Abstract:
Disclosed is a method and apparatus for preventing cross-site request forgery. The recommendation method comprises storing a first environment fingerprint associated with a client, wherein the first environment fingerprint uniquely identifies the client based on local terminal information associated with the client; receiving an access request message from the client, the access request message including at least one operation and a second environment fingerprint generated by the client; determining whether the second environment fingerprint matches the first environmental fingerprint; rejecting the access request message if it is determined that the second environment fingerprint does not match the first environment fingerprint; and executing the operation included with the access request message if it is determined that the second environment fingerprint matches the first environment fingerprint.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims the benefit of priority from Chinese Patent Application No. 201510612430.3, filed on Sep. 23, 2015, entitled “Method, Apparatus and System for Preventing Cross-Site Request Forgery,” which is incorporated herein by reference in its entirety. 
       BACKGROUND 
       [0002]    Field of the Disclosure 
         [0003]    The disclosure relates to the field of computer technology, and in particular to a method, apparatus and system for preventing cross-site request forgery. 
         [0004]    Description of the Related Art 
         [0005]    Cross-site request forgery (CSRF) is a type of network attack where a forged request is sent to the server of a target site using the identity of a user without their knowledge and then, without their authorization, operations are executed using the user&#39;s permissions. For example, while a user is logged into a target site, a request to change a username may be sent to the server of the target site with an identifier and/or login information found in one of the user&#39;s cookies, thereby allowing the username to be altered without the user&#39;s knowledge. 
       BRIEF SUMMARY 
       [0006]    To solve at least the above technical problem, the described embodiments of the disclosure provide a method, an apparatus and a system for preventing cross-site request forgery. 
         [0007]    One embodiment of the disclosure relates to a method for preventing cross-site request forgery. In this embodiment, the method stores a first environment fingerprint associated with a client, wherein the first environment fingerprint uniquely identifies the client based on local terminal information associated with the client; receives an access request message from the client, the access request message including at least one operation and a second environment fingerprint generated by the client; determines whether the second environment fingerprint matches the first environmental fingerprint; rejects the access request message if it is determined that the second environment fingerprint does not match the first environment fingerprint; and executes the operation included with the access request message if it is determined that the second environment fingerprint matches the first environment fingerprint. 
         [0008]    One embodiment of the disclosure relates to an apparatus for preventing cross-site request forgery. In this embodiment, the apparatus includes a processor and a non-transitory memory storing computer-executable instructions. The instructions cause the apparatus to store a first environment fingerprint associated with a client, wherein the first environment fingerprint uniquely identifies the client based on local terminal information associated with the client; receiving, at the server, an access request message from the client, the access request message including at least one operation and a second environment fingerprint generated by the client; determine whether the second environment fingerprint matches the first environmental fingerprint; reject the access request message if it is determined that the second environment fingerprint does not match the first environment fingerprint; and execute the operation included with the access request message if it is determined that the second environment fingerprint matches the first environment fingerprint. 
         [0009]    One embodiment of the disclosure relates to a non-transitory computer readable storage medium tangibly storing computer program instructions capable of being executed by a computer processor. The computer program instructions define the steps of storing a first environment fingerprint associated with a client, wherein the first environment fingerprint uniquely identifies the client based on local terminal information associated with the client; receiving an access request message from the client, the access request message including at least one operation and a second environment fingerprint generated by the client; determining whether the second environment fingerprint matches the first environmental fingerprint; rejecting the access request message if it is determined that the second environment fingerprint does not match the first environment fingerprint; and executing the operation included with the access request message if it is determined that the second environment fingerprint matches the first environment fingerprint. 
         [0010]    The above embodiments of the disclosure illustrate that when the client accesses the server for the first time, the server or client generates a unique environment fingerprint according to the local terminal information of the client and the server stores the environment fingerprint as the preset authentication information and may optionally send the environment fingerprint back to the client. During data interaction between the client and the server, the access request message of the client contains the environment fingerprint, so that the server can determine the validity of the above access request message by determining whether the received access request message contains the environment fingerprint matching the stored preset authentication information (e.g., the stored environment fingerprint). 
