Website access control method, device, computer equipment and readable storage medium

Abstract

Embodiments of the present application provide a website access control method, apparatus, computer device, and readable storage medium. The method comprises: obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website via a remote browser proxy service, and receiving a target certificate returned by the target website; verifying the target certificate via the remote browser proxy service to obtain a verification result; when the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a pre-set security policy data table to obtain a query result; when the query result indicates that the target certificate is a trusted certificate, controlling the remote browser proxy service to access the target website, obtaining access data corresponding to the website access request; and returning the access data to the user's browser. This effectively improves the stability of browser website access.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a website access control method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] A public key infrastructure (PKI) is a system that uses public key cryptography to implement secure communications and digital signatures. Within a PKI, there are typically multiple layers of interconnected certificate authorities (CAs), each managing the certificate resources of all the CAs to which it is associated.

[0003] In related technologies, when a user accesses a website through a browser, verification is performed using relevant certificate resources. Only after verification is successful is the browser allowed to access the website, thereby ensuring secure website access. However, upper-level certificate authorities are typically located in different regions and managed by the management objects of those regions. When using this traditional method to access a website, there is a risk that due to issues such as regional differences between the browser and the upper-level certificate authority, network interference, and human interference, the website's certificate resources may become invalid, resulting in unstable website access. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to provide a website access control method, device, computer equipment and readable storage medium, which can effectively improve the stability of website access by browsers.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a website access control method, which is applied to a website proxy gateway. The method includes:

[0006] Obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website through a remote browser proxy service, and receiving a target certificate returned by the target website;

[0007] Verifying the target certificate through the remote browser proxy service to obtain a verification result;

[0008] When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset preservation policy data table to obtain a query result;

[0009] When the query result indicates that the target certificate is a trusted certificate, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request;

[0010] The access data is returned to the user's browser.

[0011] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides a website access control device, which is applied to a website proxy gateway. The device includes:

[0012] An acquisition module is used to acquire a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website;

[0013] A verification module, configured to verify the target certificate through the remote browser proxy service to obtain a verification result;

[0014] a query module configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error;

[0015] a control module configured to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is characterized as a trusted certificate according to the query result;

[0016] The returning module is used to return the access data to the user browser.

[0017] In some embodiments, the query module is further configured to:

[0018] When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset preservation policy data table;

[0019] When the target directory is a trusted authority directory, comparing first comparison information of the trusted authority directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information;

[0020] A query result is obtained according to the first comparison result.

[0021] In some embodiments, the query module is further configured to:

[0022] When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset preservation policy data table;

[0023] When the target directory is a trust revocation directory, comparing second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information;

[0024] A query result is obtained according to the second comparison result.

[0025] In some embodiments, the website access control device further includes a deletion module configured to:

[0026] In the trust revocation directory, the number of verifications for each certificate included therein is accumulated;

[0027] When there is a certificate in the trust revocation directory whose cumulative verification times exceeds a preset number, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result;

[0028] When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

[0029] In some embodiments, the return module is further configured to:

[0030] Obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet Protocol address, and target device information corresponding to the user browser;

[0031] Based on the user identity information, controlling the remote browser proxy service to filter the access data to obtain target access data;

[0032] The target access data is returned to the user browser.

[0033] In some embodiments, the query module is further configured to:

[0034] When the verification result indicates that the verification status of the target certificate is wrong, determining the trust level of the target website;

[0035] Based on the trust level of the target website, determining the order in which the target certificate queries the certificate directory in the security policy data table;

[0036] According to the order of the query certificate directories, the corresponding certificate directory is selected to query the target certificate to obtain the query result.

[0037] To achieve the above objectives, a third aspect of the embodiments of the present application provides a website access control method, which is applied to a user's browser. The method includes:

[0038] Sending a website access request to a target website so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website, verifies the target certificate through the remote browser proxy service to obtain a verification result, and when the verification result indicates that the verification status of the target certificate is an error, queries the target certificate according to a pre-set security policy data table to obtain a query result, and when the query result indicates that the target certificate is a trusted certificate, controls the remote browser proxy service to access the target website to obtain access data corresponding to the website access request;

[0039] Receive the access data returned by the remote browser proxy service.

[0040] To achieve the above-mentioned purpose, the fourth aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the website access control method described in any one of the first aspect embodiments or the third aspect embodiments of the present application.

[0041] To achieve the above-mentioned objectives, the fifth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the website access control method described in any one of the first aspect embodiments or the third aspect embodiments of the present application.

[0042] The embodiment of the present application obtains a website access request sent by a user browser to a target website, forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website; verifies the target certificate through the remote browser proxy service to obtain a verification result; when the verification result indicates that the verification status of the target certificate is an error, queries the target certificate according to a pre-set security policy data table to obtain a query result; when the query result indicates that the target certificate is a trusted certificate, controls the remote browser proxy service to access the target website, obtains access data corresponding to the website access request, and returns the access data to the user browser. In this way, a trusted connection between the user browser and the remote browser proxy service can be established by setting up the remote browser proxy service, and when the remote browser proxy service finds that the verification status of the target certificate is an error, it does not directly terminate the access, but makes further judgment according to the security policy data table to effectively solve the problem of inaccessibility, thereby effectively improving the stability of the browser in accessing the website. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a schematic diagram of the structure of a website public key infrastructure provided by an embodiment of the present application;

[0044] Figure 2 This is a flowchart of a website access control method provided by an embodiment of the present application;

[0045] Figure 3 This is an overall flow chart of the website access control method provided by the embodiment of the present application;

[0046] Figure 4 This is a schematic diagram of the functional modules of the website access control device provided in an embodiment of the present application;

[0047] Figure 5 This is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0051] First, let’s analyze some of the terms used in this application:

[0052] Web Public Key Infrastructure (WebPKI) is a system that uses public key cryptography to implement secure communications and digital signatures. It provides a trust model that allows users to be confident that the person they are communicating with is trustworthy and that the content of the communication cannot be tampered with.

