A browser secure access system, method, device, equipment and storage medium

Abstract

The present invention discloses a browser security access system, method, device, electronic device and computer-readable storage medium, which are applied to the field of computer network technology. The system includes a client, a server and a network service program, wherein the client and the server are respectively located in a first network and a second network isolated from each other; the client is used to send a remote browser login request to the network service program, and the remote browser login request includes user information; the network service program is used to generate a remote browser creation request based on the user information in the remote browser login request; the server is used to create a remote browser according to the remote browser creation request; the client is used to establish a connection channel between the client and the remote browser of the server according to the WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the present invention is conducive to improving the security of the client and ensuring the Internet security of users.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a browser security access system, method, device, electronic device and computer-readable storage medium. Background Art

[0002] Currently, existing technologies mainly use VDI (Virtual Desktop Infrastructure, desktop virtualization), local sandbox and RBI (Remote Browser Isolation, remote browser) technology for browser-based secure Internet access scenarios. Among them:

[0003] VDI is a desktop cloud infrastructure that performs virtual machine computing on the server and delivers it to clients using client-side desktop interactive tools. Specifically, virtual machines are managed and deployed on the server using virtualization technology, and the client displays the virtual machine screen using interactive tools. This approach is relatively costly for users, both from deployment to use. Furthermore, users may only need to use a browser to access the internet, while using VDI to publish a desktop (a complete virtual machine and operating system) for user internet access wastes resources.

[0004] Local sandboxing involves running the browser in a local sandbox. Since the browser still runs locally on the user's machine, despite the sandbox's isolation, attackers can still exploit the sandbox to attack the user's local machine, posing a security risk. A sandbox is a security mechanism that provides an isolated environment for executing programs. Sandboxes typically strictly control the resources accessible to programs within them, ensuring that any changes made within the sandbox do not harm the operating system. Sandbox escapes exploit vulnerabilities within the sandbox to access and modify local resources within the sandbox. These modifications can potentially impact the operating system.

[0005] RBI requires users to connect to a remote server and browse the internet using a remote browser rather than a local browser. This ensures client security, as data is stored only on the remote server and not locally. Compared to the previous two methods, this technology offers significant advantages: security and lightweight. However, the user's local browser typically connects directly to the server hosting the remote browser, establishing a direct, two-way network data channel. By compromising the remote browser and its server, attackers can launch attacks on the user's local computer, threatening the user.

[0006] In view of this, how to provide a browser security access system and method with higher security has become a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0007] The purpose of the embodiments of the present invention is to provide a browser security access system, method, device, electronic device and computer-readable storage medium, which can improve client security and ensure user Internet security during use.

[0008] To solve the above technical problems, an embodiment of the present invention provides a browser security access system, comprising a client, a server, and a network service program, wherein the client and the server are respectively located in a first network and a second network that are isolated from each other;

[0009] The client is configured to send a remote browser login request to the network service program, wherein the remote browser login request includes user information;

[0010] The network service program is used to generate a remote browser creation request based on the user information in the remote browser login request;

[0011] The server is configured to create a remote browser according to the remote browser creation request;

[0012] The client is used to establish a connection channel between the client and the remote browser of the server based on WebRTC technology, and the connection channel is used for data transmission between the client located on the first network and the remote browser located on the second network.

[0013] Optionally, establishing a connection channel between the client and the remote browser of the server based on the WebRTC technology includes:

[0014] The client and the server implement export address exchange and protocol negotiation through the network service program, so that the client and the server respectively obtain the export address of the other party; the export address represents the address on the NAT gateway where the client or the server is located;

[0015] The client and the server establish a connection channel between the client and the remote browser of the server according to the exit addresses of the other ends obtained by each of them.

[0016] Optionally, the client and the server implement the export address exchange through the network service program, including:

[0017] The client and the server access the STUN service in the network service program based on the real STUN address, and after the access is successful, the STUN service returns the exit address of the initiating access end, and then exchanges the exit address of the other end through the network service program.

[0018] Optionally, in the case where the client and the server fail to establish a connection channel between the client and the remote browser of the server according to the respective obtained exit addresses of the other end, the method further includes:

[0019] The client and the server establish a connection channel between the client and the remote browser of the server through the relay service in the network service program.

[0020] Optionally, before establishing a connection channel between the client and the remote browser of the server according to the WebRTC technology, the method further includes:

[0021] Detecting whether the client has enabled a security reinforcement policy;

[0022] If the security reinforcement policy is enabled, establishing a connection channel between the client and the remote browser of the server based on WebRTC technology specifically includes:

[0023] The client and the server access the STUN service based on the false STUN address, and in the event of access failure, establish a connection channel between the client and the remote browser of the server through the relay service in the network service program, so that the relay service performs malicious data detection on the received data information based on the security hardening policy.

[0024] Optionally, the client and the server are located in mutually isolated local area networks.

[0025] Optionally, the client is located in a local area network, and the server is located in a cloud platform in a wide area network.

