A defense method and system for browser cache poisoning

Abstract

A defense method for browser cache poisoning proposed by the present invention includes the following steps: when it is found through detection that the browser sends a request page to the server and calls a local cache control key function, intercept the cache control key function; The key function of cache control obtains all uncached and expired JavaScript files in the requested page, and calculates the hash value of the JavaScript files; checks whether the JavaScript files have been tampered with according to the calculation results, and if so, adjusts its cache time to be earlier than the current time. Realized through interactive verification between the client and the server, it can effectively defend against browser cache poisoning attacks and protect the security of users' personal information without affecting the user experience. At the same time, a system for realizing the above method is provided.

Description

technical field [0001] The invention relates to the field of computer network security, and is used for fighting cache poisoning attacks implemented by using a browser cache mechanism, more specifically, a detection method and system for browser cache poisoning. Background technique [0002] Browser cache poisoning means that attackers use man-in-the-middle and other attack methods to implant malicious JavaScript scripts into the client browser cache. On the premise that the cache is not cleared, every time a user visits a web page, malicious JavaScript scripts will be loaded. In turn, it achieves the purpose of stealing user account passwords, browsing records, hijacking, and tampering with traffic, which seriously threatens the security of users' personal information. [0003] The original intention of the browser caching mechanism is to allow the browser to store some static resources (such as pictures, CCS, JavaScript files, etc.) locally, thereby reducing network delays...

AI Technical Summary

Problems solved by technology

Client-based defense methods require users to have high security awareness and affect user experience

For the server, methods of isolating cache files and URL randomization can be adopted to prevent the client from directly reading page information from the cache, but this will inevitably affect the response speed and violate the original intention of browser caching

Existing defense methods have problems to varying degrees, especially the inability to protect user personal information while taking into account user experience

Images