestamp corresponding to the terminal credential identifier and the time stamp through the configuration information. The valid period of the stamp, because the credential identifier is unique to different terminals or different users using the terminal, therefore, the configuration and judgment of the valid period of the timestamp can be specific to each terminal and different users using the terminal, which improves the server verification time The granularity of stamp validity.

Referring to FIG. 3 , it shows a schematic flow diagram of Embodiment 3 of a communication method based on the HTTP protocol provided by the present application. The communication method based on the HTTP protocol of this embodiment includes the following steps:

Step 301, the terminal sends a certificate request to the server.

Step 302, the server responds to the credential request, generates a credential identifier according to the rules, and sends the credential identifier to the terminal.

Although the credential ID can be generated by the terminal itself, when there are too many terminals and concurrent requests, the generated credential ID cannot be guaranteed to be absolutely unique. The server can effectively avoid the above-mentioned problems by uniformly generating the certificate identifier according to the preset rules according to the certificate request of each terminal. For example, the current unique serial number of the terminal can be generated as the certificate according to the IP address, port number and time contained in the terminal request information. logo.

Step 303, the terminal sends a timestamp request to the server.

Step 304, the server generates a first timestamp.

Step 305, the server sends the first timestamp to the terminal.

In step 306, the terminal encrypts the algorithm factor including the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext.

Step 307, the server receives the network request information sent by the terminal; the network request information includes the first time stamp, the certificate identifier and the corresponding time stamp ciphertext.

The time stamp ciphertext is generated by encrypting the algorithm factors including the first time stamp and certificate identification according to the preset encryption algorithm.

Preferably, the server verifies whether the credential identifier in the current network request information is valid, and if invalid, execute step 308 .

If the current terminal is offline, disconnected or inactive for a long time, the credential identifier corresponding to the terminal may be invalidated by the server.

Step 308, the server verifies whether the time stamp ciphertext is valid according to a preset encryption algorithm, and if not, executes step 310.

The preset encryption algorithm is an encryption algorithm rule agreed between the terminal and the server.

Optionally, the encryption algorithm is a signature encryption algorithm. The terminal encrypts the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate a first digital signature to form a timestamp ciphertext; the server encrypts the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate A second digital signature; verifying whether the second digital signature is consistent with the first digital signature corresponding to the time stamp ciphertext, if not, the time stamp ciphertext is invalid.

The signature encryption algorithm rules may include the following steps: first organize the algorithm factors according to preset rules; then calculate the algorithm factors according to the signature algorithm to obtain a digital signature. For example, the organization rule of the algorithm factor in this example can be 'time stamp + credential identification + others', and even the entire request message can be used as the algorithm factor; the signature algorithm used can be a message digest algorithm (MD5, MessageDigestAlgorithm5) or other Signature algorithm.

The MD5 algorithm is a hash function widely used in the field of computer security to provide message integrity protection. This algorithm can generate a unique MD5 information digest, that is, a digital signature, for any file or a piece of information. If anyone makes any changes to the file or information, its MD5 value will change.

Optionally, the preset encryption algorithm is a symmetric encryption algorithm; the terminal uses a corresponding key to encrypt the algorithm factor containing the first timestamp according to the symmetric encryption algorithm to generate an interstamp ciphertext; the server uses the symmetric The key corresponding to the encryption algorithm decrypts the timestamp ciphertext to obtain the timestamp information as the second timestamp, and judges whether the second timestamp is consistent with the first timestamp in the network request information, and if not, Then the timestamp ciphertext is invalid.

Unlike the signature algorithm, which encrypts the information digest of the algorithm factor to obtain the signature, the symmetric encryption algorithm encrypts the entire algorithm factor string to obtain the timestamp ciphertext; the server uses the same key or the corresponding decryption program to decrypt the timestamp The ciphertext is decrypted to obtain the original text of the algorithm factor. Commonly used algorithms such as Advanced Encryption Standard (Advanced Encryption Standard, AES) encryption algorithm.