[0026] Optionally, the network service program further includes a cloud control service;

[0027] The server is used to establish a connection with the cloud control service in advance according to the cloud control service address, create a container according to the remote browser creation request sent by the cloud control service, and create a remote browser in the container.

[0028] Optionally, the cloud control service is used to obtain the remote browser login request sent by the client, authenticate the user information in the remote browser login request, and send a remote browser creation request to the server after successful authentication.

[0029] The embodiment of the present invention further provides a browser security access method, which is applied to a client and includes:

[0030] Sending a remote browser login request to the network service program to create a remote browser on the server side;

[0031] A connection channel is established between a remote browser of the server and the client terminal based on WebRTC technology, wherein the connection channel is used for data transmission between a client terminal located on the first network and a remote browser located on the second network; the client terminal and the server terminal are respectively located in the first network and the second network, which are isolated from each other.

[0032] The embodiment of the present invention further provides a browser security access method, which is applied to a network service program, comprising:

[0033] Receive a remote browser login request sent by a client; the remote browser login request includes user information;

[0034] generating a remote browser creation request based on the user information;

[0035] The remote browser creation request is sent to the server, so that the server creates a remote browser according to the remote browser creation request; wherein the remote browser and the client are communicated with each other through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the client and the server are respectively located in the first network and the second network, which are isolated from each other.

[0036] The embodiment of the present invention further provides a browser security access device, which is applied to a client and includes:

[0037] A first sending module is used to send a remote browser login request to the network service program to realize the creation of a remote browser on the server side;

[0038] An establishment module is used to establish a connection channel between the remote browser of the server according to WebRTC technology, wherein the connection channel is used for data transmission between the client located on the first network and the remote browser located on the second network; the client and the server are respectively located in the first network and the second network, which are isolated from each other.

[0039] The embodiment of the present invention further provides a browser security access device, which is applied to a network service program and includes:

[0040] A receiving module, configured to receive a remote browser login request sent by a client; the remote browser login request includes user information;

[0041] A generating module, configured to generate a remote browser creation request based on the user information;

[0042] The second sending module is used to send the remote browser creation request to the server, so that the server creates a remote browser according to the remote browser creation request; wherein the remote browser and the client are communicated with each other through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the client and the server are respectively located in the first network and the second network that are isolated from each other.

[0043] An embodiment of the present invention further provides an electronic device, including:

[0044] memory for storing computer programs;

[0045] A processor is used to implement the steps of the browser security access method as described above when executing the computer program.

[0046] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the browser security access method described above are implemented.

[0047] An embodiment of the present invention further provides a computer program product comprising instructions. When the computer program product is executed by a computer, the instructions enable the computer to perform the steps of the browser security access method described above.

[0048] An embodiment of the present invention provides a browser security access system, method, device, electronic device and computer-readable storage medium, wherein the system includes a client, a server and a network service program, wherein the client and the server are respectively located in a first network and a second network isolated from each other; the client is used to send a remote browser login request to the network service program, and the remote browser login request includes user information; the network service program is used to generate a remote browser creation request based on the user information in the remote browser login request; the server is used to create a remote browser according to the remote browser creation request; the client is used to establish a connection channel between the client and the remote browser of the server according to WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network.

[0049] It can be seen that the client in the present invention is located in the first network, the server is located in the second network, and the first network and the second network are isolated from each other. When the client needs to communicate with the remote browser, the client sends a remote browser login request to the network service program. The network service program generates a remote browser creation request based on the user information in the remote browser login request and sends the remote browser creation request to the server. The server creates a remote browser according to the remote browser creation request. The client establishes a connection channel between the client and the remote browser according to the WebRTC technology to transmit data between the client and the remote browser through the connection channel. Since the client and server in the present invention are located in different networks and isolated from each other, it can effectively prevent further attacks on the client after the remote browser is compromised, thereby improving the security of the client and ensuring the user's Internet security. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the prior art and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 A schematic diagram of the structure of a browser security access system provided by an embodiment of the present invention;

[0052] Figure 2 A schematic diagram of the structure of another browser security access system provided by an embodiment of the present invention;

[0053] Figure 3 A schematic diagram of the structure of another browser security access system provided by an embodiment of the present invention;

[0054] Figure 4 A schematic diagram of the structure of another browser security access system provided by an embodiment of the present invention;

[0055] Figure 5 A schematic diagram of the structure of another browser security access system provided by an embodiment of the present invention;

[0056] Figure 6 A schematic diagram of a protocol negotiation process between a client and a server when establishing a connection channel provided by an embodiment of the present invention;

[0057] Figure 7 A flowchart of a browser security access method provided by an embodiment of the present invention;

[0058] Figure 8A flowchart of another browser security access method provided by an embodiment of the present invention;

[0059] Figure 9 A schematic structural diagram of a browser security access device provided by an embodiment of the present invention;

[0060] Figure 10 A schematic structural diagram of another browser security access device provided by an embodiment of the present invention;

[0061] Figure 11 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The embodiments of the present invention provide a browser security access system, method, device, electronic device and computer-readable storage medium, which can improve client security and ensure the user's Internet security during use.

