A safe remote isolated browsing method and device

Abstract

The present invention provides a safe remote isolated browsing method and device, the method comprising: according to a received user request website, a server performs DOM reconstruction on the website, obtains a first DOM structure, replaces a URL in the first DOM structure with a pre-configured domain name, and obtains a second DOM structure; the server reconstructs the second DOM structure, detects the reconstructed page, and if there is no risk, sends the second DOM structure to a client for display; if there is a risk, the reconstructed page performs DOM reconstruction again to obtain a third DOM structure, replaces the URL in the third DOM structure with a pre-configured domain name, obtains a fourth DOM structure, and then sends it to a client for display, thereby avoiding security issues that may be caused by existing DOM reconstruction technology and ensuring consistency of user experience with the original website.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for secure remote isolated browsing. Background Art

[0002] Existing browser isolation technologies are mainly divided into two categories: local isolation and remote isolation. Local isolation usually uses sandbox technology to isolate the browser process on the user's device. This method has the disadvantages of high resource consumption and high risk of isolation failure. Remote isolation browsers reduce direct threats to terminals by transferring the browser operating environment to the cloud or enterprise server.

[0003] However, existing technologies in remote isolation, such as pixel push (delivering the browser's visual content to the client by transmitting video streams) and DOM reconstruction (removing potential malicious code by rebuilding the HTML and CSS content of the web page), have their own limitations. DOM reconstruction technology solves the problems of pixel push in terms of bandwidth requirements, latency, and user experience, but there are security risks, such as URL leakage or potential leakage of JavaScript code; therefore, DOM reconstruction technology still cannot completely avoid information leakage in browser isolation mode. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a safe remote isolated browsing method and device, avoid the security problems that may be caused by the existing DOM reconstruction technology, and ensure the consistency of user experience with the original website.

[0005] In a first aspect, the present invention provides a method for secure remote isolated browsing, comprising the following steps:

[0006] Step 1: According to the received user request website, the server reconstructs the DOM of the website, obtains a first DOM structure, replaces the URL in the first DOM structure with a pre-configured domain name, and obtains a second DOM structure;

[0007] Step 2: The server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure is sent to the client for display. If there is a risk, the reconstructed page is reconstructed again to obtain a third DOM structure. The URL in the third DOM structure is replaced with a pre-configured domain name to obtain a fourth DOM structure, which is then sent to the client for display.

[0008] In a second aspect, the present invention provides a secure remote isolated browsing device, comprising:

[0009] The DOM parsing module reconstructs the DOM of the website according to the received user request website, obtains the first DOM structure, replaces the URL in the first DOM structure with the pre-configured domain name, and obtains the second DOM structure;

[0010] DOM verification and reconstruction module, the server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure is sent to the client for display. If there is a risk, the reconstructed page is reconstructed again to obtain the third DOM structure, and the URL in the third DOM structure is replaced with a pre-configured domain name to obtain the fourth DOM structure, which is then sent to the client for display.

[0011] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0012] The present invention performs an independent secondary detection on the server side, replaces all URLs in the DOM with safe domain names, completes DOM reconstruction on the server side, confirms that the reconstructed page is risk-free, and then sends it to the client for display. At the same time, a self-developed security protection SDK is deployed on the client side to intercept any JavaScript or XHR request that may be executed on the client side, thereby avoiding security issues that may be caused by existing DOM reconstruction technology and ensuring that the user experience is consistent with the original website.

[0013] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0015] Figure 1 is a flow chart of the method in Embodiment 1 of the present invention;

[0016] Figure 2 It is a schematic diagram of the structure of the device in the second embodiment of the present invention. DETAILED DESCRIPTION

[0017] The embodiments of the present application provide a method and device for secure remote isolated browsing, perform independent secondary detection on the server, replace all URLs in the DOM with secure domain names, complete DOM reconstruction on the server, confirm that the reconstructed page is risk-free, and then send it to the client for display, thereby ensuring the security of the client.

[0018] The technical solution in the embodiment of the present application has the following general idea:

[0019] 1. Secondary detection and DOM reconstruction on the server

[0020] When a user requests a website, the remote isolated browser first performs a comprehensive inspection of the website through the server, intercepting and cleaning any potential malicious content. During this process, the server replaces all URLs in the DOM with pre-configured safe domain names. After completing these replacements, the server rebuilds the DOM structure, confirms that the reconstructed page is risk-free, and then sends the processed DOM to the client for display. This secondary detection mechanism effectively prevents potential security risks in the traditional DOM reconstruction process; risks include URL leakage and JavaScript code leakage. According to the pre-configured safe domain name, all URLs in the DOM structure are replaced with pre-configured safe domain names; and through DOM technology, JavaScript code can be intercepted; the code in the browser can be used to obtain whether the tag is a script. If it is a script, it is a JavaScript code leak.

