A web page address rewriting method using encryption and decryption methods to reduce space complexity

Abstract

The present invention discloses a web page address rewriting method that uses encryption and decryption methods to reduce space complexity. The method randomly generates a web page address encryption and decryption key related to the user, encrypts the web page address based on the key, and uses a hash algorithm to generate a digital summary of the actual address of the web page. At the same time, the encrypted web page address and the digital summary of the actual address of the web page are merged, and then a virtual address type symbol is added to replace the actual URL address in the web page. When a user request is received, it is first checked whether the web page address in the request is a virtual address. If it is a virtual address, the virtual address in the request is extracted, the virtual address in the request is decrypted, and the digital summary in the request is verified to be legal. The random dynamic nature of the web page address is achieved through the above method, but there is no need to store the virtual URL address corresponding to the relevant URL address in the system for each user, which effectively solves the system space complexity problem of the existing solution.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a web page address rewriting method that utilizes encryption and decryption methods to reduce space complexity. Background Art

[0002] URL, Uniform Resource Locator, uniquely identifies a resource on the World Wide Web. In web application services, URL is used to represent the address of a web page.

[0003] In order to prevent hacker attacks and improve the security and defense capabilities of web services, CN106657044A proposes an address rewriting technology solution. This technology replaces the actual URL of the system with a randomly generated URL, effectively reducing the system injection points, and randomly generates a virtual static link address that can be used to dynamically convert two addresses, increasing the difficulty of attacks. However, this solution needs to record the mapping relationship between the randomly generated URL and the actual URL during the system URL address rewriting process, which will consume a large amount of storage space during system operation. In response to this problem, the present invention proposes a URL rewriting method based on encryption and decryption algorithms to reduce the high space complexity of existing web page address rewriting solutions.

[0004] Definition of terms

[0005] 1. Static page request: The HTTP request URL does not contain dynamic fields or dynamic field values. The Request Method is GET. For example, the request URL value is: http: / / img1.cache.netease.com / f2e / include / common_nav / images / topapp.jpg

[0006] 2. Dynamic page request: The URL address request field of the HTTP request contains dynamic fields and dynamic field values. Its RequestMethod is GET, and its dynamic field values ​​remain unchanged. For example, the requestURL field value in the request is:

[0007] http: / / g.163.com / r?site=netease&affiliate=homepage&cat=homepage&type=logo300x250&location=9

[0008] 3. Form page request: A URL request initiated through a form. RequestMethod can be POST or GET. If RequestMethod is GET, the format of the HTTP request is the same as the dynamic page request, except that the dynamic field values ​​are variable, such as

[0009] http: / / localhost / search.php? keywords=%B1%A3%C3%DC&postflag=1&imageField.x=18&imageField.y=9, or http: / / localhost / search.php? keywords=%B2%E2%CA%D4&postflag=1&imageField.x=20&imageField.y=4

[0010] 4. Static URL: The URL address does not contain dynamic fields and dynamic field values, such as:

[0011] http: / / img1.cache.netease.com / f2e / include / common_nav / images / topapp.jpg

[0012] 5. Dynamic URL: The URL address contains dynamic fields and dynamic field values. For example, the requestURL field value in the request is:

[0013] http: / / g.163.com / r?site=netease&affiliate=homepage&cat=homepage&type=logo300x250&location=9

[0014] 6. Form URL: The URL address embedded in the form. Summary of the Invention

[0015] The first purpose of the present invention is to propose a new web page address rewriting method in response to the current needs of website system security defense. This method can not only effectively improve the security capabilities of the website system, but also significantly reduce the problem of high space complexity of the existing web page address rewriting method.

