Browser-based website access method, device, equipment and medium

Abstract

The embodiment of the present application provides a browser-based website access method, device, equipment and medium, which belongs to the field of network security technology. The method includes: sending an access request to a target website, and receiving certificate response information corresponding to at least one target certificate returned by the target website; calling a default function from a preset underlying protocol library, and verifying the certificate response information based on the default function to obtain an initial verification result; when the initial verification result indicates that the target certificate verification fails, calling a callback function from the underlying protocol library, and re-verifying the certificate response information based on the callback function to obtain a target verification result; when the target verification result indicates that the target certificate verification passes, encrypting the certificate response information based on the key generated by the browser itself, and sending the encrypted result to the target website, so as to access the target website based on the secure channel established by the encryption result. The present application can improve the reliability of the browser accessing the target website.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a browser-based website access method, device, equipment and medium. Background Art

[0002] Certificate verification is an important part of target website access, where certificates include root certificates (root CA certificates) and other related certificates. Root CA certificates are issued by an authoritative authority (CA institution) to ensure the legitimacy of online entity identities and their public keys. Other related certificates are verified and issued by root CA certificates.

[0003] In the related art, the root CA certificates of most browsers rely on the issuance of foreign CA institutions. Therefore, when a foreign CA institution maliciously revokes or does not reissue an expired root CA certificate, the verification and update of the certificate will be affected. In this case, the user cannot normally interact with the target website corresponding to the certificate to be verified. That is, in the related art, when a foreign CA institution does not update the root CA certificate required by the browser, the certificate required by the browser cannot be preserved and becomes invalid, and the target website cannot be accessed normally, thus affecting the reliability of the browser accessing the target website. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a browser-based website access method, device, equipment and medium, aiming to improve the reliability of browser access to a target website.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a browser-based website access method, which is applied to a browser and includes:

[0006] Sending an access request to a target website, and receiving certificate response information corresponding to at least one target certificate returned by the target website;

[0007] Call the default function from the preset underlying protocol library, and verify the certificate response information based on the default function to obtain the initial verification result;

[0008] When the initial verification result indicates that the target certificate verification fails, a callback function is called from the underlying protocol library, and the certificate response information is re-verified based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured security policy;

[0009] When the target verification result indicates that the target certificate verification has passed, the certificate response information is encrypted based on the key generated by the browser itself, and the encryption result is sent to the target website to access the target website based on the secure channel established by the encryption result.

[0010] In some embodiments, re-verifying the certificate response information based on the callback function to obtain a target verification result includes:

[0011] Select at least one from a plurality of preservation strategies preset by the callback function, and determine corresponding preservation item information according to the selected preservation strategy;

[0012] Re-verify the certificate response information based on the security project information to obtain the target verification result.

[0013] In some embodiments, the target verification result includes a first target verification result and a second target verification result;

[0014] Re-verify the certificate response information based on the preservation project information to obtain the target verification results, including:

[0015] When the selected security strategy is a first security strategy representing distrust, at least one first security item information is determined based on the first security strategy, the first security item information including a first sequence number;

[0016] Parse the certificate response information to obtain the certificate serial number;

[0017] If the certificate serial number matches the first serial number, a first target verification result is obtained indicating that the target certificate does not need to be preserved;

[0018] Otherwise, a second target verification result indicating that the target certificate is incorrect is obtained.

[0019] In some embodiments, the target verification result further includes a third target verification result and a fourth target verification result;

[0020] Re-verify the certificate response information based on the preservation project information to obtain the target verification result, which also includes:

[0021] Parse the initial verification result to obtain certificate error information indicating that the target certificate verification failed;

[0022] When the selected preservation strategy is a second preservation strategy representing trust, determining at least one second preservation item information based on the second preservation strategy, the second preservation item information including the second sequence number and error type information corresponding to the second sequence number;

[0023] If the certificate serial number matches any second serial number, and the certificate error information matches the error type information, a third target verification result is obtained indicating that the target certificate needs to be preserved;

[0024] Otherwise, a fourth target verification result indicating that the target certificate is incorrect is obtained.

[0025] In some embodiments, re-verifying the certificate response information based on the security item information to obtain a target verification result further includes:

[0026] When the selected security policy includes both the first security policy and the second security policy, verifying the certificate response information based on the first security item information;

[0027] If the target verification result obtained is the second target verification result, continue to verify the certificate response information based on the second security item information;

[0028] If the certificate serial number matches any second serial number, and the certificate error information matches the error type information, changing the second target verification result to the third target verification result;

[0029] Otherwise, the second target verification result remains unchanged.

[0030] In some embodiments, re-verifying the certificate response information based on the security item information to obtain a target verification result further includes:

[0031] When the selected security policy includes both the first security policy and the second security policy, and the certificate response information matches both the first security item information and the second security item information, the one with a more recent update time between the first security policy and the second security policy is determined as the target security policy;

[0032] Determine the corresponding target preservation project information according to the selected target preservation strategy, verify the certificate response information based on the target preservation project information, and obtain the target verification result, wherein the target verification result is one of the first target verification result, the second target verification result, the third target verification result and the fourth target verification result.

[0033] In some embodiments, obtaining a third target verification result indicating that the target certificate needs to be preserved includes:

[0034] The certificate error information is deleted, and a third target verification result is obtained, indicating that the target certificate needs to be preserved.

[0035] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a browser-based website access device, the device comprising:

[0036] The acquisition module is used to send an access request to a target website and receive certificate response information corresponding to at least one target certificate returned by the target website;

[0037] The basic verification module is used to call the default function from the preset underlying protocol library, and verify the certificate response information based on the default function to obtain the initial verification result;

[0038] A re-verification module, used for calling a callback function from an underlying protocol library when an initial verification result indicates that the target certificate verification fails, and re-verifying the certificate response information based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured security policy;

[0039] The target access module is used to encrypt the certificate response information based on the key generated by the browser itself when the target verification result indicates that the target certificate verification has passed, and send the encrypted result to the target website, so as to access the target website based on the secure channel established by the encryption result.

