Website access control method and device, computer equipment and readable storage medium

Abstract

The embodiment of the invention provides a website access control method and device, computer equipment and a readable storage medium. The method comprises the steps of obtaining a website access request sent by a user browser for a target website, forwarding the website access request to the target website through remote browser proxy service, and receiving a target certificate returned by the target website; verifying the target certificate through the remote browser proxy service to obtain a verification result; when the verification result represents that the verification state of the target certificate is wrong, querying the target certificate according to a preset security policy data table to obtain a query result; when the target certificate is represented as a credible certificate according to the query result, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request; and returning the access data to the user browser. Therefore, the website access stability of the browser can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a website access control method, device, computer equipment and readable storage medium. Background Art

[0002] Public key infrastructure is a system that uses public key cryptography to achieve secure communication and digital signatures. In a public key infrastructure, there are usually multiple layers of certificate authorities that are linked layer by layer, and these certificate authorities manage the certificate resources of all certificate authorities that are linked to them in the lower layers.

[0003] In the related art, when a user accesses a website through a browser, the relevant certificate resources are used for verification, and the browser is allowed to access the website only after the verification is passed, thereby ensuring the security of the website access. However, the upper-level certificate authority is usually set up in different regions and managed by the management object of the region. When using the original method to access the website, there are problems such as the different regions between the browser and the upper-level certificate authority, network and human interference, which make the certificate resources of the website invalid, thereby making it impossible to perform stable website access. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide a website access control method, device, computer equipment and readable storage medium, which can effectively improve the stability of browser access to the website.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a website access control method, which is applied to a website proxy gateway. The method includes:

[0006] Obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website through a remote browser proxy service, and receiving a target certificate returned by the target website;

[0007] Verifying the target certificate through the remote browser proxy service to obtain a verification result;

[0008] When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset security policy data table to obtain a query result;

[0009] When the target certificate is characterized as a credible certificate according to the query result, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request;

[0010] The access data is returned to the user's browser.

[0011] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a website access control device, which is applied to a website proxy gateway, and the device includes:

[0012] An acquisition module is used to acquire a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website;

[0013] A verification module, used to verify the target certificate through the remote browser proxy service to obtain a verification result;

[0014] A query module, configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error;

[0015] A control module, configured to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is characterized as a trusted certificate according to the query result;

[0016] The returning module is used to return the access data to the user browser.

[0017] In some implementations, the query module is further used to:

[0018] When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset security policy data table;

[0019] When the target directory is a trusted authority directory, comparing the first comparison information of the trusted authority directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information;

[0020] A query result is obtained according to the first comparison result.

[0021] In some implementations, the query module is further used to:

[0022] When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset security policy data table;

[0023] When the target directory is a trust revocation directory, comparing the second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information;

[0024] A query result is obtained according to the second comparison result.

[0025] In some implementations, the website access control device further includes a deletion module, which is used to:

[0026] In the trust revocation directory, the number of verifications of each certificate included therein is accumulated;

[0027] When there is a certificate in the trust revocation directory whose cumulative verification times exceed the preset times, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result;

[0028] When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

[0029] In some embodiments, the return module is further used to:

[0030] Obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet Protocol address, and target device information corresponding to the user browser;

[0031] Based on the user identity information, controlling the remote browser proxy service to screen the access data to obtain target access data;

[0032] The target access data is returned to the user browser.

[0033] In some implementations, the query module is further used to:

[0034] When the verification result indicates that the verification status of the target certificate is wrong, determining the trust level of the target website;

[0035] Based on the trust level of the target website, determining the order in which the target certificate queries the certificate directory in the security policy data table;

[0036] According to the order of the query certificate directories, the corresponding certificate directory is selected to query the target certificate to obtain the query result.

[0037] To achieve the above purpose, a third aspect of the embodiments of the present application proposes a website access control method, which is applied to a user browser, and the method includes:

[0038] Sending a website access request to a target website so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website, and verifies the target certificate through the remote browser proxy service to obtain a verification result; when the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a pre-set security policy data table to obtain a query result; when the query result indicates that the target certificate is a trusted certificate, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request;

[0039] The access data returned by the remote browser proxy service is received.

[0040] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer device, wherein the computer device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the website access control method described in any one of the first aspect embodiment or the third aspect embodiment of the present application.

[0041] To achieve the above-mentioned purpose, the fifth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the website access control method described in any one of the first aspect embodiments or the third aspect embodiments of the present application.

[0042] The embodiment of the present application obtains the website access request sent by the user browser to the target website, forwards the website access request to the target website through the remote browser proxy service, and receives the target certificate returned by the target website; verifies the target certificate through the remote browser proxy service to obtain the verification result; when the verification result indicates that the verification status of the target certificate is wrong, queries the target certificate according to the pre-set security policy data table to obtain the query result; when the target certificate is a trusted certificate according to the query result, controls the remote browser proxy service to access the target website, obtains the access data corresponding to the website access request; and returns the access data to the user browser. In this way, a trusted connection between the user browser and the remote browser proxy service can be established by setting the remote browser proxy service, and when the remote browser proxy service finds that the verification status of the target certificate is wrong, it does not directly terminate the access, but makes further judgments according to the security policy data table to effectively solve the problem of inaccessibility, thereby effectively improving the stability of the browser in accessing the website. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a structural diagram of a website public key infrastructure provided by an embodiment of the present application;

[0044] Figure 2 is a flow chart of a website access control method provided by an embodiment of the present application;

[0045] Figure 3 It is an overall flow chart of the website access control method provided by the embodiment of the present application;

[0046] Figure 4 It is a functional module diagram of a website access control device provided in an embodiment of the present application;

[0047] Figure 5 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0051] First, some nouns involved in this application are analyzed:

[0052] Web Public Key Infrastructure (WebPKI) is a system that uses public key cryptography to achieve secure communication and digital signatures. It provides a trust model that allows users to be sure that the person they are communicating with is trustworthy and that the content of the communication will not be tampered with.