[0016] The present invention uses encryption and decryption methods to reduce space complexity in web page address rewriting, which includes three processes: address checking and conversion, address rewriting, and distributed data access. Specifically,

[0017] (1) Address checking and conversion

[0018] Step 1.1: The user accesses the web server and the client sends a user request to the web address rewriting system;

[0019] Step 1.2: The address checking and conversion module in the web address rewriting system receives the user request, parses the user request, checks the URL address in the user request and converts the virtual address part into the actual URL address corresponding to the server backend. Specifically:

[0020] Step 1.2.1: The address checking and conversion module in the web address rewriting system receives the user request, parses the user request, extracts the URL address and the cookies carried in the user request, and determines the request type. If the page request is not a form page request, it jumps directly to step 1.2.2. Otherwise, it extracts the URL address excluding the query string in the request address as the page request address, and then jumps to step 1.2.2.

[0021] Step 1.2.2: The address check and conversion module queries the user identification table of the system database through the distributed storage module based on the cookie carried in the user request to see if there is a record corresponding to the cookie. If not, jump to step 1.2.3; otherwise, set the first access flag of the page request to false and jump to step 1.2.5.

[0022] Step 1.2.3: Check whether the page request type is a dynamic page request. If it is a dynamic page request, block the request, record it and issue an alarm. Otherwise, jump to step 1.2.4.

[0023] Step 1.2.4: Determine whether the web page whitelist issued by the distributed data access module to the system database contains the page address query request; if it does, directly forward the page request to the web server, set the first access flag of the request to true, and jump to step 1.3; if it does not, block the user request, record it, and issue an alarm.

[0024] Step 1.2.5: Decrypt the user's virtual URL using the encryption and decryption key in the user ID table and the corresponding record in the user cookie to obtain the user's actual URL value and message digest value MD corresponding to the virtual URL. Then, calculate the message digest value MD based on the user's actual URL value using a hash function. URL , and then compare the MD value in the user virtual URL part with the calculated MD URL Check whether the values ​​are the same; if so, go to step 1.2.6; otherwise, block the request, record the information, and issue an alarm.

[0025] Step 1.2.6: The distributed data access module queries the system database to obtain the user's last visit time. The system then calculates the time interval between the current visit and the user's last visit and checks whether the time interval is less than the system-configured threshold. If so, the request is redirected to the website homepage. Otherwise, the system proceeds to step 1.2.7.

[0026] Step 1.2.7: The distributed data access module queries the system database to obtain the cumulative number of visits by the user within a given time interval. Then, the system checks whether the cumulative number of visits by the user within the given time interval exceeds the threshold set by the system. If so, the request is redirected to the website homepage. Otherwise, the system proceeds to step 1.2.8.

[0027] Step 1.2.8: Replace the address portion of the virtual URL in the request, excluding the host name, with the user's actual URL value obtained after decryption in step 1.2.5 to obtain the actual URL address; at the same time, update the system database with the user's most recent access time to the web service through the distributed data access module, and record the access in the user's corresponding resource access list in the system database through the distributed data access module. Then, forward the request to the web server and mark the request as a non-first access, and go to step 1.3.

[0028] Step 1.3: The web server parses the user request, generates corresponding web page information, and then directly returns the generated web page information to the web address rewriting system.

[0029] (2) Address rewriting

[0030] Step 2.1: The address rewriting module in the web address rewriting system receives the response information returned by the web server, parses the response header and web page information, and rewrites the URL address. Specifically:

[0031] 2.1.1: Get the cookie value in the response header. If this request is the first visit, jump directly to step 2.1.2. If this request is not the first visit, jump to step 2.1.3.

[0032] Step 2.1.2: Randomly generate a user identifier, and add a record containing the cookie, user identifier, and user URL encryption and decryption key to the cookie and user mapping table of the system database through the distributed storage module. The corresponding URL and access time of the web page are recorded in the resource access list corresponding to the user in the system database, and then go to step 2.1.3.

[0033] Step 2.1.3: Search the URL addresses in the web page information in sequence and update the URL address in the response web page information; specifically:

[0034] Step 2.1.3.1: Search the web page information for URLs one by one. If a URL is found, check whether it is a link to a web server outside the system's protection. If so, search the web page information for the next URL and repeat step 2.1.3.1. Otherwise, proceed to step 2.1.3.2.

[0035] Step 2.1.3.2: Check whether the current URL address is an absolute URL path. If it is, go directly to step 2.1.3.3. If it is not, convert the URL path to an absolute URL path and then go to step 2.1.3.3.