[0040] To achieve the above objectives, the third aspect of an embodiment of the present application proposes an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the browser-based website access method of the above first aspect is implemented.

[0041] To achieve the above objectives, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the browser-based website access method of the first aspect is implemented.

[0042] The present application proposes a browser-based website access method, device, equipment and medium, the method comprising sending an access request to a target website, and receiving certificate response information corresponding to at least one target certificate returned by the target website; calling a default function from a preset underlying encryption library, and verifying the certificate response information based on the default function to obtain an initial verification result; when the initial verification result indicates that the target certificate verification fails, calling a callback function from the underlying encryption library, and re-verifying the certificate response information based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured preservation policy, and re-verifying the certificate response information can prevent the target certificate that itself represents access security from being not issued by a certificate authority in other regions, thereby causing the original normal access based on the browser to be interrupted, and the new access to be based on the browser to be blocked, thereby causing business interruption, business loss and other situations; when the target verification result indicates that the target certificate verification passes, encrypting the certificate response information based on a key generated by the browser itself, and sending the encrypted result to the target website, so as to access the target website based on a secure channel established by the encryption result, thereby improving the reliability of the browser access to the target website. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the structure of an optional website public key infrastructure used in the embodiment of the present application;

[0044] Figure 2This is an optional flowchart of the browser-based website access method provided in an embodiment of the present application;

[0045] Figure 3 yes Figure 2 A flowchart of an implementation of step 103 in FIG.

[0046] Figure 4 yes Figure 3 A flowchart of an implementation of step 202 in FIG.

[0047] Figure 5 yes Figure 3 Another implementation flow chart of step 202 in FIG.

[0048] Figure 6 yes Figure 3 Another implementation flowchart of step 202 in FIG.

[0049] Figure 7 yes Figure 3 Another implementation flow chart of step 202 in FIG.

[0050] Figure 8 This is an optional module diagram of a browser-based website access device provided in an embodiment of the present application;

[0051] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0055] like Figure 1 As shown, Figure 1This is a schematic diagram of the structure of an optional website public key infrastructure used in the embodiment of the present application, wherein the website public key infrastructure (PKI) includes multiple certificate authorities that are associated layer by layer, specifically, including a root certificate authority at the top layer, and multiple upper-level certificate authorities associated with the root certificate authority, and multiple lower-level certificate authorities associated with the upper-level certificate authority. Furthermore, each lower-level certificate authority is also associated with multiple website servers for performing certificate authorization on the associated website servers so that the browser requesting access can access the target website managed by the website server; and the root certificate authority is deployed in an overseas area. It should be noted that the embodiment of the present application only illustrates a three-layer certificate authority. In actual applications, there are usually more certificate authority architectures than three layers, which are also applicable, but they are not listed in detail here.

[0056] Exemplarily, in an application scenario, the certificate authorities include a root certificate authority, an upper-level certificate authority, and a lower-level certificate authority. The certificates issued by each certificate authority form a certificate chain. When a user wants to access a target website managed by a website server by operating a browser, the website server will send the relevant certificate chain information to the browser for verification; when the certificate chain information is verified, the browser can obtain the encrypted information sent to the website server based on the public key in the certificate chain and the key generated by itself; thereafter, the browser accesses the target website based on the secure channel established by the encrypted information, thereby ensuring the reliability of the browser's access to the target website.

[0057] However, the root certificate authority, the upper certificate authority, and the lower certificate authority are usually located in different regions and are managed by different management objects, such as Figure 1 As shown in the figure, the root certificate authority is located in a foreign region, while other certificate authorities associated with the root certificate authority are located in a domestic region. The certificate chain information used to indicate the security of the website server includes the root CA certificate (issued by the root certificate authority), the intermediate certificate (issued by the upper-level certificate authority), and the user certificate (issued by the lower-level certificate authority). When a user uses a browser belonging to a domestic region to visit a target website, various trust issues are prone to occur due to the different regions where the certificate authorities are located. The specific descriptions are as follows:

[0058] (1) Risk of stopping issuing root CA certificates (isolation and blindness risk): When the certificate resources used by a website server in a certain region rely on the root certificate authority in another region, once the root certificate authority in the other region does not issue the relevant resource certificate to the website server due to a crisis of distrust between the two regions, or due to network problems between the two regions, the resource website managed by the network server will not be able to be used normally;

[0059] (2) Risk of root CA revoking issued certificates (disappearance risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region cancels / revokes the resource certificate originally issued to the website server due to a crisis of distrust between the two regions, the encryption services of all domain name websites of the website server will disappear, and the encryption services between the corresponding domain name websites and users will be interrupted, causing the browser to be unable to access the corresponding target website;

[0060] (3) Risk of certificate tampering (hijacking): When the certificate resource registration used by a website server in a certain region relies on a root certificate authority in another region, when the root certificate authority in another region is attacked or performs malicious operations or issues certificates containing false information, it is easy for the resource websites held by the relevant website servers to be attacked or even hijacked.

[0061] (4) Information security risk: When the certificate resource registration used by a website server in a certain region relies on a root certificate authority in another region, the daily traffic network service information of the website server in that region (such as website access information of network devices) will be controlled by the root certificate authority in the other region. If the relationship between the two regions is not harmonious, it will cause serious information security leakage risks.

[0062] Since many root certificate authorities in the real-life website public key infrastructure are usually located in a few regions, and the root certificate authorities in a few regions are directly or indirectly associated with website servers in most regions, when there is distrust or conflict between different regions, the above four malicious situations will easily occur, making the browser's access to the target website less reliable. In other words, the target website is actually safe and accessible, but the browser cannot access it normally.

[0063] Based on this, the embodiments of the present application provide a browser-based website access method, device, equipment and medium, aiming to improve the reliability of browser access to a target website.