[0021] 2. The bottom-line interception mechanism of the self-developed security protection SDK

[0022] The client uses a self-developed security protection SDK, which is a TypeScript SDK to further ensure security. The SDK is responsible for intercepting all JavaScript and XHR requests executed on the client side, preventing any unauthorized code from being executed on the user's device, and ensuring the isolation and security of the browser. The core module functions of the SDK include:

[0023] Monitoring module: used to monitor all JavaScript execution and XHR requests on web pages in real time. This module intercepts and analyzes each step of JavaScript execution and blocks operations that do not comply with security rules.

[0024] Interception module: When suspicious behavior is detected, the interception module will promptly block JavaScript execution or XHR requests and return error logs or warnings to ensure that harmful code is not executed.

[0025] Security log module: records all intercepted operations and detailed log information to help administrators conduct further analysis.

[0026] Custom rule module: Administrators can configure custom security rules to flexibly adjust the interception mechanism in different business scenarios.

[0027] Integration and extensibility: The SDK provides a flexible API that allows enterprise developers to integrate customized security policies and easily expand new functional modules.

[0028] Security Protection SDK core code example:

[0029]

[0030]

[0031]

[0032]

[0033]

[0034]

[0035] 3. Secure data transmission

[0036] The data transmission between the server and the client is carried out through an encrypted channel, and all transmitted data is encrypted to prevent it from being intercepted or tampered with during the transmission process. The specific encryption methods used include SSL / TLS protocol and encrypted DOM structure transmission method to ensure that the user's browsing behavior cannot be spied on by the outside world.

[0037] Embodiment 1

[0038] like Figure 1 As shown, this embodiment provides a secure remote isolated browsing method, comprising the following steps:

[0039] Step 1: According to the received user request website, the server reconstructs the DOM of the website, obtains a first DOM structure, replaces the URL in the first DOM structure with a pre-configured domain name, and obtains a second DOM structure;

[0040] Step 2: The server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure is sent to the client for display. If there is a risk, the reconstructed page is reconstructed again to obtain a third DOM structure. The URL in the third DOM structure is replaced with a pre-configured domain name to obtain a fourth DOM structure, which is then sent to the client for display.

[0041] In this embodiment, preferably, the step 2 specifically includes: setting a security protection SDK; the security protection SDK is used to intercept all JavaScript executions and XHR requests of the client; and compare them with the set security rules, if they meet the requirements, the operation is allowed; if they do not meet the requirements, the operation is rejected;

[0042] The server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure and the security protection SDK are sent to the client. The client runs the security protection SDK and displays the page according to the second DOM structure. If there is a risk, the reconstructed page is reconstructed again to obtain a third DOM structure. The risky URL in the third DOM structure is replaced with a pre-configured domain name to obtain a fourth DOM structure. The fourth DOM structure and the security protection SDK are sent to the client. The client runs the security protection SDK and displays the page according to the fourth DOM structure.

[0043] In this embodiment, preferably, all intercepted operations and corresponding log information are recorded and sent to the server.

[0044] In this embodiment, preferably, the risks include URL leakage and JavaScript code leakage.

[0045] In this embodiment, preferably, the data transmission between the server and the client is carried out through an encrypted channel, and all data to be transmitted is processed in an encrypted manner before being sent, and the encrypted channel adopts the SSL / TLS protocol.

[0046] Based on the same inventive concept, the present application also provides a device corresponding to the method in Example 1, see Example 2 for details.

[0047] Embodiment 2

[0048] like Figure 2 As shown, in this embodiment, a secure remote isolated browsing device is provided, including:

[0049] The DOM parsing module reconstructs the DOM of the website according to the received user request website, obtains the first DOM structure, replaces the URL in the first DOM structure with the pre-configured domain name, and obtains the second DOM structure;

[0050] DOM verification and reconstruction module, the server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure is sent to the client for display. If there is a risk, the reconstructed page is reconstructed again to obtain the third DOM structure, and the URL in the third DOM structure is replaced with a pre-configured domain name to obtain the fourth DOM structure, which is then sent to the client for display.

[0051] In this embodiment, preferably, the DOM verification and reconstruction module specifically includes: setting a security protection SDK; the security protection SDK is used to intercept all JavaScript executions and XHR requests of the client; and compare them with the set security rules, if they meet the requirements, the operation is allowed; if they do not meet the requirements, the operation is rejected;

[0052] The server reconstructs the second DOM structure and detects the reconstructed page. If there is no risk, the second DOM structure and the security protection SDK are sent to the client. The client runs the security protection SDK and displays the page according to the second DOM structure. If there is a risk, the reconstructed page is reconstructed again to obtain a third DOM structure. The risky URL in the third DOM structure is replaced with a pre-configured domain name to obtain a fourth DOM structure. The fourth DOM structure and the security protection SDK are sent to the client. The client runs the security protection SDK and displays the page according to the fourth DOM structure.

