A method and apparatus for controlling access to a page

Abstract

The application provides a page access permission control method and device. The control method comprises the following steps: after successful login verification of a client, according to the verified login verification information and the page addresses of a plurality of subdirectories and the encrypted addresses of each page address in the same root directory of the login page in a search mapping table, the encrypted addresses are generated based on the page addresses, the login verification information of the client; the encrypted addresses searched are returned to the client, so that the stored page addresses of the plurality of subdirectories are replaced by the encrypted addresses; when receiving a page access request from the client, the page address corresponding to the encrypted address carried in the page access request is searched, and the page data of the page address is returned to the client. The page address is encrypted by the above method, so that the encrypted page content can only be accessed through the encrypted address. Since the probability of obtaining the access entrance by illegal persons is reduced, the security is improved.

Description

Technical Field

[0001] This application relates to the field of access control, and more particularly to a method and device for controlling page access permissions. Background Technology

[0002] With the development of the Internet, all kinds of network devices have adopted the Web for configuration and management. Configuring network devices through the Web is convenient and fast, but due to the low security of accessing network security device page addresses, criminals can easily intercept page addresses to carry out network intrusion and steal data. Summary of the Invention

[0003] In view of this, this application provides a method and device for controlling page access permissions.

[0004] Specifically, this application is implemented through the following technical solution:

[0005] A first aspect of this application provides a method for controlling page access permissions, the method comprising:

[0006] After successful client login verification, the page addresses of several subdirectories under the same root directory as the login page and the encrypted address of each page address are found in the mapping table based on the verified login verification information. The encrypted address is generated based on the page address and the client's login verification information.

[0007] The found encrypted address is returned to the client so that the client can replace the page addresses of several stored subdirectories with the encrypted address;

[0008] When a page access request is received from a client, the system looks up the page address that corresponds to the encrypted address carried in the page access request and returns the page data of that page address to the client.

[0009] A second aspect of this application provides a page access permission control device, the control device comprising:

[0010] The lookup module is used to, after successful client login verification, look up the page addresses of several subdirectories under the same root directory as the login page in the lookup mapping table and the encrypted address of each page address, based on the verified login verification information and the page address in the lookup mapping table. The encrypted address is generated based on the page address and the client's login verification information.

[0011] The replacement module is used to return the found encrypted address to the client, so that the client can replace the page addresses of the stored subdirectories with the encrypted address;

[0012] The response module is used to, when receiving a page access request from the client, find the page address corresponding to the encrypted address carried in the page access request, and return the page data of the page address to the client.

[0013] According to the above scheme, this application has at least the following beneficial effects:

[0014] In this application, the page address that the administrator needs to access for configuration management has been replaced with an encrypted address, making it difficult for intruders to know the real page address. This reduces the probability of data theft and improves security. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating a page access permission control method according to an exemplary embodiment of this application.

[0016] Figure 2 This is a network topology diagram illustrating a client-web device connection in an exemplary embodiment of this application.

[0017] Figure 3 This is a block diagram illustrating a page access permission control device according to an exemplary embodiment of this application.

[0018] Figure 4 This is a block diagram illustrating a web device for implementing a control device, as shown in an exemplary embodiment of this application. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0020] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0021] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0022] When managing network devices, one of the following methods is typically used: Console, Telnet, or Web. Web management allows for graphical interface configuration instead of command-line configuration. Compared to Telnet and Console, Web management is more accessible to non-professionals unfamiliar with command lines. Therefore, Web management backends are widely used in devices such as switches, routers, intrusion detection / prevention systems, firewalls, and cameras.

[0023] Network equipment manufacturers typically provide a management page address, such as the default management page address for routers, which is often 192.168.1.1. Since the skill levels of users of various network devices differ, using the default management page address makes it vulnerable to leakage by users of similar devices. Even if the default management page address is changed to another address, such as 192.168.10.1, the fixed access address still makes it easy for malicious actors to intercept it.

[0024] In this regard, refer to Figure 1 This application provides a method for controlling page access permissions, which may include:

[0025] S101. After successful login verification on the client, the page addresses of several subdirectories under the same root directory as the login page and the encrypted address of each page address are found in the mapping table based on the verified login verification information. The encrypted address is generated based on the page address and the client's login verification information.

[0026] S102. Return the found encrypted address to the client so that the client can replace the page addresses of the stored subdirectories with the encrypted address;

[0027] S103. When a page access request is received from a client, the page address corresponding to the encrypted address carried in the page access request is found, and the page data of the page address is returned to the client.

[0028] In the above scheme, the client's login verification information may include, but is not limited to, one or more of the information that can be obtained from the access request, such as machine-related information or user-related information. For example, in one embodiment, the client's login verification information may include the client's IP address.