[0053] Reference Figure 1 , is a schematic diagram of the structure of a website public key infrastructure provided by an embodiment of the present application. Figure 1 As shown in , in the related art, it is usually composed of multiple certificate authorities associated layer by layer, including a root certificate authority at the top layer, multiple upper certificate authorities associated with the root certificate authority, and multiple lower certificate authorities associated with the upper certificate authority, and each lower certificate authority is associated with multiple website servers for performing resource certificate authorization on these website servers so that these website servers can manage multiple resource websites. It can be understood that the embodiment of the present application is illustrated with only three layers of certificate authorities, and in actual applications, there are usually more certificate authority architectures than three layers.

[0054] When any user browser visits a resource website managed by a network server, the user browser will usually use the digital certificate obtained in advance from the website server of the website to verify the identity of the website, including but not limited to whether the certificate is expired or revoked. If the certificate verification is successful and the information in the certificate is consistent with the visited website, the identity of the website is considered to have been confirmed, allowing the user to establish an encrypted connection with the website; otherwise, the verification fails and the user browser cannot access the corresponding resource website, thereby ensuring the security of website access.

[0055] However, if Figure 1 As shown in the website public key infrastructure, generally speaking, the root certificate authority and the upper certificate authority are set up in different regions and are managed by the management object of the region. When a user browser in a different region needs to access a resource website indirectly managed by the upper certificate authority in the region, there are trust issues due to the different regions between the user browser and the upper certificate authority, network and human interference, etc., as described below.

[0056] 1) Risk of Root Certificate Authority (CA) stopping issuing certificates (isolation and blinding risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region does not issue a resource certificate to the website server due to distrust between the two regions, or due to network problems between the two regions, the resource website managed by the network server will not be able to be used normally.

[0057] 2) Risk of root CA revoking issued certificates (disappearance risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region cancels the resource certificate originally issued to the website server due to distrust between the two regions, the encryption services of all domain name websites of the website server will disappear, and the encryption services between the corresponding domain name websites and user servers will be interrupted, causing the entire network system to be paralyzed.

[0058] 3) Risk of certificate tampering (hijacking risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, when the root certificate authority in another region is attacked or performs malicious operations or issues certificates containing false information, it is easy for the resource website held by the website server to be attacked or even hijacked.

[0059] 4) Information security risk: When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, the daily traffic network service information of the website server in that region (such as website access information of the user's browser) will be mastered by the root certificate authority in another region. If the relationship between the two regions is not harmonious, it will cause serious information security leakage risks.

[0060] In reality, in the current website public key infrastructure, many root certificate authorities are usually set up in a few regions, and then the root certificate authorities in a few regions are directly or indirectly associated with website servers in most regions. When there is distrust or conflict between regions, the above four malicious situations will easily occur, making the browser less stable when accessing the website.

[0061] Based on this, the embodiments of the present application provide a website access control method, apparatus, computer equipment and readable storage medium, which can effectively improve the stability of website access by the browser.

[0062] The website access control method in the embodiments of the present application can be illustrated by the following embodiments.

[0063] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0064] In the embodiment of the present application, the website access control device will be described from the perspective of the website access control device, which is applied to the website proxy gateway and can be specifically integrated in a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the website access control method provided in the embodiment of the present application. The embodiment of the present application takes the website access control device as an example, which is specifically integrated in a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the website access control method, the specific process is as follows:

[0065] Step 101, obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website through a remote browser proxy service, and receiving a target certificate returned by the target website.

[0066] In some implementations, in order to ensure the stability of user browser access to the target website, the website access request sent by the user browser can be forwarded to the target website through the remote browser proxy service, which can alleviate the risk of access interruption caused by certificate problems due to abnormal reasons to a certain extent and improve the security and reliability of access.

[0067] The user browser may be software installed on a user device (such as a personal computer, mobile phone, tablet computer, etc.) for browsing web pages and communicating with website servers. The main functions of the user browser include, but are not limited to, sending HyperText Transfer Protocol (HTTP) requests, presenting web page content, managing small text files, and executing code.

[0068] The target website can be a specific website or network resource that the user wants to access through a browser. For example, the target website can be a commercial site, a social media platform, an information service portal, or any other form of online content provider. The target website is usually hosted by a group of servers, which are responsible for responding to requests from user browsers and returning target certificates for verifying the identity of the website. After the target certificate is passed, the corresponding web page or data is returned to the user's browser.

[0069] The website access request may be a request sent by a user's browser to a website server to obtain content or services of a target website.

[0070] Among them, the remote browser proxy service can be an intermediate layer service located between the user browser and the target website, which is set on the website proxy gateway. Its main responsibility is to receive website access requests sent by the user browser, forward these requests to the target website, and receive data returned by the target website (including but not limited to web page content and certificates). In addition, when the certificate of the server where the target website is located is revoked, etc., causing the user browser to be unable to access the target website normally, the remote browser proxy service can also verify the target certificate, and further check the status of the target certificate provided by the target website according to the pre-set security policy data table to ensure the security and reliability of website access.

[0071] The target certificate can be a digital certificate returned by the website server of the target website after receiving the access request from the user's browser. The target certificate contains information about the identity of the website, such as the website's domain name, certificate validity period, and the certificate authority that issued the certificate. The target certificate is used to verify the authenticity of the target website and ensure that the communication between the user's browser and the target website is encrypted and secure.