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0064] Please refer to Figure 1 , Figure 1 This is a schematic diagram of the structure of a browser security access system provided by an embodiment of the present invention. The browser security access system includes a client 1, a server 2, and a network service program 3, wherein the client and server are located in a first network and a second network, respectively, which are isolated from each other.

[0065] Client 1 is used to send a remote browser login request to the network service program 3, where the remote browser login request includes user information;

[0066] Network service program 3, used for generating a remote browser creation request based on user information in the remote browser login request;

[0067] Server 2, used to create a remote browser according to the remote browser creation request;

[0068] Client 1 is used to establish a connection channel between client 1 and a remote browser of server 2 based on WebRTC (Web Real-Time Communication) technology. The connection channel is used for data transmission between client 1 located on a first network and a remote browser located on a second network.

[0069] It should be noted that the client 1 and server 2 in the implementation of the present invention are located in two different and isolated networks, so the client 1 and server 2 cannot be directly connected. When the client 1 needs to access the Internet, the client 1 will send a remote browser login request carrying user information to the network service program 3. After receiving the remote browser login request, the network service program 3 generates a remote browser creation request based on the user information in the remote browser login request, and sends the remote browser creation request to the server 2. The server 2 receives the remote browser creation request and establishes a corresponding remote browser on the server 2 according to the remote browser creation request. It can also feedback the creation completion information to the network service program 3, and the network service program 3 then feedbacks the creation completion information to the client 1. After the client 1 learns that the server 2 has established the remote browser, it establishes a connection channel between the client 1 and the remote browser according to the WebRTC technology, and realizes data transmission between the client 1 located in the first network and the remote browser located in the second network through the connection channel.

[0070] WebRTC is a real-time communication technology that allows web applications or websites to establish peer-to-peer connections between browsers without the need for an intermediary, enabling the transmission of video and / or audio streams, or any other arbitrary data. In practice, WebRTC can be integrated into the client (specifically, the client browser) kernel. This allows the client to establish a connection channel between client 1 and the remote browser using the WebRTC Application Program Interface (API) without installing any plugins.

[0071] In the traditional method, the client and the server are located in the same network, and the network between the client and the remote browser is directly interconnected, resulting in the client being directly attacked after the remote browser is compromised. However, in the embodiment of the present invention, the client 1 and the server 2 are located in two isolated networks and cannot be directly connected. When the user locally uses the remote browser to surf the Internet, even after the remote browser is compromised, the client 1 cannot be directly attacked, effectively avoiding remote network attacks, thereby improving the user's Internet security.

[0072] Specifically, the client 1 and the server 2 in the embodiment of the present invention are respectively located in mutually isolated local area networks, that is, the first network where the client 1 is located is the first local area network, and the network where the server 2 is located is the second local area network, and the first local area network and the second local area network are isolated from each other.

[0073] Of course, in actual applications, it is not limited to the case where client 1 and server 2 are located in mutually isolated local area networks. It can also be a cloud platform where client 1 is located in a local area network and server 2 is located in a wide area network. That is, the first network where client 1 is located is a local area network, and the second network where server 2 is located is a wide area network, so as to provide remote browser services through subscription and leasing. For example, users can lease and subscribe to a specified number of browser instance resources on the cloud service to keep their browsers running.

[0074] Furthermore, the network service program 3 in the embodiment of the present invention may also include a cloud control service 30;

[0075] The server 2 is used to establish a connection with the cloud control service 30 according to the cloud control service address in advance, create a container according to the remote browser creation request sent by the cloud control service, and create a remote browser in the container.

[0076] For details, please refer to Figure 2 The server 2 in the example can establish a connection with the cloud control service 30 in advance. Specifically, the cloud control service address of the cloud control service 3 can be obtained in advance, and then a connection between the server 2 and the cloud control service 30 is established based on the cloud control service address. After receiving the remote browser creation request sent by the cloud control service 30, a corresponding container is first created based on the user information in the remote browser creation request. The container can be initialized and then a corresponding remote browser is created in the container. The initialization of the container can specifically be to initialize functional modules such as the audio and video capture module and the module responsible for establishing the connection. The specific functional modules to be initialized can be determined according to actual needs, and the embodiment of the present invention does not make special limitations on this.

[0077] As can be understood, since containers are created based on the user information in the remote browser creation request, different containers correspond to different users. When multiple remote browsers need to be created, these containers can be used to isolate each remote browser from others, improving browser security. Furthermore, containers are easy to start and manage. After a remote browser is used, the container containing the remote browser can be destroyed to destroy all data generated during its use. Even malicious data will be destroyed, thus ensuring the security of the network environment.

