CN115348105A - Honeynet-based verification method, device, storage medium and equipment - Google Patents

Abstract

The application discloses a verification method, a verification device, a storage medium and verification equipment based on a honey net, which can be applied to the field of network security, wherein when a transaction request sent by a user is received, the honey net is used for identifying the transaction request to obtain an identification result, and whether the identification result is an abnormal result is judged; if the identification result is not an abnormal result, acquiring the identity information of the user from the information base, and verifying the user information by using the identity information; when the user information passes the verification, performing auxiliary authentication on the user information by using an auxiliary authentication mode; when the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request, compared with the prior art, the user information is verified again by using an auxiliary authentication mode, the user information is prevented from being stolen by a third party, and the safety of a service system is improved.

Description

Honeynet-based verification method, device, storage medium and equipment

technical field

The present application relates to the field of network security, in particular to a honeynet-based verification method, device, storage medium and equipment.

Background technique

Banking products have a wide range of audiences, and there are large differences in the deployment of different groups of systems, such as differences within the bank and the audience network. Data transmitted between different networks is extremely vulnerable to hacker attacks, so the defense of network security is particularly important .

At present, the user enters valid user information to verify the user's information. If the verification passes, a session identifier (SessionID) is generated, and then the SessionID is verified. If the verification passes, the user can enter the business system, as long as the SessionID is valid. , users can enter other business systems without repeatedly entering passwords.

Since only the user information entered by the user is verified, once the user leaks the information, there will be a risk that the user identity will be fraudulently used by a third party to log in to various business systems for illegal operations.

Contents of the invention

The present application provides a honeynet-based verification method, device, storage medium and equipment, with the purpose of preventing user information from being embezzled by a third party and improving the security of a business system.

In order to achieve the above object, the application provides the following technical solutions:

A verification method based on a honeynet, comprising:

When a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain a recognition result, and judge whether the recognition result is an abnormal result; wherein, the transaction request includes at least the user information; The honeynet is pre-built by multiple honeypot hosts and firewalls;

If the identification result is not the abnormal result, obtain the identity information of the user from the information database, and use the identity information to verify the user information;

When the verification of the user information is passed, perform auxiliary authentication on the user information by means of auxiliary authentication;

When the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request.

Optionally, after determining whether the identification result is an abnormal result, it also includes:

If the recognition result is the abnormal result, the honeynet is used to analyze the abnormal result to obtain an analysis result, and parameters are adjusted according to the analysis result, so that the honeynet can accurately capture data.

Optionally, also include:

When the user information verification fails, a transaction failure prompt is sent to the user.

Optionally, also include:

When the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user.

A verification device based on a honeynet, comprising:

The identifying unit is configured to, when receiving a transaction request sent by a user, use a honeynet to identify the transaction request, obtain an identification result, and judge whether the identification result is an abnormal result; wherein, the transaction request includes at least The user information; the honeynet is pre-built by multiple honeypot hosts and firewalls;

A verification unit, configured to obtain the identity information of the user from the information database if the identification result is not the abnormal result, and use the identity information to verify the user information;

An authentication unit, configured to use an auxiliary authentication method to perform auxiliary authentication on the user information when the user information is verified to pass;

A transaction unit, configured to complete a corresponding transaction according to the transaction request when the user information passes the auxiliary authentication.

Optionally, also include:

If the recognition result is the abnormal result, the honeynet is used to analyze the abnormal result to obtain an analysis result, and parameters are adjusted according to the analysis result, so that the honeynet can accurately capture data.

Optionally, also include:

When the user information verification fails, a transaction failure prompt is sent to the user.

Optionally, also include:

When the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user.

A computer-readable storage medium, characterized in that the computer-readable storage medium includes a stored program, wherein the program executes the honeynet-based verification method.

A honeynet-based verification device, characterized in that it includes: a processor, a memory, and a bus; the processor and the memory are connected through the bus;

The memory is used to store a program, and the processor is used to run the program, wherein the honeynet-based verification method is executed when the program runs.

