CN115296863A - A method, device and storage medium for ensuring user safety - Google Patents

Abstract

The present disclosure relates to the technical field of network security, and discloses a method, a device and a storage medium for ensuring user security. The method includes: determining a target client certificate and a target user corresponding to the target user terminal based on an HTTPS request message initiated by a target user terminal Credential, based on the target user credential and the pre-established binding relationship between the certificate and the credential, to determine the binding client certificate bound to the target user credential. It should be noted that the above-mentioned binding relationship between the certificate and the credential is based on the target user terminal It is determined by the sent HTTPS connection establishment request message, and based on the target client certificate and the bound client certificate, it responds to the HTTPS request message, that is, the target client certificate of the target user terminal and the bound client certificate are determined according to the binding relationship. Whether the certificates are consistent can be used to judge whether there is a security risk, effectively screening out the behavior of fraudulently using the identity of other users, and ensuring the safety of users.

Description

A method, device and storage medium for ensuring user safety

technical field

The present disclosure relates to the technical field of network security, and provides a method, device and storage medium for ensuring user security.

Background technique

At present, after the user terminal successfully logs in to the system, it will obtain a credential, such as SessionId, AccessToken, etc., and the subsequent access of the user terminal to the system needs to carry the credential to clarify the identity and authority of the user terminal.

However, the above-mentioned credentials are generally in the form of random character strings or Java Web Services (JWS). Once the above-mentioned credentials are leaked, an attacker (that is, other users) can use the above-mentioned credentials to access the data of the user terminal in the system. That is, the existing HTTPS two-way authentication method can only determine that the user terminal is a trusted user terminal, but cannot determine whether the user terminal is fraudulently using the identity of other user terminals.

Contents of the invention

Embodiments of the present disclosure provide a method, device, and storage medium for ensuring user security, which are used to screen behaviors that impersonate other user identities, thereby ensuring user security.

The specific technical solutions provided by the present disclosure are as follows:

In the first aspect, the embodiment of the present disclosure provides a method for ensuring user security, including:

Determine the target client certificate and target user credentials corresponding to the target user terminal based on the HTTPS request message initiated by the target user terminal;

Determine the binding client certificate bound to the target user credential based on the target user credential and the pre-established binding relationship between the certificate and the credential, wherein the binding relationship between the certificate and the credential is based on the HTTPS connection establishment request sent by the target user terminal The news is confirmed;

Respond to the HTTPS request message based on the target client certificate and the binding client certificate.

Optionally, the binding relationship between certificates and credentials is determined by the following methods:

When receiving the HTTPS connection establishment request message sent by the target user terminal, parse the client certificate from the HTTPS connection establishment request message;

Generate a certificate digest based on the client certificate, and generate user credentials based on the certificate digest;

Based on the client certificate and user credentials, a binding relationship between certificates and credentials is generated.

Optionally, based on the HTTPS request message initiated by the target user terminal, determine the target client certificate and target user credentials corresponding to the target user terminal, including:

When receiving the HTTPS request message sent by the target user terminal, parse out the target client certificate from the HTTPS request message;

A target certificate digest is generated based on the target client certificate, and a target user credential is generated based on the target certificate digest, and the generated target user credential is determined as the target user credential corresponding to the target user terminal.

Optionally, based on the target user credential and the pre-established binding relationship between the certificate and the credential, determining the bound client certificate bound to the target user credential includes:

Find the client certificate bound to the target user's certificate in the pre-established binding relationship between the certificate and the certificate;

Use the found bound client certificate as the bound client certificate.

Optionally, responding to the HTTPS request message based on the target client certificate and the bound client certificate, including:

If the target client certificate is the same as the bound client certificate, HTTPS request messages are allowed to access;

If the target client certificate is different from the bound client certificate, intercept the HTTPS request message.

In the second aspect, the embodiment of the present disclosure also provides a device for ensuring user safety, including:

A determining unit, configured to determine a target client certificate and a target user certificate corresponding to the target user terminal based on a hypertext transfer security protocol HTTPS request message initiated by the target user terminal;

The binding unit is configured to determine the binding client certificate bound to the target user credential based on the target user credential and the pre-established binding relationship between the certificate and the credential, wherein the binding relationship between the certificate and the credential is based on the target user terminal determined by the HTTPS connection establishment request message sent;

The response unit is configured to respond to the HTTPS request message based on the target client certificate and the bound client certificate.