[0078] It should be noted that the network service program 3 in the embodiment of the present invention can be deployed on a private cloud or a public cloud, and supports containerized operation (such as Docker containerization). Specifically, in actual applications, a container management component can be pre-deployed in the server 2, which can be a Docker container management component. The container management component manages the life cycle of the container operation of the remote browser corresponding to each user, and the cloud control service address is pre-stored on the container management component. After the container management component starts working, it can establish a connection with the cloud control service 30 through the cloud control service address, and create a container (such as a Docker container) after receiving the remote browser creation request sent by the cloud control service 30, and create a remote browser in the container after initializing the container.

[0079] Furthermore, the cloud control service 30 is used to obtain the remote browser login request sent by the client 1, authenticate the user information in the remote browser login request, and send a remote browser creation request to the server 2 after successful authentication. Specifically, the user can obtain the cloud control service address in advance and enter the cloud control service address through the client 1 (specifically, the client browser) when needed. By accessing the cloud control service address, the user requests to the login page. The user enters the user information (such as the user name and password) on the login page and clicks "Login". The remote browser login request carrying the user information is sent to the cloud control service 30 in the network service program 3. After receiving the remote browser login request, the cloud control service 30 authenticates the user information in the remote browser login request. After successful authentication, it generates a remote browser creation request based on the user information and sends the remote browser creation request to the server 2, specifically to the container management component of the server 2, so that the container management component first creates a corresponding container according to the remote browser creation request and creates a corresponding remote browser in the container. In addition, after the container management component of server 2 successfully creates the remote browser, it will send a creation success notification to the cloud control service 30, and the cloud control service 30 will return the creation success notification to client 1, so that client 1 can establish a connection channel between the client and the remote browser of the server according to WebRTC technology after knowing that server 2 has created the remote browser.

[0080] It should also be noted that NAT (Network Address Translation) technology is commonly used in private networks with multiple hosts but accessing the Internet through only one public IP address. It is a convenient and widely used technology that has become popular in order to solve the shortage of IPv4 addresses and avoid the difficulty of reserving IP addresses. Therefore, in actual applications, a NAT (Network Address Translation) gateway can be set between client 1 and server 2 to isolate the networks of client 1 and server 2 from each other, and to allow the established connection channel between client 1 and server 2 to pass through the NAT gateway. It is possible to set up a NAT gateway only on the client 1 side (such as Figure 3 As shown), you can also set up a NAT gateway on the client 1 side and the server 2 side (as shown Figure 4 When client 1 and the remote browser in server 2 transmit data through the established connection channel, the NAT device converts the IP address carried in the data packet into the exit address of the application, and then sends the data packet carrying the corresponding exit address to the other end, thereby improving the security of data communication.

[0081] Specifically, the client 1 can access the network service program 3 through the API interface provided by WebRTC to further establish a connection channel between the client 1 and the remote browser.

[0082] Furthermore, the process of establishing a connection channel between the client 1 and the remote browser of the server according to the WebRTC technology may specifically include:

[0083] Client 1 and server 2 exchange egress addresses and negotiate protocols through network service program 3, so that client 1 and server 2 can obtain each other's egress addresses. The egress address represents the address on the NAT gateway where client 1 or server 2 is located.

[0084] The client 1 and the server 2 establish a connection channel between the remote browsers of the client 1 and the server 2 according to the exit addresses of the other ends obtained by each.

[0085] Specifically, in the process of client 1 and server 2 implementing export address exchange through network service program 3, the address of the NAT gateway where client 1 or server 2 is located can be obtained through network service program 3, that is, client 1 can obtain the address of the NAT gateway where server 2 is located through network service program 3, and server 2 can obtain the address of the NAT gateway where client 1 is located through network service program 3, wherein the NAT gateway where server 2 is located and the NAT gateway where client 1 is located can be the same NAT gateway or different NAT gateways.

[0086] like Figure 5 As shown, in actual applications, the network service program 3 includes not only the cloud control service 30, but also the STUN (Simple Traversal of UDP over NATs, NAT UDP simple traversal) service 31 and the TURN (Traversal Using Relay NAT, using relay traversal) service 32. Figure 6 As shown in the process of establishing a connection channel between client 1 and the remote browser of server 2 according to WebRTC technology, client 1 sends client information to network service program 3, network service program 3 forwards the client information to the server browser (i.e., remote browser) in server 2, and the server browser records the client information for protocol negotiation. Server 2 sends the server browser information to network service program 3, and network service program 3 forwards the server browser information to client 1. Client 1 records the server browser information for protocol negotiation. Client 1 accesses the STUN service in network service program 3 to obtain the client exit address. The STUN service obtains the client's exit address and returns it to Client 1. The server browser accesses the STUN service to obtain the browser's exit address. The STUN service obtains the browser's exit address and returns it to Server 2. Client 1 sends the obtained client's exit address (exit IP and port) to Network Service 3. Network Service 3 forwards the client's exit address to the server browser. The server browser records the client's exit address. The server browser sends the browser's exit address to Network Service 3. Network Service 3 forwards the browser's exit address to Client 1. Client 1 records the browser's address, thus achieving the exchange of exit addresses. Client 1 attempts to establish a point-to-point connection. If the point-to-point connection fails, a connection is established through the relay service.

