Browser fingerprint defense method, electronic device and storage medium based on hidden plug-in CSS leakage

Abstract

The present invention proposes a browser fingerprint defense method, electronic device and storage medium based on the leakage of hidden plug-in CSS, which belongs to the technical field of browser fingerprint defense. The method includes the following steps: S1. Collect and refine the CSS of the plug-in and save it locally; S2. Control the CSS introduced by the hidden or displayed installed plug-in to the web page, and the CSS introduced by the installed plug-in to the web page includes hiding of layout-irrelevant attributes and hiding of layout-related attributes. S3. Complete the randomization of the plug-in. The present invention can not only hide our real installed plug-in information, but also resist browser fingerprint recognition and protect the user's privacy information. By randomly installing the plug-in, it can actively resist the website from collecting the plug-in as fingerprint information; it solves the technical problems of low flexibility, poor performance and weak defense of the fingerprint defense method in the prior art.

Description

Technical Field

[0001] The present application relates to a defense method, and in particular to a browser fingerprint defense method, electronic device and storage medium based on hidden plug-in CSS leakage, belonging to the technical field of browser fingerprint defense. Background Art

[0002] As one of the most commonly used software in daily mobile phones and computers, browsers are the most intensive channels for exchanging information between the network and the outside world. When using a browser, the web pages visited can collect a lot of Internet environment information through the interaction between the user and the browser. The collected Internet environment information includes which plug-ins are installed in the browser. Identifying which plug-ins are installed by the user can not only provide strong user identity information for browser fingerprints (the plug-ins installed by different users vary greatly, and the differentiation effect is good), but also through which plug-ins are installed by the user, the user's occupation, hobbies and other information can be judged to a certain extent (which may expose some of the user's privacy information). This information can be combined to locate / differentiate different users, and this process has a professional term called browser fingerprint recognition.

[0003] Browser fingerprints belong to device fingerprints, which means that by collecting device information, a unique feature / fingerprint is obtained. This fingerprint is relatively stable and unique. Browser fingerprints have been very popular in the past decade. This technology also has its pros and cons. The pros are mainly for service providers, who hope to prevent users from sharing accounts through fingerprint identification, and of course prevent user accounts from being stolen and avoid user losses. The cons are mainly for users. Users may not want to be identified by web pages when they go online, because browser fingerprints are completely or difficult to control by users. Users do not know whether the web page is collecting fingerprint information, what information is collected, and they cannot prevent the collection.

[0004] An obvious application trend of browser fingerprints is advertising recommendation. Since third-party cookies are disabled by default in many browsers, other tracking methods are needed to better push advertisements to users. Browser fingerprints are a good alternative.

[0005] There has always been a lot of attacks and defenses against browser fingerprints. Many browsers are pursuing the protection of user privacy and Internet security (such as Brave browser). There have been papers proposing to detect plug-ins through plug-in CSS leakage, but there is still little research, and the detection method was only proposed in 2021. Currently, there are several obvious disadvantages of using a plug-in to defend against plug-in fingerprint recognition:

[0006] 1. The plug-in itself needs to be installed by the user, and the interfaces and permissions that the plug-in can access are relatively limited, and the flexibility is not high;

[0007] 2. Because the entire webpage needs to be copied, the memory usage will be doubled directly, and the performance is poor;

[0008] 3. It cannot effectively defend against plug-in fingerprinting (because even though no plug-ins can be identified, this information can still be used as part of the browser fingerprint, which means that the user has not installed any plug-ins). Summary of the invention

[0009] A brief overview of the present invention is provided below in order to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to present certain concepts in a simplified form as a prelude to a more detailed description discussed later.

[0010] In view of this, in order to solve the technical problems of low flexibility, poor performance and weak defense of fingerprint defense methods in the prior art, the present invention provides a browser fingerprint defense method, electronic device and storage medium based on hidden plug-in CSS leakage.

[0011] Solution 1: Browser fingerprint defense method based on hidden plug-in CSS leakage, including the following steps:

[0012] S1. Collect and refine the CSS of the plug-in and save it locally;

[0013] S2. Control the CSS introduced to the web page by the installed plug-in that hides or displays;

[0014] S3. Complete the randomization plugin.

