Page detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a page detection method and device, a storage medium and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: obtaining a target page corresponding to a public network link in response to a page access request initiated by a terminal based on the public network link; encrypting the first hash value of the target page by using a private key stored in the connector to generate a digital signature; sending the target page containing the digital signature to the terminal; receiving a second hash value returned by the terminal; comparing the second hash value with an original hash value of a public network link, and judging whether data change occurs in the target page in the transmission process or not; and if it is detected that the data change does not occur in the target page in the transmission process, displaying the target page to the user. Compared with the prior art, efficient real-time performance and low resource consumption are achieved through a multi-level collaborative protection system, full-process prevention and control of page tampering behaviors are achieved, and credible guarantee of a transmission process and a terminal side verification link is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a page detection method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the rapid development of Internet technology and the widespread popularity of digital services, the security of web page content is facing increasingly severe challenges. Various websites, especially business systems in critical areas such as government, finance, and medical care, are frequently subjected to hacker attacks and page tampering, resulting in sensitive information leakage, service interruption, and even social trust crises. To protect the authenticity and integrity of user access content and prevent pages from being illegally tampered with during transmission or display, an efficient, reliable, and strongly secure authentication-capable web page tamper-proofing mechanism is urgently needed.

[0003] Currently, time polling technology, event triggering, and other technologies are commonly used to monitor changes in server-side web page files to detect tampering behavior. However, related detection methods lack trust assurance for the transmission process and terminal-side verification links, and cannot build a complete end-to-end protection chain, which has great limitations when facing advanced persistent threats. SUMMARY

[0004] Therefore, the present application provides a page detection method and device, a storage medium and an electronic device, which mainly aims to solve the technical problem that the current detection methods lack trust assurance for the transmission process and terminal-side verification links, and cannot build a complete end-to-end protection chain, which has great limitations when facing advanced persistent threats.

[0005] In a first aspect, the present application provides a page detection method applied to a server side, comprising: In response to a page access request initiated by a terminal based on a public link, obtaining a target page corresponding to the public link; Encrypting a first hash value of the target page using a private key stored in a connector to generate a digital signature; Sending the target page containing the digital signature to the terminal; Receiving a second hash value returned by the terminal, which is obtained by decrypting the digital signature using a public key stored in a super SIM card security chip by the terminal; By comparing the second hash value and the original hash value of the public link, it is determined whether the target page has undergone data changes during transmission; If it is detected that the target page has not undergone data changes during transmission, the target page is displayed to the user.

[0006] Secondly, this application provides a page detection method, characterized in that it is applied to the terminal side and includes: Initiate a page access request to the server based on a public network link; The server receives a target page containing a digital signature, wherein the digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector. The digital signature is decrypted using the public key stored in the Super SIM card's security chip to obtain a second hash value; The second hash value is sent back to the server. The second hash value is used to determine whether the target page has undergone data changes during transmission.

[0007] Thirdly, this application provides a page detection device applied on the server side, comprising: The acquisition module is configured to, in response to a page access request initiated by the terminal based on a public network link, acquire the target page corresponding to the public network link; The generation module is configured to encrypt the first hash value of the target page using a private key stored in the connector, thereby generating a digital signature; The sending module is configured to send a target page containing the digital signature to the terminal; The receiving module is configured to receive a second hash value returned by the terminal, the second hash value being obtained by the terminal decrypting the digital signature using a public key stored in the Super SIM card security chip; The judgment module is configured to determine whether the target page has undergone data changes by comparing the second hash value with the original hash value of the public network link; The display module is configured to display the target page to the user if it detects that no data change has occurred on the target page.

[0008] Fourthly, this application provides a page detection device, characterized in that it is applied to the terminal side and includes: The initiation module is configured to send page access requests to the server via a public network connection. The receiving module is configured to receive a target page containing a digital signature sent by the server, wherein the digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector; The decryption module is configured to decrypt the digital signature using a public key stored in the Super SIM card security chip to obtain a second hash value; The return module is configured to return the second hash value to the server, and the second hash value is used to determine whether the target page has undergone data changes.

