Defense method and system for browser cache poisoning

Abstract

The invention provides a defense method for browser cache poisoning. The defense method comprises the following steps: intercepting a cache control key function when discovering that a browser sends arequest page to a server and calls the local cache control key function through detection; acquiring all unexpired cached JavaScript files in the request page according to the cache control key function, and performing Hash value computation on the JavaScript files; checking whether the JavaScript files are tampered according to the computation result, if the JavaScript files are tampered, adjusting the caching time to be earlier than the current time. The defense is realized through the interactive verification of a client and the server, the browser cache poisoning attack can be effectivelydefended without influencing the user experience, and the user personal information security is protected. The invention provides a system for realizing the above method at the same time.

Description

technical field [0001] The invention relates to the field of computer network security, and is used for fighting cache poisoning attacks implemented by using a browser cache mechanism, more specifically, a detection method and system for browser cache poisoning. Background technique [0002] Browser cache poisoning means that attackers use man-in-the-middle and other attack methods to implant malicious JavaScript scripts into the client browser cache. On the premise that the cache is not cleared, every time a user visits a web page, malicious JavaScript scripts will be loaded. In turn, it achieves the purpose of stealing user account passwords, browsing records, hijacking, and tampering with traffic, which seriously threatens the security of users' personal information. [0003] The original intention of the browser caching mechanism is to allow the browser to store some static resources (such as pictures, CCS, JavaScript files, etc.) locally, thereby reducing network delays...

AI Technical Summary

Problems solved by technology

Client-based defense methods require users to have high security awareness and affect user experience

For the server, methods of isolating cache files and URL randomization can be adopted to prevent the client from directly reading page information from the cache, but this will inevitably affect the response speed and violate the original intention of browser caching

Existing defense methods have problems to varying degrees, especially the inability to protect user personal information while taking into account user experience

Images