[0015] Preferably, the method of collecting and refining the CSS of the plug-in and saving it locally includes the following steps:

[0016] S11. Crawl plugins from the plugin store;

[0017] S12. Parse the manifest.json file of the plug-in and obtain the corresponding CSS file introduced into the web page;

[0018] S13. Aggregate multiple CSS files corresponding to a plug-in into a single file, and extract and retain some of the rules therein.

[0019] The partial rules are rules with selectors such as id and class name.

[0020] Preferably, the CSS introduced into the webpage by the installation plug-in includes hiding of layout-irrelevant attributes and hiding of layout-related attributes.

[0021] Preferably, the method for hiding the layout-irrelevant attributes is to save the CSS inserted by the plug-in as the CSS that needs to be hidden and the CSS that does not need to be hidden respectively. When calculating the computed style, one element may be calculated twice, one is required for normal rendering of the web page, recorded as computed_style_1, and the other is required for the web page code to obtain the attributes of the HTML element, recorded as computed_style_2;

[0022] For normal rendering of a web page, a node inherits the computed_style_1 of its father node, applies the CSS rules matched by its own node, including the CSS rules that need to be hidden, and calculates and saves the computed_style_1 of the current node;

[0023] When a web page obtains the attributes of an HTML element through code, the node inherits the computed_style_2 of the parent node, applies the CSS rules matched by the node itself, which do not include the CSS rules that need to be hidden, and calculates and saves the computed_style_2 of the current node.

[0024] Preferably, the method of hiding the layout-related attributes is to randomize the layout-related attribute values, including the following:

[0025] S21. Use different random schemes to directly modify the return value of the interface;

[0026] S22. When the webpage js code calls these interfaces, it will obtain the modified values;

[0027] Preferably, the method for completing the randomization plug-in comprises the following steps:

[0028] S31. Collect the list of installed plug-ins and the list of plug-ins that can be disguised, and remove duplicate lists;

[0029] S32. Randomly select k plugins from n plugins (k <n);

[0030] S33. For the plug-ins that are actually installed and have not been operated, if they are among the selected k plug-ins, insert CSS without marking them hidden; if they are not among the selected k plug-ins, insert CSS with marking them hidden;

[0031] S34. If there are any unoperated plug-ins among the extracted k plug-ins, insert CSS without marking them as hidden. If there are no unoperated plug-ins, end.

[0032] Solution 2: An electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the browser fingerprint defense method based on hidden plug-in CSS leakage described in Solution 1 when executing the computer program.

[0033] Solution three: A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the browser fingerprint defense method based on hidden plug-in CSS leakage described in Solution one.

[0034] The beneficial effects of the present invention are as follows: the present invention can not only hide our real installed plug-in information, but also resist browser fingerprint recognition and protect user privacy information. By randomly installing plug-ins, it can actively resist websites from collecting plug-ins as fingerprint information. It solves the technical problems of low flexibility, poor performance and weak defense of fingerprint defense methods in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0036] Figure 1 It is a schematic diagram of the process of the present invention;

[0037] Figure 2 It is a schematic diagram of the hiding process of layout-independent attributes of the present invention;

[0038] Figure 3 Complete the randomization plug-in process for the present invention 1 Schematic diagram. DETAILED DESCRIPTION

[0039] In order to make the technical solutions and advantages in the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0040] Example 1, reference Figure 1-3 This embodiment describes a browser fingerprint defense method based on hidden plug-in CSS leakage, including the following steps:

[0041] S1. Collect and refine the CSS of the plug-in and save it locally;

[0042] In order to disguise (uninstalled) plug-ins later, it is necessary to locally save the CSS introduced by other plug-ins to the web page, and extract and summarize the introduced CSS content into a single CSS file. Each CSS file corresponds to a plug-in that can be disguised. Users can also expand these files by themselves later, or download them shared by others.

[0043] Collect and refine the plugin's CSS, including the following steps:

[0044] S11. Crawl plugins from the plugin store, and give priority to plugins with high download volume / number of users;

[0045] S12. Parse the manifest.json file of the plug-in and obtain the corresponding CSS file introduced into the web page;

[0046] S13. Aggregate multiple CSS files corresponding to a plug-in into a single file, and extract and retain some rules therein, wherein the partial rules are rules with selectors such as id and class name.

[0047] The single plug-in CSS file obtained by organizing according to the method described in this embodiment is relatively simple, easy to operate, contains obvious features, and is not likely to affect the user's normal Internet experience (if we do not install the plug-in ourselves, many rules will not take effect, but can deceive the browser fingerprint collection code).