Optionally, the preset encryption algorithm is an asymmetric encryption algorithm; the terminal uses the corresponding public key to encrypt the algorithm factor containing the first timestamp according to the asymmetric encryption algorithm to generate an interstamp ciphertext; the server uses the The private key corresponding to the asymmetric encryption algorithm decrypts the timestamp ciphertext to obtain the timestamp information therein as a second timestamp, and judges whether the second timestamp is consistent with the first timestamp in the network request information, If inconsistent, the time stamp ciphertext is invalid. Commonly used asymmetric encryption algorithms such as RSA encryption algorithm.

If it is verified that the timestamp ciphertext is invalid, it means that the string corresponding to the algorithm factor in the network request information has been tampered with, and the current network request is no longer trusted and is an illegal request.

Preferably, the present application uses a character string including a time stamp and a certificate identifier as an algorithm factor of an encryption algorithm according to preset rules. Since the credential identifier assigned by the server to the terminal is unique, the algorithm factor composed of it is also unique and non-repetitive. Since the timestamp in the HTTP request message is mostly clear code, and the credential identifier is generated by the server according to preset rules, unless the credential identifier is leaked by the rules, the possibility of the credential identifier being tampered with is very low; moreover, the composition rules of the algorithm factor are determined by the terminal Agreed with the server, it is not disclosed to the public. Even if you know that the timestamp and credential identifier are used in the algorithm factor, it is difficult to know the frequency and arrangement of their occurrence. Therefore, if the timestamp ciphertext in the terminal network request information is invalid, then It can be considered that the timestamp in the string has been tampered with, and the request is an illegal request.

Those skilled in the art should understand that when implementing this application, the preset rules for the composition of the time stamp and the credential identifier can be determined according to specific circumstances, as well as the order and number of times that the timestamp and the credential identifier appear in the algorithm factor, for example, it can be Timestamp + credential identifier, or credential identifier + timestamp + timestamp + credential identifier, etc.

In step 309, the server verifies whether the time interval between the first timestamp in the network request and the current time is within its valid period, and if it exceeds the valid period, the current network request is an invalid request.

Step 310, the server returns response information to the terminal.

In the above embodiment, the network request information sent by the terminal to the server includes a credential identifier uniformly assigned by the server, and the server may first verify whether the credential identifier is valid for the network request information containing the credential identifier, and if the credential identifier is invalid, then The server can interrupt the follow-up operation and directly return the invalid request of the terminal, which saves some operation instructions of the server, thus saving server resources to a certain extent and reducing the server load. Secondly, adding a digital signature to the network request information can effectively prevent the network request information from being tampered with and avoid replay attacks. In particular, this application uses the certificate identifier and timestamp uniformly distributed by the server as the signature algorithm factor, which ensures the uniqueness of the signature algorithm factor, avoids the possibility of different terminals generating the same signature and the possibility of the timestamp being tampered with, and effectively Network replay attacks are prevented.

A communication method based on the HTTP protocol provided by the present application has been described above in conjunction with several embodiments. The method is further described below in conjunction with the specific application environment:

In the following embodiments, assume that a user logs in to a website using his user name and password through a terminal, and if the server successfully verifies the login request, the server returns a dynamic password Key to the terminal for use. The server of this website includes login server and encryption server.

Step S01, the user logs in and obtains a credential ID.

In the terminal, the user enters the user name and password to send a login request to the login server. If the login is successful, the login server returns the credential identifier to the terminal. The credential identifier is a unique authentication information string generated by the login server based on the user's username and other relevant information.

Step S02, the terminal obtains the time stamp from the encryption server.

The terminal calls the PostDownloadTimeStamp method to send a timestamp request to the encrypted server to obtain the latest timestamp from the encrypted server. The timestamp is the current accurate time obtained by the encrypted server from the global time synchronization server.

Step S03, the terminal generates the first signature to form a timestamp ciphertext, and organizes a verification request data packet.