[0053] Reference Figure 1 , is a schematic diagram of the structure of a website public key infrastructure provided by an embodiment of the present application. Figure 1 As shown in , in the related art, it is usually composed of multiple certificate authorities that are associated layer by layer, including a root certificate authority at the top layer, multiple upper-layer certificate authorities associated with the root certificate authority, and multiple lower-layer certificate authorities associated with the upper-layer certificate authority. Each lower-layer certificate authority is associated with multiple website servers and is used to authorize resource certificates for these website servers so that these website servers can manage multiple resource websites. It is understandable that the embodiment of this application only illustrates a three-layer certificate authority. In actual applications, there are usually more certificate authority architectures than three layers.

[0054] When any user browser visits a resource website managed by a network server, the user browser will usually use the digital certificate obtained in advance from the website server to verify the identity of the website, including but not limited to whether the certificate has expired or been revoked. If the certificate verification is successful and the information in the certificate is consistent with the website being visited, the identity of the website is considered to have been confirmed, allowing the user to establish an encrypted connection with the website; otherwise, the verification fails and the user browser cannot access the corresponding resource website, thereby ensuring the security of website access.

[0055] However, if Figure 1 As shown in the website public key infrastructure, root certificate authorities and upper-level certificate authorities are typically located in different regions and managed by the management objects of those regions. When a user browser in a different region needs to access a resource website indirectly managed by a higher-level certificate authority in that region, trust issues may arise due to differences in the region between the user browser and the higher-level certificate authority, network issues, and human interference, as described below.

[0056] 1) Risk of Root Certificate Authority (CA) ceasing to issue certificates (Isolation and blinding risk): When the certificate resource registration used by a website server in one region depends on the root certificate authority in another region, if the root certificate authority in the other region does not issue the resource certificate to the website server due to distrust between the two regions, or if there is a network problem between the two regions, the resource website managed by the network server will not be able to be used normally.

[0057] 2) Risk of root CA revoking issued certificates (disappearance risk): When the certificate resource registration used by a website server in a certain region depends on the root certificate authority in another region, once the root certificate authority in the other region cancels the resource certificate originally issued to the website server due to distrust between the two regions, the encryption services of all domain name websites of the website server will disappear, and the encryption services between its corresponding domain name websites and user servers will be interrupted, causing the entire network system to be paralyzed.

[0058] 3) Risk of certificate tampering (hijacking): When the certificate resource registration used by a website server in a certain region relies on a root certificate authority in another region, when the root certificate authority in another region is attacked or performs malicious operations or issues certificates containing false information, it is easy for the resource website held by the website server to be attacked or even hijacked.

[0059] 4) Information security risk: When the certificate resource registration used by a website server in a certain region relies on the root certificate authority in another region, the daily traffic network service information of the website server in that region (such as website access information of user browsers) will be mastered by the root certificate authority in the other region. If the relationship between the two regions is not harmonious, it will cause serious information security leakage risks.

[0060] In reality, in current website public key infrastructure, many root certificate authorities are typically located in a few regions. These root certificate authorities are then directly or indirectly connected to website servers in most regions. When there is distrust or conflict between regions, the four aforementioned malicious scenarios are prone to occur, making browsers less stable when accessing websites.

[0061] Based on this, the embodiments of the present application provide a website access control method, apparatus, computer device, and readable storage medium, which can effectively improve the stability of website access by a browser.

[0062] The website access control method in the embodiments of the present application can be illustrated by the following embodiments.

[0063] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0064] In the embodiment of the present application, the website access control device will be described from the perspective of the website access control device, which is applied to the website proxy gateway and can be integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the website access control method provided in an embodiment of the present application. In this embodiment of the present application, the website access control device is specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the website access control method, the specific process is as follows:

[0065] Step 101: obtain a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website.

[0066] In some embodiments, in order to ensure the stability of the user browser's access to the target website, the website access request sent by the user browser can be forwarded to the target website through the remote browser proxy service, which can alleviate the risk of access interruption caused by certificate problems due to abnormal reasons to a certain extent and improve the security and reliability of access.

[0067] A user browser is software installed on a user's device (such as a personal computer, mobile phone, or tablet computer) that is used to browse web pages and communicate with website servers. The main functions of a user browser include, but are not limited to, sending Hypertext Transfer Protocol (HTTP) requests, presenting web page content, managing small text files, and executing code.

[0068] The target website can be a specific website or network resource that a user wishes to access through a browser. For example, the target website can be a commercial site, a social media platform, an information service portal, or any other form of online content provider. The target website is typically hosted by a set of servers. These servers respond to requests from the user's browser and return a target certificate used to verify the website's identity. Once the target certificate is verified, the corresponding web page or data is returned to the user's browser.

[0069] The website access request may be a request sent by a user's browser to a website server to obtain content or services of a target website.

[0070] The remote browser proxy service can be an intermediate layer service located between the user's browser and the target website, installed on the website proxy gateway. Its main responsibility is to receive website access requests sent by the user's browser, forward these requests to the target website, and receive the data returned by the target website (including but not limited to web page content and certificates). In addition, if the certificate of the server hosting the target website is revoked, causing the user's browser to be unable to access the target website normally, the remote browser proxy service can also verify the target certificate and further check the status of the target certificate provided by the target website according to a pre-set security policy data table to ensure the security and reliability of website access.

[0071] The target certificate is a digital certificate returned by the target website's web server upon receiving an access request from a user's browser. The target certificate contains information about the website's identity, such as the website's domain name, certificate validity period, and the issuing certification authority. The target certificate verifies the authenticity of the target website and ensures that communications between the user's browser and the target website are encrypted and secure.

[0072] In some embodiments, the user browser pre-imports the trusted root certificate of the website proxy gateway to establish a trusted connection between the user browser and the website proxy gateway. The website proxy gateway can receive requests from clients (such as user browsers) and forward these requests to the target server, and can also receive responses from the target server and return them to the user browser.