[0072] In some embodiments, the user browser pre-imports the trusted root certificate of the website proxy gateway to establish a trusted connection between the user browser and the website proxy gateway. The website proxy gateway can receive requests from a client (such as a user browser) and forward these requests to a target server, and can also receive responses from the target server and return them to the user browser.

[0073] In some embodiments, the remote browser proxy service can be designed to serve multiple user browsers. For example, in an enterprise environment, user browsers installed on employees' devices (such as mobile devices, etc.) can access external target websites through the same website proxy gateway, which enables the enterprise to implement unified security policies and monitoring. In educational institutions, students and teachers can access the Internet through the website proxy gateway in the campus network to control the user browser's access to the target website. In this way, resource utilization can be maximized, the stability and security of access can be improved, and high-quality services can be provided at a lower cost.

[0074] For example, if user A needs to access an e-commerce website www.xxxx.com through a user browser, after user A enters www.xxxx.com in the user browser and confirms it, the user browser sends a website access request. The gateway will reliably intercept the website access request and control the remote browser proxy service to forward the received request to the server of the e-commerce website www.xxxx.com.

[0075] Furthermore, after receiving the website access request, the server of the target website www.xxxx.com returns a target certificate (digital certificate) for verifying the identity of the target website, so that the remote browser proxy service can verify the target certificate.

[0076] A forwarding channel is established between the user's browser and the target website through the remote browser proxy service, effectively improving the security and reliability of website access.

[0077] Step 102: Verify the target certificate through the remote browser proxy service to obtain a verification result.

[0078] In some implementations, in order to determine whether the target certificate is valid, the target certificate can be verified through a remote browser proxy service to centrally manage certificate verification policies. Users do not need to configure complex certificate verification rules in local browsers, reducing user operation difficulty.

[0079] The verification result may be a conclusion obtained by the remote browser proxy service after receiving the target certificate returned by the target website and performing a series of checks and verifications on the target certificate.

[0080] Exemplarily, the remote browser proxy service may first verify the validity of the target certificate. For example, the target certificate may be verified from aspects such as the validity of the certificate, the revocation status of the certificate, the issuer of the certificate, and the consistency between the certificate and the target website. For example, for the validity verification of the certificate, it may be checked whether the target certificate is within the validity period, that is, whether the start date and end date of the target certificate cover the current date; for the validity verification of the certificate, it may be checked whether the certificate is valid by querying the Certificate Revocation List (CRL) or by the Online Certificate Status Protocol (OCSP). For the issuer verification of the certificate, it may be verified whether the certificate is issued by a trusted Certificate Authority (CA). For the consistency verification of the certificate and the target website, it may be verified by confirming that the information in the certificate (such as the domain name) matches the target website attempted to be accessed. Further, the verification of the target certificate may also include the verification of the integrity of the certificate chain of the target certificate, etc.

[0081] Exemplarily, when the verification result can indicate whether the target certificate is legal, has not been tampered with, has not been revoked, and is trustworthy. When the target certificate is a legal, untampered, unrevoked trusted certificate, that is, the verification result indicates that the verification status of the target certificate is correct, then the verification result can be forwarded to the user's browser, and the user's browser can establish an encrypted connection with the target website through the remote browser proxy service of the website proxy gateway. If the target certificate is illegal, tampered with, or the trusted certificate is revoked, it indicates that the verification has failed and needs to be further processed by the remote browser proxy service.

[0082] Verifying the target certificate through a remote browser proxy service instead of directly by the user's browser can avoid problems such as the target certificate being maliciously interrupted or revoked. The target certificate can be preserved through a remote browser proxy service to ensure the stability and security of website access.

[0083] Step 103: When the verification result indicates that the verification status of the target certificate is an error, the target certificate is queried according to a preset security policy data table to obtain a query result.

[0084] In some embodiments, in order to provide an additional protection mechanism when problems arise in verifying the target certificate during the standard verification process, when the verification result indicates that the verification status of the target certificate is incorrect, the target certificate can be queried according to a pre-set preservation policy data table, so that in the event of certificate verification failure, the true status of the certificate can be confirmed through an additional mechanism to ensure that the user browser can still safely access the website when necessary.

[0085] The security policy data table may be a pre-set database or file, which contains information for determining how to handle target certificates with verification status errors. The security policy data table is mainly used to further determine whether the target certificate is credible according to predefined rules when the remote browser proxy service finds that the verification status of the target certificate is wrong, so as to determine whether to allow the user browser to continue to access the target website.

[0086] The query result may be a conclusion obtained after the remote browser proxy service queries the target certificate according to the security policy data table, and is used to indicate whether the target certificate is credible.

[0087] In some embodiments, the security policy data table may include, but is not limited to, a trust authority directory and a trust revocation directory. The trust authority directory contains information about certificates that are considered trustworthy, such as the serial number, subject name, and alternate name of the certificate. When a target certificate appears in the trust authority directory, it will be considered a trustworthy certificate even if the verification result indicates that the verification status is an error.

[0088] Furthermore, the trust revocation directory contains information about certificates that are considered untrustworthy, such as the certificate's serial number, subject name, alternative name, issuer name and its alternative name, etc. If the verification result indicates that the verification status of the target certificate is an error and the target certificate appears in the trust revocation directory, the target certificate is considered an untrustworthy certificate and the user's browser will not be able to access the target website.

[0089] In some implementations, the administrator can first write a local certificate preservation policy database table, or generate a JSON file for the local certificate preservation policy, and store the preservation policy in the form of a database or JSON file in a specific directory of the website proxy gateway. When the website proxy gateway verifies the certificate for preservation, the website proxy gateway program accesses the database table through the database interface, or reads the JSON file content in the form of a file read and write interface.

[0090] Through the above method, when the target certificate verification status is wrong, the credibility of the target certificate can be further judged to decide whether to allow the user browser to continue to access the target website, thereby ensuring security while providing a flexible access control mechanism, thereby improving the stability and security of the user browser accessing the target website.