Optionally, the binding relationship between certificates and credentials is determined by the following methods:

When receiving the HTTPS connection establishment request message sent by the target user terminal, parse the client certificate from the HTTPS connection establishment request message;

Generate a certificate digest based on the client certificate, and generate user credentials based on the certificate digest;

Based on the client certificate and user credentials, a binding relationship between certificates and credentials is generated.

Optionally, based on the HTTPS request message initiated by the target user terminal, determine the target client certificate and target user credentials corresponding to the target user terminal, and the determining unit is used for:

When receiving the HTTPS request message sent by the target user terminal, parse out the target client certificate from the HTTPS request message;

A target certificate digest is generated based on the target client certificate, and a target user credential is generated based on the target certificate digest, and the generated target user credential is determined as the target user credential corresponding to the target user terminal.

Optionally, based on the target user credential and the pre-established binding relationship between the certificate and the credential, determine the bound client certificate bound to the target user credential, and the binding unit is used for:

Find the client certificate bound to the target user's certificate in the pre-established binding relationship between the certificate and the certificate;

Use the found bound client certificate as the bound client certificate.

Optionally, respond to the HTTPS request message based on the target client certificate and the bound client certificate, and the response unit is used for:

If the target client certificate is the same as the bound client certificate, HTTPS request messages are allowed to access;

If the target client certificate is different from the bound client certificate, intercept the HTTPS request message.

In a third aspect, a server includes:

memory for storing executable instructions;

A processor, configured to read and execute executable instructions stored in the memory, so as to implement the method according to any one of the first aspect.

In a fourth aspect, a computer-readable storage medium, when the instructions in the storage medium are executed by a processor, enables the processor to execute the method described in any one of the above-mentioned first aspects.

The beneficial effects of the disclosure are as follows:

To sum up, in the embodiments of the present disclosure, a method, device and storage medium for ensuring user security are provided, the method includes: based on the HTTPS request message initiated by the target user terminal, determining the target client certificate corresponding to the target user terminal and the target user credential, based on the target user credential and the pre-established binding relationship between the certificate and the credential, determine the binding client certificate bound to the target user credential. It should be noted that the binding relationship between the above certificate and credential is based on Determine the HTTPS connection establishment request message sent by the target user terminal, and respond to the HTTPS request message based on the target client certificate and the bound client certificate, that is, determine the target user terminal’s target client certificate and bound client certificate according to the binding relationship. Determine whether the client certificate is consistent, so as to judge whether there is a security risk, effectively screen out the behavior of impersonating other user identities, and ensure the safety of users.

Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the disclosure. The objectives and other advantages of the disclosure may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The drawings described here are used to provide a further understanding of the present disclosure, and constitute a part of the present disclosure. The schematic embodiments of the present disclosure and their descriptions are used to explain the present disclosure, and do not constitute improper limitations to the present disclosure. In the attached picture:

FIG. 1 is a schematic diagram of a system architecture for guaranteeing user security in an embodiment of the present disclosure;

FIG. 2 is a schematic flowchart of a method for ensuring user security in an embodiment of the present disclosure;

FIG. 3 is a schematic flow diagram of determining a target user credential in an embodiment of the present disclosure;

FIG. 4 is a schematic flow diagram of determining to bind a client certificate in an embodiment of the present disclosure;

5 is a schematic diagram of responding to an HTTPS request message in an embodiment of the present disclosure;

Figure 6 is a schematic diagram of using SHA256 to generate a summary certificate in an application scenario;

Fig. 7 is a schematic diagram of binding the target client certificate and the target user certificate in the application scenario;

FIG. 8 is a schematic diagram of using a binding relationship to verify user credentials in an application scenario;

FIG. 9 is a schematic diagram of a logical architecture of a device for ensuring user safety in an embodiment of the present disclosure;

FIG. 10 is a schematic diagram of a physical architecture of a server in an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are the embodiment of the present disclosure. Some embodiments of the technical solution, but not all embodiments. Based on the embodiments recorded in this disclosure document, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of the technical solution of the disclosure.