[0073] In some embodiments, the remote browser proxy service can be designed to serve multiple user browsers. For example, in an enterprise environment, user browsers installed on employees' devices (such as mobile devices) can all access external target websites through the same website proxy gateway, allowing the enterprise to implement unified security policies and monitoring. In educational institutions, students and teachers can access the Internet through the website proxy gateway in the campus network to control user browser access to target websites. In this way, resource utilization can be maximized, access stability and security can be improved, and high-quality services can be provided at a lower cost.

[0074] For example, if user A needs to access an e-commerce website www.xxxx.com through a user browser, after user A enters www.xxxx.com in the user browser and confirms it, the user browser sends a website access request. The gateway will reliably intercept the website access request and control the remote browser proxy service to forward the received request to the server of the e-commerce website www.xxxx.com.

[0075] Furthermore, after receiving the website access request, the server of the target website www.xxxx.com returns a target certificate (digital certificate) for verifying the identity of the target website, so that the remote browser proxy service can verify the target certificate.

[0076] A forwarding channel is established between the user's browser and the target website through the remote browser proxy service, effectively improving the security and reliability of website access.

[0077] Step 102: Verify the target certificate through the remote browser proxy service to obtain a verification result.

[0078] In some implementations, in order to determine whether the target certificate is valid, the target certificate can be verified through a remote browser proxy service to centrally manage certificate verification policies. Users do not need to configure complex certificate verification rules in the local browser, reducing the user's operational difficulty.

[0079] The verification result may be a conclusion obtained by the remote browser proxy service after receiving the target certificate returned by the target website and performing a series of checks and verifications on the target certificate.

[0080] Exemplarily, the remote browser proxy service can first verify the validity of the target certificate. For example, the target certificate can be verified from aspects such as the certificate's validity, certificate revocation status, certificate issuer, and consistency between the certificate and the target website. For example, to verify the validity of the certificate, it can be checked whether the target certificate is within its validity period, that is, whether the start and end dates of the target certificate cover the current date. To verify the validity of the certificate, it can be checked by querying the Certificate Revocation List (CRL) or checking the validity of the certificate through the Online Certificate Status Protocol (OCSP). To verify the issuer of the certificate, it can be verified whether the certificate is issued by a trusted Certificate Authority (CA). To verify the consistency between the certificate and the target website, it can be verified by confirming that the information in the certificate (such as the domain name) matches the target website being accessed. Furthermore, verifying the target certificate can also include verifying the integrity of the target certificate's certificate chain.

[0081] For example, when the verification result can indicate whether the target certificate is legal, has not been tampered with, has not been revoked, and is trusted. If the target certificate is a legal, untampered, unrevoked and trusted certificate, that is, the verification result indicates that the verification status of the target certificate is correct, then the verification result can be forwarded to the user's browser, and the user's browser can establish an encrypted connection with the target website through the remote browser proxy service of the website proxy gateway. If the target certificate is illegal, tampered with, or the trusted certificate is revoked, etc., it indicates that the verification failed and further processing is required by the remote browser proxy service.

[0082] Verifying the target certificate through a remote browser proxy service instead of directly by the user's browser can avoid problems such as the target certificate being maliciously interrupted or revoked. The target certificate can be preserved through a remote browser proxy service to ensure the stability and security of website access.

[0083] Step 103: When the verification result indicates that the verification status of the target certificate is an error, the target certificate is queried according to a preset preservation policy data table to obtain a query result.

[0084] In some embodiments, in order to provide an additional protection mechanism when problems arise in verifying the target certificate during the standard verification process, when the verification result indicates that the verification status of the target certificate is incorrect, the target certificate can be queried according to a pre-set preservation policy data table, so that in the event of certificate verification failure, the true status of the certificate can be confirmed through an additional mechanism to ensure that the user browser can still safely access the website when necessary.

[0085] The security policy data table can be a pre-configured database or file containing information used to determine how to handle target certificates with verification status errors. The security policy data table is primarily used by the remote browser proxy service to determine the trustworthiness of the target certificate based on pre-defined rules when it detects a target certificate verification status error, thereby determining whether to allow the user browser to continue accessing the target website.

[0086] The query result may be a conclusion obtained after the remote browser proxy service queries the target certificate according to the security policy data table, and is used to indicate whether the target certificate is trustworthy.

[0087] In some embodiments, the security policy data table may include, but is not limited to, a trusted authority directory and a trusted revocation directory. The trusted authority directory contains information about certificates deemed trustworthy, such as the certificate's serial number, subject name, and alternative name. When a target certificate appears in the trusted authority directory, it is considered trustworthy even if the verification result indicates a verification status of error.

[0088] Furthermore, the trust revocation directory contains information about certificates that are considered untrustworthy, such as the certificate's serial number, subject name, alternative name, issuer name, and its alternative name. If the verification result indicates that the verification status of the target certificate is incorrect and the target certificate appears in the trust revocation directory, the target certificate is considered untrustworthy, and the user's browser will be unable to access the target website.

[0089] In some implementations, the administrator can first write a database table of the preservation policy for the local certificate, or generate a JSON file of the preservation policy for the local certificate, and store the preservation policy in the form of a database or JSON file in a specific directory of the website proxy gateway. When the website proxy gateway verifies the certificate for preservation, the website proxy gateway program accesses the database table through the database interface, or reads the JSON file content in the form of a file read and write interface.

[0090] Through the above method, when the target certificate verification status is incorrect, the credibility of the target certificate can be further judged to decide whether to allow the user browser to continue to access the target website. This ensures security while providing a flexible access control mechanism, thereby improving the stability and security of the user browser accessing the target website.

[0091] In some implementations, to improve query efficiency, the query order of the certificate directories that need to be queried first can be determined based on the trust level of the target website to reduce unnecessary query operations. For example, step 103 may include:

[0092] (103.a1) when the verification result indicates that the verification status of the target certificate is incorrect, determining the trust level of the target website;

[0093] (103.a2) Based on the trust level of the target website, determine the order in which the target certificate is queried in the certificate directory in the preservation policy data table;

[0094] (103.a3) According to the order of querying the certificate directory, select the corresponding certificate directory to query the target certificate and obtain the query result.