[0048] S2. Controlling hiding or displaying of CSS introduced into the webpage by the installation plug-in, wherein the CSS introduced into the webpage by the installation plug-in includes hiding of layout-irrelevant attributes and hiding of layout-related attributes.

[0049] CSS can control the Style of our web page HTML elements, and this Style information is stored in two types of objects: computed style and layout object in the DataNode (data node) corresponding to the element. The layout-independent attributes here refer to the attributes that are not related to the layout object (such as color, background, shadow, etc.) and are only related to the computedstyle.

[0050] The method of hiding the layout-irrelevant attributes is to save the CSS inserted by the plug-in as the CSS that needs to be hidden and the CSS that does not need to be hidden respectively. When calculating the computed style, one element may be calculated twice, one is required for the normal rendering of the web page, recorded as computed_style_1, and the other is required for the web page code to obtain the attributes of the HTML element, recorded as computed_style_2;

[0051] For normal rendering of a web page, a node inherits the computed_style_1 of its father node, applies the CSS rules matched by its own node, including the CSS rules that need to be hidden, and calculates and saves the computed_style_1 of the current node;

[0052] When a web page obtains the attributes of an HTML element through code, the node inherits the computed_style_2 of the parent node, applies the CSS rules matched by the node itself, which do not include the CSS rules that need to be hidden, and calculates and saves the computed_style_2 of the current node.

[0053] Compared with layout-independent properties (which only involve computed style calculations), what affects layout object calculations is not just the nodes with parent-child relationships, but also sibling nodes, etc. For example, the width of a node may affect the width of its sibling nodes, or even more complex relationships.

[0054] To this end, the method of hiding the layout-related attributes includes additionally calculating the layout object and randomizing the layout-related attribute values;

[0055] Calculate the layout object additionally. When we obtain layout-related attributes, we use an additionally calculated layout object instead of the original layout object. This hiding method can perfectly solve the problem of plug-in CSS leakage and has almost no impact on the normal function of the web page. It is suitable for use in environments with high privacy requirements.

[0056] The additional calculation of layout objects is similar to the additional calculation of computed styles, and includes the following steps:

[0057] An element maintains two layout objects, one for normal rendering (recorded as layout_object_1, containing all CSS rules), and one for use when the web page code is obtained (recorded as layout_object_2, excluding hidden CSS rules, which will not be calculated if not obtained)

[0058] When obtaining layout-related attributes of an HTML element through web page code, if the element's layout_object_2 has been calculated, use it; otherwise, recalculate it.

[0059] Different layouts may have different calculation methods, which are relatively complicated. The present invention only needs to trigger recalculation and also recalculate the dependent elements.

[0060] This will not only depend on the parent node, but also on the sibling and child nodes. It may also calculate the computedstyle additionally.

[0061] Randomize layout-related attribute values, including:

[0062] S21. Instead of applying CSS rules, different random schemes are used to directly modify the return value of the interface;

[0063] The interface includes:

[0064] (1)window.getComputedStyle;

[0065] (2)element.getBoundingClientRect;

[0066] (3)element.offsetHeight;

[0067] (4)element.offsetWidth, etc.

[0068] The randomization scheme includes:

[0069] (1) Directly return a fixed value a (such as 0);

[0070] (2) Return a random value in a certain range (such as ab);

[0071] (3) The correct value fluctuates up or down by a% (e.g. 5%).

[0072] S22. When the webpage js code calls these interfaces, it will obtain the modified values, which has the effect of hiding the layout attributes;

[0073] S3. Complete the randomization plug-in, including the following steps:

[0074] S31. Collect the list of installed plug-ins and the list of plug-ins that can be disguised, and remove duplicate lists;

[0075] The deduplication method is removed from the masqueradable plugin.

[0076] S32. Assume that there are n plugins after deduplication, and randomly select k plugins from n plugins (k <n);

[0077] The pool sampling method is used to ensure that the probability of each element being drawn is equal. As our final disguised installed plug-in, we need to balance performance and security. k cannot be too small or too large. If it is too small, the disguise may not be captured by the attacker, and if it is too large, it may affect the loading performance of the web page itself.