[0091] In some implementations, in order to improve the efficiency of the query, the query order of the certificate directory that needs to be queried first can be determined according to the trust level of the target website to reduce unnecessary query operations. For example, step 103 may include:

[0092] (103.a1) when the verification result indicates that the verification status of the target certificate is erroneous, determining a trust level of the target website;

[0093] (103.a2) Based on the trust level of the target website, determine the order in which the target certificate is queried in the certificate directory in the preservation strategy data table;

[0094] (103.a3) According to the order of querying the certificate directory, select the corresponding certificate directory to query the target certificate and obtain the query result.

[0095] The trust level can be a grade mark assigned after evaluating the security and trustworthiness of the target website. The trust level reflects the importance, sensitivity and security requirements of each website.

[0096] The certificate directory may be a list in the security policy data table used to verify the credibility of the target certificate, including a trust authorization directory and a trust revocation directory.

[0097] The order of precedence may be the priority order of querying the certificate directory determined according to the trust level of the target website when querying the target certificate. By setting the order of precedence, the certificate directory that is most likely to provide accurate credibility judgment can be queried first, thereby reducing unnecessary query operations.

[0098] For example, for the trust level, a high trust level, a medium trust level and a low trust level can be set. Among them, the high trust level may involve sensitive information, financial transactions or important business functions, such as bank websites and official websites. The medium trust level website may contain personal information or business information, such as e-commerce websites. The low trust level website may contain public information, such as forum websites, etc.

[0099] Furthermore, for target websites with a high trust level, the trust authorization directory can be queried first and then the trust revocation directory; for target websites with a medium trust level, the order of queries is not restricted; and for target websites with a low trust level, the trust revocation directory can be queried first and then the trust authorization directory. In this way, according to the specific situation of the target website, the certificate directory that is most likely to provide accurate credibility judgment can be queried first, thereby reducing unnecessary query operations, improving query efficiency, and ensuring the security of the system.

[0100] In some implementations, the number of items to be queried for the target certificate of the target website in the certificate directory can be determined based on the trust level of the target website, and the corresponding certificate directory can be queried according to the number of items to be queried. For example, for a target certificate with a high trust level, only the serial number of the certificate in the trust authorization directory needs to be queried. For a target certificate with a low trust level, the serial number of the certificate, the subject name of the certificate, the subject replacement name of the certificate, etc. need to be queried in the trust authorization directory.

[0101] By adjusting the order and number of certificate queries based on the trust level of the target website, you can improve query efficiency while ensuring system security.

[0102] In some implementations, in order to further determine the credibility of the target certificate by comparing the preservation policy data table when the certificate verification status is an error, the target directory (such as the trust revocation directory and the trust authorization directory) where the target certificate is located can be first determined, and the key information of the target certificate can be further compared in the target directory to ensure the consistency and accuracy of the comparison result. For example, step 103 can also include:

[0103] (103.b1) When the verification result indicates that the verification status of the target certificate is wrong, determine the target directory corresponding to the target certificate from the pre-set preservation policy data table;

[0104] (103.b2) When the target directory is a trusted authorization directory, compare the first comparison information of the trusted authorization directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information;

[0105] (103.b3) Obtain a query result based on the first comparison result.

[0106] The target directory may be a directory of certificates that needs to be queried when certificate verification fails, determined according to the trust level of the target website. This directory may be a trust authorization directory or a trust revocation directory.

[0107] The trusted authority directory may be a list of known trusted certificates, which is used to verify the trustworthiness of a target certificate. Certificates in the white directory are considered reliable even if they have problems during the standard verification process.

[0108] The first comparison result may be: the first comparison result refers to the result obtained after comparing the first comparison information in the trusted authorization directory with the target certificate. This result will indicate whether the target certificate matches a certain information in the white directory.

[0109] The first certificate version number may be: The first certificate version number refers to the version number of the first certificate used for comparison in the trusted authority directory. This version number is used to ensure that the current version of the certificate information is compared.

[0110] The first certificate error type may be: The first certificate error type refers to the error type of the first certificate used for comparison in the trusted authority directory. This error type is used to identify specific problems that may occur with the certificate.

[0111] The first certificate serial number may be the serial number of the first certificate used for comparison in the trusted authority directory. This serial number is used to uniquely identify the certificate.

[0112] The first certificate subject name may be the subject name of the first certificate used for comparison in the trust authority directory. This name is used to confirm the holder of the certificate.

[0113] The first certificate subject alternative name may be the first certificate subject alternative name, which refers to the subject alternative name of the first certificate used for comparison in the trust authority directory. This alternative name is used to cover all domain names that may be involved in the certificate.

[0114] The annotation of the first comparison information may be the annotation of the first comparison information refers to the relevant annotation information of the first certificate used for comparison in the trusted authority directory. This annotation provides additional description or explanation.

[0115] In some implementations, the trust authorization directory may be managed in a data table format, and the storage format of the trust authorization directory (LocalCertWhiteFilters) in the website proxy gateway may be as follows:

[0116]

[0117] Among them, id is the storage number of the corresponding certificate in the trust authorization directory, that is, the primary key of the trust authorization directory; Version is the version number of the first certificate, and the default value is 1; ErrorNo is the error type of the first certificate, and the default value is ERR_CERT_REVOKED; serialNumber is the serial number of the first certificate; subjectName is the name of the first certificate subject; subjectName is the alternative name of the first certificate subject; comment is the annotation of the first comparison information.

[0118] In some implementations, the trust authorization directory may also be managed in the form of a JSON file, and the meaning of the fields is the same as that of management in a data table format, which will not be described in detail here.