[0064] It should be noted that in the embodiments of the present application, when it comes to information related to user characteristics such as user basic information or user identity, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the user's separate permission or separate consent will be obtained first. After the user's separate permission or separate consent is clearly obtained, the necessary data for the normal operation of the embodiments of the present application will be obtained. For example, in the browser-based website access method of the embodiment of the present application (for the convenience of description, it can also be referred to as "access method" below), before sending an access request to the target website, the Internet Protocol address (IP address) of the server where the browser is located will be obtained from the operating user. Otherwise, the basic connection between the browser and the target website cannot be established, and it is impossible to send an access request to the target website on the basis of the basic connection, and receive the certificate response information corresponding to at least one target certificate returned by the target website. In addition, the other data mentioned in the embodiments of the present application are also legal data after obtaining relevant authorization or consent, and will not be repeated here.

[0065] It should also be noted that the access method of the present application is suitable for situations where each certificate on the certificate chain is issued by certificate authorities in at least two different regions. For example, the access method proposed in the present application can also be used in situations where the upper-level certificate authority and the root certificate authority are both deployed in overseas regions, while the lower-level certificate authority is deployed in domestic regions.

[0066] The following is a detailed description of the browser-based website access method provided by the embodiment of the present application. Specifically, in the embodiment of the present application, the description will be made from the perspective of a browser-based website access device (hereinafter referred to as "access device" for ease of understanding). The access device is applied to the browser side, such as being integrated in a computer device. Figure 2 As shown, Figure 2 is an optional flowchart of a browser-based website access method provided in an embodiment of the present application. Figure 2 The method may include but is not limited to the following steps 101 to 104. When the access device executes the access method, the specific process is as follows. It should be noted that the present embodiment Figure 2 The order of step 101 to step 104 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0067] Step 101: Send an access request to a target website, and receive certificate response information corresponding to at least one target certificate returned by the target website.

[0068] The following is a detailed description of step 101.

[0069] In some embodiments, before the browser sends an access request to the target website, the browser has established a Transmission Control Protocol (TCP) connection with the target website to be accessed. To protect network communication security, a Secure Sockets Layer (SSL) / Transport Layer Security (TLS) connection needs to be further implemented between the browser and the target website. On the basis that the browser and the target website have established a TCP connection, the browser will then send an access request to the target website for implementing an SSL / TLS connection.

[0070] Furthermore, the format of the access request is an SSL / TLS protocol request format. After receiving the access request sent by the browser, the target website obtains the certificate response information of the relevant certificate based on the website server that manages the target website, and sends the certificate response information to the browser. The certificate response information is determined by the certificate chain, for example, Figure 1 As shown, the lower-level certificate authority 1-1 includes a website server A, and the website server A manages the target website a. The certificate chain related to the target website a is generated by the lower-level certificate authority 1-1 that manages the website server A and its upper-level certificate authority (including the upper-level certificate authority 1 and the root certificate authority); specifically, the root certificate authority issues a root CA certificate to the upper-level certificate authority 1, and after the upper-level certificate authority 1 determines that the root CA certificate is valid, it issues an intermediate certificate to the lower-level certificate authority 1-1 based on the root CA certificate. After the lower-level certificate authority 1-1 determines that the intermediate certificate is valid, it issues a user certificate based on the intermediate certificate, thereby obtaining a certificate chain (root CA certificate-intermediate certificate-user certificate); wherein the target certificate can be any one of the root CA certificate, the intermediate certificate and the user certificate. The certificate response information is generated by the target website a based on the certificate chain after receiving the access request sent by the browser.

[0071] Furthermore, the certificate response information includes the validity period, issuing authority, certificate serial number, certificate subject, certificate public key information, certificate signature and other contents of each certificate in the certificate chain; of course, depending on the actual application scenario, the certificate response information can also include more content, such as key usage, signature algorithm, etc., or the certificate response information is the certificate chain, and the content contained in the certificate response information can be specifically set according to the actual situation, and the embodiment of the present application does not limit this.

[0072] Step 102, calling a default function from a preset underlying protocol library, and verifying the certificate response information based on the default function to obtain an initial verification result.

[0073] The following is a detailed description of step 102.

[0074] Among them, the underlying protocol library is a function library pre-defined and configured in the browser kernel. The underlying protocol library contains a variety of encryption functions, which are usually encapsulated as reusable modules or components to quickly call the required encryption functions when needed. It can be understood that the underlying protocol library is an important basis for verifying and ensuring the security of information browser access. The browser kernel is a rendering engine used by the browser, which determines how the browser displays the content of the web page and the format information of the page.

[0075] Furthermore, the browser kernel is pre-installed with an open source software library package (OpenSSL) so that the browser can communicate securely based on OpenSSL. Among them, OpenSSL consists of three main parts: the cryptographic algorithm library (libcrypto), the SSL protocol library / underlying protocol library (libssl), and the multi-functional command line tool (openssl). Among them, libcrypto is used to implement various encryption algorithms, libssl implements the SSL / TLS protocol, and the openssl command line tool provides encryption, decryption, certificate creation and other functions.

[0076] Among them, the default function is an important function in the encryption function of the certificate security class, and the default function is the preferred function for verifying the security of the certificate. For example, the default function can be the SSL_CTX_load_verify_locations function, and the SSL_CTX_load_verify_locations function can load the certificate response information in the following two loading methods:

[0077] (1) File format: Load multiple certificates under the certificate response information into the SSL context in the form of a file path;

[0078] (2) Directory format: Load multiple certificates under the certificate response information into the SSL context in the form of a directory. It should be noted that the directory loading method requires an additional directory inspection tool.

[0079] Furthermore, the relevant certificate chain is verified based on the loaded certificate response information. If all certificates in the certificate chain are verified successfully, it means that the certificate chain is valid, and the initial verification result is characterized by successful verification of the certificate response information. At this time, the browser can securely access the target website based on the successfully connected SSL / TLS protocol; if any certificate verification fails, it means that the certificate chain is invalid, and the initial verification result is characterized by failed verification of the certificate response information. When the certificate verification fails, the browser cannot access the target website normally, and the normal interaction between the browser and the target website is limited.