[0095] The trust level can be a graded identification assigned after evaluating the security and trustworthiness of the target website. The trust level reflects the importance, sensitivity, and security requirements of each website.

[0096] The certificate directory may be a list in the security policy data table used to verify the credibility of the target certificate, including a trust authorization directory and a trust revocation directory.

[0097] The order of precedence can be determined by the priority of querying the certificate directories based on the trust level of the target website when querying the target certificate. By setting the order of precedence, the certificate directories that are most likely to provide accurate credibility judgments can be queried first, thereby reducing unnecessary query operations.

[0098] For example, trust levels can be set as high, medium, and low. High trust levels may involve sensitive information, financial transactions, or important business functions, such as bank websites and official websites. Medium trust levels may contain personal information or commercial information, such as e-commerce websites. Low trust levels may contain public information, such as forum websites.

[0099] Furthermore, for target websites with a high trust level, the trust authorization directory can be queried first and then the trust revocation directory; for target websites with a medium trust level, there is no restriction on the order of queries; and for target websites with a low trust level, the trust revocation directory can be queried first and then the trust authorization directory. In this way, according to the specific situation of the target website, the certificate directory that is most likely to provide accurate credibility judgment can be queried first, thereby reducing unnecessary query operations, improving query efficiency, and ensuring the security of the system.

[0100] In some implementations, the number of items to be queried for the target certificate of the target website in the certificate directory can be determined based on the trust level of the target website, and the corresponding certificate directory can be queried based on the number of items to be queried. For example, for a target certificate with a high trust level, only the serial number of the certificate in the trust authority directory needs to be queried. For a target certificate with a low trust level, the serial number of the certificate, the subject name of the certificate, the subject alternative name of the certificate, etc. need to be queried in the trust authority directory.

[0101] By adjusting the order and number of certificate queries based on the trust level of the target website, you can improve query efficiency while ensuring system security.

[0102] In some embodiments, in order to further determine the credibility of the target certificate by comparing the preservation policy data table when the certificate verification status is an error, the target directory (such as the trust revocation directory and the trust authorization directory) where the target certificate is located can be first determined, and the key information of the target certificate can be further compared in the target directory to ensure the consistency and accuracy of the comparison result. For example, step 103 can also include:

[0103] (103.b1) When the verification result indicates that the verification status of the target certificate is incorrect, determining the target directory corresponding to the target certificate from a pre-set preservation policy data table;

[0104] (103.b2) When the target directory is a trusted authority directory, compare the first comparison information of the trusted authority directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information;

[0105] (103.b3) Obtain a query result based on the first comparison result.

[0106] The target directory may be a directory of certificates that needs to be queried based on the trust level of the target website when certificate verification fails. This directory may be a trust authorization directory or a trust revocation directory.

[0107] The trust authority directory can be a list of known trusted certificates, which is used to verify the credibility of the target certificate. Certificates in the white directory are considered reliable even if they have problems during the standard verification process.

[0108] The first comparison result may be: the first comparison result refers to the result obtained after comparing the first comparison information in the trusted authority directory with the target certificate, and this result will indicate whether the target certificate matches a certain information in the white directory.

[0109] The first certificate version number may be the version number of the first certificate in the trusted authority directory for comparison. This version number is used to ensure that the comparison is done with the current version of the certificate information.

[0110] The first certificate error type may be an error type of the first certificate used for comparison in the trusted authority directory. This error type is used to identify specific problems that may occur with the certificate.

[0111] The first certificate serial number may be the serial number of the first certificate used for comparison in the trusted authority directory. This serial number is used to uniquely identify the certificate.

[0112] The first certificate subject name may be the subject name of the first certificate used for comparison in the trust authority directory. This name is used to confirm the holder of the certificate.

[0113] The first certificate subject alternative name may be the subject alternative name of the first certificate used for comparison in the trust authority directory. This alternative name is used to cover all domain names that may be involved in the certificate.

[0114] The annotation of the first comparison information may be related annotation information of the first certificate used for comparison in the trusted authority directory, and the annotation provides additional description or explanation.

[0115] In some implementations, the trust authorization directory may be managed in a data table format. The storage format of the trust authorization directory (LocalCertWhiteFilters) in the website proxy gateway may be as follows:

[0116]

[0117] Among them, id is the storage number of the corresponding certificate in the trust authorization directory, that is, the primary key of the trust authorization directory; Version is the version number of the first certificate, and the default value is 1; ErrorNo is the error type of the first certificate, and the default value is ERR_CERT_REVOKED; serialNumber is the serial number of the first certificate; subjectName is the name of the first certificate subject; subjectName is the alternative name of the first certificate subject; comment is the annotation of the first comparison information.

[0118] In some implementations, the trust authorization directory may also be managed in the form of a JSON file. The meaning of the fields is the same as that of management in a data table format, and is not described in detail here.

[0119] For example, the trust authority directory (LocalCertWhiteFilters) can be specified in the following JSON format:

[0120]

[0121]

[0122] The CertWhiteFilters member is represented by an array of zero or more objects. Each object must contain at least one of the members "serialNumber", "subjectName", and "subjectAltName", or a combination thereof. "comment" is optional and is used to annotate this configuration item.

[0123] For example, if the target directory corresponding to the target certificate a is a trusted authorization directory, the first comparison information corresponding to the target certificate a can be extracted from the trusted authorization directory. For example, the first comparison information is as follows:

[0124] First certificate version number: 1

[0125] First certificate error type: 201

[0126] First certificate serial number: 1234567890

[0127] First certificate subject name: bank.example.com

[0128] First certificate subject alternative name: www.bank.example.com

[0129] Notes for the first comparison information: Knowngoodcertificateforbank.example.com

[0130] The first comparison information is compared with the target certificate to obtain a comparison result. If the serial number of the target certificate is consistent with the serial number of the first certificate in the trusted authority directory and other information also matches, the target certificate is considered to be credible. Otherwise, the target certificate is considered to be untrustworthy.