[0119] For example, the trust authority directory (LocalCertWhiteFilters) can be specified in the following JSON format:

[0120]

[0121]

[0122] The member CertWhiteFilters is represented by an array of zero or more objects, each of which must contain at least one of the members "serialNumber", "subjectName" and "subjectAltName", or a combination of them. "comment" is optional and is used to annotate this configuration item.

[0123] Exemplarily, if the target directory corresponding to the target certificate a is a trusted authorization directory, the first comparison information corresponding to the target certificate a can be extracted from the trusted authorization directory. For example, the first comparison information is as follows:

[0124] First certificate version number: 1

[0125] First certificate error type: 201

[0126] First certificate serial number: 1234567890

[0127] First certificate subject name: bank.example.com

[0128] First Certificate Subject Alternative Name: www.bank.example.com

[0129] Notes for the first comparison information: Knowngoodcertificateforbank.example.com

[0130] The first comparison information is compared with the target certificate to obtain a comparison result. If the serial number of the target certificate is consistent with the serial number of the first certificate in the trust authority directory, and other information also matches, the target certificate is considered to be credible, otherwise, the target certificate is considered to be untrustworthy.

[0131] Through the above methods, the credibility of the certificate can be effectively confirmed, thereby improving the security and reliability of the system.

[0132] In some implementations, in order to further determine the credibility of the target certificate by comparing the preservation policy data table when the certificate verification status is an error, the target directory (such as the trust revocation directory and the trust authorization directory) where the target certificate is located can be first determined, and the key information of the target certificate can be further compared in the target directory to ensure the consistency and accuracy of the comparison result. For example, step 103 can also include:

[0133] (103.c1) when the verification result indicates that the verification status of the target certificate is wrong, determining the target directory corresponding to the target certificate from a pre-set preservation policy data table;

[0134] (103.c2) When the target directory is a trust revocation directory, compare the second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information;

[0135] (103.c3) Obtain a query result based on the second comparison result.

[0136] The trust revocation directory may be a list containing information of known untrusted certificates, used to verify the credibility of a target certificate. Certificates in the black directory are considered untrusted even if they are not identified in a standard verification process.

[0137] The second comparison information may be related information of the target certificate used for comparison in the trust revocation directory. Such information is used to verify whether the target certificate is in the black directory.

[0138] The second comparison result may be a result obtained by comparing the second comparison information in the trust revocation directory with the target certificate. This result will indicate whether the target certificate matches a certain information in the black directory.

[0139] The second certificate version number may be: The second certificate version number refers to the version number of the certificate used for comparison in the trust revocation directory. This version number is used to ensure that the current version of the certificate information is compared.

[0140] The second certificate serial number may be the serial number of the certificate used for comparison in the trust revocation directory. This serial number is used to uniquely identify the certificate.

[0141] The second certificate subject name may be the subject name of the certificate used for comparison in the trust revocation directory. This name is used to confirm the holder of the certificate.

[0142] The second certificate subject alternative name may be the second certificate subject alternative name, which refers to the subject alternative name of the certificate used for comparison in the trust revocation directory. This alternative name is used to cover all domain names that may be involved in the certificate.

[0143] The certificate issuer name may be the certificate issuer name that refers to the issuer name of the certificate used for comparison in the trust revocation directory. This name is used to confirm the issuer of the certificate.

[0144] The certificate issuer alternative name may be the certificate issuer alternative name, which refers to the issuer alternative name of the certificate used for comparison in the trust revocation directory. This alternative name is used to cover all possible names of the certificate issuer.

[0145] The annotation of the second comparison information may be that the annotation of the second comparison information refers to the relevant annotation information of the certificate used for comparison in the trust revocation directory. This annotation provides additional description or explanation.

[0146] In some implementations, the trust revocation directory may be managed in a data table format, and the storage format of the trust revocation directory (LocalCertBlackAssertions) in the website proxy gateway may be as follows:

[0147]

[0148]

[0149] Among them, id is the storage number of the corresponding certificate in the trust revocation directory, that is, the primary key of the trust revocation directory; Version is the version number of the second certificate, and the default value is 1; ErrorNo is the certificate verification error type that needs to be preserved, that is, the second certificate error type, and the default value is ERR_CERT_REVOKED; serialNumber is the serial number of the second certificate; subjectName is the name of the second certificate subject; subjectName is the alternative name of the second certificate subject; issuerName is the name of the second certificate issuer; issuerAltName is the alternative name of the second certificate issuer; comment is the annotation of the second comparison information.

[0150] In some implementations, the trust revocation directory may also be managed in the form of a JSON file, and the meaning of the fields is the same as that of management in a data table format, which will not be described in detail here.

[0151] For example, the trust revocation directory (LocalCertBlackAssertions) can be specified in the following JSON format:

[0152] "LocalCertBlackAssertions": {

[0153] "CertBlackAssertions": [

[0154] {

[0155] "serialNumber":Type Int(serial Number of certificate),

[0156] "subjectName":Type String,Base64(subject name of certificate),

[0157] "subjectAltName"Type String,Base64(subjectAltName of certificate),

[0158] "issuerName":Type String,Base64(issuer name of certificate),

[0159] "issuerAltName"Type String,Base64(issuerAltName of certificate),

[0160] "comment": Type String,

[0161] }

[0162] ],

[0163] }

[0164] }

[0165] The member CertBlackAssertions is represented by an array of zero or more objects, each of which must contain at least one of the members "serialNumber", "subjectName", "subjectAltName", "issuerName" and "issuerAltName", or a combination thereof. "comment" is optional and is used to annotate this configuration item.