[0080] Among them, certificate verification failure includes one or more of certificate expiration, untrusted certificate, revoked certificate, server configuration error, etc.; of course, certificate verification failure can also be designed with other aspects, such as mismatched certificate information, incomplete certificate chain, etc. The situation determined as verification failure can be specifically set according to actual conditions, and the embodiments of the present application do not limit this.

[0081] Step 103, when the initial verification result indicates that the target certificate verification fails, a callback function is called from the underlying protocol library, and the certificate response information is re-verified based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured security policy.

[0082] The following is a detailed description of step 103.

[0083] Among them, the callback function is another important function in the encryption function of the certificate security verification class, and the scheduling priority of the default function is higher than the callback function. That is, when the browser needs to verify the certificate response information, the browser kernel will first schedule the default function to perform initial verification on it. When the initial verification result indicates that the target certificate verification is passed, the SSL / TLS protocol is successfully connected, and the browser can safely access the target website; when the initial verification result indicates that the target certificate verification fails, the browser kernel schedules the callback function to re-verify the certificate response information. If the target verification result obtained by re-verification indicates that the target certificate verification is passed, the SSL / TLS protocol can also connect successfully, and the browser can also safely access the target website. For example, the callback function can be the verify_callback function.

[0084] The preservation strategy refers to a customized strategy to avoid the phenomenon that the target certificate that originally represents access security becomes invalid when one or more of the four malicious situations mentioned above occur, thereby causing the browser to be unable to access the target website normally. In addition, the preservation strategy is passed to the browser kernel in the form of parameters and called by the callback function to re-verify the certificate response information.

[0085] It is understandable that in the related art, when the browser kernel calls the default function to verify the target certificate, no matter whether the verification result is successful or failed, the target certificate will not be re-verified. If the target certificate that represents access security is maliciously revoked by the root certificate authority in other regions, the normal access based on the browser is interrupted and the new access based on the browser is blocked, thereby causing business interruption, business loss and other problems, and even causing direct economic losses to the relevant access applicants or applicants. In comparison, the access method proposed in the embodiment of the present application can re-verify the certificate response information by calling a callback function pre-configured with at least one preservation policy, so as to give the local browser a certain verification option for the target certificate, thereby avoiding the decrease in the reliability of the browser accessing the target website due to the malicious invalidation of the target certificate.

[0086] In some embodiments, Figure 3 As shown, Figure 3 yes Figure 2 A flowchart for implementing step 103 in the embodiment of the present invention re-verifies the certificate response information based on the callback function to obtain the target verification result, including the following steps 201 to 202:

[0087] Step 201: select at least one from a plurality of security strategies preset in the callback function, and determine corresponding security item information according to the selected security strategy.

[0088] Step 202: re-verify the certificate response information based on the security item information to obtain a target verification result.

[0089] Steps 201 to 202 are described in detail below.

[0090] In some embodiments, different security item information is set for different security policies, and under different security policies, the method of re-verifying the certificate response information based on the security item information is also different.

[0091] Furthermore, the security policy can be formulated by any one or more certificate authorities associated with the website server where the target network is located, or by a third-party associated institution, and the present application embodiment does not limit this. In addition, the security item information included in the security policy can be updated at intervals, or, when changes occur, the relevant institution notifies each browser, and the present application embodiment also does not limit the update time of the security policy.

[0092] Furthermore, when it is necessary to add, delete, modify, or query the security policy definition or the specific content of the security project information, it can be processed through the browser's application layer command line definition or graphical configuration parameter definition. For example, when it is necessary to add new security project information, the browser kernel calls the SSL / TLS function module and defines the relevant member parameters of the security project information, and receives the new parameters passed from the application layer command line or graphical configuration.

[0093] The following are several possible hold policy scenarios and the corresponding revalidation actions:

[0094] In some embodiments, Figure 4 As shown, Figure 4 yes Figure 3 A flowchart for implementing step 202 in the embodiment of the present invention re-verifies the certificate response information based on the preservation project information to obtain the target verification result, including the following steps 301 to 304:

[0095] Step 301: When the selected security strategy is a first security strategy representing untrustworthiness, at least one first security item information is determined based on the first security strategy, and the first security item information includes a first sequence number.

[0096] Step 302: parse the certificate response information to obtain the certificate serial number.

[0097] Step 303: If the certificate serial number matches the first serial number, a first target verification result is obtained indicating that the target certificate does not need to be preserved.

[0098] Step 304: otherwise, obtain a second target verification result indicating that the target certificate is incorrect.

[0099] Steps 301 to 304 are described in detail below.

[0100] In some embodiments, the first security policy indicates that the first security item information corresponding to the first security policy is not trusted by the local certificate authority. When the initial verification result indicates that the target certificate verification fails, the first security policy passes the parameters related to the first security item information to the callback function, so that the browser kernel can re-verify the certificate response information based on the callback function. In addition, the first security item information includes a first serial number for indicating an untrusted certificate, and the first serial number is used to uniquely refer to a specific one of multiple untrusted certificates.

[0101] Furthermore, the certificate authority that issues the distrust opinion may be one or more. For example, it can be set that as long as there is a certificate authority that publishes the first security item information representing the distrust opinion, it will be included in the first security strategy; or, it can be set that when the designated certificate authority publishes the first security item information representing the distrust opinion, the corresponding first security item information will be included in the first security strategy. The embodiment of the present application does not limit the scope of the certificate authority included in the first security item information, and it can be adjusted according to actual conditions.

