Interface call injection preventing method and system

Abstract

The invention discloses an interface call injection preventing method and system. The method and the system relate to the computer internet technology, and solve the problem that a URL request is maliciously tampered. The method comprises: a sender sorts request parameters in a uniform resource locator (URL) request according to a preset sorting rule consistent with a receiver; the sender generates a first signature according to the sorting result; and the sender adds the first signature to the URL request and send the URL request with the first signature, so that the receiver verifies the parameter status of the URL request. The technical solution is applicable to the URL request and implements a mechanism for verifying the parameter status of the URL request.

Description

technical field [0001] The invention relates to computer internet technology, in particular to an interface call injection prevention method and system. Background technique [0002] Parameter pollution attack can be described as: For the existing legal parameter P and malicious parameter P, the application program does not check and filter the validity of the input parameters, then the parameter P will be received by the program and execute the attacker's intention. This is the parameter pollution attack . [0003] Parameter pollution attack vulnerabilities can be used to modify HTTP hard-coded parameters, change web application behavior, access or exploit uncontrollable variables, and bypass input validation checks and web application firewall rules. [0004] In reality, there are many URL requests without parameter anti-injection security protection, and URL requests are generally easier to obtain. Malicious attackers will modify the URL parameter value or add the numbe...

AI Technical Summary

Problems solved by technology

[0004] In reality, there are many URL requests without parameter anti-injection security protection, and URL requests are generally easier to obtain

Images