[0087] The following is a detailed description of the process of protocol negotiation and establishing a connection channel. In particular, the protocol negotiation between client 1 and server 2 is implemented through network service program 3. The details are as follows:

[0088] During the protocol negotiation process, the cloud control service 30 acts as a signaling server. The client 1 creates information through the API interface provided by WebRTC and sends it to the signaling server. The signaling server establishes a connection with the server 2. For example, the signaling server establishes a connection with the remote browser control module in the server 2. The client 1 creates an offer invitation through the API. The offer carries SDP (Session Description Protocol) object information. After the client 1 saves the SDP object information, it sends the offer information carrying the SDP object information to the signaling server. The signaling server sends the offer information to the remote browser control module of the server 2. After receiving the offer information, the remote browser control module saves the SDP object information in the offer information and creates a response answer information. The answer information contains the corresponding SDP object information, and then sends the answer information containing the SDP object information to the signaling server. The signaling server sends the received answer information to the client 1. The client 1 receives After receiving the answer message, the SDP object information in the answer message is saved, and then the process of establishing a connection between the two parties begins. The client 1 will obtain the IP address that the remote browser in the server 2 can connect to (that is, the address on the NAT gateway where the server 2 is located) through the network service program 3 (specifically the STUN service in the network service program 3). The remote browser control module in the server 2 will also obtain the IP address that the client 1 can connect to (that is, the address on the NAT gateway where the client 1 is located) through the STUN service. Then, the remote browsers of the client 1 and the server 2 establish a connection channel between the remote browsers of the client 1 and the server 2 based on the IP addresses of the other parties they have obtained.

[0089] The remote browser control module in the embodiment of the present invention may also run in a Docker container corresponding to the remote browser, and the remote browser-related components in the server 2 may also be directly deployed on a private cloud or a public cloud.

[0090] It is understandable that after establishing a connection channel between the client 1 and the remote browser, communication can begin. Specifically, the client 1 sends the network data packet carrying the browser's preset instructions captured by the client browser to the remote browser of the server 2 through the established connection channel, so that the remote browser processes and executes the instruction information in the network data packet carrying the browser's preset instructions. The server 2 sends the remote browser data packet (such as audio and video information, etc.) captured by the remote browser to the client 1 through the connection channel, so that the client browser can display and play the audio and video information in the remote browser data packet. Among them, the encoding protocol used by the remote browser matches the decoding protocol used by the client browser, which can be specifically implemented based on WebRTC technology.

[0091] Furthermore, the process of implementing the export address exchange between the remote browsers of the client 1 and the server 2 through the network service program 3 may specifically include:

[0092] The remote browsers of client 1 and server 2 access the STUN service in network service program 3 based on the real STUN address. After the access is successful, the STUN service returns the exit address of the initiating end, and then exchanges the exit address of the other end through network service program 3.

[0093] It should be noted that, in actual applications, when client 1 and the remote browser of server 2 implement exit address exchange through network service program 3, client 1 will obtain the real STUN address provided by network service program 3, and client 1 accesses the STUN service in network service program 3 based on the real STUN address. After the access is successful, the STUN service will obtain the exit address of client 1 and return the exit address of client 1 to client 1; the remote browser of server 2 will also obtain the real STUN address provided by network service program 3, and the remote browser of server 2 accesses the STUN service in network service program 3 based on the real STUN address. After the access is successful, the STUN service will obtain the exit address of the remote browser of server 2 and return the exit address of the remote browser of server 2 to the remote browser of server 2. Client 1 and the remote browser of server 2 then exchange exit addresses through network service program 3.

[0094] Specifically, after the exit address exchange is completed, the remote browsers of client 1 and server 2 first establish a connection channel based on the communication protocol in the process of establishing a connection channel between the remote browsers of client 1 and server 2 according to the exit addresses of the other end obtained by each. Among them, since the UDP (User Datagram Protocol) protocol has a fast transmission speed, the connection channel can be established based on the UDP protocol first. If the connection channel based on the UDP protocol fails to be established, the connection channel between the client browser and the remote browser is established based on the TCP (Transmission Control Protocol) protocol through the network address translation device.

[0095] Furthermore, in the case that the remote browsers of the client 1 and the server 2 fail to establish a connection channel between the client 1 and the remote browser of the server 2 according to the respective obtained exit addresses of the other end, the method may further include:

[0096] The client 1 and the remote browser of the server 2 establish a connection channel between the client 1 and the remote browser of the server 2 through the relay service in the network service program 3.

[0097] It should be noted that, in the embodiment of the present invention, when the connection channel between the client 1 and the remote browser of the server 2 fails to be established based on the communication protocol, a connection channel between the client 1 and the remote browser is established through the relay service.