[0102] Furthermore, the certificate serial number is used to uniquely identify a certificate (i.e., the target certificate in the embodiment of the present application) to ensure that the target certificate can be accurately identified during the verification and preservation process for subsequent processing. After obtaining the certificate serial number, the certificate serial number and the first serial number are compared. When the certificate serial number matches the first serial number, it indicates that the target certificate is not trusted by any one or more of the certificate authority chain (including all relevant certificate authorities) where the target website is located, and no subsequent verification operation is required, thereby obtaining the first target verification result indicating that the target certificate does not need to be preserved. For example, Figure 1 As shown, the lower-level certificate authority 1-1 does not trust the root CA certificate issued by the root certificate authority. Therefore, when the browser accesses the website server managed by the lower-level certificate authority 1-1 and the initial verification result is failure, even if the target certificate indicates that the target website is safe to access to a certain extent, the lower-level certificate authority 1-1 still indicates that it does not trust the root CA certificate issued by the root certificate authority, and obtains the first target verification result of failure to pass the verification. Moreover, when the first target verification result is obtained, the user cannot access the target network in any way based on the browser.

[0103] Otherwise, a second target verification result indicating a target certificate error is obtained. The second target verification result error may be reported in the form of contacting the website server administrator; or in the form of a pop-up window, the error message is displayed on the front end of the browser, and the user can choose whether to trust the target website; of course, the error report form can be specifically set according to the actual situation, and the embodiment of the present application does not limit this.

[0104] Furthermore, the first security item information can be stored in a lightweight data exchange format (JSON file) to form a first security strategy, and the relevant parameters are quickly passed to the callback function when the callback function is called. Exemplarily, a first security item information (LocalCertBlackAssertions) is stored in a JSON file in the form of a relational table, as shown below:

[0105] Table LocalCertBlackAssertions(

[0106] idINTEGER PRIMARY KEY,

[0107] versionINTEGER DEFAULT 1,

[0108] serialNumberINTEGER NOT NULL,

[0109] subjectNameBLOB DEFAULT NULL,

[0110] subjectAltNameBLOB DEFAULT NULL,

[0111] issuerNameBLOB DEFAULT NULL,

[0112] issuerAltNameBLOB DEFAULT NULL,

[0113] commentSTRING DEFAULT NULL );

[0115] Among them, id is the number, which is the primary key of the relationship table; version is the version, and its default value is 1; serialNumber is the first serial number; subjectName is the subject name of the certificate; subjectAltName is the subject replacement name of the certificate; issuerName is the issuer / issuing agency name of the certificate; issuerAltName is the issuer / issuing agency replacement name of the certificate; comment is the relevant comment; the corresponding storage attributes are defined after each field, which is the conventional technical knowledge of those skilled in the art and will not be repeated here.

[0116] In some embodiments, Figure 5 As shown, Figure 5 yes Figure 3 Another implementation flowchart of step 202 in the embodiment of the present invention re-verifies the certificate response information based on the security item information to obtain the target verification result, and further includes the following steps 401 to 404:

[0117] Step 401: parse the initial verification result to obtain certificate error information indicating that the target certificate verification fails.

[0118] Step 402: When the selected security policy is a second security policy representing trust, at least one second security item information is determined based on the second security policy, and the second security item information includes a second serial number and error type information corresponding to the second serial number.

[0119] Step 403: If the certificate serial number matches any second serial number and the certificate error information matches the error type information, a third target verification result is obtained indicating that the target certificate needs to be preserved.

[0120] Step 404: otherwise, obtain a fourth target verification result indicating that the target certificate is reported as an error.

[0121] Steps 401 to 404 are described in detail below.

[0122] In some embodiments, the second security policy indicates that the corresponding second security item information is trusted by the local certificate authority. When the initial verification result indicates that the target certificate verification fails, the second security policy passes the parameters related to the second security item information to the callback function, so that the browser kernel can re-verify the certificate response information based on the callback function. In addition, the second security item information includes a second serial number used to indicate the trusted certificate, and error type information of the certificate indicated by the second serial number that indicates the browser trusts, and the second serial number is used to uniquely refer to a specific one of the multiple trusted certificates.

[0123] Furthermore, the certificate authority that issues the trust opinion may be one or more. For example, it can be set that as long as there is a certificate authority that publishes the second security project information representing the trust opinion, it will be included in the second security policy; or, it can be set that when the designated certificate authority publishes the second security project information representing the trust opinion, the corresponding second security project information will be included in the second security policy. The embodiment of the present application does not limit the scope of the definition of the second security project information, and it can be adjusted according to actual conditions.

[0124] Furthermore, when the initial verification result indicates that the target certificate verification fails, the initial verification result is parsed to obtain certificate error information indicating that the target certificate verification fails. The certificate error information may have the following preset situations:

[0125] (1) Invalid Name Constraint Violation: This means that some fields in the target certificate (such as the subject name or the issuer / issuing authority name) do not comply with the name constraints specified by the certificate issuance policy or CA organization.

[0126] (2) IIVALIDITY TOO LONG: The validity period of the target certificate exceeds the maximum period allowed by the CA or specific policy;

[0127] (3) PINNED KEY MISSING: Some browsers may require that the target certificate must use a specific public key (i.e., a "pinned" public key). If the target certificate changes its public key without updating the configuration accordingly, this error will be triggered.

[0128] (4) CERTIFICATE TRANSPARENCY REQUIRED: Target certificate transparency is a certificate verification security mechanism that requires the CA to submit relevant information to the log server before issuing the target certificate. If the browser has transparency requirements but the target certificate does not comply, this error will be triggered;

[0129] (5) SYMANTEC LEGACY: refers to the fact that old target certificates issued by Symantec, which was found to be poorly managed, may no longer be trusted;

[0130] (6) KNOWN INTERCEPTION BLOCKED: This error is triggered if the target certificate is issued by an entity that is known to intercept or tamper with communications;

[0131] (7) AUTHORITY INVALID: The target certificate is issued by an untrusted CA, or there is a problem with the target certificate issued by the CA.