         [0011]    In this way, an unauthorized terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information (e.g., IP address, MAC address) and thus cannot pass server authentication due to differing environments and environment fingerprints. Therefore, the server can reject the operation requested by the access request message of the unauthorized terminal and thus effectively prevent CSRF attacks. In contrast to the prior art, the disclosed embodiments utilize terminal information to generate an environment fingerprint versus a page or session identifier. Further, unlike the prior art, the disclosed embodiments&#39; use of terminal information allows an environment fingerprint to be generated either at the client or at the server. Thus, according to the embodiments disclosed herein, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security and privacy requirements can be met. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0012]    The foregoing and other objects, features, and advantages of the disclosure will be apparent from the following description of embodiments as illustrated in the accompanying drawings, in which reference characters refer to the same parts throughout the various views. 
           [0013]      FIG. 1  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0014]      FIG. 2  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0015]      FIG. 3  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0016]      FIG. 4  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0017]      FIG. 5  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0018]      FIG. 6  is a flow diagram of a method for preventing CSRF according to some embodiments of the disclosure. 
           [0019]      FIG. 7  is a diagram of a server for preventing CSRF, according to some embodiments of the disclosure. 
           [0020]      FIG. 8  is a diagram of a server for preventing CSRF, according to some embodiments of the disclosure. 
           [0021]      FIG. 9  is a diagram of a client device for preventing CSRF, according to some embodiments of the disclosure. 
           [0022]      FIG. 10  is a diagram of a client device for preventing CSRF, according to some embodiments of the disclosure. 
           [0023]      FIG. 11  is a diagram of a system for preventing CSRF according to some embodiments of the disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0024]    The embodiments of the disclosure provide a method, device and system for preventing CSRF. For better understanding of the technical solutions of the disclosure by those skilled in the art, the technical solutions of the embodiments of the disclosure will be described clearly and completely in combination with the drawings herein. It is clear that the described embodiments are only some, not all, of the possible embodiments of the disclosure. Any other embodiments obtained by those skilled in the art based on the embodiments of the disclosure are intended to fall within the protection scope of the disclosure. The detailed implementations of the embodiments of the disclosure are described with the following specific examples. Although the methods described below contain multiple operations in a certain sequence, it should be understood that these methods may contain more or less operations that can be executed in sequence or concurrently (e.g., using parallel processors or in a multi-threaded environment). 
         [0025]      FIG. 1  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0026]    In step S 110 , the method sends local terminal information from a client to the server. In some embodiments, the method sends the local terminal information from the client to the server when accessing the server for the first time (e.g., upon an initial visit to a webpage provided by the server). 
         [0027]    In one embodiment, the local terminal information may comprise a unique identifier for identifying the terminal. Particularly, in some embodiments, the local terminal information may contain at least one of the following: a unique hardware identifier, a unique network identifier, a unique application identifier, or a combination thereof. In some embodiments, the unique hardware identifier may include, for example, the MAC address of the terminal, a unique serial number identifier of the terminal, or a combination thereof. In some embodiments, the unique network identifier of the terminal may include, for example, the IP address of the client, an identifier of the mobile communication network used by the client, or a combination thereof. In some embodiments, the unique application identifier of the terminal may, for example, include the user agent of the client browser. The local terminal information illustrated above is not intended to be limited to the above identifiers. In other embodiments, the content of the local terminal information may be determined according to application needs, and the embodiments of the disclosure are not restricted to any particular identifier format. 
         [0028]    In step S 120 , the method, at the server, generates an environment fingerprint based on the local terminal information. In some embodiments, the environment fingerprint includes at least one of a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal in the local terminal information. In some embodiments, the environment fingerprint includes data generated by encrypting one or more of a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal. 
         [0029]    In some embodiments, one or more unique hardware identifiers, unique network identifiers, and unique application identifiers of the terminal may be encrypted through algorithms such as MD5, RSA, or DSA. In some embodiments, the environment fingerprint may be a character string, such as: “f6c534209e0cc087b03696f303549ca0.” 
         [0030]    The method for generating the environment fingerprint is not limited to the above. In practical applications, the environment fingerprint may be generated according to actual application scenarios, and the embodiments of the disclosure are not restricted to a particular method of generating the environment fingerprint. 
         [0031]    In step S 130 , the method stores the environment fingerprint as preset authentication information at the server and, in step S 140 , sends the environment fingerprint to the client from the server. 
         [0032]    As illustrated in  FIG. 1 , steps S 110  through S 140  complete a registration protocol negotiation stage between the client and the server. In the illustrated embodiment, the registration protocol negotiation stage between the client and the server may include the process of accessing a website through a browser by a user and executing the method illustrated in steps S 110  through S 140  of  FIG. 1  when accessing the server for the first time. 