[0098] Specifically, the relay service may be a TURN service 32. The TURN service 32 is a NAT relay traversal method, that is, the TURN service acts as a relay to help transfer data transmitted by the remote browsers of the client 1 and the server 2 during the transmission process.

[0099] Furthermore, before establishing a connection channel between the client 1 and the remote browser of the server 2 according to the WebRTC technology, the following steps may also be included:

[0100] Check whether client 1 has enabled the security hardening policy;

[0101] If the security hardening policy is enabled, a connection channel is established between client 1 and the remote browser of server 2 using WebRTC technology, including:

[0102] The remote browsers of client 1 and server 2 access the STUN service based on the fake STUN address. If the access fails, a connection channel is established between the remote browsers of client 1 and server 2 through the relay service in the network service program 3, so that the relay service can detect malicious data on the received data information based on the security hardening strategy.

[0103] It is understandable that in order to further improve security in actual applications, security reinforcement policies can be pre-set, and administrators can pre-establish a correspondence between users and the conditions for enabling security reinforcement policies based on the actual needs of users, for example, user 1 enables the security reinforcement policy, user 2 does not enable the security reinforcement policy, etc. Specifically, after the cloud control service 30 in the network service program 3 receives the notification of successful creation of the remote browser fed back by the server 2, the notification of successful creation is fed back to the client 1. The client 1 determines whether the security reinforcement policy needs to be enabled based on the user information input by the user and the pre-established correspondence between the user and the conditions for enabling the security reinforcement policy, and enables the security reinforcement policy if it is determined that the security reinforcement policy is enabled. The corresponding cloud control service 30 will also further confirm whether the client 1 has enabled the security reinforcement policy based on the user information in the remote browser login request. If it is determined that the client has enabled the security reinforcement policy, the client 1 will enable the security reinforcement policy based on the user information in the remote browser login request. When establishing a connection channel between the client 1 and the remote browser of the server 2 using WebRTC technology, a false STUN address is used for the client 1 and the server 2 so that the remote browsers of the client 1 and the server 2 cannot successfully access the STUN service. At this time, a connection channel is established between the client 1 and the remote browser of the server 2 through the relay service (i.e., TURN service 32) in the network service program 3, so that the relay service can perform malicious data detection on the received data information based on the security reinforcement strategy. Specifically, it can detect whether the data information carries malicious instructions and / or malicious information, etc., and then send the data with a detection result that is safe to the other end. It can be seen that in the embodiment of the present invention, when the client 1 turns on the security reinforcement strategy, network protection and security detection can be performed through the relay service (i.e., TURN service 32) to further improve Internet security.

[0104] It should also be noted that the embodiment of the present invention extends a service form of cloud services. Compared with the architecture in which the traditional client and server are set in the same network, the traditional architecture does not have the ability to be deployed in the cloud. In this application, the client and network service program are set behind the NAT gateway, which conforms to the form of the existing cloud deployment architecture and therefore has the ability to be deployed in the cloud. That is, the network service program can be deployed in the cloud, and after being deployed in the cloud, the network service program can also be used to manage the length of time the user uses the browser, so as to meet the user's use needs of not wanting to close the browser for a long time. Correspondingly, the user can rent or subscribe to a specified number of browser instance resources from the cloud service provider so that the browser can always keep running. Since the cloud browser service provider centrally operates the browser service, it can continuously optimize so that the energy consumption of a single browser instance is far lower than that created by the user on his own physical computer, and can continuously optimize so that the response speed of its remote browser is better than the local browser maintained by the user himself. The network bandwidth that can be provided to the remote browser is far greater than the bandwidth of the user's own public network connection, which satisfies the user's desire to flexibly and flexibly choose the type and number of browsers for Internet access.

[0105] From the above, it can be seen that the client in the present invention is located in the first network, the server is located in the second network, and the first network and the second network are isolated from each other. When the client needs to communicate with the remote browser, the client sends a remote browser login request to the network service program. The network service program generates a remote browser creation request based on the user information in the remote browser login request and sends the remote browser creation request to the server. The server creates a remote browser according to the remote browser creation request. The client establishes a connection channel between the client and the remote browser based on WebRTC technology to transmit data between the client and the remote browser through the connection channel. Since the client and server in the present invention are located in different networks and isolated from each other, it can effectively prevent further attacks on the client after the remote browser is compromised, thereby improving the security of the client and ensuring the user's Internet security.

[0106] Based on the above embodiment, the embodiment of the present invention also provides a browser security access method, which is applied to the client. Figure 7 , the method comprising:

[0107] S110: Sending a remote browser login request to the network service program to create a remote browser on the server side;

[0108] S120: Establishing a connection channel with a remote browser on the server side according to WebRTC technology, where the connection channel is used for data transmission between a client located on the first network and a remote browser located on the second network; the client side and the server side are respectively located on the first network and the second network, which are isolated from each other.