The terms "first", "second" and the like in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein.

Preferred embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings.

Referring to FIG. 1 , in the embodiment of the present disclosure, the system includes at least one server and at least two user terminals. In FIG. 1 , user terminal 1 and user terminal 2 represent the two user terminals connected to the server. In the implementation process, one of the user terminals (for example, user terminal 1) generates user credentials on the basis of HTTPS two-way authentication with the server, and the other user terminal (for example, user terminal 2) sends an HTTPS request to the server It is possible to fraudulently use the above user credentials when sending messages, which will bring security risks. In the embodiment of the present disclosure, the target user terminal is usually one of the above-mentioned at least two user terminals, and the target user terminal uses the pre-established binding relationship between the certificate and the certificate to verify the target user terminal that sends the HTTPS request message, as follows Specific introduction.

Referring to Figure 2, in the embodiment of the present disclosure, a specific process for ensuring user security is as follows:

Step 201: Based on a HyperText Transfer Protocol Secure (HTTPS) request message initiated by a target user terminal, determine a target client certificate and a target user credential corresponding to the target user terminal.

During the implementation process, the process of determining the target client certificate and target user credentials corresponding to the target user terminal, as shown in Figure 3, includes:

Step 2011: When receiving the HTTPS request message from the target user terminal, parse out the target client certificate from the HTTPS request message.

When the target user terminal sends an HTTPS request message to the server, for example, the interface access request message sent by the target user terminal, that is, during the HTTPS handshake, the server receives the HTTPS request message and parses the HTTPS request message to obtain the included Target client certificate.

It should be noted that the above-mentioned target client certificate corresponds to the target user terminal one by one, and the target client certificate is uniquely configured by the server for the target user terminal, and the target client certificates corresponding to each target user terminal are different. of.

Step 2012: Generate a target certificate digest based on the target client certificate, generate a target user credential based on the target certificate digest, and determine the generated target user credential as the target user credential corresponding to the target user terminal.

Since the target client certificate is a file, during the implementation process, after the target client certificate is determined, the target client certificate is generated using an algorithm such as SHA256, MD5 or SM3 to generate a target certificate summary, thereby determining a smaller file size for the target user terminal. More private identification. Further, the target user credentials, such as SessionId, AccessToken, etc., are generated according to the target certificate abstract above, and the generated target user credentials are determined as the target user credentials corresponding to the target user terminal, that is, corresponding to the HTTPS request message sent by the target user terminal. Target user credentials.

Step 202: Determine the binding client certificate bound to the target user credential based on the target user credential and the pre-established binding relationship between the certificate and the credential, wherein the binding relationship between the certificate and the credential is based on the HTTPS sent by the target user terminal The connection establishment request message is determined.

First, the binding relationship between the certificate and the certificate is determined by the following methods:

(1) When receiving the HTTPS connection establishment request message sent by the target user terminal, parse out the client certificate from the HTTPS connection establishment request message.

When the target user terminal sends an HTTPS connection establishment request message to the server, the server parses the received HTTPS connection establishment request message and determines the client certificate corresponding to the target user terminal. Used as an identification for calibration when sending an HTTPS request message.

(2) Generate a certificate digest based on the client certificate, and generate user credentials based on the certificate digest.

During the implementation process, after the client certificate is determined, use algorithms such as SHA256, MD5 or SM3 to generate a certificate summary from the client certificate, and further, generate user credentials based on the above certificate summary, namely SessionId, AccessToken, etc.

(3) Based on the client certificate and the user certificate, a binding relationship between the certificate and the certificate is generated.

Since subsequent target user terminals access to the server need to carry user credentials to clarify the user's identity and authority, etc., in order to facilitate the verification of the target user terminal in the subsequent process, the above client certificate and the corresponding user Credentials are bound to generate a binding relationship between certificates and credentials.

It should be added that since there are multiple target user terminals that send HTTPS connection establishment request messages to the server, correspondingly, multiple client certificates and user credentials will also be stored in the above-mentioned binding relationship between certificates and credentials. pair.

After the target user terminal sends an HTTPS request message, determine the binding client certificate bound to the target user credential, as shown in Figure 4, specifically including:

Step 2021: In the pre-established binding relationship between the certificate and the credential, search for the client certificate bound to the target user credential.