[0131] Through the above methods, the credibility of the certificate can be effectively confirmed, thereby improving the security and reliability of the system.

[0132] In some embodiments, in order to further determine the credibility of the target certificate by comparing the preservation policy data table when the certificate verification status is an error, the target directory (such as the trust revocation directory and the trust authorization directory) where the target certificate is located can be first determined, and the key information of the target certificate can be further compared in the target directory to ensure the consistency and accuracy of the comparison result. For example, step 103 can also include:

[0133] (103.c1) When the verification result indicates that the verification status of the target certificate is incorrect, determining the target directory corresponding to the target certificate from a pre-set preservation policy data table;

[0134] (103.c2) When the target directory is a trust revocation directory, compare the second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information;

[0135] (103.c3) Obtain a query result based on the second comparison result.

[0136] The trust revocation directory can be a list containing information about known untrusted certificates, used to verify the trustworthiness of a target certificate. Certificates in the black directory are considered untrusted even if they are not identified during standard verification.

[0137] The second comparison information may be related information of the target certificate for comparison in the trust revocation directory, and the information is used to verify whether the target certificate is in the blacklist.

[0138] The second comparison result may be a result obtained by comparing the second comparison information in the trust revocation directory with the target certificate, and the result indicates whether the target certificate matches a certain information in the blacklist.

[0139] The second certificate version number may be the version number of the certificate used for comparison in the trust revocation directory. This version number is used to ensure that the comparison is done with the current version of the certificate information.

[0140] The second certificate serial number may be the serial number of the certificate used for comparison in the trust revocation directory. This serial number is used to uniquely identify the certificate.

[0141] The second certificate subject name may be the subject name of the certificate used for comparison in the trust revocation directory. This name is used to confirm the holder of the certificate.

[0142] The second certificate subject alternative name may be the subject alternative name of the certificate used for comparison in the trust revocation directory. This alternative name is used to cover all domain names that may be involved in the certificate.

[0143] The certificate issuer name can be the name of the issuer of the certificate used for comparison in the trust revocation directory. This name is used to confirm the issuer of the certificate.

[0144] The certificate issuer alternative name can be the certificate issuer alternative name that is used for comparison in the trust revocation directory. This alternative name is used to cover all possible names of the certificate issuer.

[0145] The annotation of the second comparison information may be related annotation information of the certificate used for comparison in the trust revocation directory, and the annotation provides additional description or explanation.

[0146] In some embodiments, the trust revocation directory can be managed in a data table format. The storage format of the trust revocation directory (LocalCertBlackAssertions) in the website proxy gateway can be as follows:

[0147]

[0148]

[0149] Among them, id is the storage number of the corresponding certificate in the trust revocation directory, that is, the primary key of the trust revocation directory; Version is the version number of the second certificate, and the default value is 1; ErrorNo is the certificate verification error type that needs to be preserved, that is, the second certificate error type, and the default value is ERR_CERT_REVOKED; serialNumber is the serial number of the second certificate; subjectName is the name of the second certificate subject; subjectName is the alternative name of the second certificate subject; issuerName is the name of the second certificate issuer; issuerAltName is the alternative name of the second certificate issuer; comment is the annotation of the second comparison information.

[0150] In some implementations, the trust revocation directory may also be managed in the form of a JSON file. The meaning of the fields is the same as that of management in a data table format, and is not described in detail here.

[0151] For example, the trust revocation directory (LocalCertBlackAssertions) can be specified in the following JSON format:

[0152] "LocalCertBlackAssertions": {

[0153] "CertBlackAssertions": [

[0154] {

[0155] "serialNumber":Type Int(serial Number of certificate),

[0156] "subjectName":Type String,Base64(subject name of certificate),

[0157] "subjectAltName"Type String,Base64(subjectAltName of certificate),

[0158] "issuerName":Type String,Base64(issuer name of certificate),

[0159] "issuerAltName"Type String,Base64(issuerAltName of certificate),

[0160] "comment":Type String,

[0161] }

[0162] ],

[0163] }

[0164] }

[0165] The CertBlackAssertions member is represented by an array of zero or more objects. Each object must contain at least one of the members "serialNumber", "subjectName", "subjectAltName", "issuerName", and "issuerAltName", or a combination thereof. "comment" is optional and is used to annotate this configuration item.

[0166] For example, if the target directory corresponding to the target certificate b is a trust revocation directory, the second comparison information corresponding to the target certificate b can be extracted from the trust revocation directory. For example, the second comparison information is as follows:

[0167] Second certificate version number: 1

[0168] Second certificate serial number: 1234567890

[0169] Second certificate subject name: bank.example.com

[0170] Second certificate subject alternative name: www.bank.example.com

[0171] Issuer Name: ExampleCA

[0172] Issuer Alternative Name: ExampleCA.net

[0173] Notes on the second comparison information: Known bad certificate for bank.example.com

[0174] The second comparison information is compared with the target certificate. If the serial number of the target certificate is consistent with the serial number of the second certificate in the black directory and other information also matches, the target certificate is considered untrustworthy. If they do not match, further verification is required.

[0175] Through the above methods, the credibility of the certificate can be effectively confirmed, thereby improving the security and reliability of the system.

[0176] Step 104: When the target certificate is identified as a credible certificate according to the query result, the remote browser proxy service is controlled to access the target website to obtain access data corresponding to the website access request.

[0177] In some implementations, in order to address potential security risks such as certificate revocation and tampering, the certificate preservation policies of all users can be centrally managed through the website proxy gateway. In this way, the trust revocation directory and trust authorization directory of the certificate can be uniformly managed on the remote browser proxy service to ensure that users can access websites that have been pre-identified as accessible, thereby improving the flexibility and stability of access.