         [0033]    It should be noted that, the environment fingerprint negotiated between the server and the client in steps S 110  through S 140  is generated according to the local terminal information of the client. Moreover, the local terminal information among different terminals is different and different terminals cannot generate identical environment fingerprints by using rogue programs or scripts. Thus, the server can authenticate the validity of requests during the subsequent interactions with services based on the environment fingerprint generated in steps S 110  through S 140 . 
         [0034]    In step S 150 , the method sends an access request message containing the environment fingerprint from the client to the server. The client may send an access request message to the server when requesting access to data services (e.g., HTTP services) between the client and the server. In some embodiments, the data transmitted between the client and server (e.g., HTTP requests and responses) may, itself, contain the environment fingerprint. In some embodiments, the client may generate the access request message containing the environment fingerprint. 
         [0035]    In step S 160 , the method receives the access request message at the server and determines whether the access request message contains an environment fingerprint matching stored preset authentication information. In some embodiments, the server can determine the validity of the received access request message by determining whether the access request message contains an environment fingerprint matching the stored preset authentication information. 
         [0036]    In step S 170 , the method, at the server, responds to the access request message according to the results of the determination made in step S 160 . 
         [0037]    In some embodiments, the server can determine the validity of the access request message and execute operations such as adding, deleting, searching, and altering, etc., included in the access request message when it is determined that the access request message contains an environment fingerprint matching the preset authentication information. 
         [0038]    In some embodiments, the server can reject the access request message and not execute an operation included in the access request message when the access request message does not contain an environment fingerprint matching the preset authentication information. In some embodiments, the server can send a warning message to the client if the access request message does not contain an environment fingerprint matching the preset authentication information. 
         [0039]    The access request message in step S 150  may be sent by an automatically operated rogue program or a script on some terminal page when a CSRF occurs. In a case where the access request message is sent by an automatically operated rogue program or a script, as the information of different terminals is different, the access request message sent by the automatically operated rogue program or script will not contain the correct environment fingerprint, and the access request will be rejected by the server. 
         [0040]    In one embodiment, the server can attach the environment fingerprint to a cookie sent to the browser as an identifier so that the browser can extract the identifier from the cookie and send it with a request parameter to the server when the web page requests the corresponding service. The server can determine the validity of the request according to the environment fingerprint in the request parameter. 
         [0041]    According to the embodiment illustrated in  FIG. 1 , another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information and thus cannot pass server authentication. Therefore, the server can reject an operation included in the access request message sent by an incorrect terminal and thus effectively prevent CSRF. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0042]      FIG. 2  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0043]    In step S 210 , the client generates an environment fingerprint according to the local terminal information when accessing the server for the first time. 
         [0044]    In some embodiments, the client can generate an environment fingerprint according to the local terminal information when accessing the server for the first time. In one embodiment, the local terminal information may comprise a unique identifier for identifying the terminal. Particularly, in some embodiments, the local terminal information may contain at least one of the following: a unique hardware identifier, a unique network identifier, and a unique application identifier, or a combination thereof. In some embodiments, the unique hardware identifier of the terminal may include, for example, the MAC address of the client and a unique serial number identifier of the terminal, or a combination thereof. The unique network identifier of the terminal may include, for example, the IP address of the client, an identifier of the mobile communication network used by the client, or a combination thereof. In some embodiments, the unique application identifier of the terminal may contain, for example, the user agent of the client browser. The local terminal information illustrated above is not intended to be limited to the above identifiers. In other embodiments, the local terminal information may be determined according to application needs, and the embodiments of the disclosure are not restricted to any particular terminal format. 
         [0045]    In some embodiments, the environment fingerprint may contain at least one of a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal in the terminal information. In some embodiments, the environment fingerprint may contain the data generated by encrypting any one or more of a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal. 
         [0046]    In some embodiments, one or more of a unique hardware identifier, unique network identifiers, and unique application identifiers of the terminal may be encrypted through algorithms such as MD5, RSA, or DSA. In some embodiments, the environment fingerprint may be a character string, such as: “f6c534209e0cc087b03696f303549ca0.” 
         [0047]    The method for generating the environment fingerprint is not limited to the above. In practical applications, the environment fingerprint may be generated according to actual application scenarios, and the embodiments of the disclosure are not restricted to a particular method of generating the environment fingerprint. 