During the implementation process, after the target user credential is determined according to the HTTPS request message, in the above-mentioned pre-established binding relationship between the certificate and the credential, search for the client certificate bound to the target user credential, that is, in the above-mentioned binding relationship Find the same user credentials as the target user credentials.

If the same user credential as the target user credential is found in the above-mentioned stored binding relationship, the bound client certificate will be further searched based on the same user credential.

If no user credential identical to the target user credential can be found in the above-mentioned stored binding relationship, an abnormal alarm is sent out directly, that is, it is determined that the target user terminal embezzles an illegal target user credential for access.

Step 2022: Use the found bound client certificate as the bound client certificate.

During the implementation process, if the user credential identical to the target user credential is found based on the binding relationship, the bound client certificate found will be used as the bound client certificate, and the bound client certificate will be used to measure whether the target user terminal is Criteria for fraudulent use of user credentials of other clients.

Step 203: Respond to the HTTPS request message based on the target client certificate and the bound client certificate.

During the implementation process, respond to the above HTTPS request message according to whether the target client certificate and the bound client certificate are consistent. Specifically, refer to Figure 5, including:

Step 2031: If the target client certificate is the same as the bound client certificate, allow the HTTPS request message to access.

In the first case, the target client certificate is the same as the bound client certificate, indicating that the target user credential corresponding to the target user terminal when sending the HTTPS request message is consistent with the corresponding user credential when the target user terminal is sending the connection establishment request message , and the client certificate corresponding to the target user terminal is also legal, in this case, the HTTPS request message is allowed to access, that is, continue to respond to the above HTTPS request message.

Step 2032: If the target client certificate is different from the bound client certificate, intercept the HTTPS request message.

In the second case, the target client certificate is the same as the bound client certificate, indicating that the target user credential corresponding to the target user terminal when sending the HTTPS request message is the same as the corresponding user credential when the target user terminal is sending the connection establishment request message Yes, but the client certificate corresponding to the target user terminal is illegal, that is, it is determined that the target user terminal has fraudulently used user credentials. In this case, intercept the HTTPS request message, that is, stop responding to the above HTTPS request message. Usually, in this case, an abnormal alert is also issued externally.

Application scenario:

Referring to Figure 6, the process of interaction between user terminal A and the server is as follows: user terminal A sends an HTTPS connection establishment request to the gateway of the server, that is, user terminal A wants to log in to the server, and the gateway of the server returns to user terminal A containing the server The public key certificate, user terminal A verifies the legitimacy of the certificate returned by the server, and obtains the public key from the certificate, and sends the certificate containing the client public key to the server after the verification is passed. The gateway verifies the legitimacy of the client certificate, obtains the public key from the certificate, and uses the certificate to generate a certificate summary through the SHA256 algorithm. After that, user terminal A sends the encryption scheme supported by itself to the server, and the server uses the client (that is, the user terminal A) The public key encryption communication encryption scheme is given to the client, so that the client can use the client private key decryption scheme to generate a random number R, encrypt it with the server public key and pass it to the server, so that the server can use the server private key to decrypt and get the private key. At the same time, the client uses the random number R as the key for HTTPS communication, and sends GET/user/{userId} to the server, so that the gateway of the server can add a field to the header of the request to store the client certificate , and request the corresponding service based on GET/user/{userId}{http request header contains client certificate summary}.

Referring to Figure 7, the normal interaction process between the user terminal and the server is as follows: User terminal A generates a certificate digest through the SHA256 algorithm during the HTTPS two-way authentication with the server, and then sends the generated client certificate digest to The gateway of the server further sends a POST/login message to the gateway. The gateway adds a field to the header of the request, and stores the summary of the client certificate in this field, and the gateway sends a POST/login message to the service (the header of the http request contains client certificate summary) message, the corresponding service verifies the user name and password and other elements, generates the user credential (token) after the verification is successful, and takes out the value stored in the request Header, that is, the certificate summary, and binds the certificate summary to the token , the service sends OK (200) userInfo to the gateway, and the gateway sends OK (200) token to user terminal A, so that user terminal A carries the token for subsequent interface access, etc. User terminal A sends GET /user/{ userId}, the gateway adds a field in the header of the request to store the summary of the client certificate, the gateway continues to send GET/user/{userId}{the header of the http request contains the summary of the client certificate} to the service, and the service obtains from the above cookie Obtain the token, verify the validity of the token, and at the same time, take out the value stored in the request header, and verify the binding relationship with the token, the service sends OK (200) userInfo to the gateway, and the gateway forwards the OK (200) userInfo to user terminal A.