[0053] In this embodiment, preferably, all intercepted operations and corresponding log information are recorded and sent to the server.

[0054] In this embodiment, preferably, the risks include URL leakage and JavaScript code leakage.

[0055] In this embodiment, preferably, the data transmission between the server and the client is carried out through an encrypted channel, and all data to be transmitted is processed in an encrypted manner before being sent, and the encrypted channel adopts the SSL / TLS protocol.

[0056] Since the device introduced in the second embodiment of the present invention is a device used to implement the method of the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the device based on the method introduced in the first embodiment of the present invention, so it is not described here in detail. All devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0057] The technical solution provided in the embodiments of the present application has at least the following technical effects or advantages:

[0058] The present invention is widely used in browsing environments with extremely high security requirements, especially in financial institutions, government departments and cross-border e-commerce companies. It reduces the risk of data leakage and malicious code execution by ensuring the isolation between the browser and the user's device. While ensuring the user experience, it provides a powerful protection capability for the enterprise network.

[0059] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0060] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0063] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A secure remote isolated browsing method, characterized by: The steps include: Step 1: According to the received user request website, the server reconstructs the DOM of the website, obtains a first DOM structure, replaces the URL in the first DOM structure with a pre-configured domain name, and obtains a second DOM structure; Step 2, setting up a security protection SDK; the security protection SDK is used to intercept all JavaScript executions and XHR requests of the client; all JavaScript executions and XHR requests intercepted by the client are compared with the set security rules, and if they meet the requirements, the operation is allowed; if they do not meet the requirements, the operation is rejected; The server rebuilds the second DOM structure and detects the rebuilt page. If there is no risk, the server sends the second DOM structure and the security protection SDK to the client. The client runs the security protection SDK and displays the page according to the second DOM structure. If there is a risk, the reconstructed page will be rebuilt again by DOM to obtain a third DOM structure, and the URL with risk in the third DOM structure will be replaced with the pre-configured domain name to obtain a fourth DOM structure. The fourth DOM structure and the security protection SDK will be sent to the client, and the client will run the security protection SDK to display the page according to the fourth DOM structure.

2. A safe remote isolated browsing method according to claim 1, characterized in that: The security protection SDK records all intercepted operations and corresponding log information, and sends them to the server.

3. A safe remote isolated browsing method according to claim 1, characterized in that: The risks include URL leakage and JavaScript code leakage.

4. A safe remote isolated browsing method according to claim 1, characterized in that: The data transmission between the server and the client is carried out through an encrypted channel. All data to be transmitted is processed in an encrypted manner before being sent. The encrypted channel adopts the SSL / TLS protocol.

5. A secure remote isolated browsing device, characterized by: include: The DOM parsing module reconstructs the DOM of the website according to the received user request website, obtains the first DOM structure, replaces the URL in the first DOM structure with the pre-configured domain name, and obtains the second DOM structure; The DOM verification and reconstruction module sets a security protection SDK; the security protection SDK is used to intercept all JavaScript executions and XHR requests of the client; all JavaScript executions and XHR requests intercepted by the client are compared with the set security rules, and if they meet the requirements, the operation is allowed; if they do not meet the requirements, the operation is rejected; The server rebuilds the second DOM structure and detects the rebuilt page. If there is no risk, the server sends the second DOM structure and the security protection SDK to the client. The client runs the security protection SDK and displays the page according to the second DOM structure. If there is a risk, the reconstructed page will be rebuilt again by DOM to obtain a third DOM structure, and the URL with risk in the third DOM structure will be replaced with the pre-configured domain name to obtain a fourth DOM structure. The fourth DOM structure and the security protection SDK will be sent to the client, and the client will run the security protection SDK to display the page according to the fourth DOM structure.

6. A secure remote isolated browsing device according to claim 5, characterized in that: The security protection SDK records all intercepted operations and corresponding log information, and sends them to the server.

7. A secure remote isolated browsing device according to claim 5, characterized in that: The risks include URL leakage and JavaScript code leakage.

8. The secure remote isolated browsing device according to claim 5, characterized in that: The data transmission between the server and the client is carried out through an encrypted channel. All data to be transmitted is processed in an encrypted manner before being sent. The encrypted channel adopts the SSL / TLS protocol.

Images