[0166] Exemplarily, if the target directory corresponding to the target certificate b is a trust revocation directory, the second comparison information corresponding to the target certificate b can be extracted from the trust revocation directory. For example, the second comparison information is as follows:

[0167] Second certificate version number: 1

[0168] Second certificate serial number: 1234567890

[0169] Second certificate subject name: bank.example.com

[0170] Second certificate subject alternative name: www.bank.example.com

[0171] Issuer Name: ExampleCA

[0172] Issuer Alternative Name: ExampleCA.net

[0173] Notes on the second comparison information: Known bad certificate for bank.example.com

[0174] The second comparison information is compared with the target certificate. If the serial number of the target certificate is consistent with the serial number of the second certificate in the black directory, and other information also matches, the target certificate is considered untrustworthy. If they do not match, further verification is required.

[0175] Through the above methods, the credibility of the certificate can be effectively confirmed, thereby improving the security and reliability of the system.

[0176] Step 104: when the target certificate is characterized as a credible certificate according to the query result, the remote browser proxy service is controlled to access the target website to obtain access data corresponding to the website access request.

[0177] In some implementations, in order to address potential security risks such as certificate revocation and tampering, the certificate preservation policies of all users can be centrally managed through the website proxy gateway. In this way, the trust revocation directory and trust authorization directory of the certificate can be uniformly managed on the remote browser proxy service to ensure that users can access websites that have been pre-determined to be accessible, thereby improving the flexibility and stability of access.

[0178] The access data may be the data content obtained when the remote browser proxy service proxy user browser accesses the target website. The access data may include but is not limited to web page content, images, video streams, JavaScript codes, and any other form of media or text information, which are not listed here one by one.

[0179] It is understandable that when a user's browser directly accesses a target website, if the target website's certificate is revoked, expired, or tampered with, the user's browser will rely on the verification mechanism provided by the certificate authority, such as the Online Certificate Status Protocol (OCSP), Certificate Revocation List (CRL), etc. for verification. Once the verification fails, the user's browser will prevent the user from continuing to access the target website and display a security warning. Therefore, the user's browser cannot access the certificate that has been maliciously revoked or tampered with.

[0180] Furthermore, through the remote browser proxy service, the user's browser can avoid directly relying on these verification mechanisms that may be affected by malicious intent. The remote browser proxy service can determine whether the target certificate is valid through the trust revocation directory and trust authorization directory (which can be customized by the user) maintained on the website proxy gateway. Even if the target certificate fails in routine verification, as long as the conditions of the local policy are met, the remote browser proxy service can still consider the target certificate valid and access the target website to obtain access data.

[0181] In some embodiments, a remote browser proxy service is used to preserve website certificates in a trusted authorization directory. Even if the certificates of important target websites are maliciously revoked or expired by certificate issuing authorities in other regions without reissuing the certificates, the terminal user (browser management end) is given a certain right of choice, so that the administrator can decide locally which de facto certificates in use are legal, rather than relying solely on the certificate legitimacy verification results controlled by a specific region, so as to achieve the purpose of preserving website certificates of certain specific important industries or entities, thereby preventing and eliminating the risk of certificates of these important websites being maliciously revoked or expired by certificate issuing authorities in other regions without reissuing the certificates. At the same time, the present application does not require modification of the browser kernel or installation of plug-ins, and can be perfectly compatible with the certificate verification system.

[0182] Step 105: Return the access data to the user's browser.

[0183] The remote browser proxy service can return the obtained access data to the user's browser through an encrypted channel, and the user can browse the content of the target website normally through the remote browser proxy service.

[0184] In some implementations, the user's identity information can be obtained and the access data can be screened to achieve personalized services, improve user experience, and ensure the security and compliance of the system. This method not only improves user satisfaction, but also enhances the intelligence and security of the system. For example, step 105 may include:

[0185] (105.1) obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet protocol address, and target device information corresponding to the user browser;

[0186] (105.2) Based on the user identity information, control the remote browser proxy service to filter the access data to obtain the target access data;

[0187] (105.3) Return the target access data to the user's browser.

[0188] The user identity information may be data used to identify and describe the user's identity, which helps the website provide personalized services and content. The user identity information may be at least one of the user's age, Internet protocol address, and target device information corresponding to the user's browser.

[0189] An Internet Protocol address is a unique digital identifier assigned to each computer on the Internet, used to locate and route data packets in the network. An Internet Protocol address can be used to determine a user's geographic location, network connection status, and other information.

[0190] The target device information corresponding to the user's browser may be information such as the device type and operating system used by the user to access the target website, so that the remote browser proxy service can determine how to present the content to optimize the user experience.

[0191] The target access data may be access data that is screened based on user identity information and that meets the user's identity, needs, and preferences.

[0192] Exemplarily, when the user identity information is the user's age, content filtering can be implemented based on the user's age information. For example, when the user is under 18 years old, the content in the access data that is not suitable for display to minors can be filtered to ensure that appropriate target access data is provided to minors.

[0193] For example, when the user identity information is an Internet Protocol address, the user's geographic location can be identified through the Internet Protocol address, and corresponding content can be provided or content that does not comply with regional regulations can be filtered out accordingly. For example, if the Internet Protocol address shows that the user's device is located in region A, then the access data can be translated according to the language of region A, and the target access data can be returned to the user's browser. Alternatively, sensitive words and content can be filtered out according to the regulations of region A.

[0194] Exemplarily, when the user identity information is the target device information used by the user, such as a computer for children, a computer for an enterprise, a computer for a school, etc., access can be filtered according to the corresponding target device information, and so on.

[0195] In some implementations, after receiving the access data, the user browser may filter the access data according to the user identity information to obtain the target access data, and display the corresponding target access data to the user.

[0196] By filtering the access data displayed to users based on user identity information, content presentation can be optimized, thereby significantly improving user experience and security.