         [0048]    In step S 220 , the client sends the environment fingerprint to the server. In some embodiments, the client can send the environment fingerprint to the server after generating the environment fingerprint at the client. 
         [0049]    In step S 230 , the server stores the environment fingerprint as the preset authentication information. As mentioned above, the environment fingerprint stored at the server may be generated by the client (as illustrated in  FIG. 2 ) or the server (as illustrated in  FIG. 1 ). Therefore, in one embodiment, the preset authentication information may contain at least one of an environment fingerprint generated according to the local terminal information sent by the client or an environment fingerprint generated by the client according to the local terminal information and received by the server. 
         [0050]    The above steps S 210  through S 230  complete a registration protocol negotiation stage between the client and the server. In the illustrated embodiment, the registration protocol negotiation stage between the client and the server may comprise the process of registering on a website through the browser by the user and executing a process on the terminal, or the applications on the terminal, when accessing the server for the first time. 
         [0051]    The environment fingerprint negotiated between the server and the client in the registration protocol negotiation stage illustrated in  FIG. 2  is generated by the client according to the local terminal information of the client. Moreover, the terminal information is different between terminals. Therefore, other terminals cannot generate an environment fingerprint identical to that in the above registration protocol negotiation stage by using rogue programs or scripts. The server can authenticate the validity of an access request during an interaction for the subsequent services by using the environment fingerprint from the above stage of registration protocol negotiation. 
         [0052]    In step S 240 , the method sends an access request message containing the environment fingerprint from the client to the server. 
         [0053]    In step S 250 , the method receives the access request message at the server and determines whether the access request message contains the environment fingerprint matching the stored preset authentication information. In some embodiments, the server can determine the validity of the current access request message by determining whether the access request message contains an environment fingerprint matching the stored preset authentication information upon receiving the access request message sent by the client. 
         [0054]    In step S 260 , the method, at the server, responds to the access request message according to the results of the determination made in step S 250 . 
         [0055]    In some embodiments, the server can determine the validity of the access request message and execute operations such as adding, deleting, searching, and altering, etc., corresponding to the access request message when it is determined that the access request message contains an environment fingerprint matching the preset authentication information. 
         [0056]    In some embodiments, the server can reject the access request message and not execute the above access request operation when the environment fingerprint contained in the access request message does not match the preset authentication. In some embodiments, the server can send a warning message to the client if the access request message does not contain an environment fingerprint matching the preset authentication. 
         [0057]    The access request message in step S 240  may be sent by an automatically operated rogue program or a script on some terminal page when a CSRF starts. In this case, since the information of different terminals is different, the access request message sent by the automatically operated rogue program or script will not contain the correct environment fingerprint, and then the access request will be rejected by the server. 
         [0058]    In one embodiment, the client will generate a unique environment fingerprint according to the local terminal information and send the environment fingerprint to the server. The server will store environment fingerprint as preset authentication information at the stage of registration protocol negotiation between the client and the server. During data interaction between the client and the server, the server can determine the validity of an access request message containing an environment fingerprint by determining whether the received access request message contains the environment fingerprint matching the stored preset authentication information. In this way, another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information and thus cannot pass server authentication. Therefore, the server can reject an operation requested by the access request message of a different terminal and effectively prevent CSRF. Compared with prior art techniques, the illustrated method can more effectively prevent CSRF attacks, ensure Internet security for users, and meet security and/or privacy requirements. 
         [0059]      FIG. 3  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0060]    In step S 310 , the method receives the local terminal information of the client sent by the client. In step S 320 , the method generates an environment fingerprint according to the terminal information. In step S 330 , the method stores the environment fingerprint as the preset authentication information. In step S 340 , the method sends the environment fingerprint to the client. 
         [0061]    As illustrated in steps S 310  through S 340 , the method executes a registration protocol negotiation stage with the client. In some embodiments, the above registration protocol negotiation stage between the client and the server may comprise the process of registering on a website through the browser by the user and executing a process on the terminal, or applications on the terminal, when accessing the server for the first time. 
         [0062]    The environment fingerprint negotiated between the server and the client in the above stage of registration protocol negotiation is generated according to the terminal information of the client. Moreover, terminal information among terminals is different. Therefore, other terminals cannot generate identical environment fingerprints in the above stage of registration protocol negotiation by using rogue programs or scripts. The server can authenticate the validity of an access request during a data interaction for subsequent services using the environment fingerprint from the above registration protocol negotiation. 
