A method for dynamically managing client data transmission

Abstract

This invention discloses a method for dynamically managing client data transmission, relating to the field of information security; it includes: for non-HTTPS application access, creating an OkHttpClient client that does not verify SSL certificates, trusting all certificates through TrustManager, when an SSL error occurs in the URL loaded by WebView, checking whether the certificate issuer is in the whitelist; if not, ignoring the error and continuing to load the page; determining whether to intercept HTTPS requests based on the configured httpsInterceptControl value; if yes, calling the parent class method to execute the default SSL error handling logic; otherwise, ignoring the certificate error and continuing to load the page for data transmission; for HTTPS application access, creating an OkHttpClient that verifies SSL certificates, loading the application's built-in certificate file and certificate files in external storage, configuring SSLContext and SSLSocketFactory, and building a TrustManager based on the loaded certificates, verifying the SSL certificates, and making secure HTTPS requests based on this for data transmission.

Description

Technical Field

[0001] This invention discloses a method for dynamically managing client data transmission, which relates to the field of information security. Background Technology

[0002] Existing client / server architecture applications typically use HTTP and HTTPS protocols for data transmission.

[0003] The HTTP (Hypertext Transfer Protocol) is an application-layer transport protocol based on TCP. User data is encapsulated through layers of the application layer, transport layer, network layer, and data link layer before being sent to the target machine via the physical layer. At each of these layers, the data is not encrypted, which can lead to security issues such as data leakage, data tampering, and data replay for sensitive data.

[0004] Currently, the mainstream alternative technology is to use the HTTPS protocol instead of the HTTP protocol. HTTPS is an HTTP channel with security as its goal. It ensures security during transmission through encryption and authentication on top of HTTP. HTTPS adds SSL to HTTP; the security foundation of HTTPS is SSL, so the details of encryption are handled by SSL. However, in actual deployments, there are often situations where applications are deployed on a user's internal LAN, and the user does not want to apply for a domain name and a corresponding HTTPS certificate. In such cases, other encryption schemes are needed to ensure the security of information transmission. Summary of the Invention

[0005] This invention addresses the problems of existing technologies by providing a method for dynamically managing client data transmission. This dynamic management achieves compatibility between HTTPS and non-HTTPS applications, ensuring that applications accessed on mobile devices can still run normally even without an HTTPS certificate. This improves user choice and satisfaction, saves application implementation costs, and increases application efficiency and scope.

[0006] The specific solution proposed in this invention is as follows:

[0007] This invention provides a method for dynamically managing client data transmission, comprising:

[0008] For non-HTTPS application access, create an OkHttpClient client that does not verify SSL certificates, set a custom CookieJar for managing cookies, use an ArrayMap to store cookies for each domain, and trust all certificates through TrustManager.

[0009] When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is in the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If yes, call the parent class method to execute the default SSL error handling logic. Otherwise, ignore the certificate error and continue loading the page for data transmission.

[0010] When accessing HTTPS applications, an OkHttpClient is created to verify the SSL certificate. Requests are made based on the configured certificate. A custom CookieJar is set to manage cookies. The application's built-in certificate file and certificate files in external storage are loaded. SSLContext and SSLSocketFactory are configured, and a TrustManager is built based on the loaded certificate. The SSL certificate is verified, and a secure HTTPS request is made based on this for data transmission.

[0011] Furthermore, in the method for dynamically managing client data transmission, when accessing non-HTTPS applications, after creating the OkHttpClient client, it checks whether the passed OkHttpClient.Builder is null; if so, it creates a new Builder.

[0012] Similarly, when accessing HTTPS applications, after creating the OkHttpClient client, check if the passed-in OkHttpClient.Builder is null. If it is, create a new Builder.

[0013] Furthermore, in the method for dynamically managing client data transmission, when non-HTTPS applications access the service, the hostnameVerifier is set to return true, thus ignoring hostname verification.

[0014] Similarly, when accessing via HTTPS applications, setting hostnameVerifier returns true, thus ignoring hostname verification.

[0015] Furthermore, in the method for dynamically managing client data transmission, for non-HTTPS application access, a timeout period, DNS resolution, and event listener are configured, and an insecure OkHttpClient instance is constructed and returned.

[0016] Similarly, for HTTPS application access, configure timeout, DNS resolution, and event listeners, and build and return a secure OkHttpClient instance.

[0017] The present invention also provides an apparatus for dynamically managing client data transmission, including a non-HTTPS application access management module and an HTTPS application access management module.

[0018] For non-HTTPS application access management, the module creates an OkHttpClient client that does not verify SSL certificates, sets a custom CookieJar for managing cookies, uses an ArrayMap to store cookies for each domain, and trusts all certificates through TrustManager.