[0078] S33. For the plug-ins that are actually installed and have not been operated, if they are among the selected k plug-ins, insert CSS without marking them hidden; if they are not among the selected k plug-ins, insert CSS with marking them hidden;

[0079] S34. If there are any unoperated plug-ins among the extracted k plug-ins, insert CSS without marking them as hidden. If there are no unoperated plug-ins, end.

[0080] Glossary of the present invention:

[0081] CSS: an application used to represent HTML;

[0082] layout object: layout target;

[0083] layout: layout;

[0084] class name: object label;

[0085] manifest.json: Chrome Extension configuration file;

[0086] computed style: computed style;

[0087] js code: some scripts written to implement some special effects or functions on web pages.

[0088] Embodiment 2: The computer device of the present invention may be a device including a processor and a memory, such as a single chip microcomputer including a central processing unit. Furthermore, the processor is used to implement the steps of the above-mentioned recommendation method based on CREO software that can modify the recommendation data driven by the relationship when executing the computer program stored in the memory.

[0089] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0090] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0091] Embodiment 3, Computer-readable storage medium embodiment

[0092] The computer-readable storage medium of the present invention can be any form of storage medium that can be read by a processor of a computer device, including but not limited to non-volatile memory, volatile memory, ferroelectric memory, etc. A computer program is stored on the computer-readable storage medium. When the processor of the computer device reads and executes the computer program stored in the memory, the steps of the above-mentioned modeling method of modifiable relationship-driven modeling data based on CREO software can be implemented.

[0093] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer readable media do not include electric carrier signals and telecommunication signals.

[0094] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative, not restrictive, with respect to the scope of the present invention, which is defined by the appended claims.

Claims

1. A browser fingerprint defense method based on hidden plug-in CSS leakage, characterized in that: The following steps are involved: S1. Collect and refine the CSS of the plug-in and save it locally; S2. Control the CSS introduced to the web page by the installed plug-in that hides or displays; S3. Complete the randomization plug-in; The CSS introduced into the webpage by the installation plug-in includes hiding of layout-irrelevant attributes and hiding of layout-related attributes; The method of hiding the layout-irrelevant attributes is to save the CSS inserted by the plug-in as the CSS that needs to be hidden and the CSS that does not need to be hidden respectively. When calculating the computed style, one element may be calculated twice, one is required for the normal rendering of the web page, recorded as computed_style_1, and the other is required for the web page code to obtain the attributes of the HTML element, recorded as computed_style_2; For normal rendering of a web page, a node inherits the computed_style_1 of its father node, applies the CSS rules matched by its own node, including the CSS rules that need to be hidden, and calculates and saves the computed_style_1 of the current node; When a web page obtains the attributes of an HTML element through code, the node inherits the computed_style_2 of the parent node, applies the CSS rules matched by the node itself, which do not include the CSS rules that need to be hidden, and calculates and saves the computed_style_2 of the current node; The method of hiding the layout-related attributes is to randomize the layout-related attribute values, including: S21. Use different random schemes to directly modify the return value of the interface; S22. When the webpage js code calls these interfaces, it will obtain the modified values; The method for completing the randomization plug-in comprises the following steps: S31. Collect the list of installed plug-ins and the list of plug-ins that can be disguised, and remove duplicate lists; S32. randomly select k plug-ins from n plug-ins, k < n; S33. For the plug-ins that are actually installed and have not been operated, if they are among the selected k plug-ins, insert CSS without marking them hidden; if they are not among the selected k plug-ins, insert CSS with marking them hidden; S34. If there are any unoperated plug-ins among the extracted k plug-ins, insert CSS without marking them as hidden. If there are no unoperated plug-ins, end.

2. The browser fingerprint defense method based on hidden plug-in CSS leakage according to claim 1 is characterized in that: The method of collecting and refining the CSS of the plug-in and saving it locally includes the following steps: S11. Crawl plugins from the plugin store; S12. Parse the manifest.json file of the plug-in and obtain the corresponding CSS file introduced into the web page; S13. Aggregate multiple CSS files corresponding to a plug-in into a single file, and extract and retain some rules therein, wherein the partial rules are rules with id and class name selectors.

3. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the browser fingerprint defense method based on hidden plug-in CSS leakage as claimed in claim 1 or 2 when executing the computer program.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the browser fingerprint defense method based on hidden plug-in CSS leakage described in claim 1 or 2 is implemented.

Images