Referring to Fig. 8, when an attacker has embezzled the user credential (i.e. token) of user terminal A, the interaction process between user terminal A, the attacker and the server is as follows: the environment of user terminal A is risky, resulting in The login credential token is stolen by the attacker. In this case, the attacker uses his own certificate for the handshake, and at the same time uses the stolen token of other users. After receiving the handshake request, the gateway adds fields to the header of the request, and in This field stores the summary of the client certificate, and the value stored in the added field in the corresponding service extraction request Header, that is, the summary of the client certificate, verifies the binding relationship with the token. Obviously, the attacker uses another user's Token, from the binding relationship, it can be seen that the token of other users corresponds to the certificate digest of other users. In this case, the certificate digest of other users is different from the certificate digest of the attacker, that is, it is determined that the verification fails. The service sends an Unauthorized (401) alarm to the gateway, and the gateway further sends the Unauthorized (401) alarm to the attacker.

Based on the same inventive concept, as shown in FIG. 9 , an embodiment of the present disclosure provides a device for ensuring user safety, including:

The determining unit 901 is configured to determine a target client certificate and a target user credential corresponding to the target user terminal based on a hypertext transfer security protocol HTTPS request message initiated by the target user terminal;

Binding unit 902, configured to determine the binding client certificate bound to the target user credential based on the target user credential and the pre-established binding relationship between the certificate and the credential, wherein the binding relationship between the certificate and the credential is based on the target user Determined by the HTTPS connection establishment request message sent by the terminal;

The response unit 903 is configured to respond to the HTTPS request message based on the target client certificate and the bound client certificate.

Optionally, the binding relationship between certificates and credentials is determined by the following methods:

When receiving the HTTPS connection establishment request message sent by the target user terminal, parse the client certificate from the HTTPS connection establishment request message;

Generate a certificate digest based on the client certificate, and generate user credentials based on the certificate digest;

Based on the client certificate and user credentials, a binding relationship between certificates and credentials is generated.

Optionally, based on the HTTPS request message initiated by the target user terminal, determine the target client certificate and target user credentials corresponding to the target user terminal, and the determining unit 901 is configured to:

When receiving the HTTPS request message sent by the target user terminal, parse out the target client certificate from the HTTPS request message;

A target certificate digest is generated based on the target client certificate, and a target user credential is generated based on the target certificate digest, and the generated target user credential is determined as the target user credential corresponding to the target user terminal.

Optionally, based on the target user credential and the pre-established binding relationship between the certificate and the credential, determine the bound client certificate bound to the target user credential, and the binding unit 902 is configured to:

Find the client certificate bound to the target user's certificate in the pre-established binding relationship between the certificate and the certificate;

Use the found bound client certificate as the bound client certificate.

Optionally, based on the target client certificate and the bound client certificate, responding to the HTTPS request message, the response unit 903 is configured to:

If the target client certificate is the same as the bound client certificate, HTTPS request messages are allowed to access;

If the target client certificate is different from the bound client certificate, intercept the HTTPS request message.

Based on the same inventive concept, as shown in FIG. 10 , an embodiment of the present disclosure provides a server, including: a memory 1001 for storing executable instructions; a processor 1002 for reading and executing the executable instructions stored in the memory, And execute any one of the above-mentioned methods for ensuring user safety.

Based on the same inventive concept, an embodiment of the present disclosure provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor, the processor can perform any of the above methods for ensuring user security. a way.