[0019] When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is in the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If yes, call the parent class method to execute the default SSL error handling logic. Otherwise, ignore the certificate error and continue loading the page for data transmission.

[0020] When accessing HTTPS applications, the non-HTTPS application access management module creates an OkHttpClient that verifies the SSL certificate, makes requests based on the configured certificate, sets a custom CookieJar for managing cookies, loads the application's built-in certificate file and certificate files in external storage, configures SSLContext and SSLSocketFactory, builds a TrustManager based on the loaded certificate, verifies the SSL certificate, and makes secure HTTPS requests for data transmission.

[0021] Furthermore, in the device for dynamically managing client data transmission, the non-HTTPS application access management module, when accessing non-HTTPS applications, after creating the OkHttpClient client, checks whether the passed-in OkHttpClient.Builder is null; if so, it creates a new Builder.

[0022] Similarly, when the HTTPS application access management module encounters HTTPS application access, after creating the OkHttpClient client, it checks whether the passed-in OkHttpClient.Builder is null. If it is, it creates a new Builder.

[0023] Furthermore, in the aforementioned device for dynamically managing client data transmission, the non-HTTPS application access management module sets the hostnameVerifier to true and ignores hostname verification when a non-HTTPS application accesses the device.

[0024] Similarly, when an HTTPS application accesses the application, the HTTPS application access management module sets the hostnameVerifier and returns true, ignoring hostname verification.

[0025] Furthermore, in the aforementioned device for dynamically managing client data transmission, the non-HTTPS application access management module configures timeout periods, DNS resolution, and event listeners for non-HTTPS application access, and constructs and returns an insecure OkHttpClient instance.

[0026] Similarly, the HTTPS application access management module configures timeout, DNS resolution, and event listeners for HTTPS application access, and builds and returns a secure OkHttpClient instance.

[0027] The advantages of this invention are:

[0028] Dynamic management enables HTTPS and non-HTTPS applications to run compatiblely, ensuring that applications accessed on mobile devices can still run normally even without an HTTPS certificate. This increases user choice and satisfaction, saves application implementation costs, and improves application efficiency and scope. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the non-HTTPS application access process in the method of this invention.

[0030] Figure 2 This is a schematic diagram of the HTTPS application access process in the method of the present invention. Detailed Implementation

[0031] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0032] Example 1

[0033] This invention provides a method for dynamically managing client data transmission, comprising:

[0034] For non-HTTPS applications, create an OkHttpClient client that does not verify SSL certificates. After creating the OkHttpClient client, check if the passed OkHttpClient.Builder is null. If it is, create a new Builder, set a custom CookieJar for managing cookies, use an ArrayMap to store cookies for each domain, and trust all certificates through TrustManager. Set hostnameVerifier, returning true to ignore hostname verification.

[0035] When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is on the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If so, call the parent class method to execute the default SSL error handling logic; otherwise, ignore the certificate error and continue loading the page for data transmission. For non-HTTPS application access, configure the timeout, DNS resolution, and event listeners, and construct and return an insecure OkHttpClient instance.

[0036] For HTTPS application access, an OkHttpClient that verifies the SSL certificate is created. After creating the OkHttpClient client, it checks if the passed OkHttpClient.Builder is null. If it is, a new Builder is created, and a request is made based on the configured certificate. A custom CookieJar is set to manage cookies, the application's built-in certificate file and the certificate file in external storage are loaded, the hostnameVerifier is set, and if it returns true, hostname verification is ignored. SSLContext and SSLSocketFactory are configured, and a TrustManager is built based on the loaded certificate. The SSL certificate is verified, and a secure HTTPS request is made based on this for data transmission.

[0037] Configure timeout, DNS resolution, and event listeners for HTTPS application access, and build and return a secure OkHttpClient instance.

[0038] Example 2

[0039] The present invention also provides an apparatus for dynamically managing client data transmission, including a non-HTTPS application access management module and an HTTPS application access management module.

[0040] For non-HTTPS application access management, the module creates an OkHttpClient client that does not verify SSL certificates, sets a custom CookieJar for managing cookies, uses an ArrayMap to store cookies for each domain, and trusts all certificates through TrustManager.

[0041] When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is in the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If yes, call the parent class method to execute the default SSL error handling logic. Otherwise, ignore the certificate error and continue loading the page for data transmission.

[0042] When accessing HTTPS applications, the non-HTTPS application access management module creates an OkHttpClient that verifies the SSL certificate, makes requests based on the configured certificate, sets a custom CookieJar for managing cookies, loads the application's built-in certificate file and certificate files in external storage, configures SSLContext and SSLSocketFactory, builds a TrustManager based on the loaded certificate, verifies the SSL certificate, and makes secure HTTPS requests for data transmission.