[0036] Step 2.1.3.3: Use the distributed data access module to query whether the web page whitelist table in the system database contains the current absolute URL path. If it does, go directly to step 2.1.3.6; otherwise, go to step 2.1.3.4.

[0037] Step 2.1.3.4: Generate a data summary of the path and file name portion of the current URL address, and use the user URL encryption and decryption key to encrypt the path and file name portion of the current URL address. Combine the data summary and the encrypted URL address to obtain a virtual address, and then proceed to step 2.1.3.5.

[0038] Step 2.1.3.5: Add URL type tags before and after the virtual address in step 2.1.3.4 to obtain a new URL address, use the current new URL address to replace the actual URL address in the response web page information, and then proceed to step 2.1.3.6.

[0039] The URL type is marked as static, dynamic or form.

[0040] Step 2.1.3.6: Determine whether all URL addresses have been traversed. If yes, skip to step 2.2. If not, return to step 2.1.3.1.

[0041] Step 2.2: The web address proxy sends the replaced web page information to the user.

[0042] (3) Distributed data access

[0043] Step 3: The distributed storage module receives the data query and storage requests from the address rewriting module and the address checking and conversion module, issues a data query or storage instruction to the system database, and returns the operation result to the module that initiated the request.

[0044] The second object of the present invention is to provide a web page address rewriting system that uses encryption and decryption methods to reduce space complexity, including

[0045] The address checking and conversion module is used to check the URL address in the user request and convert the virtual address part into the actual URL address corresponding to the server backend.

[0046] The address rewriting module is used to receive the response information returned by the web server, parse the response header and web page information, and rewrite the URL address.

[0047] The distributed storage module receives data query and storage requests from the address rewriting module and the address checking and converting module, issues data query or storage instructions to the system database, and returns the operation results to the module that initiated the request.

[0048] A third object of the present invention is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described above.

[0049] A fourth object of the present invention is to provide a computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described is implemented.

[0050] The beneficial effects of the present invention are as follows:

[0051] The present invention discloses a web address rewriting method and system that utilizes encryption and decryption methods to reduce space complexity. When rewriting a web address, the method first randomly generates a web address encryption and decryption key associated with the user. Based on this key, the web address is encrypted using a cryptographic algorithm to obtain the encrypted web address. A hash algorithm is then used to generate a digital digest of the actual web address. The encrypted web address and the digital digest of the actual web address are then combined, and a virtual address type symbol is added to the combined portion to replace the actual URL address in the web page. Upon receiving a user request, the method first checks whether the web address in the request is a virtual address. If so, the virtual address in the request is extracted and decrypted using the user-associated web address encryption and decryption key to obtain the decrypted web address. The digital digest in the request is then verified to be valid. Through these steps, the proposed method achieves random and dynamic web address generation without requiring the system to store the virtual URL corresponding to each user's URL address. Compared to the existing web address rewriting method (CN106657044A), this method effectively addresses the system space complexity issue associated with existing solutions.

[0052] At the same time, the method of the present invention can also effectively reduce the number of injection points used for website attacks, making it difficult for attackers to predict the virtual static addresses that other users can access the system, thereby increasing the difficulty of attacks. Furthermore, the relevant data of the web address rewriting system is stored in the system database via a distributed storage module, providing load balancing support, improving the scalability of the system, and increasing the robustness of the system. Furthermore, because the web address rewriting system detects system attacks not based on signatures, it also provides protection against unknown attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 Rewrite the system architecture diagram for web page addresses.

[0054] Figure 2 This is a business process diagram for users accessing the website after the web address rewriting system is deployed.

[0055] Figure 3 Flowchart for address checking and conversion.