In the technical solution provided by this application, when a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain the recognition result, and judge whether the recognition result is an abnormal result; if the recognition result is not an abnormal result, the Obtain the user's identity information in the process, and use the identity information to verify the user information; when the user information verification is passed, use the auxiliary authentication method to perform auxiliary authentication on the user information; when the user information passes the auxiliary authentication, complete the corresponding transaction according to the transaction request Compared with the existing technology, the transaction uses the auxiliary authentication method to re-verify the user information to prevent the user information from being embezzled by a third party and improve the security of the business system.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present application. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a flow chart of a verification method based on a honeynet provided by an embodiment of the present application;

Fig. 2 is the flow chart of another kind of verification method based on honeynet that the embodiment of the present application provides;

FIG. 3 is a schematic structural diagram of a verification device based on a honeynet provided in an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a honeynet-based verification device provided in an embodiment of the present application;

FIG. 5 is a schematic diagram of a honeynet architecture provided by an embodiment of the present application.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the application with reference to the drawings in the embodiments of the application. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

It should be noted that the honeynet-based verification method, device, storage medium and equipment provided by the present invention can be applied in the field of network security. The above is only an example, and does not limit the application fields of the honeynet-based verification method, device, storage medium and equipment provided by the present invention.

As used herein, the term "comprise" and its variations are open-ended, ie "including but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one further embodiment"; the term "some embodiments" means "at least some embodiments." Relevant definitions of other terms will be given in the description below.

It should be noted that concepts such as "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the sequence of functions performed by these devices, modules or units or interdependence.

It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative and not restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more" Multiple".

As shown in Figure 1, a flow chart of a honeynet-based verification method provided by the embodiment of the present application includes:

S101: When receiving the transaction request sent by the user, use the honeynet to identify the transaction request, obtain the identification result, and judge whether the identification result is an abnormal result.

If the recognition result is an abnormal result, execute S102, otherwise execute S103.

Among them, the transaction request includes at least user information, and the user information includes at least a user name and a password corresponding to the user name, and abnormal results include: abnormal transaction requests (such as transaction forgery, cross-site access, transaction resending, etc.).

It should be noted that the honeynet is pre-built by multiple honeypot hosts and firewalls, and uses the honeynet (as shown in Figure 5) to identify transaction requests. Since the honeynet has a real deceptive network environment, hackers are induced to attack, and the Hackers are intercepted in the honeynet, preventing hackers from attacking user accounts and avoiding risks.

Specifically, assuming that the transaction request for purchasing electrical appliances sent by the user is received, the honeynet is used to identify the transaction request for purchasing electrical appliances sent by the user, and the identification result is obtained, and it is judged whether the identification result is an abnormal result. It can be seen that the purchase The transaction request of the electrical appliance is a normal transaction request, therefore, continue to execute S103.

What needs to be emphasized is that the specific implementation of using the honeynet to identify the transaction request is common knowledge known to those skilled in the art, and will not be repeated here.

S102: Use the honeynet to analyze the abnormal result, obtain the analysis result, and adjust the parameters according to the analysis result, so that the honeynet can accurately capture data.

Wherein, the analysis result at least includes the IP address sending the transaction request.

Optionally, use the honeynet to analyze the abnormal results, obtain the analysis results (for example, obtain the IP address of the transaction request), and adjust the parameters of the honeynet (such as monitoring frequency, etc.) The area to which it belongs is focused on monitoring, so as to obtain information about the attacker.

It should be noted that the specific implementation manner of analyzing abnormal results by using the honeynet is common knowledge known to those skilled in the art, and will not be repeated here.

S103: Obtain the user's identity information from the information database, and use the identity information to verify the user information.

Wherein, the identity information includes at least a user account and a password corresponding to the user account.

It should be noted that the user's identity information is obtained from the information database, and the identity information is compared with the user information. If the identity information is consistent with the user information, it is determined that the user information has passed the verification. If the identity information is inconsistent with the user information , it is determined that the user information has not passed the verification, and the transaction operation corresponding to the transaction request cannot be performed.

Optionally, user information can be verified through an identity authentication protocol, which includes but is not limited to: Kerberos, Oauth, SAML2.0 and other protocols.

Specifically, assuming that the user information is: user account (such as Zhang San), and the password corresponding to the user account (123456789), the identity information corresponding to the user obtained from the information database is: user account (Zhang San), corresponding to the user account password (123456789), it can be seen that the identity information is consistent with the user information, so continue to execute S104.

S104: When the verification of the user information is passed, perform auxiliary authentication on the user information in an auxiliary authentication manner.

After executing S104, continue to execute any one of S106 and S107.

Among them, auxiliary authentication methods include but are not limited to: face, voiceprint, SMS, and iris.

Specifically, assuming that the auxiliary authentication method is face authentication, when the user information verification is passed, use face authentication to perform auxiliary authentication on user information, and compare the collected user's face image with the face image obtained in the database. Yes, if the comparison is consistent, the auxiliary certification will be passed, and if the comparison is inconsistent, it will not be passed.

It should be noted that using auxiliary authentication to perform auxiliary authentication on user information can reduce the risk of user information forgery and avoid losses caused by user information being stolen.