[0009] Fifthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first or second aspect.

[0010] In a sixth aspect, this application provides an electronic device, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the method described in the first or second aspect.

[0011] In a seventh aspect, this application provides a computer program product having a computer program stored thereon, which, when executed by a processor, implements the method described in the first or second aspect.

[0012] Using the above technical solution, this application provides a page detection method, apparatus, storage medium, and electronic device. First, in response to a page access request initiated by a terminal based on a public network link, the method obtains the target page corresponding to the public network link. Then, it encrypts the first hash value of the target page using a private key stored in the connector to generate a digital signature. The target page containing the digital signature is then sent to the terminal. Next, the method receives a second hash value returned by the terminal, which is obtained by the terminal decrypting the digital signature using a public key stored in the Super SIM card security chip. By comparing the second hash value with the original hash value of the public network link, the method determines whether the target page has undergone data changes during transmission. If no data changes are detected during transmission, the target page is displayed to the user. Compared with existing technologies, this application dynamically obtains the page content and calculates the latest hash value by the connector when user access is triggered. It then compares the hash value with the original hash value stored in the security gateway in real time, avoiding the continuous resource consumption caused by traditional polling mechanisms. The verification process is only initiated when the user actually accesses the page, improving response efficiency. Meanwhile, the generation of the digital signature is completed by the server-side connector, while the verification is performed by the security chip of the terminal's super SIM card. The hardware-level key storage mechanism enhances overall security. The private key is stored in the connector's controlled environment, while the public key is written into the super SIM card's security chip, ensuring that encryption and decryption operations are performed in an isolated environment. This effectively prevents key leakage and attacks during transmission. Through a multi-layered collaborative protection system, it achieves high real-time efficiency and low resource consumption. When a hash value inconsistency is detected, risk information is promptly fed back, achieving full-process control of page tampering and providing reliable protection for the transmission process and the terminal-side verification process.

[0013] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0014] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic flowchart of a page detection method provided in an embodiment of this application is shown; Figure 2 A flowchart illustrating an example provided in an embodiment of this application is shown; Figure 3 A flowchart illustrating another page detection method provided in an embodiment of this application is shown; Figure 4 This paper shows a schematic diagram of the structure of a page detection device provided in an embodiment of the present application; Figure 5 A schematic diagram of another page detection device provided in an embodiment of this application is shown. Detailed Implementation

[0017] The embodiments of this application will now be described in more detail with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0018] With the rapid development of the Internet and the continuous expansion of website businesses, websites face increasing cybersecurity threats. Hackers use increasingly sophisticated automated tools to attack websites, resulting in a large number of websites being at risk of being tampered with. Statistics show that up to 75% of websites worldwide have security vulnerabilities, many of which lack effective patches or solutions. This has led to frequent website tampering incidents, causing serious reputational damage and social instability for various websites. Faced with these challenges, traditional protection measures such as manual comparison and detection are no longer sufficient, prompting the development and application of website anti-tampering technologies such as time polling, event triggering, core embedding, and file filtering.

[0019] Website anti-tampering technologies mainly include time-polling technology, event-triggered technology, core-embedded technology, and file-filtering-driven technology. While each of these technologies has its own characteristics, they all have shortcomings in terms of real-time performance, resource consumption, and protection effectiveness. For example, time-polling technology has significant limitations in practical applications due to its low efficiency and high resource consumption; event-triggered technology's detection mechanism for illegal operations relies on known file systems or driver interfaces, which poses a risk of being bypassed; while core-embedded technology improves network transmission reliability, it also faces resource consumption issues; and although file-filtering-driven technology has high accuracy, it still carries risks when used alone because it lacks the ability to detect and recover tampered web pages.

[0020] To address the current technical limitations of lacking reliable guarantees for the transmission process and terminal-side verification, thus hindering the construction of a complete end-to-end protection chain and significantly limiting its effectiveness against advanced persistent threats, this embodiment provides a page detection method, such as... Figure 1 As shown, applied to the server side, the method includes: Step 101: In response to the page access request initiated by the terminal based on the public network link, obtain the target page corresponding to the public network link.