If the timestamp is obtained successfully, the terminal calls the RequestHeader_Stamp method to generate a signature and form a verification request packet.

The terminal uses the timestamp and the certificate identifier to calculate the signature to form the timestamp ciphertext. The specific algorithm is: firstly, the timestamp + timestamp + certificate identifier + timestamp is used to form the algorithm factor string; then the algorithm factor string is MD5ed to generate a The signature string forms the timestamp ciphertext.

Step S04, the terminal uses HTTPS to send a verification request to the encrypted server

The terminal uses the PostDownloadTimeStamp method to send the verification request to the encrypted server.

Step S05, the encryption server uses the same rules as the terminal to generate a second signature for the timestamp and the certificate identifier to verify the verification request sent by the terminal. If the second signature is consistent with the first signature corresponding to the timestamp ciphertext, the timestamp encryption The text is legal and valid.

Step S06, verifying whether the time interval between the first timestamp in the network request information and the current time is within a corresponding valid period, and if it exceeds, the network request is invalid.

In step S07, the encryption server returns response information to the terminal.

If the verification is passed, the encryption server returns the correct dynamic password key to the terminal; otherwise, it returns a request failure notification message to the terminal.

The dynamic password Key obtained by the terminal can be used for subsequent operations of the user, such as inputting a dynamic password.

It should be noted that for the foregoing method embodiments, for the sake of simple description, they are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by this application.

Referring to FIG. 4 , it is a schematic structural diagram of an HTTP server based on the hypertext transfer protocol described in the embodiment of the present application.

The HTTP server specifically includes:

Receiving module 410, sending module 420, timestamp generating module 460 and ciphertext checking module 430;

Wherein the receiving module 410 includes:

A first receiving unit 411, configured to receive timestamp request information;

The second receiving unit 412 is configured to receive network request information; the network request information includes a first time stamp and a corresponding time stamp ciphertext; The algorithm factor encryption generation of the time stamp;

Wherein the timestamp generating module 460 is configured to generate a first timestamp in response to the timestamp request information;

Wherein the sending module 420 includes:

The first sending unit 421 is configured to send the first timestamp generated by the timestamp generating module;

The ciphertext verification module 430 is used to verify whether the time stamp ciphertext is valid according to the preset encryption algorithm, and if invalid, the network request information is an invalid request.

preferred,

The server also includes:

The timestamp verification module 470 is configured to verify whether the interval between the first timestamp and the current time in the network request information received by the second receiving unit 412 is within the validity period, and if it exceeds, the network request information is invalid.

Optionally, the preset encryption algorithm is a signature encryption algorithm,

The ciphertext verification module 430 also includes:

A signature generating unit 431, configured to encrypt an algorithm factor including the first timestamp according to the signature encryption algorithm to generate a second signature;

The first verification unit 432 is configured to verify whether the second digital signature generated by the signature generation unit 431 is consistent with the first digital signature corresponding to the timestamp ciphertext received by the second receiving unit 412, and if not, the The above timestamp ciphertext is invalid.

Optionally, the preset encryption algorithm is a symmetric encryption algorithm,

The ciphertext verification module 430 also includes:

The second verification unit 433 is configured to use the key corresponding to the symmetric encryption algorithm to decrypt the timestamp ciphertext received by the second receiving unit 412 to obtain the timestamp information therein as the second timestamp, and judge the Whether the second time stamp is consistent with the first time stamp in the network request information received by the second receiving unit; if not, the ciphertext of the time stamp is invalid.

Optionally, the preset encryption algorithm is an asymmetric encryption algorithm,

The ciphertext verification module 430 also includes:

The third verification unit 434 is configured to use the private key corresponding to the asymmetric encryption algorithm to decrypt the timestamp ciphertext received by the second receiving unit 412 to obtain the timestamp information therein as the second timestamp, and determine Whether the second timestamp is consistent with the first timestamp in the network request information, if not, the timestamp ciphertext is invalid.