S105: When the user information verification fails, send a transaction failure prompt to the user.

Wherein, when the user information is inconsistent with the identity information, the verification of the user information fails, and a prompt of transaction failure is sent to the user.

Specifically, assuming a user account (such as Zhang San) and a password corresponding to the account (12345), the identity information corresponding to the user obtained from the information base is: the user account (Zhang San), the password corresponding to the user account (12389) , it can be seen that the identity information is inconsistent with the user information, and if the user information verification fails, a transaction failure prompt will be sent to the user.

S106: When the user information passes the auxiliary authentication, complete the corresponding transaction according to the transaction request.

S107: When the user information fails the auxiliary authentication, send a transaction failure prompt to the user.

Wherein, the auxiliary authentication method is used to perform auxiliary authentication on the user information, and when the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user.

To sum up, when a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain the recognition result, and judge whether the recognition result is an abnormal result; if the recognition result is not an abnormal result, obtain it from the information base The user's identity information is used to verify the user information; when the user information is verified, the user information is assisted by the auxiliary authentication method; when the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request. Compared with the prior art, the user information is verified again by using the auxiliary authentication method, which prevents the user information from being embezzled by a third party and improves the security of the business system.

As shown in Figure 2, it is a flow chart of another honeynet-based verification method provided by the embodiment of the present application, including:

S201: When receiving the transaction request sent by the user, use the honeynet to identify the transaction request, obtain the identification result, and judge whether the identification result is an abnormal result.

Among them, the transaction request includes at least user information; the honeynet is pre-built by multiple honeypot hosts and firewalls.

S202: If the recognition result is not an abnormal result, acquire the user's identity information from the information database, and use the identity information to verify the user information.

S203: When the verification of the user information is passed, perform auxiliary authentication on the user information in an auxiliary authentication manner.

S204: When the user information passes the auxiliary authentication, complete the corresponding transaction according to the transaction request.

To sum up, when a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain the recognition result, and judge whether the recognition result is an abnormal result; if the recognition result is not an abnormal result, obtain it from the information base The user's identity information is used to verify the user information; when the user information is verified, the user information is assisted by the auxiliary authentication method; when the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request. Compared with the prior art, the user information is verified again by using the auxiliary authentication method, which prevents the user information from being embezzled by a third party and improves the security of the business system.

It should be noted that the honeynet-based verification method provided by the present invention can be used in the fields of artificial intelligence, blockchain, distributed, cloud computing, big data, Internet of Things, mobile Internet, and network security. , chip field, virtual reality field, augmented reality field, holographic technology field, quantum computing field, quantum communication field, quantum measurement field, digital twin field or financial field. The above is only an example, and does not limit the application field of the verification method based on the honeynet provided by the present invention.

The honeynet-based verification method provided by the present invention can be used in the financial field or other fields, for example, it can be used in transaction application scenarios in the financial field. The other fields are arbitrary fields other than the financial field, for example, the network security field. The above is only an example, and does not limit the application field of the verification method based on the honeynet provided by the present invention.

As shown in Figure 3, it is a schematic diagram of the architecture of another honeynet-based verification device provided in the embodiment of the present application, including:

The identification unit 100 is configured to use the honeynet to identify the transaction request when receiving the transaction request sent by the user, obtain the identification result, and judge whether the identification result is an abnormal result; wherein, the transaction request includes at least user information; the honeynet It is pre-built by multiple honeypot hosts and firewalls.

The identification unit 100 is further configured to use the honeynet to analyze the abnormal result to obtain the analysis result if the identification result is an abnormal result, and adjust the parameters according to the analysis result so that the honeynet can accurately capture data.

The verification unit 200 is configured to obtain the user's identity information from the information database if the recognition result is not an abnormal result, and use the identity information to verify the user information.

The authentication unit 300 is configured to perform auxiliary authentication on user information in an auxiliary authentication manner when the user information is verified and passed.

The authentication unit 300 is further configured to send a transaction failure prompt to the user when the user information verification fails.

The transaction unit 400 is configured to complete the corresponding transaction according to the transaction request when the user information passes the supplementary authentication.

The transaction unit 400 is further configured to send a transaction failure prompt to the user when the user information fails the supplementary authentication.

To sum up, when a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain the recognition result, and judge whether the recognition result is an abnormal result; if the recognition result is not an abnormal result, obtain it from the information base The user's identity information is used to verify the user information; when the user information is verified, the user information is assisted by the auxiliary authentication method; when the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request. Compared with the prior art, the user information is verified again by using the auxiliary authentication method, which prevents the user information from being embezzled by a third party and improves the security of the business system.