[0056] Figure 4 Rewriting flow chart for web page addresses

[0057] Figure 5 Compose a map for virtual addresses. DETAILED DESCRIPTION

[0058] The following is a detailed description of the specific implementation scheme of the present invention in conjunction with the accompanying drawings and specific implementation methods. The network address rewriting system uses Nginx service as a proxy service, conducts secondary development on Nginx, implements address rewriting, address checking and conversion modules, and uses Redis as the database system of the system. The system processes the user's web page request and the web server's web page response as follows: Figure 3 、 Figure 4 shown. Figure 5 is a virtual address composition diagram. The process of the present invention is as follows Figure 1-Figure 4 As shown, the details are as follows:

[0059] (1) Address checking and conversion

[0060] Step 1: The user accesses the web server and sends a user request to the web address rewriting system;

[0061] Step 2: The web address rewriting system receives the user request, parses the user request, checks the URL address in the user request and converts the virtual address part into the actual URL address corresponding to the server backend. Specifically:

[0062] Step 2.1: Receive the user request, parse the user request, extract the URL address and the cookies carried in the user request, and then determine the request type. If the page request is not a form page request, jump directly to step 2.2; otherwise, extract the URL address excluding the query string in the request address as the page request address, and go to step 2.2.

[0063] Step 2.2: The distributed storage module checks the user ID table in the system database for a record corresponding to the cookie carried in the user request. If not, proceed to Step 2.3. Otherwise, set the first-access flag of the request to false and proceed to Step 2.5.

[0064] Step 2.3: Check whether the page request type is a dynamic page request. If it is a dynamic page request, block the request, log it, and issue an alarm. If it is not a dynamic page request, go to step 2.4.

[0065] Step 2.4: Send a query to the distributed data access module to see if the page address is included in the system database's web whitelist. If so, the page request is forwarded directly to the web server, and the first-access flag of the request is set to true, proceeding to step 3. If not, the user request is blocked, logged, and an alarm is issued.

[0066] Step 2.5: Decrypt the user's virtual URL using the encryption and decryption key in the user ID table and the corresponding record in the user cookie to obtain the user's actual URL value and message digest value MD corresponding to the virtual URL. Then, calculate the message digest value MD based on the user's actual URL value using the MD5 hash function. URL , and then compare the MD value in the user virtual URL part with the calculated MD URL Check whether the values ​​are the same. If so, proceed to step 2.6. Otherwise, block the request, log the information, and issue an alert.

[0067] Step 2.6: The distributed data access module queries the system database to obtain the user's last visit time. The system then calculates the time interval between the current visit and the user's last visit and checks whether the time interval is less than a system-configured threshold. If so, the request is redirected to the website homepage. Otherwise, the system proceeds to step 2.7.

[0068] Step 2.7: The distributed data access module queries the system database to obtain the cumulative number of visits by the user within a given time interval. The system then checks whether the cumulative number of visits by the user within the given time interval exceeds the threshold set by the system. If so, the request is redirected to the website homepage. Otherwise, the process continues with step 2.8.

[0069] Step 2.8: Replace the address part of the virtual URL address in the request except the host name with the decrypted URL to obtain the actual URL address. At the same time, update the user's most recent access time to the web service in the system database through the distributed data access module, and record the access to the user's corresponding resource access list in the system database through the distributed data access module. Then forward the request to the web server and mark the request as a non-first access, and go to step 3.

[0070] Step 3: The web server parses the user request, generates corresponding web page information, and then returns the generated web page information directly to the web address rewriting system.

[0071] (2) Address rewriting

[0072] Step 4: The address rewriting module receives the response information returned by the web server, parses the response header and web page information, and rewrites the URL address. Specifically:

[0073] 4.1: Receive the response information returned by the web server, parse the response header and web page information to obtain the cookie value of the response header. If the first access flag set in step 2.4 of the address check and conversion module is true, jump directly to step 4.2.

[0074] Otherwise go to step 4.3.

[0075] Step 4.2: Randomly generate a user identifier userGuid and a user URL encryption and decryption key. Add a record containing the cookie user identifier and the user URL encryption and decryption key to the cookie and user mapping table of the system database through the distributed storage module, and record the URL and access time corresponding to the web page in the resource access list corresponding to the user in the system database, and then go to step 4.3.