[0043] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0044] Similarly, the device of the present invention dynamically manages the compatibility between HTTPS and non-HTTPS applications, ensuring that applications accessed on mobile devices can still run normally even without an HTTPS certificate. This improves user choice and satisfaction, saves application implementation costs, and increases application efficiency and scope.

[0045] It should be noted that not all steps and modules in the above processes and device structures are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0046] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A method for dynamically managing client data transmission, characterized in that: include: For non-HTTPS application access, create an OkHttpClient client that does not verify SSL certificates, set a custom CookieJar for managing cookies, use an ArrayMap to store cookies for each domain, and trust all certificates through TrustManager. When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is in the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If yes, call the parent class method to execute the default SSL error handling logic. Otherwise, ignore the certificate error and continue loading the page for data transmission. When accessing HTTPS applications, an OkHttpClient is created to verify the SSL certificate. Requests are made based on the configured certificate. A custom CookieJar is set to manage cookies. The application's built-in certificate file and certificate files in external storage are loaded. SSLContext and SSLSocketFactory are configured, and a TrustManager is built based on the loaded certificate. The SSL certificate is verified, and a secure HTTPS request is made based on this for data transmission.

2. The method for dynamically managing client data transmission according to claim 1, characterized in that: When accessing non-HTTPS applications, after creating the OkHttpClient client, check if the passed OkHttpClient.Builder is null. If it is, create a new Builder. Similarly, when accessing HTTPS applications, after creating the OkHttpClient client, check if the passed-in OkHttpClient.Builder is null. If it is, create a new Builder.

3. The method for dynamically managing client data transmission according to claim 1, characterized in that: When accessing from non-HTTPS applications, setting `hostnameVerifier` to return `true` ignores hostname verification. Similarly, when accessing via HTTPS applications, setting hostnameVerifier returns true, thus ignoring hostname verification.

4. The method for dynamically managing client data transmission according to claim 1, characterized in that: For non-HTTPS applications, configure timeout, DNS resolution, and event listeners; build and return an insecure OkHttpClient instance. Similarly, for HTTPS application access, configure timeout, DNS resolution, and event listeners, and build and return a secure OkHttpClient instance.

5. A device for dynamically managing client data transmission, characterized in that: Includes a non-HTTPS application access management module and an HTTPS application access management module. For non-HTTPS application access management, the module creates an OkHttpClient client that does not verify SSL certificates, sets a custom CookieJar for managing cookies, uses an ArrayMap to store cookies for each domain, and trusts all certificates through TrustManager. When an SSL error occurs in the URL loaded by WebView, check if the certificate issuer is in the whitelist. If not, ignore the error and continue loading the page. Based on the configured httpsInterceptControl value, determine whether to intercept the HTTPS request. If yes, call the parent class method to execute the default SSL error handling logic. Otherwise, ignore the certificate error and continue loading the page for data transmission. When accessing HTTPS applications, the non-HTTPS application access management module creates an OkHttpClient that verifies the SSL certificate, makes requests based on the configured certificate, sets a custom CookieJar for managing cookies, loads the application's built-in certificate file and certificate files in external storage, configures SSLContext and SSLSocketFactory, builds a TrustManager based on the loaded certificate, verifies the SSL certificate, and makes secure HTTPS requests for data transmission.

6. The apparatus for dynamically managing client data transmission according to claim 5, Its characteristic is that when a non-HTTPS application access management module encounters access from a non-HTTPS application, after creating an OkHttpClient client, it checks whether the passed-in OkHttpClient.Builder is null. If it is, it creates a new Builder. Similarly, when the HTTPS application access management module encounters HTTPS application access, after creating the OkHttpClient client, it checks whether the passed-in OkHttpClient.Builder is null. If it is, it creates a new Builder.

7. The apparatus for dynamically managing client data transmission according to claim 5, characterized in that the non-HTTPS application access management module sets hostnameVerifier to return true and ignores hostname verification when a non-HTTPS application accesses the application. Similarly, when an HTTPS application accesses the application, the HTTPS application access management module sets the hostnameVerifier and returns true, ignoring hostname verification.

8. The apparatus for dynamically managing client data transmission according to claim 5, characterized in that the non-HTTPS application access management module configures timeout, DNS resolution, and event listeners for non-HTTPS application access, and constructs and returns an insecure OkHttpClient instance. Similarly, the HTTPS application access management module configures timeout, DNS resolution, and event listeners for HTTPS application access, and builds and returns a secure OkHttpClient instance.

Images