The present application also provides a computer-readable storage medium, and the computer-readable storage medium includes a stored program, wherein the program executes the honeynet-based verification method provided in the present application.

As shown in FIG. 4 , the present application also provides a verification device based on a honeynet, including: a processor 401 , a memory 402 and a bus 403 . The processor 401 and the memory 402 are connected through the bus 403, the memory 402 is used to store the program, and the processor 401 is used to run the program, wherein, when the program is running, the verification method based on the honeynet provided by the above-mentioned application is executed, including the following steps:

When a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain a recognition result, and judge whether the recognition result is an abnormal result; wherein, the transaction request includes at least the user information; The honeynet is pre-built by multiple honeypot hosts and firewalls;

If the identification result is not the abnormal result, obtain the identity information of the user from the information database, and use the identity information to verify the user information;

When the verification of the user information is passed, perform auxiliary authentication on the user information by means of auxiliary authentication;

When the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request.

Optionally, after determining whether the identification result is an abnormal result, it also includes:

If the recognition result is the abnormal result, the honeynet is used to analyze the abnormal result to obtain an analysis result, and parameters are adjusted according to the analysis result, so that the honeynet can accurately capture data.

Optionally, also include:

When the user information verification fails, a transaction failure prompt is sent to the user.

Optionally, also include:

When the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

While several specific implementation details are contained in the above discussion, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

The above description is only a preferred embodiment of the present disclosure and an illustration of the applied technical principle. Those skilled in the art should understand that the disclosure scope involved in this disclosure is not limited to the technical solution formed by the specific combination of the above-mentioned technical features, but also covers the technical solutions formed by the above-mentioned technical features or Other technical solutions formed by any combination of equivalent features. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

If the functions described in the methods of the embodiments of the present application are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computing device-readable storage medium. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, the software product is stored in a storage medium, and includes several instructions to make a A computing device (which may be a personal computer, a server, a mobile computing device or a network device, etc.) executes all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. A verification method based on honeynet, is characterized in that, comprises: When a transaction request sent by a user is received, the honeynet is used to identify the transaction request, obtain a recognition result, and judge whether the recognition result is an abnormal result; wherein, the transaction request includes at least the user information; The honeynet is pre-built by multiple honeypot hosts and firewalls; If the identification result is not the abnormal result, obtain the identity information of the user from the information database, and use the identity information to verify the user information; When the verification of the user information is passed, perform auxiliary authentication on the user information by means of auxiliary authentication; When the user information passes the auxiliary authentication, the corresponding transaction is completed according to the transaction request. 2. The method according to claim 1, wherein after said and judging whether the recognition result is an abnormal result, further comprising: If the recognition result is the abnormal result, the honeynet is used to analyze the abnormal result to obtain an analysis result, and parameters are adjusted according to the analysis result, so that the honeynet can accurately capture data. 3. The method according to claim 1, further comprising: When the user information verification fails, a transaction failure prompt is sent to the user. 4. The method according to claim 1, further comprising: When the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user. 5. A verification device based on a honeynet, characterized in that, comprising: The identifying unit is configured to, when receiving a transaction request sent by a user, use a honeynet to identify the transaction request, obtain an identification result, and judge whether the identification result is an abnormal result; wherein, the transaction request includes at least The user information; the honeynet is pre-built by multiple honeypot hosts and firewalls; A verification unit, configured to obtain the identity information of the user from the information database if the identification result is not the abnormal result, and use the identity information to verify the user information; An authentication unit, configured to use an auxiliary authentication method to perform auxiliary authentication on the user information when the user information is verified to pass; A transaction unit, configured to complete a corresponding transaction according to the transaction request when the user information passes the auxiliary authentication. 6. The device according to claim 5, further comprising: If the recognition result is the abnormal result, the honeynet is used to analyze the abnormal result to obtain an analysis result, and parameters are adjusted according to the analysis result, so that the honeynet can accurately capture data. 7. The device according to claim 5, further comprising: When the user information verification fails, a transaction failure prompt is sent to the user. 8. The device according to claim 5, further comprising: When the user information fails the auxiliary authentication, a transaction failure prompt is sent to the user. 9. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored program, wherein the program executes the honeynet-based verification method according to any one of claims 1-4. 10. A verification device based on a honeynet, comprising: a processor, a memory, and a bus; the processor and the memory are connected through the bus; The memory is used to store a program, and the processor is used to run the program, wherein, when the program is running, the honeynet-based verification method described in any one of claims 1-4 is executed.

Images