[0132] (8) Common Name INVALID: The name field in the target certificate does not comply with specification or policy requirements;

[0133] (9) NO REVOCATION MECHANISM: The target certificate does not provide a revocation checking mechanism (such as a certificate revocation list or online certificate status protocol) for checking whether the target certificate has been revoked.

[0134] (10) UNABLE TO CHECK REVOCATION: Although the target certificate provides revocation checking mechanisms, the system cannot access these mechanisms;

[0135] (11) REVOKED: The target certificate has been revoked by its issuing authority and is no longer valid;

[0136] (12) Non-unique name: Some fields in the target certificate (such as subject name) are not unique in the namespace;

[0137] (13) Weak Key: The key used by the target certificate is not strong enough to provide adequate security;

[0138] (14) WEAK SIGNATURE ALGORITHM: The signature algorithm used by the target certificate is not strong enough and may be easily cracked;

[0139] (15) DATE INVALID: The validity start date or end date of the target certificate is invalid, or the usage time of the target certificate is not within its validity period.

[0140] It should be noted that, depending on the actual situation, there may be many other certificate error messages that cause the target certificate verification to fail. The specific situations can be set according to the actual situation and will not be listed one by one here, but it does not mean that this application will limit the certificate error messages.

[0141] Furthermore, the certificate serial number and the second serial number are first compared; when the certificate serial number and the second serial number match, the certificate error information and the error type information are further compared; when the certificate error information and the error type information also match, a third target verification result is obtained, indicating that the target certificate needs to be preserved. For example, Figure 1 As shown, the lower-level certificate authority 2-1 trusts the root CA certificate issued by the root certificate authority. When the browser accesses the website server managed by the lower-level certificate authority 2-1, if the corresponding initial verification result fails, if the certificate serial number and the second serial number, the certificate error information and the error type information all match, it means that the local certificate authority recognizes the specified error in the specified target certificate, and then obtains the third target verification result of passing the verification. Moreover, in the case of obtaining the third target verification result, even if the initial verification result indicating that the target certificate verification fails is obtained, the user can still use the browser to access the target network, thereby improving the reliability of the target network access.

[0142] Otherwise, a fourth target verification result indicating a target certificate error is obtained. The fourth target verification result error may be reported in the form of contacting the website server administrator; or in the form of a pop-up window, the error message may be displayed on the front end of the browser, and the user may choose whether to trust the target website; of course, the error report form may be specifically set according to the actual situation, and the present application embodiment does not limit this.

[0143] Furthermore, the second security project information can also be stored in a lightweight data exchange format (JSON file) to form a second security strategy, and quickly pass relevant parameters to the callback function when the callback function is called. For example, a second security project information (LocalCertWhiteFilters) is stored in a JSON file in the form of a relational table, as shown below:

[0144] Table LocalCertWhiteFilters(

[0145] idINTEGER PRIMARY KEY,

[0146] versionINTEGER DEFAULT 1,

[0147] ErrorNoINTEGER DEFAULT 201,

[0148] serialNumberINTEGER DEFAULT NULL,

[0149] subjectNameBLOB DEFAULT NULL,

[0150] subjectAltNameBLOB DEFAULT NULL,

[0151] commentSTRING DEFAULT NULL );

[0153] The specific interpretation of the same parameters is the same as LocalCertBlackAssertions illustrated in steps 301 to 304, and will not be repeated here. In particular, ErrorNo is the certificate error type, and 201 in "DEFAULT 201" is a serial number obtained by pre-encoding multiple certificate error types, which can be adaptively adjusted according to actual conditions.

[0154] In some embodiments, obtaining a third target verification result indicating that a target certificate needs to be preserved includes the following steps 501:

[0155] Step 501, delete the certificate error information, and obtain a third target verification result indicating that the target certificate needs to be preserved.

[0156] The following is a detailed description of step 501.

[0157] Among them, certificate error information is the main reason for the failure of the target certificate. Therefore, when the target certificate needs to be preserved based on the callback function verification, the certificate error information is deleted and the updated target certificate is obtained. In this way, the browser can establish a secure communication connection with the target website based on the target certificate without certificate error information, thereby improving the reliability of access to the target website.

[0158] Furthermore, the browser kernel can completely delete the certificate error information operation by calling the preset HandleverifyResult function. Moreover, the "delete" operation can be to directly remove the certificate error information from the certificate response information, or ignore the certificate error information, such as changing the certificate error information to comment information, etc. Of course, the specific deletion operation can be set according to the actual situation, and the embodiment of the present application does not limit this.

[0159] In some embodiments, Figure 6 As shown, Figure 6 yes Figure 3 Another implementation flowchart of step 202 in the embodiment of the present invention re-verifies the certificate response information based on the security item information to obtain the target verification result, and further includes the following steps 601 to 604:

[0160] Step 601: When the selected security policy includes both the first security policy and the second security policy, the certificate response information is verified based on the first security item information.

[0161] Step 602: If the target verification result obtained is the second target verification result, continue to verify the certificate response information based on the second security item information.

[0162] Step 603: If the certificate serial number matches any second serial number and the certificate error information matches the error type information, the second target verification result is changed to a third target verification result.

[0163] Step 604: otherwise, maintain the second target verification result unchanged.

[0164] Steps 601 to 604 are described in detail below.

[0165] In some embodiments, to improve the reliability of certificate verification, a first security policy and a second security policy are configured in the browser kernel at the same time. In this case, the verification priority of the first security policy is greater than that of the second security policy.

[0166] Furthermore, after verification based on the first security strategy, if the target verification result obtained is the second target verification result, it means that the relevant parameters of the target certificate are not included in the second security project information, that is, only when the target certificate is not distrusted by any certificate authority or other third-party organization, can the certificate response information continue to be verified based on the second security project information to ensure the reliability of the browser accessing the target network.

[0167] Furthermore, when verifying the certificate response information based on the second security item information, if a third target verification result representing trust in the target certificate is obtained, the third target verification result is used as the final target verification result after re-verifying the target certificate response information. At this time, the browser can access the target website normally.