[0197] In some implementations, in order to dynamically manage and update the trust revocation directory and the trust authorization directory to ensure the security and effectiveness of the system, the certificates in the trust revocation directory can be regularly evaluated to ensure that only certificates with real problems are included in the black directory, and valid certificates that are mistakenly included in the trust revocation directory are moved to the trust authorization directory, thereby improving the accuracy and reliability of the system. For example, the website access control method may also include:

[0198] (A.1) In the trust revocation directory, the verification times of each certificate included are accumulated;

[0199] (A.2) When there is a certificate in the trust revocation directory whose cumulative verification times exceed the preset times, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result;

[0200] (A.3) When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

[0201] The number of verifications is the number of queries performed on the target certificate according to the preset security policy data table.

[0202] The certificate to be evaluated may be a certificate in the trust revocation directory whose cumulative verification times exceed the preset times. The certificate to be evaluated needs to be further evaluated to reconfirm its validity.

[0203] The evaluation result may be a result obtained after evaluating the certificate to be evaluated, and is used to indicate whether the certificate to be evaluated is a valid certificate.

[0204] In some implementations, frequent query and verification of a certificate may mean that the certificate is of high importance. In order to reduce the negative impact of misjudgment, certificates that have been verified more than a preset number of times can be re-evaluated regularly to ensure the timeliness and effectiveness of the trust revocation directory and the trust authorization directory.

[0205] For example, if the preset number of times is set to 100 times, assuming that the certificate with the serial number 1234567890 has been verified multiple times, the number of verifications reaches 101. At this point, it indicates that the number of verifications of the certificate exceeds the preset number of times, and the certificate corresponding to the serial number 1234567890 can be re-evaluated as a certificate to be evaluated. Furthermore, if the evaluation result shows that the certificate to be evaluated is a valid certificate, the certificate with the serial number 1234567890 is added to the trust authorization directory, and the certificate is deleted from the trust revocation directory.

[0206] In some implementations, the certificate to be evaluated is evaluated to verify whether the certificate to be evaluated is expired, to verify the revocation status of the certificate to be evaluated, to check the integrity and authenticity of the certificate to be evaluated, etc. Furthermore, the validity of the certificate to be evaluated can also be evaluated by a machine model or manually, and this application does not limit the specific evaluation method.

[0207] In some embodiments, when the same certificate is stored in both the trust revocation directory and the trust authorization directory, for example, when both store certificate a, the update time of the corresponding certificate in the trust revocation directory and the update time in the trust authorization directory are obtained, and the certificate directory with the latest update time of the certificate is determined as the target certificate directory, and the certificate is deleted in the other certificate directory. For example, if certificate a is stored in both the trust authorization directory and the trust revocation directory, the last update time of certificate a in the trust authorization directory is 12:39 on October 15, 2024, and the last update time in the trust revocation directory is 16:50 on October 23, 2024, then the update time of certificate a in the trust revocation directory is the latest and closer to the current time, then the trust revocation directory can be determined as the target certificate directory, and the relevant information of certificate a can be deleted in the trust authorization directory. In this way, the most recent operation intention can be determined from the latest update time, avoiding confusion in management and ensuring the validity and accuracy of the certificate status.

[0208] By accumulating the number of verifications in the trust revocation directory, the trust revocation directory and the white directory can be dynamically managed and updated to ensure the security and effectiveness of the system. This not only improves the query efficiency, but also ensures the security of the system, reduces the impact of misjudgments, and improves the accuracy and reliability of the system.

[0209] In some implementations, the present application proposes a website access control method, which is applied to a user's browser, and the method includes:

[0210] Step 201, sending a website access request to a target website, so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website, verifies the target certificate through the remote browser proxy service, and obtains a verification result. When the verification result indicates that the verification status of the target certificate is an error, the target certificate is queried according to a pre-set security policy data table to obtain a query result. When the query result indicates that the target certificate is a trusted certificate, the remote browser proxy service is controlled to access the target website to obtain access data corresponding to the website access request;

[0211] Step 202: Receive access data returned by the remote browser proxy service.

[0212] The embodiment of the website access control method applied to the user browser is basically the same as the embodiment of the website access control method applied to the website proxy gateway described above, and will not be described in detail here.

[0213] The embodiment of the present application sends a website access request to the target website so that the website proxy gateway forwards the website access request to the target website through the remote browser proxy service, receives the target certificate returned by the target website, verifies the target certificate through the remote browser proxy service, obtains the verification result, and when the verification result indicates that the verification status of the target certificate is wrong, queries the target certificate according to the pre-set security policy data table to obtain the query result, and when the query result indicates that the target certificate is a trusted certificate, controls the remote browser proxy service to access the target website, obtains the access data corresponding to the website access request; receives the access data returned by the remote browser proxy service. In this way, a trusted connection between the user browser and the remote browser proxy service can be established by setting the remote browser proxy service, and when the remote browser proxy service finds that the verification status of the target certificate is wrong, it does not directly terminate the access, but makes further judgments according to the security policy data table to effectively solve the problem of inaccessibility, thereby effectively improving the stability of the browser in accessing the website.

[0214] In some implementations, the website access request sent by the user browser to the target website can also be obtained by the remote browser proxy service of the website proxy gateway. After the remote browser proxy service receives the target certificate returned by the target website, it first queries the target certificate according to the pre-set security policy data table to obtain the query result, and calibrates the target website according to the query result. For example, when the query result indicates that the target certificate is located in the trust revocation directory of the security policy data table, that is, when the target certificate is an untrusted certificate, an access error prompt is directly returned to the user browser, or the website access request of the user browser is only forwarded to the target website without obtaining data through the remote browser proxy service.