         [0063]    In step S 350 , the method receives an access request message containing an environment fingerprint sent by the client. In step S 360 , the method determines whether the access request message contains an environment fingerprint matching the stored preset authentication information. In step S 370 , the method responds to the access request message according to the determined results. 
         [0064]    In the embodiment illustrated in  FIG. 3 , the server will generate a unique environment fingerprint according to the local terminal information of the client, store the environment fingerprint as preset authentication information, and send the environment fingerprint to the client during the registration protocol negotiation stage between the server and the client. During a data interaction stage between the client and the server, the server can determine the validity of an access request message containing an environment fingerprint by determining whether the received access request message contains the environment fingerprint matching the stored preset authentication information sent by the client. In this way, another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information and thus cannot pass server authentication. Therefore, the server can reject an operation requested by an access request message of a different terminal and thus effectively prevent CSRF. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0065]      FIG. 4  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0066]    In step S 410 , the method receives an environment fingerprint generated by the client according to the local terminal information. In step S 420 , the method stores the environment fingerprint as preset authentication information. 
         [0067]    In steps S 410  through S 420 , the server executes a registration protocol negotiation with the client. In the illustrated embodiment, the registration protocol negotiation stage between the client and the server may comprise the process of registering on a web site through the browser by the user and executing a process on the terminal, or applications on the terminal, when accessing the server for the first time. 
         [0068]    In step S 430 , the method receives the access request message containing the environment fingerprint sent by the client. In step S 440 , the method determines whether the access request message contains the environment fingerprint matching the stored preset authentication information. In step S 450 , the method responds to the access request message according to the determined results. 
         [0069]    In the embodiment illustrated in  FIG. 4 , the server will receive a unique environment fingerprint generated according to the local terminal information of the client and store the environment fingerprint as preset authentication information during the registration protocol negotiation between the client and the server. During data interactions between the client and the server, the server can determine the validity of an access request message containing an environment fingerprint by determining whether the received access request message contains an environment fingerprint matching the stored preset authentication information sent by the client. In this way, another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information and thus cannot pass server authentication. Therefore, the server can reject an operation requested by an access request message of a different terminal and thus effectively prevent CSRF. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0070]      FIG. 5  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0071]    In step S 510 , the method generates an environment fingerprint according to local terminal information, when accessing a server for the first time, and sends the environment fingerprint to the server. 
         [0072]    In one embodiment, the client executes a registration protocol negotiation with the server. In one embodiment, the above registration protocol negotiation between the client and the server may comprise the process of registering on some website through the browser by the user and executing a process on the terminal or applications on the terminal when accessing the server for the first time. 
         [0073]    The environment fingerprint negotiated between the server and the client in the above stage of registration protocol negotiation is generated by the client according to the terminal information of the client. Moreover, the terminal information among different terminals is different. Therefore, other terminals cannot generate an environment fingerprint identical to that in the above stage of registration protocol negotiation by using rogue programs or scripts. 
         [0074]    In some embodiments, when a data interaction is required between the client and the server, the method further comprises the following steps. 
         [0075]    In step S 520 , the method sends an access request message containing the environment fingerprint to the server. 
         [0076]    In some embodiments, the access request message sent to the server by the client during a data interaction for subsequent services contains the environment fingerprint. Thus, the server can authenticate the validity for the access request based on the environment fingerprint. 
         [0077]    In one embodiment, the client generates a unique environment fingerprint based on local terminal information and sends the environment fingerprint to the server. The server then stores the environment fingerprint as preset authentication information during the registration protocol negotiation between the client and the server. During a data interaction between the client and the server, the access request message of the client may include the environment fingerprint, so that the server can determine the validity of the access request message by determining whether the received access request message contains an environment fingerprint matching the stored preset authentication information. In this way, another terminal cannot obtain the correct environment fingerprint due to different terminal information of different terminals, and thus cannot pass server authentication. Therefore, the server can reject an operation requested by an access request message of a different terminal and thus effectively prevent CSRF. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0078]      FIG. 6  is a flow diagram of a method for preventing CSRF, according to some embodiments of the disclosure. 
         [0079]    In step S 610 , the method sends local terminal information to the server from the client when accessing the server for the first time. In step S 620 , the method receives the environment fingerprint generated by the server according to the terminal information. 
         [0080]    In steps S 610  through S 620 , the client executes a registration protocol negotiation stage with the server. In one embodiment, the above registration protocol negotiation stage between the client and the server may comprise the process of registering on some website through the browser by the user and executing a process on the terminal, or applications on the terminal, when accessing the server for the first time. 