[0029] With the above solution, when the logged-in interface is required, an encrypted address must be provided to access the logged-in interface, such as the homepage, configuration page 1, configuration page 2, etc. Since the encrypted address is generated by encrypting the original page address and the client's login verification information, even if the original page address is obtained by criminals, it is difficult to obtain the page data because the encryption method and the random data in the encryption process cannot be known. Applying this application significantly reduces the probability of page data being obtained and improves security.

[0030] In devices that use web management, page addresses usually have a certain hierarchy. For example, " / " can represent the root directory, and " / page" can represent other page addresses under the root directory. In the above scheme, the page addresses involved in login have been encrypted, but the root directory has not been protected.

[0031] Although the root directory does not contain any resources, since there is a certain connection between the root directory and various page addresses, malicious actors may attack the root directory to discover other unknown security vulnerabilities. Therefore, in this application, the mapping table may also include the root directory address, the login page address, and the encrypted address of the login page address, with the root directory address being a string.

[0032] The above method replaces the original root directory address with a string and stores it in a mapping table to prevent access to the original root directory. To access the root directory, the string must be entered.

[0033] Furthermore, to prevent the string that allows access to the root directory from being leaked, and to enable administrators to legitimately enter the root directory, the root directory address (i.e., the string) is sent to the administrator via email or SMS, so that the administrator can log in to the root directory address on the client.

[0034] It is understandable that the string can be randomly generated or set by the administrator when configuring the web backend. The string can consist of one or more of uppercase and lowercase English letters, numbers, punctuation marks, etc. The specific generation method and format can be set according to actual needs. Since it does not affect the implementation of the solution in this application, it should all fall within the protection scope of this application.

[0035] The encryption algorithm can be one of the following: symmetric encryption, asymmetric encryption, or hash algorithm.

[0036] In one exemplary embodiment, the encrypted address can be generated by a hash algorithm based at least on the page address, the client's IP address, and the login username. That is, the login verification information mentioned above may include the client's IP address and the login username.

[0037] For ease of understanding, please refer to Table 1 below, which is an example mapping table:

[0038]

[0039] In the above embodiment, the encrypted address is obtained by calculating the page address, IP address, username, etc. through a hash algorithm. In actual applications, more or less data can be selected for encryption calculation. This mapping table is only an example, and the actual mapping table may not store contents such as "name" and "mapping method".

[0040] Because hash algorithms are irreversible, have higher security, and require less storage space after hash calculation, they have greater advantages for use in this application.

[0041] Based on the scheme that includes a control method for the login page, since accessing the login page does not involve data such as usernames, the encrypted address of the login page can be generated at least based on the login page address and the client's IP address.

[0042] Accordingly, since the access request will not carry the username when accessing the page address before login and before logging in, the control method may also include:

[0043] Upon receiving a login request from a client, if the address carried in the login request matches the string in the mapping table, or matches the encrypted address corresponding to the login page address, return the encrypted address corresponding to the login page address and the page data of the login page address to the client for login verification.

[0044] Therefore, in one embodiment, when encrypting the address of a page that does not require login, such as a login page, the username may not be included, but information related to the client that initiated the access may be included, such as the client's IP address.

[0045] In one embodiment, the mapping table includes the root directory, login page, and other page addresses. An exemplary mapping table is shown in Table 2.

[0046]

[0047] It is understandable that the strings corresponding to the root directories in the examples in Table 2 are not encrypted addresses. The strings corresponding to the root directory address " / " are randomly generated or preset by the administrator. They may not use an encryption algorithm or may use a different encryption algorithm than other page addresses. However, since the strings have the same function as encrypted addresses, they can be stored in the mapping table as encrypted addresses.

[0048] In this application, the string corresponding to the root directory address can be set or generated when the administrator first configures the web device. After that, any device or user needs to use this string to access the root directory. Since only the administrator can obtain the string corresponding to the root directory address, the security of the root directory address is guaranteed.

[0049] Based on the above scheme, it is easy to understand that there can be multiple mapping tables. Except for the root directory address, which is a specific string, the other page addresses are different in different mapping tables. For example, in one embodiment, except for the root directory address, the fields used to generate the encrypted address in the other page addresses all contain the IP address of the client that initiated the access request. Therefore, the mapping table can be regarded as a mapping table generated for that IP address.

[0050] The mapping table can be generated when a client first logs into the root directory using a string. If the IP address is not found in the access request and a mapping table corresponding to that IP address is not found, a mapping table can be generated and saved according to the above scheme. This allows for subsequent access to any page using the string or encrypted address to query the mapping table to determine whether access is allowed. Therefore, the string can be generated or set before any mapping table is generated, and then stored in any subsequently generated mapping table.