[0168] In some embodiments, Figure 7 As shown, Figure 7 yes Figure 3 Another implementation flowchart of step 202 in the embodiment of the present invention re-verifies the certificate response information based on the preservation project information to obtain the target verification result, and further includes the following steps 701 to 702:

[0169] Step 701: When the selected security policies include both the first security policy and the second security policy, and the certificate response information matches both the first security item information and the second security item information, the one with a more recent update time between the first security policy and the second security policy is determined as the target security policy.

[0170] Step 702, determine the corresponding target preservation project information according to the selected target preservation strategy, verify the certificate response information based on the target preservation project information, and obtain a target verification result, wherein the target verification result is one of the first target verification result, the second target verification result, the third target verification result and the fourth target verification result.

[0171] Steps 701 to 702 are described in detail below.

[0172] In some embodiments, the certificate serial number may exist in both the first security policy and the second security policy. When the certificate response information matches both the first security item information and the second security item information, it may be that one of the security policies has not been updated in time, resulting in a conflict between the two security policies representing trust and distrust. In this case, it is possible to determine which security policy is more reliable by obtaining and comparing the update time of the two security policies in the browser kernel, and to use the corresponding security policy with an update time closer to the current time as the target security policy. The target security policy may be the first security policy or the second security policy.

[0173] Furthermore, when the target security policy is the first security policy, the certificate response information is re-verified based on steps 301 to 304; when the target security policy is the second security policy, the certificate response information is re-verified based on steps 401 to 404. The specific verification steps will not be repeated here.

[0174] Step 104, when the target verification result indicates that the target certificate verification is passed, the certificate response information is encrypted based on the key generated by the browser itself, and the encryption result is sent to the target website, so as to access the target website based on the secure channel established by the encryption result.

[0175] Step 104 is described in detail below.

[0176] Among them, the key generated by the browser itself is a private key, and then the browser uses the private key to encrypt the public key in the certificate response information; or, the browser can use the private key to encrypt the verification information in the certificate response information; this application does not limit the specific content of the encryption.

[0177] Furthermore, in the related art, when the initial verification result indicates that the target certificate verification has failed, it will not autonomously establish a secure channel between the browser and the target website, and the traditional manual judgment method greatly increases the uncertainty of access security. The embodiment of the present application can re-verify the certificate response information by scheduling the callback function in the browser kernel, thereby improving the reliability of target website access; and avoiding the tedious manual configuration required for normal access, thereby improving the access speed of the target website.

[0178] like Figure 8 As shown, Figure 8 801 is an optional module diagram of a browser-based website access device provided in an embodiment of the present application. The access device includes the following modules 801 to 804:

[0179] The acquisition module 801 is used to send an access request to a target website and receive certificate response information corresponding to at least one target certificate returned by the target website.

[0180] The basic verification module 802 is used to call a default function from a preset underlying protocol library, and verify the certificate response information based on the default function to obtain an initial verification result.

[0181] The re-verification module 803 is used to call the callback function from the underlying protocol library when the initial verification result indicates that the target certificate verification fails, and re-verify the certificate response information based on the callback function to obtain the target verification result, wherein the callback function is constructed by at least one pre-configured security policy.

[0182] The target access module 804 is used to encrypt the certificate response information based on the key generated by the browser itself when the target verification result indicates that the target certificate verification has passed, and send the encryption result to the target website to access the target website based on the secure channel established by the encryption result.

[0183] It is understandable that in the related art, when the browser kernel calls the default function to verify the target certificate, no matter whether the verification result is successful or failed, the target certificate will not be re-verified. If the target certificate that represents access security is maliciously revoked by the root certificate authority in other regions, the normal access based on the browser is interrupted and the new access based on the browser is blocked, thereby causing business interruption, business loss and other problems, and even causing direct economic losses to the relevant access applicants or applicants. In comparison, the access method proposed in the embodiment of the present application can re-verify the certificate response information by calling a callback function pre-configured with at least one preservation policy, so as to give the local browser a certain verification option for the target certificate, thereby avoiding the decrease in the reliability of the browser accessing the target website due to the malicious invalidation of the target certificate.

[0184] The present application proposes a browser-based website access method, device, equipment and medium, the method comprising sending an access request to a target website, and receiving certificate response information corresponding to at least one target certificate returned by the target website; calling a default function from a preset underlying encryption library, and verifying the certificate response information based on the default function to obtain an initial verification result; when the initial verification result indicates that the target certificate verification fails, calling a callback function from the underlying encryption library, and re-verifying the certificate response information based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured preservation policy, and re-verifying the certificate response information can prevent the target certificate that itself represents access security from being not issued by a certificate authority in other regions, thereby causing the original normal access based on the browser to be interrupted, and the new access to be based on the browser to be blocked, thereby causing business interruption, business loss and other situations; when the target verification result indicates that the target certificate verification passes, encrypting the certificate response information based on a key generated by the browser itself, and sending the encrypted result to the target website, so as to access the target website based on a secure channel established by the encryption result, thereby improving the reliability of the browser access to the target website.

[0185] The specific implementation of the access device is substantially the same as the specific implementation of the access method described above, and will not be described in detail herein.

[0186] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above access method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0187] like Fig. 9 As shown, Fig. 9 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0188] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0189] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the access method of the embodiment of this application;

[0190] Input / output interface 903, used to implement information input and output;

[0191] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0192] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0193] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0194] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, and the computer program implements the above-mentioned access method when executed by a processor.