         [0081]    The environment fingerprint negotiated between the server and the client in the above registration protocol negotiation stage is generated according to the terminal information of the client. Moreover, the data of other terminals is different from that of the corresponding client terminal. Therefore, other terminals cannot generate identical environment fingerprints in the above stage of registration protocol negotiation by using rogue programs or scripts. 
         [0082]    In some embodiments, when a data interaction is required between the client and the server, the method further comprises the following steps. 
         [0083]    In step S 630 , the method sends the access request message containing the environment fingerprint to the server. 
         [0084]    In some embodiments, the access request message sent to the server by the client during the data interaction for the subsequent services may contain an environment fingerprint, thus, the server can authenticate the validity for the above access request. 
         [0085]    In one embodiment, the client may receive a unique environment fingerprint generated by the server according to the local terminal information of the client generated during the registration protocol negotiation between the client and the server. During data interactions between the client and the server, the access request message of the client contains the environment fingerprint, so that the server can determine the validity of the access request message by determining whether the received access request message contains the environment fingerprint matching the stored preset authentication information. In this way, another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information, and thus cannot pass server authentication. Therefore, the server can reject an operation requested by an access request message of a different terminal and thus effectively prevent CSRF attacks. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0086]      FIG. 7  is a diagram of a server for preventing CSRF, according to some embodiments of the disclosure. Referring to  FIG. 7 , the server  700  includes the following elements. 
         [0087]    A third receiving module  710  is configured for receiving the local terminal information of the client sent by the client. A second information generation module  720  is configured for generating the environment fingerprint according to the terminal information. A first data processing module  730  is configured for storing the environment fingerprint as the preset authentication information. A fifth sending module  740  is configured for sending the environment fingerprint to the client. 
         [0088]    The third receiving module  710 , the second information generation module  720 , the first data processing module  730 , and the fifth sending module  740  execute the registration protocol negotiation stage between the server and the client. The environment fingerprint negotiated between the server and the client during the registration protocol negotiation is generated by the second information generation module  720  according to the terminal information of the client. Moreover, the terminal information among different terminals is different. Therefore, other terminals cannot generate an environment fingerprint identical to that in the above registration protocol negotiation by using rogue programs or scripts. 
         [0089]    In some embodiments, for data interaction between the client and the server, the server  700  further includes the following. 
         [0090]    A first receiving module  750  is configured for receiving the access request message containing the environment fingerprint sent by the client. A first determination module  760  is configured for determining whether the access request message contains the environment fingerprint matching the stored preset authentication information. A first response module  770  is configured for responding to the access request message according to the determined results. 
         [0091]    In one embodiment of the disclosure of the device for preventing CSRF, the preset authentication information may contain at least one of the environment fingerprint generated according to the local terminal information sent by the client, and the received environment fingerprint generated by the client according to the local terminal information. 
         [0092]    According to the environment fingerprint from the above registration protocol negotiation, the first determination module  760  can authenticate the validity of an access request during a data interaction for subsequent services by determining whether the access request message contains the environment fingerprint matching the stored preset authentication information. 
         [0093]    In some embodiments, the local terminal information may contain at least one of the following: a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal. 
         [0094]    In some embodiments, the first response module  770  may further include a first operation unit for rejecting the access request message when the first determination module determines that the environment fingerprint matching the preset authentication is not contained in the access request message. 
         [0095]    In some embodiments, the first response module  770  may further include a second operation unit for executing the operation corresponding to the access request message when the first determination module determines that the environment fingerprint matching the stored preset authentication information is contained in the access request message. 
         [0096]      FIG. 8  is a diagram of a server for preventing CSRF, according to some embodiments of the disclosure. Referring to  FIG. 8 , the device  800  includes the following elements. 
         [0097]    A fourth receiving module  810  is configured for receiving an environment fingerprint generated by a client according to local terminal information. A second data processing module  820  is configured for storing the environment fingerprint as preset authentication information. The fourth receiving module  810  and the second data processing module  820  execute the registration protocol negotiation between the server and the client. 
         [0098]    In some embodiments, for a data interaction between the client and the server, the device  800  further comprises the following. 
         [0099]    A first receiving module  830  is configured for receiving the access request message containing the environment fingerprint sent by the client. A first determination module  840  is configured for determining whether the access request message contains the environment fingerprint matching the stored preset authentication information. 