[0178] The access data may be the data content obtained when the remote browser proxy service proxies the user's browser to access the target website. The access data may include, but is not limited to, web page content, images, video streams, JavaScript code, and any other form of media or text information, which are not listed here.

[0179] It's understandable that when a user's browser directly accesses a target website, if the target website's certificate has been revoked, expired, or tampered with, the browser will rely on verification mechanisms provided by the certificate authority, such as the Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL). If verification fails, the browser will block the user from continuing to access the target website and display a security warning. Therefore, the browser cannot access a certificate that has been maliciously revoked or tampered with.

[0180] Furthermore, through the remote browser proxy service, the user's browser can avoid directly relying on these verification mechanisms that may be affected by malicious intent. The remote browser proxy service can determine whether the target certificate is valid through the trust revocation directory and trust authorization directory (which can be customized by the user) maintained on the website proxy gateway. Even if the target certificate fails in routine verification, as long as the conditions of the local policy are met, the remote browser proxy service can still consider the target certificate valid and access the target website to obtain access data.

[0181] In some embodiments, a remote browser proxy service is used to implement the preservation of website certificates in a trusted authorization directory. Even if the certificates of important target websites are maliciously revoked or expired by certificate issuing authorities in other regions without reissuing the certificates, the terminal user (browser management terminal) is given a certain right of choice, so that the administrator can decide locally which fact certificates in use are legal, rather than relying solely on the certificate legitimacy verification results controlled by a specific region, so as to achieve the purpose of preserving website certificates of certain specific important industries or entities, thereby preventing and resolving the risk that the certificates of these important websites are maliciously revoked or expired by certificate issuing authorities in other regions without reissuing the certificates. At the same time, this application does not require modification of the browser kernel or installation of plug-ins, and can be perfectly compatible with the certificate verification system.

[0182] Step 105: Return the access data to the user's browser.

[0183] The remote browser proxy service can return the obtained access data to the user's browser through an encrypted channel, and the user can browse the content of the target website normally through the remote browser proxy service.

[0184] In some implementations, user identity information can be obtained and access data can be filtered to provide personalized services, improve user experience, and ensure system security and compliance. This approach not only improves user satisfaction but also enhances the intelligence and security of the system. For example, step 105 may include:

[0185] (105.1) Obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet Protocol address, and target device information corresponding to the user browser;

[0186] (105.2) Based on the user identity information, control the remote browser proxy service to filter the access data and obtain the target access data;

[0187] (105.3) Return the target access data to the user's browser.

[0188] User identity information may be data used to identify and describe a user, which helps websites provide personalized services and content. User identity information may include at least one of the following: user age, Internet protocol address, and target device information corresponding to the user's browser.

[0189] An Internet Protocol address is a unique numerical identifier assigned to every computer on the internet, used to locate and route data packets within the network. It can be used to determine a user's geographic location, network connection status, and other information.

[0190] The target device information corresponding to the user's browser may be information such as the device type and operating system used by the user to access the target website, so that the remote browser proxy service can determine how to present the content to optimize the user experience.

[0191] The target access data may be access data that is screened based on user identity information and that meets the user's identity, needs, and preferences.

[0192] For example, when the user identity information is the user's age, content filtering can be implemented based on the user's age information. For example, if the user is under 18 years old, content in the access data that is not suitable for display to minors can be filtered to ensure that appropriate target access data is provided to minors.

[0193] For example, when the user identity information is an Internet Protocol address, the user's geographic location can be identified through the Internet Protocol address, and corresponding content can be provided or content that does not comply with regional regulations can be filtered accordingly. For example, if the Internet Protocol address indicates that the user device is located in Region A, the access data can be translated according to the language of Region A, and the target access data can be returned to the user's browser. Alternatively, sensitive words and content can be filtered out based on the regulations of Region A.

[0194] For example, when the user identity information is the target device information used by the user, such as a computer for children, a computer for an enterprise, a computer for a school, etc., access can be filtered according to the corresponding target device information, and so on.

[0195] In some implementations, after receiving the access data, the user browser may filter the access data according to the user identity information to obtain target access data, and then display the corresponding target access data to the user.

[0196] By filtering the access data displayed to users based on user identity information, content presentation can be optimized, thereby significantly improving user experience and security.

[0197] In some implementations, to dynamically manage and update the trust revocation directory and the trust authorization directory and ensure the security and effectiveness of the system, certificates in the trust revocation directory can be regularly evaluated to ensure that only certificates with real problems are included in the blacklist. At the same time, valid certificates that are mistakenly included in the trust revocation directory are moved to the trust authorization directory, thereby improving the accuracy and reliability of the system. For example, the website access control method may also include:

[0198] (A.1) In the trust revocation directory, the number of verifications for each certificate included is accumulated;

[0199] (A.2) When there is a certificate in the trust revocation directory whose cumulative verification times exceeds a preset number, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result;

[0200] (A.3) When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

[0201] The number of verifications is the number of queries performed on the target certificate according to the preset security policy data table.

[0202] The certificate to be evaluated may be a certificate in the trust revocation directory whose cumulative verification times exceed the preset number. The certificate to be evaluated needs to be further evaluated to reconfirm its validity.

[0203] The evaluation result may be a result obtained after evaluating the certificate to be evaluated, and is used to indicate whether the certificate to be evaluated is a valid certificate.

[0204] In some implementations, frequent query and verification of a certificate may mean that the certificate is of high importance. In order to reduce the negative impact of misjudgment, certificates that have been verified more than a preset number of times can be re-evaluated regularly to ensure the real-time and validity of the trust revocation directory and the trust authorization directory.

[0205] For example, if the preset number of times is set to 100, and the certificate with serial number 1234567890 has been verified multiple times, its verification count reaches 101. At this point, it indicates that the certificate has been verified more than the preset number of times, and the certificate corresponding to serial number 1234567890 can be re-evaluated as a certificate to be evaluated. Furthermore, if the evaluation result shows that the certificate to be evaluated is valid, the certificate with serial number 1234567890 will be added to the trust authorization directory and deleted from the trust revocation directory.

