A web user privacy protection system and method based on information flow tags

Abstract

The invention discloses a Web user privacy protection system and method based on an information stream tag, and belongs to the field of Internet safety. The system comprises a tag adding module and a tag detection module, wherein a novel access control tag model applied to a Web environment is designed in the tag adding module for adding a tag to a message transmitted between a Web component and a Web component; when the Web component comprises a third-party code, a light-weight process is designed for isolating a third-party dangerous code; meanwhile, the tag is aimed to design a message transferring rule to track a user privacy information message so as to track the user privacy information message. The invention also realizes the Web user privacy protection method based on the information stream tag. The technical scheme disclosed by the invention is suitable for Web applications of which the safety level needs to be improved, wherein the Web applications have sensitive user information. The Web application can be free from a situation that the third-party code is damaged, and the privacy information of the user can be protected.

Description

technical field [0001] The invention belongs to the field of Internet security, and more specifically relates to a privacy protection system and method for Web users based on information flow tags. Background technique [0002] In order to provide users with rich services, including map navigation, online payment, etc., current web applications integrate a large number of third-party codes. But because these services often require access to users' private information, developers and users must fully trust them not to leak private information. Many recent studies have shown that these third-party codes can cause a series of serious hazards, such as tracking user browsing records, obtaining user form input data, stealing cookies and private data, and even hijacking session information to forge user requests. [0003] Today's browsers rely on Same Origin Policy (SOP), Cross-Origin Resource Sharing (CORS), Content Security Policy (CSP) and other security mechanisms to prevent t...

AI Technical Summary

Problems solved by technology

[0007] On the one hand, the fine-grained method runs at the object level and effectively supports the prevention of Web applications that import third-party code libraries. However, due to the need for extensive modifications to the current JavaScript engine, its performance and compatibility are poor

On the other hand, because the coarse-grained method does not provide an effective mechanism for restricting dangerous declassification privileges, it may cause privacy leaks, and the defense support for Web applications that import third-party code libraries is not enough

Images