Further, the receiving module 410 also includes:

The third receiving unit 413 is configured to receive the credential request of the terminal;

The server also includes:

A credential identifier generating unit 440, configured to generate a credential identifier according to the credential request received by the third receiving unit 413;

The sending module 420 also includes:

The second sending unit 422 is configured to send the credential identifier generated by the credential identifier generating unit 440 .

Preferably, the network request information received by the second receiving unit 412 also includes a credential identifier;

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first time stamp and the credential identifier according to preset rules.

Preferably, the credential identifier is dynamically valid;

The server also includes:

The credential verification module 450 is configured to verify whether the network request information received by the second receiving unit 412 includes a credential identifier, and if it is included and the credential identifier is invalid, the network request information is invalid.

Referring to FIG. 5 , it is a schematic structural diagram of a hypertext transfer protocol-based HTTP terminal according to an embodiment of the present application.

The HTTP terminal includes:

Sending module 510, receiving module 520 and ciphertext module 530;

Wherein the sending module 510 includes:

The first sending unit 511 is configured to send a first timestamp acquisition request;

The second sending unit 512 is configured to send network request information; the network request information includes the first timestamp received by the receiving module and the corresponding timestamp ciphertext generated by the ciphertext module;

Wherein the receiving module 520 includes:

A first receiving unit 521, configured to receive a first time stamp;

Wherein the ciphertext module is used to encrypt the algorithm factor containing the received first time stamp according to a preset encryption algorithm to generate a time stamp ciphertext.

Optionally, the preset encryption algorithm is a signature encryption algorithm;

The ciphertext module 530 also includes:

The first encryption unit 531 is configured to encrypt the algorithm factor including the first time stamp to generate a first digital signature to form a time stamp ciphertext.

Optionally, the preset encryption algorithm is a symmetric encryption algorithm;

The ciphertext module 530 also includes:

The second encryption unit 532 is configured to use a key corresponding to the symmetric encryption algorithm to encrypt the algorithm factor including the first timestamp to generate an interstamped ciphertext.

Optionally, the preset encryption algorithm is an asymmetric encryption algorithm;

The ciphertext module 530 also includes:

The third encryption unit 533 is configured to use the public key corresponding to the asymmetric encryption algorithm to encrypt the algorithm factor including the first timestamp to generate an interstamp ciphertext.

Optionally, the terminal also includes:

Credential ID generating module 540, configured to generate a voucher ID;

The algorithm factor including the first timestamp also includes the credential identification generated by the credential identification module;

The algorithm factor is composed of the first time stamp and the credential identifier according to preset rules.

preferred,

The sending unit 510 also includes:

A third sending unit 513, configured to send credential request information;

The receiving module 520 also includes:

The second receiving unit 522 is configured to receive the credential identification;

The network request information sent by the second sending unit 512 also includes the credential identifier received by the second receiving unit 522;

The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first timestamp and the credential identifier according to preset rules.

Referring to FIG. 6 , it is a schematic structural diagram of a system based on the hypertext transfer protocol HTTP described in the embodiment of the present application.

Specifically, the system includes an HTTP terminal 6100, an HTTP server 6200;

The HTTP terminal 6100 includes:

Terminal sending module 6110, terminal receiving module 6120 and ciphertext module 6130;

Wherein the terminal sending module 6110 includes:

The first sending unit 6111 is configured to send a first timestamp acquisition request;

The second sending unit 6112 is configured to send network request information; the network request information includes the first timestamp received by the receiving module and the corresponding timestamp ciphertext generated by the ciphertext module;

Wherein the terminal receiving module 6120 includes:

A first receiving unit 6121, configured to receive a first timestamp;

The ciphertext module 6130 is configured to encrypt the algorithm factor containing the received first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext.