         [0100]    Using the environment fingerprint in the above registration protocol negotiation, the first determination module  840  can authenticate the validity of an access request during a data interaction for subsequent services by determining whether the access request message contains the environment fingerprint matching the stored preset authentication information. 
         [0101]    A first response module  850  is configured for responding to the access request message according to the determined results. In some embodiments, the local terminal information may contain at least one of the following: a unique hardware identifier, a unique network identifier and a unique application identifier of the terminal. In some embodiments, the first response module  850  further comprises a first operation unit for rejecting the access request message when the first determination module determines that the environment fingerprint matching the preset authentication is not contained in the access request message. 
         [0102]    In some embodiments, the first response module  850  further comprises a second operation unit for executing the operation corresponding to the access request message when the first determination module determines that the environment fingerprint matching the stored preset authentication information is contained in the access request message. 
         [0103]      FIG. 9  is a diagram of a client device for preventing CSRF, according to some embodiments of the disclosure. Referring to  FIG. 9 , the client  900  may include the following elements. 
         [0104]    A first information generation module  920  is configured for generating an environment fingerprint according to the local terminal information when accessing the server for the first time. A first sending module  920  is configured for sending the environment fingerprint to the server when accessing the server for the first time. The first information generation module  910  and the first sending module  920  execute the registration protocol negotiation between the server and the client. The environment fingerprint negotiated between the server and the client in the above registration protocol negotiation is generated by the first information generation module  910  according to the terminal information of the client. Moreover, the terminal information among different terminals is different. Therefore, other terminals cannot generate an environment fingerprint identical to that in the above registration protocol negotiation by using rogue programs or scripts. 
         [0105]    In some embodiments, for data interaction between the client and the server, the client  900  further comprises a second sending module  930  for sending the access request message containing the environment fingerprint to the server. 
         [0106]    The second sending module  930  can send an access request message containing the environment fingerprint to the server during the data interaction for the subsequent services, thus, the server can authenticate the validity for the above access request. 
         [0107]    In some embodiments, the local terminal information contains at least one of the following: a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal. 
         [0108]      FIG. 10  is a diagram of a client device for preventing CSRF, according to some embodiments of the disclosure. Referring to  FIG. 10 , the device  1000  includes the following elements. 
         [0109]    A third sending module  1010  is configured for sending the local terminal information to the server when accessing the server for the first time. A second sending module  1020  is configured for receiving the environment fingerprint generated by the server according to the terminal information. The third sending module  1010  and the second receiving module  1020  execute the registration protocol negotiation with the server and the client. 
         [0110]    In some embodiments, for data interaction between the client and the server, the client further includes a fourth sending module  1030  for sending the access request message containing the environment fingerprint to the server. 
         [0111]    The fourth sending module  1030  can send an access request message containing the environment fingerprint to the server during a data interaction for the subsequent services. Thus, the server can authenticate the validity for the access request. 
         [0112]    In some embodiments, the local terminal information contains at least one of the following: a unique hardware identifier, a unique network identifier, and a unique application identifier of the terminal. 
         [0113]      FIG. 11  is a diagram of a system for preventing CSRF according to some embodiments of the disclosure. Referring to  FIG. 11 , the system  1100  includes a client  1110  and a server  1120 . 
         [0114]    The client  1110  is configured for sending the local terminal information to the server when accessing the server for the first time, receiving the environment fingerprint generated by the server according to the terminal information, and sending the access request message containing the environment fingerprint to the server. 
         [0115]    The server  1120  is configured for generating an environment fingerprint according to the terminal information, storing the environment fingerprint as the preset authentication information; sending the environment fingerprint to the client, and receiving the access request message containing the environment fingerprint sent by the client. The server  1120  is also configured for determining whether the access request message contains the environment fingerprint matching the stored preset authentication information, and responding to the access request message according to the determined results. 
         [0116]    In an alternative embodiment, the client  1110  may be configured to generate an environment fingerprint according to the local terminal information when accessing the server for the first time, send the environment fingerprint to the server, and send the access request message containing the environment fingerprint to the server. 
         [0117]    Alternatively, or in conjunction with the foregoing embodiment, the server  1220  may be configured to receive the environment fingerprint generated by the client according to the local terminal information, store the environment fingerprint as the preset authentication information, and receive the access request message containing the environment fingerprint sent by the client. The server  1220  may also be configured to determine whether the access request message contains the environment fingerprint matching the stored preset authentication information, and respond to the access request message according to the determined results. 