[0215] Furthermore, when the query result indicates that the target certificate is a trusted certificate, the target certificate is verified through the remote browser proxy service to obtain a verification result. When the verification result indicates that the verification status of the target certificate is correct, the remote browser proxy service of the website proxy gateway forwards the website access request of the user browser, so that the user browser can access the corresponding target website. When the verification result indicates that the verification status of the target certificate is wrong, the remote browser proxy service of the website proxy gateway does not need to forward the website access request of the user browser, but accesses the target website through the remote browser proxy service, obtains the corresponding access data, and returns the access data to the user browser, so as to achieve access to the target website through the remote browser proxy service when the user browser cannot access the target website normally.

[0216] Combine the following Figure 3 Further examples are given.

[0217] First, the user's browser needs to import the trusted root certificate provided by the website proxy gateway for the subsequent certificate verification process.

[0218] Next, the user's browser needs to configure the Domain Name System (DNS) resolution service to point to the IP address of the remote browser proxy service of the website proxy gateway (e.g. 100.100.000), so that all website access requests will be redirected to this proxy service.

[0219] The user tries to access www.xxxx.com and the browser sends an HTTP request.

[0220] After receiving the request, the remote browser proxy service first checks whether it matches the local security policy data table. If it matches, it proceeds to the next step; if not, it jumps to step 9.

[0221] If the security policy data table is not hit, the remote browser proxy service will directly access www.xxxx.com and obtain the content of the target website through encrypted data communication. If the security policy data table is hit, the remote browser proxy service will verify the certificate of the target website. If the verification is successful, continue to access the target website; if the verification fails, enter the stage of ignoring exception processing.

[0222] If the certificate verification succeeds, the remote browser proxy service will continue to access www.xxxx.com to obtain the website content. If the certificate verification fails but the ignore-certificate-errors option is configured, the remote browser proxy service will ignore the certificate error, continue to access the target website, obtain the content and return it to the user's browser.

[0223] Whether in the case of a miss or ignoring the exception, the remote browser proxy service will access www.xxxx.com through encrypted data communication, obtain the website content, and return it to the user's browser.

[0224] See also Figure 4 The embodiment of the present application also provides a website access control device, which is applied to a website proxy gateway and can implement the above website access control method. The website access control device includes:

[0225] The acquisition module 41 is used to acquire a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website;

[0226] The verification module 42 is used to verify the target certificate through the remote browser proxy service to obtain a verification result;

[0227] A query module 43, configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error;

[0228] The control module 44 is used to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is characterized as a trusted certificate according to the query result;

[0229] The return module 45 is used to return the access data to the user's browser.

[0230] The specific implementation of the website access control device is basically the same as the specific implementation of the website access control method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of the present application, the website access control device can also be provided with other functional modules to implement the website access control method described above.

[0231] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above website access control method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0232] See also Figure 5 , Figure 5 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0233] The processor 51 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0234] The memory 52 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 52 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 52, and the processor 51 calls and executes the website access control method of the embodiment of this application;

[0235] Input / output interface 53, used to implement information input and output;

[0236] The communication interface 54 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0237] A bus 55 that transmits information between the various components of the device (e.g., the processor 51, the memory 52, the input / output interface 53, and the communication interface 54);

[0238] The processor 51 , the memory 52 , the input / output interface 53 and the communication interface 54 are connected to each other in communication within the device via a bus 55 .

[0239] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned website access control method is implemented.

[0240] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0241] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0242] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0243] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0244] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0245] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0246] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0247] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0248] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0249] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0250] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0251] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A website access control method, characterized in that: Applied to a website proxy gateway, the method comprises: Obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website through a remote browser proxy service, and receiving a target certificate returned by the target website; Verifying the target certificate through the remote browser proxy service to obtain a verification result; When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset security policy data table to obtain a query result; When the target certificate is characterized as a credible certificate according to the query result, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request; The access data is returned to the user's browser.

2. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset security policy data table to obtain a query result includes: When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset security policy data table; When the target directory is a trusted authority directory, comparing the first comparison information of the trusted authority directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information; A query result is obtained according to the first comparison result.

3. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset security policy data table to obtain a query result further includes: When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset security policy data table; When the target directory is a trust revocation directory, comparing the second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information; A query result is obtained according to the second comparison result.

4. The website access control method according to claim 3, characterized in that: The method further comprises: In the trust revocation directory, the number of verifications of each certificate included therein is accumulated; When there is a certificate in the trust revocation directory whose cumulative verification times exceed the preset times, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result; When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

5. The website access control method according to claim 1, characterized in that: The step of returning the access data to the user browser comprises: Obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet Protocol address, and target device information corresponding to the user browser; Based on the user identity information, controlling the remote browser proxy service to screen the access data to obtain target access data; The target access data is returned to the user browser.

6. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset security policy data table to obtain a query result further includes: When the verification result indicates that the verification status of the target certificate is wrong, determining the trust level of the target website; Based on the trust level of the target website, determining the order in which the target certificate queries the certificate directory in the security policy data table; According to the order of the query certificate directory, the corresponding certificate directory is selected to query the target certificate to obtain the query result.

7. A website access control method, characterized in that: Applied in a user's browser, the method comprises: Sending a website access request to a target website so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website, and verifies the target certificate through the remote browser proxy service to obtain a verification result; when the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a pre-set security policy data table to obtain a query result; when the query result indicates that the target certificate is a trusted certificate, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request; The access data returned by the remote browser proxy service is received.

8. A website access control device, characterized in that: Applied to a website proxy gateway, the device comprises: An acquisition module is used to acquire a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website; A verification module, used to verify the target certificate through the remote browser proxy service to obtain a verification result; A query module, configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error; A control module, configured to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is characterized as a trusted certificate according to the query result; The returning module is used to return the access data to the user browser.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the website access control method according to any one of claims 1 to 6 or claim 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the website access control method according to any one of claims 1 to 6 or claim 7 is implemented.

Images