[0051] Based on the above scheme, access opportunities can be set to reduce unnecessary access. Specifically, the control method may also include: updating several encrypted addresses stored in the mapping table based on several preset access counts or several preset access times, wherein the encrypted address is the encrypted address of the page address or the encrypted address of the login page address; the preset access counts represent the number of times the corresponding encrypted address is allowed to be accessed; and the preset access times represent the time during which the corresponding encrypted address is allowed to be accessed.

[0052] Because each page address has a different probability of being used, some page addresses, such as the login page and the homepage, will be accessed frequently, while some page addresses, such as the configuration page for a rarely used function, will not be accessed. Therefore, each page address (or root directory address) corresponds to a different preset number of accesses or a preset access time. One page address (or root directory address) corresponds to one preset number of accesses, one page address (or root directory address) corresponds to one preset access time, or one page address (or root directory address) corresponds to one preset access time and one preset number of accesses.

[0053] Based on this, if a page address (or root directory address) corresponds to a preset number of accesses, the preset number of accesses can be set according to the priority of the page address (or root directory address) being accessed by the client.

[0054] Similarly, if a page address (or root directory address) corresponds to a preset access time, this preset access time can be set according to the priority of the page address (or root directory address) being accessed by the client.

[0055] The priority of client access can be understood as the importance of the page content and the frequency of access to the page content. If the access frequency is high and the importance is high, the priority is high. Correspondingly, fewer preset access times and shorter (or closer to the set time) preset access times can be set. Pages such as root directory addresses, which have low access frequency but are easy to attack, can also be set to have high priority. The specific priority depends on the actual application.

[0056] The preset access time can be a time period, such as 24 hours. In this case, the mapping table corresponding to the page content will be updated after 24 hours to make the original encrypted address inaccessible. The preset access time can also be a specific time node after the set time. For example, if the preset access time is set from 9:00 on January 1, 2030 to 18:00 on January 2, 2030, the mapping table will be updated when that time node is reached.

[0057] After updating the mapping table, the same preset number of visits and preset access time can be automatically generated to achieve effects such as updating every time, every hour, every day, and every week. For example, if the mapping table is updated after a preset access time of one hour is reached, and a preset access time of one hour is generated at the same time, then the update and generation will be repeated after one hour to achieve the effect of updating every hour.

[0058] For different types of pages, the steps to update the mapping table include:

[0059] When the preset access count threshold is reached, or when the preset access time is reached, the encrypted address is updated to a new encrypted address.

[0060] It is understandable that both the preset number of accesses and the preset access time can restrict access, but the preset number of accesses and the preset access time will not affect each other. Therefore, the encrypted address or string in the mapping table can be updated according to the preset conditions that are met in advance, and the mapping table will be updated again when another preset condition is met.

[0061] Since the update of the encrypted address and the update of the string can be performed simultaneously or separately, one can be updated or both can be updated. The order of updates depends on the actual situation. The order given in this application is only an example and is not intended to limit the execution order of the steps in this application.

[0062] To further ensure security and prevent malicious actors from attempting to obtain encrypted addresses in the mapping table through frequent scanning requests, a preset number of requests can be set for the mapping table. Therefore, the control method can also include updating the mapping table when the number of access requests sent by the receiving client reaches the preset number of requests, or when the number of queries in the mapping table reaches the preset number of requests; the preset number of requests corresponds to the mapping table.

[0063] By setting a preset number of requests, even if malicious actors attempt to scan for vulnerabilities, the limited number of requests they can send makes it difficult to continue scanning. Furthermore, since the mapping table is updated when the preset number of requests is reached, the probability of obtaining encrypted addresses is reset, and even continuous scanning will not yield the latest encrypted addresses.

[0064] Since the number of requests is also recorded even for legitimate access, the preset request count can be set slightly higher than the number required for legitimate access. This preset request count scheme can be combined with the preset access count or preset access time schemes mentioned earlier.

[0065] Any of the above solutions is applicable to any Web device. If a new Web device is developed, it can be configured in the form of the above solutions. If an old Web device is upgraded, the original Web management system can be replaced with a system that can execute the solutions of this application.

[0066] If upgrading existing systems is inconvenient or economically feasible, a dedicated security device configured with the proposed solution can be added as an access restriction device without altering the existing web devices. In this mode, the dedicated security device can connect to one or more web devices, which act as providers of web page content. A mapping table is stored on the dedicated security device, and the page addresses in the mapping table must include at least the IP address representing the web device. The dedicated security device is also a type of web device; this application uses this designation to highlight its difference, but this designation is not intended to limit the scope of this application.

[0067] In one embodiment, a topology diagram using dedicated security equipment can be referenced. Figure 2 Web device 1 202 and Web device 2 203, which actually contain the management page content, only provide connections to dedicated security device 201, which receives access requests from client 204.