To sum up, in the embodiments of the present disclosure, a method, device and storage medium for ensuring user security are provided, the method includes: based on the HTTPS request message initiated by the target user terminal, determining the target client certificate corresponding to the target user terminal and the target user credential, based on the target user credential and the pre-established binding relationship between the certificate and the credential, determine the binding client certificate bound to the target user credential. It should be noted that the binding relationship between the above certificate and credential is based on Determine the HTTPS connection establishment request message sent by the target user terminal, and respond to the HTTPS request message based on the target client certificate and the bound client certificate, that is, determine the target user terminal’s target client certificate and bound client certificate according to the binding relationship. Determine whether the client certificate is consistent, so as to judge whether there is a security risk, effectively screen out the behavior of impersonating other user identities, and ensure the safety of users.

Those skilled in the art should understand that the embodiments of the present disclosure may be provided as a method, a system, or a computer program product system. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product system embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program product systems according to the present disclosure. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and equivalent technologies thereof, the present disclosure also intends to include these modifications and variations.

Claims (10)

1. A method for ensuring user safety, characterized in that the method comprises: Determine the target client certificate and target user credentials corresponding to the target user terminal based on the HTTPS request message initiated by the target user terminal; Determine a bound client certificate bound to the target user credential based on the target user credential and a pre-established binding relationship between the certificate and the credential, wherein the binding relationship between the certificate and the credential is based on the target Determined by the HTTPS connection establishment request message sent by the user terminal; Responding to the HTTPS request message based on the target client certificate and the bound client certificate. 2. The method according to claim 1, wherein the binding relationship between the certificate and the voucher is determined in the following manner: When receiving the HTTPS connection establishment request message sent by the target user terminal, parsing the client certificate from the HTTPS connection establishment request message; generating a certificate digest based on the client certificate, and generating user credentials based on the certificate digest; Based on the client certificate and the user certificate, a binding relationship between the certificate and the certificate is generated. 3. The method according to claim 2, wherein, determining the target client certificate and the target user certificate corresponding to the target user terminal based on the HTTPS request message initiated by the target user terminal comprises: When receiving the HTTPS request message sent by the target user terminal, parsing the target client certificate from the HTTPS request message; Generating a target certificate abstract based on the target client certificate, generating a target user credential based on the target certificate digest, and determining the generated target user credential as the target user credential corresponding to the target user terminal. 4. The method according to claim 1, wherein, based on the target user credential and the pre-established binding relationship between the certificate and credential, determine the bound client certificate bound to the target user credential ,include: In the pre-established binding relationship between the certificate and the credential, search for the client certificate bound to the target user credential; The found bound client certificate is used as the bound client certificate. 5. The method according to any one of claims 1-4, wherein the responding to the HTTPS request message based on the target client certificate and the bound client certificate includes: If the target client certificate is the same as the bound client certificate, then allow the HTTPS request message to be accessed; If the target client certificate is different from the bound client certificate, intercept the HTTPS request message. 6. A device for ensuring user safety, characterized in that it comprises: A determining unit, configured to determine a target client certificate and a target user credential corresponding to the target user terminal based on a hypertext transfer security protocol HTTPS request message initiated by the target user terminal; A binding unit, configured to determine a binding client certificate bound to the target user credential based on the target user credential and a pre-established binding relationship between the certificate and the credential, wherein the binding of the certificate to the credential The relationship is determined based on the HTTPS connection establishment request message sent by the target user terminal; A response unit, configured to respond to the HTTPS request message based on the target client certificate and the bound client certificate. 7. The device according to claim 6, wherein the binding relationship between the certificate and the voucher is determined in the following manner: When receiving the HTTPS connection establishment request message sent by the target user terminal, parsing the client certificate from the HTTPS connection establishment request message; generating a certificate digest based on the client certificate, and generating user credentials based on the certificate digest; Based on the client certificate and the user certificate, a binding relationship between the certificate and the certificate is generated. 8. The device according to claim 7, wherein, based on the HTTPS request message initiated by the target user terminal, the target client certificate and the target user certificate corresponding to the target user terminal are determined, and the determining unit is used for: When receiving the HTTPS request message sent by the target user terminal, parsing the target client certificate from the HTTPS request message; Generating a target certificate abstract based on the target client certificate, generating a target user credential based on the target certificate digest, and determining the generated target user credential as the target user credential corresponding to the target user terminal. 9. A server, characterized in that, comprising: memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory, so as to implement the method according to any one of claims 1-5. 10. A computer-readable storage medium, wherein when the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method according to any one of claims 1-5.

Images