[0109] It should be noted that the method provided in the embodiment of the present invention is applied to a client. When the client needs to access the Internet, the client can send a remote browser login request to the network service program. Specifically, the remote browser login request can be generated based on user information input by the user. The network service program generates a remote browser creation request based on the user information in the remote browser login request and sends the remote browser creation request to the server. The server establishes a corresponding remote browser on the server side according to the remote browser creation request, and after the creation is successful, the network service program feedbacks the creation success information to the client. After the client learns that the server has established the remote browser, it establishes a connection channel between the client and the remote browser based on WebRTC technology. Data transmission between the client located on the first network and the remote browser located on the second network is achieved through the connection channel. In the embodiment of the present invention, the client and the server are located in two isolated networks and cannot be directly connected. When the user locally uses the remote browser to access the Internet, even if the remote browser is compromised, the client cannot directly attack the client 1, effectively avoiding remote network attacks, thereby improving the user's Internet security.

[0110] Specifically, the browser security access method provided in the embodiment of the present invention has the same beneficial effects as the above embodiment. For a detailed introduction to the browser security access method involved in the embodiment of the present invention, please refer to the above system embodiment, and the present invention will not go into details here.

[0111] On the basis of the above embodiment, the embodiment of the present invention also provides a browser security access method, which is applied to network service program, please refer to Figure 8 , the method comprising:

[0112] S210: Receive a remote browser login request sent by the client; the remote browser login request includes user information;

[0113] S220: Generate a remote browser creation request based on the user information;

[0114] S230: Sending a remote browser creation request to the server, so that the server creates a remote browser according to the remote browser creation request; wherein the remote browser and the client are connected to each other through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the client and the server are respectively located in the first network and the second network that are isolated from each other.

[0115] It should be noted that the method provided in the embodiment of the present invention is applied to a network service program and has the same beneficial effects as the above embodiment. For a detailed introduction to the browser security access method involved in the embodiment of the present invention, please refer to the above system embodiment, and the present invention will not go into details here.

[0116] On the basis of the above embodiment, the embodiment of the present invention further provides a browser security access device, which is applied to the client. Figure 9 , the device comprises:

[0117] The first sending module 11 is used to send a remote browser login request to the network service program to realize the creation of a remote browser on the server side;

[0118] Establishing module 12, for establishing a connection channel between a remote browser of a server according to WebRTC technology, wherein the connection channel is used for data transmission between a client located in a first network and a remote browser located in a second network; the client and the server are respectively located in the first network and the second network, which are isolated from each other.

[0119] It should be noted that the device provided in the embodiment of the present invention is applied to a client and has the same beneficial effects as the above embodiment.

[0120] On the basis of the above embodiment, the embodiment of the present invention further provides a browser security access device, which is applied to network service program, please refer to Figure 10 , the device comprises:

[0121] Receiving module 21, used to receive a remote browser login request sent by a client; the remote browser login request includes user information;

[0122] A generating module 22, configured to generate a remote browser creation request based on user information;

[0123] The second sending module 23 is used to send a remote browser creation request to the network service program so that the server can create a remote browser according to the remote browser creation request; wherein, the remote browser and the client are connected to each other through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the client and the server are respectively located in the first network and the second network that are isolated from each other.

[0124] It should be noted that the second sending module 23 in the embodiment of the present invention is also used as a medium for exchanging data required by the client and the remote browser of the server during the process of establishing a connection channel. The device provided in the embodiment of the present invention is applied to the server and has the same beneficial effects as the above embodiment.

[0125] Based on the above embodiment, the present invention further provides an electronic device. Figure 11 , the electronic device comprises:

[0126] Memory 30, for storing computer programs;

[0127] The processor 31 is configured to implement the steps of the above-mentioned browser security access method when executing a computer program.

[0128] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0129] Among them, the processor 31 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 31 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 31 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 31 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 31 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0130] The memory 30 may include one or more computer-readable storage media, which may be non-transitory. The memory 30 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 30 is at least used to store the following computer program 301, wherein, after the computer program is loaded and executed by the processor 31, it can implement the relevant steps of the browser security access method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 30 may also include an operating system 302 and data 303, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 302 may include Windows, Unix, Linux, etc. The data 303 may include but is not limited to a set offset, etc.

[0131] In some embodiments, the electronic device may further include a display screen 32 , an input / output interface 33 , a communication interface 34 , a power supply 35 , and a communication bus 36 .

[0132] Those skilled in the art will understand that Figure 11 The structure shown in the figure does not constitute a limitation of the electronic device, and may include more or fewer components than shown in the figure.

[0133] It is understandable that if the browser security access method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and executes all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk or optical disk, etc. Various media that can store program code.

[0134] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned browser security access method are implemented.

[0135] In addition, based on the above embodiment, an embodiment of the present invention further provides a computer program product, which includes instructions. When the computer program product is executed by a computer, the instructions enable the computer to perform the steps of the browser security access method described above.