The HTTP server 6200 includes:

Server receiving module 6210, server sending module 6220, time stamp generating module 6230 and ciphertext verification module 6240;

Wherein the server receiving module 6210 includes:

The first receiving unit 6211 is configured to receive timestamp request information;

The second receiving unit 6212 is configured to receive network request information; the network request information includes the first time stamp and the corresponding time stamp ciphertext; the time stamp ciphertext is based on a preset encryption algorithm The algorithm factor encryption generation of the time stamp;

Wherein the timestamp generating module 6230 is configured to generate a first timestamp in response to the timestamp request information;

Wherein the server sending module 6220 includes:

The first sending unit 6221 is configured to send the first timestamp generated by the timestamp generation module;

The ciphertext verification module 6240 is used to verify whether the timestamp ciphertext is valid according to the preset encryption algorithm, and if invalid, the network request information is an invalid request.

For the detailed structure of the above system, please refer to the above descriptions of the HTTP terminal, the HTTP server, and the relevant parts of the method embodiments.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the system and/or device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for relevant parts, refer to the part of the description of the method embodiments.

Finally, it should also be noted that in this text, relational terms such as first and second etc. are only used to distinguish one entity or operation from another, and do not necessarily require or imply that these entities or operations, any such actual relationship or order exists.

Moreover, the "and/or" in the above means that this paper includes both the relationship of "and" and the relationship of "or", wherein: if the relationship between scheme A and scheme B is "and", it means that a certain embodiment Scheme A and Scheme B can be included in both schemes; if scheme A and scheme B are in an "or" relationship, it means that scheme A or scheme B can be included alone in a certain embodiment.

Above, a kind of network communication method, server and terminal based on hypertext transfer protocol HTTP provided by the present application have been introduced in detail. In this paper, specific examples have been used to illustrate the principle and implementation of the present application. The above embodiments The description is only used to help understand the method of the present application and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation and application scope, in summary , the contents of this specification should not be construed as limiting the application.

Claims (25)