[0206] In some embodiments, the evaluation of the certificate to be evaluated may include verifying whether the certificate to be evaluated is expired, verifying the revocation status of the certificate to be evaluated, checking the integrity and authenticity of the certificate to be evaluated, etc. Furthermore, the validity of the certificate to be evaluated may also be evaluated by machine models or manually, and this application does not limit the specific evaluation method.

[0207] In some embodiments, when the same certificate is stored in both the trust revocation directory and the trust authorization directory, for example, when both store certificate A, the update time of the corresponding certificate in the trust revocation directory and the update time in the trust authorization directory are obtained, and the certificate directory with the latest update time is determined as the target certificate directory, and the certificate is deleted from the other certificate directory. For example, if certificate A is stored in both the trust authorization directory and the trust revocation directory, and the last update time of certificate A in the trust authorization directory is 12:39 on October 15, 2024, and the last update time in the trust revocation directory is 16:50 on October 23, 2024, then the update time of certificate A in the trust revocation directory is the latest and closer to the current time. In this way, the trust revocation directory can be determined as the target certificate directory, and the relevant information of certificate A can be deleted from the trust authorization directory. In this way, the most recent operation intention can be determined from the latest update time, avoiding management confusion and ensuring the validity and accuracy of the certificate status.

[0208] By accumulating the number of verifications in the trust revocation directory, the trust revocation directory and white directory can be dynamically managed and updated to ensure the security and effectiveness of the system. This not only improves the query efficiency, but also ensures the security of the system, reduces the impact of misjudgment, and improves the accuracy and reliability of the system.

[0209] In some embodiments, the present application proposes a website access control method, which is applied to a user's browser and includes:

[0210] Step 201: Send a website access request to a target website, so that the website proxy gateway forwards the website access request to the target website through the remote browser proxy service, receives a target certificate returned by the target website, verifies the target certificate through the remote browser proxy service, and obtains a verification result. When the verification result indicates that the verification status of the target certificate is an error, query the target certificate according to a pre-set security policy data table to obtain a query result. When the query result indicates that the target certificate is a trusted certificate, control the remote browser proxy service to access the target website to obtain access data corresponding to the website access request.

[0211] Step 202: Receive access data returned by the remote browser proxy service.

[0212] The embodiment of the website access control method applied to the user browser is basically the same as the embodiment of the website access control method applied to the website proxy gateway described above, and will not be repeated here.

[0213] The embodiment of the present application sends a website access request to a target website so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, receives a target certificate returned by the target website, verifies the target certificate through the remote browser proxy service, obtains a verification result, and when the verification result indicates that the verification status of the target certificate is an error, queries the target certificate according to a pre-set security policy data table to obtain a query result, and when the query result indicates that the target certificate is a trusted certificate, controls the remote browser proxy service to access the target website and obtains access data corresponding to the website access request; and receives the access data returned by the remote browser proxy service. In this way, a trusted connection between the user browser and the remote browser proxy service can be established by setting up the remote browser proxy service, and when the remote browser proxy service finds that the verification status of the target certificate is an error, it does not directly terminate the access, but makes further judgment according to the security policy data table to effectively solve the problem of inaccessibility, thereby effectively improving the stability of the browser in accessing the website.

[0214] In some embodiments, a remote browser proxy service of a website proxy gateway may also obtain a website access request sent by a user browser to a target website. After receiving the target certificate returned by the target website, the remote browser proxy service first queries the target certificate according to a pre-set security policy data table to obtain a query result, and then calibrates the target website based on the query result. For example, if the query result indicates that the target certificate is located in the trust revocation directory of the security policy data table, that is, the target certificate is untrusted, an access error prompt is directly returned to the user browser, or the website access request of the user browser is only forwarded to the target website without obtaining data through the remote browser proxy service.

[0215] Furthermore, when the query result indicates that the target certificate is a trusted certificate, the target certificate is verified through the remote browser proxy service to obtain a verification result. When the verification result indicates that the verification status of the target certificate is correct, the remote browser proxy service of the website proxy gateway forwards the website access request of the user browser, allowing the user browser to access the corresponding target website. When the verification result indicates that the verification status of the target certificate is incorrect, the remote browser proxy service of the website proxy gateway does not need to forward the website access request of the user browser. Instead, it accesses the target website through the remote browser proxy service, obtains the corresponding access data, and returns the access data to the user browser. This allows the user browser to access the target website through the remote browser proxy service in the event that the user browser cannot normally access the target website.

[0216] The following combination Figure 3 Further examples are given.

[0217] First, the user's browser needs to import the trusted root certificate provided by the website proxy gateway for the subsequent certificate verification process.

[0218] Next, the user's browser needs to configure the Domain Name System (DNS) resolution service to point to the IP address of the remote browser proxy service of the website proxy gateway (for example, 100.100.000), so that all website access requests will be redirected to this proxy service.

[0219] The user tries to access www.xxxx.com, and the browser sends an HTTP request.

[0220] After receiving the request, the remote browser proxy service first checks whether the request matches the local security policy data table. If so, it proceeds to the next step; if not, it jumps to step 9.

[0221] If the security policy table doesn't match, the remote browser proxy service will directly access www.xxxx.com and obtain the target website's content through encrypted data communication. If the security policy table does match, the remote browser proxy service will verify the target website's certificate. If verification succeeds, access to the target website continues; if verification fails, the process enters the "ignore exception" phase.

[0222] If the certificate verification succeeds, the remote browser proxy service will continue to access www.xxxx.com and obtain the website content. If the certificate verification fails but the ignore-certificate-errors option is configured, the remote browser proxy service will ignore the certificate error, continue to access the target website, obtain the content, and return it to the user's browser.

[0223] No matter in the case of a miss or when ignoring the exception, the remote browser proxy service will access www.xxxx.com through encrypted data communication, obtain the website content, and return it to the user's browser.