         [0118]    The technical solutions of the methods, the devices, and the systems for preventing CSRF provided by the embodiments of the disclosure will generate a unique environment fingerprint according to the local terminal information of the client, and store the environment fingerprint as preset authentication information during a stage of registration protocol negotiation between a client and a server. During a data interaction between the client and the server, the access request message of the client contains the environment fingerprint, so that the server can determine the validity of the access request message by determining whether the received access request message contains the environment fingerprint matching the stored preset authentication information. In this way, another terminal cannot obtain the correct environment fingerprint due to the fact that different terminals possess different terminal information, and thus cannot pass server authentication. Therefore, the server can reject an operation requested by an access request message of a different terminal and thus effectively prevent CSRF. Compared with the prior art, CSRF attacks can be effectively prevented, Internet security for users can be ensured, and security requirements can be met. 
         [0119]    Although the data interactions between the client and the server, such as data collection, interaction, and processing, are described in the disclosure, the disclosure is not limited to the conditions of a complete standard or the application of data processing discussed herein. The above descriptions involved in the embodiments are only applications according to some embodiments of the disclosure. The above technical solutions of the disclosure can also be executed in some other framework supporting custom page elements. It is obvious that, without repetitive descriptions, other non-creative variants conforming to the processing methods and steps of the above embodiments can also be realized by the teachings of this disclosure. 
         [0120]    Although the disclosure provides the operation steps of the methods as described in the embodiments or the process diagrams, based on conventional or non-creative works, more operation steps or less operation steps can be included. The step sequence listed in the embodiments is only one of the multiple sequences, and does not represent the sole execution sequence. While the steps are executed in an actual device or a client product, they may be executed in the sequences as shown in the embodiments or the drawings or executed in parallel (for example, using parallel processors or in a multi-threaded environment). 
         [0121]    The device or module illustrated in the above embodiments can be realized by computer chips or other general electronic components, or products with specific functions. For better description, the above device is described with various modules divided by functions. Of course, for implementing the disclosure, the functions of the modules can be realized in one or more software and/or hardware elements, or the modules for realizing the same function can be realized through the combination of multiple sub-modules or sub-units. 
         [0122]    Those skilled in the art shall also understand that, in addition to realizing the controller through the method of the pure computer readable program codes, the same functions of the controller can also be realized in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, embedded microcontrollers, or the like, through logic programming of the method&#39;s steps. Thus, the controller can be regarded as a hardware component; the devices contained therein for realizing various functions also can be regarded as structure in the hardware component. The devices for realizing various functions can even be regarded as both the software for realizing the method and the structure in the hardware component. 
         [0123]    The disclosure can be described in the general context of computer executable commands to be executed by the computer, for example, as one or more program modules. Generally, the program modules comprises the routines, the programs, the objects, the components, the data structures and categories, etc., for executing particular tasks or abstract data types. The disclosure can also be implemented in a distributed computing environment. In these distributed computing environments, the tasks will be executed by the remote processing device connected through the communication network. In the distributed computing environment, the program module may be located in the local and remote computer storage media, including storage devices. 
         [0124]    Thus, those skilled in the art can understand that the disclosure may be realized with the help of software and necessary general hardware platforms. Based on this understanding, the essential parts or the part of the technical solutions of the disclosure making a contribution over the prior art can be embodied in the form of a software product which can be stored in a storage media such as ROM/RAM, diskettes, or optical discs, and the like, comprising numerous commands for facilitating one or more computer devices (for example, a personal computer, a mobile terminal, a server, or a network device) to execute the embodiments of the disclosure or execute the method described by some embodiments. 
         [0125]    The embodiments in the disclosure are described progressively. For similar or identical parts in the embodiments, the descriptions can be mutually referred to. The features described for each embodiment in detail are those parts that are different from the other embodiments. The disclosure can be adopted in many general or special computer system environments or configurations. It may comprise a personal computer, a server computer, a handheld or portable device, a tablet device, a mobile communication terminal, a multiprocessor system, a microprocessor-based system, a programmable electronic device, a network PC, a small-size computer, a large-size computer, the distributed computing environment of any of the above systems or devices, and so forth. 
         [0126]    Although the disclosure is described through the embodiments, those skilled in the art shall understand that the disclosure may have many variants and alterations within the principle of the disclosure and the attached claims are intended to encompass these variants and alterations without departing from the spirit of the disclosure.