[0195] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0196] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0197] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0198] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0199] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0200] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0201] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0202] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0203] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0204] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0205] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0206] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for accessing a website based on a browser, characterized in that: Applied to a browser, the method comprises: Sending an access request to a target website, and receiving certificate response information corresponding to at least one target certificate returned by the target website; Retrieving a default function from a preset underlying protocol library, and verifying the certificate response information based on the default function to obtain an initial verification result, wherein the underlying protocol library is a function library predefined and configured in the browser kernel, the underlying protocol library includes a plurality of encryption functions, each of the encryption functions is encapsulated as a reusable module or component, the default function is one of the encryption functions, and the default function is the SSL_CTX_load_verify_locations function; When the initial verification result indicates that the target certificate verification fails, a callback function is called from the underlying protocol library, and the certificate response information is re-verified based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured security policy, the callback function is one of the encryption functions, the callback function is a verify_callback function, and the scheduling priority of the default function is higher than the callback function; When the target verification result indicates that the target certificate verification has passed, encrypting the certificate response information based on the key generated by the browser itself, and sending the encryption result to the target website, so as to access the target website based on the secure channel established by the encryption result; The re-verifying the certificate response information based on the callback function to obtain a target verification result includes: Selecting at least one from the plurality of security strategies preset by the callback function, and determining corresponding security item information according to the selected security strategy; Re-verifying the certificate response information based on the security item information to obtain the target verification result; The target verification result includes a first target verification result and a second target verification result; The re-verifying the certificate response information based on the security item information to obtain the target verification result includes: When the selected security policy is a first security policy representing untrustworthiness, determining at least one first security item information based on the first security policy, wherein the first security item information includes a first sequence number; Parsing the certificate response information to obtain the certificate serial number; If the certificate serial number matches the first serial number, obtaining the first target verification result indicating that the target certificate does not need to be preserved; Otherwise, obtaining the second target verification result indicating that the target certificate reports an error; The target verification result also includes a third target verification result and a fourth target verification result; The re-verifying the certificate response information based on the security item information to obtain the target verification result further includes: Parsing the initial verification result to obtain certificate error information indicating that the target certificate verification failed; When the selected security policy is a second security policy representing trust, determining at least one second security item information based on the second security policy, the second security item information including a second sequence number and error type information corresponding to the second sequence number; If the certificate serial number matches any of the second serial numbers, and the certificate error information matches the error type information, obtaining the third target verification result indicating that the target certificate needs to be preserved; Otherwise, the fourth target verification result indicating that the target certificate reports an error is obtained.

2. The method according to claim 1, characterized in that The re-verifying the certificate response information based on the security item information to obtain the target verification result further includes: When the selected security policy includes both the first security policy and the second security policy, verifying the certificate response information based on the first security item information; If the target verification result obtained is the second target verification result, continue to verify the certificate response information based on the second security item information; If the certificate serial number matches any of the second serial numbers, and the certificate error information matches the error type information, changing the second target verification result to the third target verification result; Otherwise, the second target verification result remains unchanged.

3. The method according to claim 1, characterized in that The re-verifying the certificate response information based on the security item information to obtain the target verification result further includes: When the selected security policy includes both the first security policy and the second security policy, and the certificate response information matches both the first security item information and the second security item information, determining the one with a more recent update time between the first security policy and the second security policy as the target security policy; Determine corresponding target preservation project information according to the selected target preservation strategy, verify the certificate response information based on the target preservation project information, and obtain the target verification result, wherein the target verification result is one of the first target verification result, the second target verification result, the third target verification result and the fourth target verification result.

4. The method according to claim 1, characterized in that: The obtaining of the third target verification result indicating that the target certificate needs to be preserved includes: The certificate error information is deleted to obtain the third target verification result indicating that the target certificate needs to be preserved.

5. A browser-based website access device, characterized in that: The device comprises: An acquisition module, used to send an access request to a target website and receive certificate response information corresponding to at least one target certificate returned by the target website; A basic verification module, used to call a default function from a preset underlying protocol library, and verify the certificate response information based on the default function to obtain an initial verification result, wherein the underlying protocol library is a function library predefined and configured in the browser kernel, the underlying protocol library includes a plurality of encryption functions, each of the encryption functions is encapsulated as a reusable module or component, the default function is one of the encryption functions, and the default function is the SSL_CTX_load_verify_locations function; a re-verification module, configured to, when the initial verification result indicates that the target certificate verification fails, call a callback function from the underlying protocol library, and re-verify the certificate response information based on the callback function to obtain a target verification result, wherein the callback function is constructed by at least one pre-configured security policy, the callback function is one of the encryption functions, the callback function is a verify_callback function, and the scheduling priority of the default function is higher than that of the callback function; A target access module, configured to encrypt the certificate response information based on a key generated by the browser itself when the target verification result indicates that the target certificate verification has passed, and send the encryption result to the target website, so as to access the target website based on a secure channel established by the encryption result; The re-verifying the certificate response information based on the callback function to obtain a target verification result includes: Selecting at least one from the plurality of security strategies preset by the callback function, and determining corresponding security item information according to the selected security strategy; Re-verifying the certificate response information based on the security item information to obtain the target verification result; The target verification result includes a first target verification result and a second target verification result; The re-verifying the certificate response information based on the security item information to obtain the target verification result includes: When the selected security policy is a first security policy representing untrustworthiness, determining at least one first security item information based on the first security policy, wherein the first security item information includes a first sequence number; Parsing the certificate response information to obtain the certificate serial number; If the certificate serial number matches the first serial number, obtaining the first target verification result indicating that the target certificate does not need to be preserved; Otherwise, obtaining the second target verification result indicating that the target certificate reports an error; The target verification result also includes a third target verification result and a fourth target verification result; The re-verifying the certificate response information based on the security item information to obtain the target verification result further includes: Parsing the initial verification result to obtain certificate error information indicating that the target certificate verification failed; When the selected security policy is a second security policy representing trust, determining at least one second security item information based on the second security policy, the second security item information including a second sequence number and error type information corresponding to the second sequence number; If the certificate serial number matches any of the second serial numbers, and the certificate error information matches the error type information, obtaining the third target verification result indicating that the target certificate needs to be preserved; Otherwise, the fourth target verification result indicating that the target certificate reports an error is obtained.

6. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the browser-based website access method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the browser-based website access method according to any one of claims 1 to 4 is implemented.

Images