[0224] See also Figure 4 The present application also provides a website access control device, which is applied to a website proxy gateway and can implement the above-mentioned website access control method. The website access control device includes:

[0225] The acquisition module 41 is used to obtain a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website;

[0226] Verification module 42, used to verify the target certificate through the remote browser proxy service and obtain a verification result;

[0227] A query module 43 is configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error;

[0228] The control module 44 is configured to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is identified as a trusted certificate according to the query result;

[0229] The return module 45 is used to return the access data to the user's browser.

[0230] The specific implementation of the website access control device is basically the same as the specific embodiment of the website access control method described above, and will not be repeated here. Under the premise of meeting the requirements of the embodiment of this application, the website access control device can also be provided with other functional modules to implement the website access control method in the above embodiment.

[0231] The present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the website access control method described above when executing the computer program. The computer device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0232] See also Figure 5 , Figure 5 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0233] The processor 51 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0234] The memory 52 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 52 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 52 and are called by the processor 51 to execute the website access control method of the embodiments of this application.

[0235] Input / output interface 53, used to implement information input and output;

[0236] Communication interface 54, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0237] bus 55 , which transmits information between the various components of the device (e.g., processor 51 , memory 52 , input / output interface 53 , and communication interface 54 );

[0238] The processor 51 , the memory 52 , the input / output interface 53 and the communication interface 54 are connected to each other in communication within the device via a bus 55 .

[0239] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned website access control method is implemented.

[0240] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0241] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0242] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0243] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0244] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0245] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0246] It should be understood that in this application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0247] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0248] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0249] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0250] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0251] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A website access control method, characterized in that: Applied to a website proxy gateway, the method includes: Obtaining a website access request sent by a user browser to a target website, forwarding the website access request to the target website through a remote browser proxy service, and receiving a target certificate returned by the target website; Verifying the target certificate through the remote browser proxy service to obtain a verification result; When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset preservation policy data table to obtain a query result; When the query result indicates that the target certificate is a trusted certificate, controlling the remote browser proxy service to access the target website to obtain access data corresponding to the website access request; The access data is returned to the user's browser.

2. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset preservation policy data table to obtain a query result includes: When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset preservation policy data table; When the target directory is a trusted authority directory, comparing first comparison information of the trusted authority directory with the target certificate to obtain a first comparison result, wherein the first comparison information includes at least one of a first certificate version number, a first certificate error type, a first certificate serial number, a first certificate subject name, a first certificate subject alternative name, and an annotation of the first comparison information; A query result is obtained according to the first comparison result.

3. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset preservation policy data table to obtain a query result further includes: When the verification result indicates that the verification status of the target certificate is wrong, determining a target directory corresponding to the target certificate from a preset preservation policy data table; When the target directory is a trust revocation directory, comparing second comparison information of the trust revocation directory with the target certificate to obtain a second comparison result, wherein the second comparison information includes at least one of a second certificate version number, a second certificate error type, a second certificate serial number, a second certificate subject name, a second certificate subject alternative name, a certificate issuer name, a certificate issuer alternative name, and an annotation of the second comparison information; A query result is obtained according to the second comparison result.

4. The website access control method according to claim 3, characterized in that: The method further comprises: In the trust revocation directory, the number of verifications for each certificate included therein is accumulated; When there is a certificate in the trust revocation directory whose cumulative verification times exceeds a preset number, the corresponding certificate is evaluated as a certificate to be evaluated to obtain an evaluation result; When the evaluation result indicates that the certificate to be evaluated is a valid certificate, the certificate to be evaluated is added to the trust authorization directory corresponding to the preservation policy data table, and the certificate to be evaluated is deleted from the trust revocation directory.

5. The website access control method according to claim 1, wherein: The returning the access data to the user browser includes: Obtaining user identity information corresponding to the user browser; wherein the user identity information includes user age, Internet Protocol address, and target device information corresponding to the user browser; Based on the user identity information, controlling the remote browser proxy service to filter the access data to obtain target access data; The target access data is returned to the user browser.

6. The website access control method according to claim 1, characterized in that: When the verification result indicates that the verification status of the target certificate is an error, querying the target certificate according to a preset preservation policy data table to obtain a query result further includes: When the verification result indicates that the verification status of the target certificate is wrong, determining the trust level of the target website; Based on the trust level of the target website, determining the order in which the target certificate queries the certificate directory in the security policy data table; According to the order of the query certificate directories, the corresponding certificate directory is selected to query the target certificate to obtain the query result.

7. A website access control method, characterized in that: Applied in a user's browser, the method includes: Sending a website access request to a target website so that the website proxy gateway forwards the website access request to the target website through a remote browser proxy service, and receives a target certificate returned by the target website, verifies the target certificate through the remote browser proxy service to obtain a verification result, and when the verification result indicates that the verification status of the target certificate is an error, queries the target certificate according to a pre-set security policy data table to obtain a query result, and when the query result indicates that the target certificate is a trusted certificate, controls the remote browser proxy service to access the target website to obtain access data corresponding to the website access request; Receive the access data returned by the remote browser proxy service.

8. A website access control device, characterized in that: Applied to a website proxy gateway, the device includes: An acquisition module is used to acquire a website access request sent by a user browser to a target website, forward the website access request to the target website through a remote browser proxy service, and receive a target certificate returned by the target website; A verification module, configured to verify the target certificate through the remote browser proxy service to obtain a verification result; a query module configured to query the target certificate according to a preset security policy data table to obtain a query result when the verification result indicates that the verification status of the target certificate is an error; a control module configured to control the remote browser proxy service to access the target website and obtain access data corresponding to the website access request when the target certificate is characterized as a trusted certificate according to the query result; The returning module is used to return the access data to the user browser.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the website access control method according to any one of claims 1 to 6 or claim 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the website access control method according to any one of claims 1 to 6 or claim 7 is implemented.

Images