[0068] Based on the above embodiments, the mapping table can be referenced as shown in Table 3. The mapping table in Table 3 is only an exemplary mapping table for Web device 1 202. HOST1 and HOST2 can be set according to actual needs to point to whether the actual location of the page address in the mapping table is located in Web device 1 202 or Web device 2 203. For example, HOST1 can be 1.1.1.1 and HOST2 can be 1.1.1.2.

[0069]

[0070] Corresponding to the embodiments of the aforementioned page access permission control method, refer to Figure 3 This application also provides an embodiment of a page access permission control device, the control device 30 comprising:

[0071] The lookup module 301 is used to, after successful login verification on the client, look up the page addresses of several subdirectories under the same root directory as the login page in the lookup mapping table and the encrypted address of each page address. The encrypted address is generated based on the page address and the client's login verification information.

[0072] Replacement module 302 is used to return the found encrypted address to the client so that the client can replace the page addresses of several stored subdirectories with the encrypted address;

[0073] The response module 303 is used to find the page address corresponding to the encrypted address carried in the page access request when it receives a page access request from the client, and return the page data of the page address to the client.

[0074] An embodiment of the page access permission control device disclosed in this application can be applied to any web device. The device embodiment can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of the web device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 4 The diagram shown is a hardware structure diagram of a web device 40 containing a page access permission control device according to this application. (Except for...) Figure 4In addition to the processor 401, memory 402, communication interface 403, and non-volatile memory 404 connected via bus 405, the Web device 40 in which the device is located in the embodiment may also include other hardware depending on its actual function, which will not be described in detail here.

[0075] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0076] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0077] The embodiments of the subject matter and functional operation described in this specification can be implemented in the following ways: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by a data processing apparatus or for controlling the operation of a data processing apparatus. Alternatively or additionally, the program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, which are generated to encode information and transmit it to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0078] The processing and logic flow described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flow can also be executed by dedicated logic circuitry—such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and the device can also be implemented as dedicated logic circuitry.

[0079] Suitable computers for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. The basic components of a computer include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0080] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0081] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0082] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0083] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0084] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for controlling page access permissions, characterized in that, The control method is applied to a web device, and the control method includes: Upon receiving a login request from a client, if the address carried in the login request matches the string in the mapping table, the client is returned with the encrypted address corresponding to the login page address and the page data of the login page address for login verification. After successful client login verification, the system searches the mapping table for page addresses of several subdirectories under the same root directory as the login page, and the encrypted address of each page address. The encrypted address is generated by encrypting the page address and the client's login verification information using a hash algorithm. The mapping table also includes the root directory address, the login page address, and the encrypted address of the login page address. The string is randomly generated or preset by the administrator and is sent to the administrator via email or SMS. The found encrypted address is returned to the client, so that the client can replace the page addresses of the stored subdirectories with the encrypted address; When a page access request is received from the client, the system finds the page address corresponding to the encrypted address carried in the page access request and returns the page data of the page address to the client.

2. The control method according to claim 1, characterized in that, The encrypted address of the page address is generated using a hash algorithm based at least on the page address, the client's IP address, and the login username.

3. The control method according to claim 1, characterized in that, The encrypted address of the login page is generated based at least on the login page address and the client's IP address.

4. The control method according to claim 3, characterized in that, The control method further includes: updating a number of encrypted addresses stored in the mapping table based on a number of preset access counts or a number of preset access times, wherein the encrypted address is an encrypted address of a page address or an encrypted address of a login page address; the preset access counts represent the number of times the corresponding encrypted address is allowed to be accessed; and the preset access times represent the time during which the corresponding encrypted address is allowed to be accessed.

5. The control method according to claim 4, characterized in that, The preset number of accesses is set according to the priority of the encrypted address being accessed by the client; Alternatively, the preset access time may be set based on the priority of the encrypted address being accessed by the client.

6. The control method according to claim 5, characterized in that, The steps for updating the mapping table include: When the preset access count threshold is reached, or the preset access time is reached, the encrypted address is updated to a new encrypted address.

7. A device for controlling page access permissions, characterized in that, The control device includes: The lookup module receives login requests from clients. If the address carried in the login request matches the string in the mapping table, it returns the encrypted address corresponding to the login page address and the page data of the login page address to the client for login verification. After successful login verification, the module looks up the page addresses of several subdirectories under the same root directory as the login page in the mapping table, along with the encrypted address of each page address. The encrypted address is generated using a hash algorithm based on the page address and the client's login verification information. The mapping table also includes the root directory address, the login page address, and the encrypted address of the login page address. The string is randomly generated or preset by the administrator and is sent to the administrator via email or SMS. The replacement module is used to return the found encrypted address to the client, so that the client can replace the page addresses of the stored subdirectories with the encrypted address; The response module is used to, when receiving a page access request from the client, find the page address corresponding to the encrypted address carried in the page access request, and return the page data of the page address to the client.

Images