1. A network communication method based on hypertext transfer protocol, characterized in that, comprising: Sending the first timestamp to the terminal at the request of the terminal; receiving the network request information sent by the terminal; the network request information includes the first timestamp and the corresponding timestamp ciphertext, and the network request information sent by the terminal also includes a credential identifier generated by the terminal; The timestamp ciphertext is generated by the terminal by encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm, and the algorithm factor containing the first timestamp includes the credential identifier; the algorithm factor is determined by the The first time stamp and the credential identifier are formed according to preset rules, wherein the credential identifier is composed of the IP address of the terminal, the port number of the terminal, the network card identifier and the current time; Verifying whether the time stamp ciphertext is valid according to the preset encryption algorithm, if invalid, the network request information is an invalid request. 2. The method of claim 1, further comprising: Verifying whether the interval between the first timestamp in the network request information and the current time is within the validity period, and if it exceeds, the network request information is invalid. 3. The method according to claim 1, wherein the preset encryption algorithm is a signature encryption algorithm, Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: The terminal encrypts the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate a first digital signature to form a timestamp ciphertext; The verification of whether the timestamp ciphertext is valid includes: Encrypt the algorithm factor containing the first timestamp according to the signature encryption algorithm to generate a second digital signature; Verifying whether the second digital signature is consistent with the first digital signature corresponding to the time stamp ciphertext, if not, the time stamp ciphertext is invalid. 4. The method according to claim 1, wherein the preset encryption algorithm is a symmetric encryption algorithm, Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: The terminal uses the corresponding key to encrypt the algorithm factor including the first timestamp according to the symmetric encryption algorithm to generate an interstamp ciphertext; The verification of whether the timestamp ciphertext is valid includes: Use the key corresponding to the symmetric encryption algorithm to decrypt the timestamp ciphertext to obtain the timestamp information therein as a second timestamp, and determine whether the second timestamp is consistent with the first timestamp in the network request information , if inconsistent, the timestamp ciphertext is invalid. 5. The method according to claim 1, wherein the preset encryption algorithm is an asymmetric encryption algorithm, Encrypting, by the terminal, an algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: The terminal uses the corresponding public key to encrypt the algorithm factor including the first timestamp according to the asymmetric encryption algorithm to generate an interstamp ciphertext; The verification of whether the timestamp ciphertext is valid includes: The server uses the private key corresponding to the asymmetric encryption algorithm to decrypt the time stamp ciphertext to obtain the time stamp information therein as the second time stamp, and judges whether the second time stamp is consistent with the first time in the network request information Whether the stamps are consistent, if not, the time stamp ciphertext is invalid. 6. The method according to claim 1, wherein the network request information sent by the receiving terminal further includes: Receive the credential request information from the terminal; generating a credential identifier corresponding to the credential request information; Send the credential identifier to the terminal. 7. The method according to claim 1, wherein the voucher identification is dynamically valid, and the method further comprises: If the network request information sent by the terminal includes a credential identifier, the server verifies whether the credential identifier is valid, and if invalid, the network request is an invalid request. 8. A network communication method based on hypertext transfer protocol, characterized in that, comprising: Get the first timestamp from the server; Sending network request information to the server; the network request information includes the first timestamp and the corresponding timestamp ciphertext, and the network request information sent by the terminal also includes a credential identifier generated by the terminal; The timestamp ciphertext is generated by encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm, and the algorithm factor containing the first timestamp also includes the credential identifier; the algorithm factor is determined by the The first time stamp and the credential identifier are composed according to preset rules, wherein the credential identifier is composed of the terminal's IP address, the terminal's port number, the network card identifier and the current time. 9. The method according to claim 8, wherein the preset encryption algorithm is a signature encryption algorithm, Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: Encrypting the algorithm factor including the first time stamp according to the signature encryption algorithm to generate a first digital signature to form a time stamp ciphertext. 10. The method according to claim 8, wherein the preset encryption algorithm is a symmetric encryption algorithm, Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: Using a key corresponding to the symmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext. 11. The method according to claim 8, wherein the preset encryption algorithm is an asymmetric encryption algorithm, Encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext includes: Using the public key corresponding to the asymmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext. 12. The method according to claim 8, further comprising: before sending the network request information to the server: Send credential request information to the server; Receive the credential ID sent by the server. 13. A server based on hypertext transfer protocol, comprising: a receiving module, a sending module, a timestamp generation module and a ciphertext verification module; Wherein said receiving module comprises: a first receiving unit, configured to receive timestamp request information; The second receiving unit is configured to receive network request information; the network request information includes a first time stamp and a corresponding time stamp ciphertext, and the received network request information also includes a credential identifier; The timestamp ciphertext is generated by encrypting the algorithm factor containing the first timestamp according to a preset encryption algorithm, and the algorithm factor containing the first timestamp also includes the credential identifier; the algorithm factor is determined by the The first time stamp and the credential identifier are formed according to preset rules, wherein the credential identifier is composed of the IP address of the terminal, the port number of the terminal, the network card identifier and the current time; Wherein the timestamp generating module is configured to generate a first timestamp in response to the timestamp request information; Wherein said sending module comprises: The first sending unit is configured to send the first timestamp generated by the timestamp generating module; Wherein the ciphertext verification module is used to verify whether the time stamp ciphertext is valid according to the preset encryption algorithm, and if invalid, the network request information is an invalid request. 