[0136] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0137] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0138] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0139] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0140] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A browser security access system, characterized in that: It includes a client, a server and a network service program, wherein the client and the server are respectively located in a first network and a second network isolated from each other; The client is configured to send a remote browser login request to the network service program, wherein the remote browser login request includes user information; The network service program is used to generate a remote browser creation request based on the user information in the remote browser login request; The server is configured to create a remote browser according to the remote browser creation request; The client is used to establish a connection channel between the client and the remote browser of the server based on WebRTC technology, and the connection channel is used for data transmission between the client located on the first network and the remote browser located on the second network; wherein: The network service program includes cloud control services; The server is used to establish a connection with the cloud control service in advance according to the cloud control service address, create a container according to the remote browser creation request sent by the cloud control service, and create a remote browser in the container after initializing the container.

2. The browser security access system according to claim 1, characterized in that: The step of establishing a connection channel between the client and the remote browser of the server based on the WebRTC technology includes: The client and the server implement export address exchange and protocol negotiation through the network service program, so that the client and the server respectively obtain the export address of the other party; the export address represents the address on the NAT gateway where the client or the server is located; The client and the server establish a connection channel between the client and the remote browser of the server according to the exit addresses of the other ends obtained by each of them.

3. The browser security access system according to claim 2, characterized in that: The client and the server implement the export address exchange through the network service program, including: The client and the server access the STUN service in the network service program based on the real STUN address, and after the access is successful, the STUN service returns the exit address of the initiating access end, and then exchanges the exit address of the other end through the network service program.

4. The browser security access system according to claim 3, characterized in that: In the case that the client and the server fail to establish a connection channel between the client and the remote browser of the server according to the exit address of the other end obtained by each of them, the method further includes: The client and the server establish a connection channel between the client and the remote browser of the server through the relay service in the network service program.

5. The browser security access system according to claim 2, characterized in that: Before establishing a connection channel between the client and the remote browser of the server according to the WebRTC technology, the method further includes: Detecting whether the client has enabled a security reinforcement policy; If the security reinforcement policy is enabled, establishing a connection channel between the client and the remote browser of the server based on WebRTC technology specifically includes: The client and the server access the STUN service based on the false STUN address, and in the event of access failure, establish a connection channel between the client and the remote browser of the server through the relay service in the network service program, so that the relay service performs malicious data detection on the received data information based on the security hardening policy.

6. The browser security access system according to claim 1, characterized in that: The client and the server are located in mutually isolated local area networks.

7. The browser security access system according to claim 1, characterized in that: The client is located in a local area network, and the server is located in a cloud platform in a wide area network.

8. The browser security access system according to claim 1, wherein: The cloud control service is used to obtain the remote browser login request sent by the client, authenticate the user information in the remote browser login request, and send a remote browser creation request to the server after successful authentication.

9. A browser security access method, characterized in that: Applied to the client, including: Sending a remote browser login request to the network service program, wherein the remote browser login request is used to generate a remote browser creation request of the network service program, and the remote browser creation request is used to create a remote browser on the server side; A connection channel is established between a remote browser of the server according to WebRTC technology, wherein the connection channel is used for data transmission between a client located on a first network and a remote browser located on a second network; the client and the server are respectively located on the first network and the second network, which are isolated from each other.

10. A browser security access method, characterized in that: Applicable to network service programs, including: Receive a remote browser login request sent by a client; the remote browser login request includes user information; generating a remote browser creation request based on the user information; The remote browser creation request is sent to the server through the cloud control service, so that the server creates a container according to the remote browser creation request and creates a remote browser in the container after initializing the container; wherein the remote browser and the client are communicated through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located on the first network and the remote browser located on the second network; the client and the server are respectively located in the first network and the second network, which are isolated from each other.

11. A browser security access device, characterized in that: Applied to the client, including: A first sending module is used to send a remote browser login request to the network service program, wherein the remote browser login request is used to generate a remote browser creation request of the network service program, and the remote browser creation request is used to create a remote browser on the server side; An establishment module is used to establish a connection channel between a remote browser of the server according to WebRTC technology, wherein the connection channel is used for data transmission between a client located on a first network and a remote browser located on a second network; the client and the server are respectively located on the first network and the second network, which are isolated from each other.

12. A browser security access device, characterized in that: Applicable to network service programs, including: A receiving module, configured to receive a remote browser login request sent by a client; the remote browser login request includes user information; A generating module, configured to generate a remote browser creation request based on the user information; The second sending module is used to send the remote browser creation request to the server through the cloud control service, so that the server creates a container according to the remote browser creation request and creates a remote browser in the container after initializing the container; wherein the remote browser and the client are communicated through a connection channel established by WebRTC technology, and the connection channel is used for data transmission between the client located in the first network and the remote browser located in the second network; the client and the server are respectively located in the first network and the second network, which are isolated from each other.

13. An electronic device, characterized in that: include: memory for storing computer programs; A processor is configured to implement the steps of the browser security access method as claimed in claim 9 or 10 when executing the computer program.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the browser security access method according to claim 9 or 10.

Images