[0076] Step 4.3: Search the URL addresses in the web page information in sequence and update the URL address in the response web page information; specifically:

[0077] In step 4.3.1, the webpage information is searched for URLs using the AC algorithm and the KMP algorithm. The AC algorithm searches for keywords preceding the URL, while the KMP algorithm searches for keywords following the URL. If a URL is found, the system checks whether it is a link outside the web server to be protected. If so, proceed to step 4.3.1; otherwise, proceed to step 4.3.2.

[0078] Step 4.3.2: Check whether the URL address is an absolute URL path. If it is, go to step 4.3.3. If not, convert the URL path to an absolute URL path and then go to step 4.3.3.

[0079] Step 4.3.3: Use the distributed data access module to query whether the web page whitelist table in the system database contains the absolute URL path. If it does, go to step 4.3.6; otherwise, go to step 4.3.4.

[0080] Step 4.3.4: Generate a data summary of the path and file name portion of the URL address, and use the user URL encryption and decryption key to encrypt the path and file name portion of the URL address. Combine the two parts to obtain a virtual address VirtualURL, and go to step 4.3.5.

[0081] Step 4.3.5: Add URL type tags (static, dynamic, and form) before and after the corresponding virtual address, and then replace the actual URL address in the response web page information, and go to step 4.3.6.

[0082] Step 4.3.6: If all web page information has been processed, go to step 5. Otherwise, return to step 4.3.1.

[0083] Step 5: The web address proxy sends the replaced web page information to the user.

[0084] (3) Distributed Data Storage

[0085] The distributed data access module receives data query and storage requests from the address rewriting module and the address checking and conversion module, issues data query or storage instructions to the system database, and returns the operation results to the requesting module. The system database is a Redis database, which includes a web page whitelist table, a cookie and user mapping table, and a user resource access list.

[0086] The present invention is not limited to the above specific embodiments, and those skilled in the art may make various changes accordingly. However, any changes that are equivalent or similar to the present invention should be included in the scope of the claims of the present invention.

Claims

1. A web page address rewriting method that uses encryption and decryption methods to reduce space complexity, including address checking and conversion, address rewriting, and distributed data access; characterized in that The method is specifically: (1) Address checking and conversion Step 1.1: The user accesses the web server and the client sends a user request to the web address rewriting system; Step 1.2: The web address rewriting system receives the user request, parses the user request, checks the URL address in the user request, and converts the virtual address part into the actual URL address corresponding to the server backend; Step 1.3: The web server parses the user request, generates the corresponding web page information, and then returns the generated web page information directly to the web address rewriting system; (2) Address rewriting Step 2.1: The address rewriting module in the web address rewriting system receives the response information returned by the web server, parses the response header and web page information, and rewrites the URL address; Specifically: Step 2.1.1: Get the cookie value in the response header. If the request is the first visit, jump directly to step 2.1.

2. If the request is not the first visit, jump to step 2.1.

3. Step 2.1.2: Randomly generate a user identifier, and add a record containing the cookie, user identifier, and user URL encryption and decryption key to the cookie and user mapping table in the system database through the distributed storage module. The URL and access time corresponding to the webpage are recorded in the resource access list corresponding to the user in the system database, and then go to step 2.1.3; Step 2.1.3: Search the URL addresses in the web page information in sequence and update the URL address in the response web page information; specifically: Step 2.1.3.1: Search for URL addresses in the web page information one by one. If a URL address is found, check whether the address is an external link address of the web server to be protected by the system; If the link address is outside the web server to be protected by the system, find the next URL address in the web page information and repeat step 2.1.3.

1. Otherwise, go to step 2.1.3.2; Step 2.1.3.2: Check whether the current URL address is an absolute URL path; If it is an absolute URL path, go directly to step 2.1.3.3; if it is not an absolute URL path, convert the URL path to an absolute URL path and then go to step 2.1.3.3; Step 2.1.3.3: Use the distributed data access module to query whether the webpage whitelist table in the system database contains the current absolute URL path. If it does, go directly to step 2.1.3.6; otherwise, go to step 2.1.3.4; Step 2.1.3.4: Generate a data digest of the path and file name portion of the current URL address. Use the user's URL encryption and decryption key to encrypt the path and file name portion of the current URL address. Combine the data digest and the encrypted URL address to obtain a virtual address, and then proceed to step 2.1.3.