14. The server of claim 13, wherein: The server also includes: The timestamp verification module is used to verify whether the interval between the first timestamp and the current time in the network request information received by the second receiving unit is within the valid period, and if it exceeds, the network request information is invalid. 15. The server according to claim 13, wherein the preset encryption algorithm is a signature encryption algorithm, The ciphertext verification module also includes: A signature generating unit, configured to encrypt an algorithm factor including the first timestamp according to the signature encryption algorithm to generate a second signature; The first checking unit is used to verify whether the second digital signature generated by the signature generating unit is consistent with the first digital signature corresponding to the timestamp ciphertext received by the second receiving unit, and if not, the timestamp The ciphertext is invalid. 16. The server according to claim 13, wherein the preset encryption algorithm is a symmetric encryption algorithm, The ciphertext verification module also includes: The second verification unit is configured to use the key corresponding to the symmetric encryption algorithm to decrypt the time stamp ciphertext received by the second receiving unit to obtain the time stamp information therein as the second time stamp, and determine the second time whether the stamp is consistent with the first timestamp in the network request information received by the second receiving unit; if not, the timestamp ciphertext is invalid. 17. The server according to claim 13, wherein the preset encryption algorithm is an asymmetric encryption algorithm, The ciphertext verification module also includes: The third verification unit is configured to use the private key corresponding to the asymmetric encryption algorithm to decrypt the time stamp ciphertext received by the second receiving unit to obtain the time stamp information therein as the second time stamp, and determine the first time stamp Whether the second timestamp is consistent with the first timestamp in the network request information; if not, the timestamp ciphertext is invalid. 18. The server according to claim 13, wherein the receiving module further comprises: a third receiving unit, configured to receive a credential request from the terminal; The server also includes: a credential identifier generating unit, configured to generate a credential identifier according to the credential request received by the third receiving unit; The sending module also includes: The second sending unit is configured to send the voucher identifier generated by the voucher identifier generating unit. 19. The server according to claim 18, 13, wherein the credential identifier is dynamically valid; The server also includes: A credential verification module, configured to verify whether the network request information received by the second receiving unit includes a credential identifier, and if it is included and the credential identifier is invalid, the network request information is invalid. 20. A terminal based on hypertext transfer protocol, characterized in that, comprising: Sending module, receiving module and ciphertext module; Wherein said sending module comprises: a first sending unit, configured to send a first timestamp acquisition request; The second sending unit is configured to send network request information; the network request information includes the first timestamp received by the receiving module and the corresponding timestamp ciphertext generated by the ciphertext module, the network request The information also includes the credential identification generated by the terminal; Wherein said receiving module comprises: a first receiving unit, configured to receive a first timestamp; Wherein the ciphertext module is used to encrypt the algorithm factor containing the received first timestamp according to a preset encryption algorithm to generate a timestamp ciphertext, and the algorithm factor containing the first timestamp includes the credential identifier; The algorithm factor is composed of the first time stamp and the credential identifier according to preset rules, wherein the credential identifier is composed of the terminal's IP address, the terminal's port number, the network card identifier and the current time. 21. The terminal according to claim 20, wherein the preset encryption algorithm is a signature encryption algorithm; The ciphertext module also includes: The first encryption unit is configured to encrypt the algorithm factor including the first time stamp to generate a first digital signature to form a time stamp ciphertext. 22. The terminal according to claim 20, wherein the preset encryption algorithm is a symmetric encryption algorithm; The ciphertext module also includes: The second encryption unit is configured to use a key corresponding to the symmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext. 23. The terminal according to claim 20, wherein the preset encryption algorithm is an asymmetric encryption algorithm; The ciphertext module also includes: The third encryption unit is configured to use the public key corresponding to the asymmetric encryption algorithm to encrypt the algorithm factor including the first time stamp to generate an interstamped ciphertext. 24. The terminal according to claim 20, further comprising: A credential identification generating module, configured to generate a credential identification; The algorithm factor including the first timestamp also includes the credential identification generated by the credential identification module; The algorithm factor is composed of the first time stamp and the credential identifier according to preset rules. 25. The terminal of claim 20, wherein: The sending module also includes: a third sending unit, configured to send credential request information; The receiving module also includes: The second receiving unit is configured to receive the credential identification; The network request information sent by the second sending unit also includes the credential identifier received by the second receiving unit; The algorithm factor including the first time stamp also includes the credential identifier; the algorithm factor is composed of the first time stamp and the credential identifier according to preset rules.