5. Step 2.1.3.5: Add URL-type tags before and after the virtual address in step 2.1.3.4 to obtain a new URL address, replace the actual URL address in the response web page information with the current new URL address, and then proceed to step 2.1.3.6; Step 2.1.3.6: Determine whether all URL addresses have been traversed. If so, skip to step 2.

2. If not, return to step 2.1.3.

1. Step 2.2: The web page address rewriting system sends the replaced web page information to the user; (3) Distributed data access Step 3: The distributed storage module receives the data query and storage requests from the address rewriting module and the address checking and conversion module, issues a data query or storage instruction to the system database, and returns the operation result to the module that initiated the request.

2. The method according to claim 1, wherein Step 1.2 is as follows: Step 1.2.1: The web address rewriting system receives the user request, parses the request, extracts the URL and cookies carried in the request, and then determines the request type. If the page request is not a form page request, it directly jumps to step 1.2.

2. Otherwise, it extracts the URL address excluding the query string in the request address as the page request address, and then jumps to step 1.2.2; Step 1.2.2: The address check and conversion module uses the distributed storage module to query the user identification table in the system database based on the cookie carried in the user request to see if there is a record corresponding to the cookie. If not, the process jumps to step 1.2.

3. Otherwise, the first access flag for the page request is set to false and the process jumps to step 1.2.

5. Step 1.2.3: Check whether the page request type is a dynamic page request. If it is a dynamic page request, block the request, record it, and issue an alarm. Otherwise, jump to step 1.2.4; Step 1.2.4: Determine whether the web page whitelist sent by the distributed data access module to the system database contains the address in the page request; if so, directly forward the page request to the web server, set the first access flag of the request to true, and jump to step 1.3; if not, block the user request, record it, and issue an alarm; Step 1.2.5: Decrypt the user's virtual URL using the user URL encryption and decryption key in the user ID table and the corresponding record in the user cookie to obtain the user's actual URL value and message digest value MD corresponding to the virtual URL. Then, calculate the message digest value MD based on the user's actual URL value using a hash function. URL , and then compare the MD value in the user virtual URL part with the calculated MD URL Check whether the values ​​are the same; if so, proceed to step 1.2.6; otherwise, block the request, log the request, and issue an alarm. Step 1.2.6: Use the distributed data access module to query the system database to obtain the user's last visit time, then calculate the time interval between the current visit and the user's last visit, and check whether the time interval is less than the system-set threshold. If so, redirect the request to the website homepage. Otherwise, go to step 1.2.7; Step 1.2.7: Query the system database through the distributed data access module to obtain the cumulative number of visits by the user in a given time interval, and then check whether the cumulative number of visits by the user in the given time interval exceeds the threshold set by the system; If the threshold is exceeded, redirect the request to the website homepage; Otherwise, go to step 1.2.8; Step 1.2.8: Replace the address portion of the virtual URL in the request, excluding the host name, with the user's actual URL value obtained after decryption in step 1.2.5 to obtain the actual URL address; at the same time, update the system database with the user's most recent access time to the web service through the distributed data access module, and record the access in the user's corresponding resource access list in the system database through the distributed data access module. Then, forward the request to the web server and mark the request as a non-first access, and go to step 1.

3.

3. The method according to claim 1, wherein The URL type mentioned in step 2.1.3.5 is marked as static, dynamic, or form.

4. A system for implementing the method according to any one of claims 1 to 3, characterized in that include: The address checking and conversion module is used to check the URL address in the user request and convert the virtual address part into the actual URL address corresponding to the server backend; The address rewriting module is used to receive the response information returned by the web server, parse the response header and web page information, and rewrite the URL address; The distributed storage module receives data query and storage requests from the address rewriting module and the address checking and converting module, issues data query or storage instructions to the system database, and returns the operation results to the module that initiated the request.

5. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 3.

6. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 3 is implemented.

Images