[0021] In some examples, the server side may include, for example: Figure 2 The diagram shows a cloud security gateway, connected machines, and intranet business systems. The intranet business systems provide the actual business content and are not directly exposed to the public network, ensuring the security of core data and services. The connector, deployed in a demilitarized zone (DMZ), acts as a communication bridge between the internal and external networks. During access, it is responsible for obtaining the HTML source code of the target page, calculating its hash value, and generating a digital signature using a private key to complete critical security processing operations. The cloud security gateway, located in the cloud, serves as the access point and control center for the entire system. It undertakes core functions such as link encapsulation, user whitelist management, request routing and forwarding, raw hash value storage, and final integrity comparison and risk alerts, achieving secure control and collaborative verification throughout the entire page access process. Furthermore, the super SIM card in the diagram is a terminal-side hardware security module used to store the public key and complete digital signature decryption, ensuring the security of the client verification process.

[0022] For example, upon receiving a page access request from a terminal, the cloud security gateway first parses and verifies the validity of the public network link in the request, confirming that it is a registered and valid encapsulated link. Then, based on this public network link, it searches the mapping table for the corresponding real business link and associated business system information. After successful verification, the security gateway forwards the access request to the connector. The connector then initiates a page retrieval operation from the internal network business system based on the business link, fetching the source code of the target page from the current server in real time to ensure that the retrieved content is the latest generated page version, thus completing the process of retrieving the target page corresponding to the public network link.

[0023] Optionally, the method in this embodiment may further include: receiving a user whitelist uploaded by the business system; generating a private key and a public key corresponding to the business system based on the user whitelist; distributing the private key to a connector for storage through a secure tunnel; and sending the public key to the terminal of an authorized user.

[0024] For example, a secure communication channel is established between a connector deployed on the business side and a cloud security gateway. Through this channel, a whitelist of users authorized to access the system is uploaded to the security gateway. The whitelist contains user identification information that allows access to specific business resources. The security gateway receives and stores the whitelist as the basis for subsequent public key distribution and public network link issuance, ensuring that only user terminals that are included in the whitelist and have passed identity authentication can obtain access credentials and encryption keys, thereby achieving pre-control of access subjects.

[0025] In some examples, after receiving the whitelist information from a business system, the security gateway generates a unique asymmetric public-private key pair for that business system. The private key is transmitted through an encrypted secure tunnel established between the connector and the security gateway and is written into the controlled storage area of ​​the connector, ensuring that the private key is not stolen or tampered with externally during transmission and storage. At the same time, the security gateway distributes the corresponding public key according to the user range in the whitelist. The public key is securely written into the super SIM card of each authorized user terminal through the operator's SIM card management channel. The public key data is stored in the security chip of the super SIM card and is only allowed to participate in decryption operations within the chip. It is not exposed to the terminal operating system or other applications in plaintext, thereby achieving reliable distribution and isolated storage of the key pair on the server and terminal sides.

[0026] For example, a secure key storage strategy is employed: the private key is stored in the connector to ensure its security in a controlled environment; the public key is stored in the secure chip of the Super SIM card, providing hardware-level security. This approach not only improves the efficiency of key management but also significantly reduces the risk of key leakage, enhancing the overall security of the system.

[0027] Optionally, the method in this embodiment may further include: responding to a link encapsulation request initiated by the business system, obtaining the page source code corresponding to the business link; performing a hash operation on the page source code to generate an original hash value; encapsulating the business link into a public network link and storing the mapping relationship between the public network link and the original hash value; and sending the public network link to the terminal through the SIM card message channel.

[0028] For example, when a business system needs to publicly share a page link, it will proactively initiate a link encapsulation request to the cloud security gateway through a connector deployed in the DMZ. This request contains the original business link information to be published. Before forwarding the request, the connector can verify the identity of the request source to ensure that only authorized business systems can trigger the encapsulation process. After receiving the encapsulation request, the security gateway enters the link processing process, preparing to perform secure conversion and association binding on the original link, in preparation for the subsequent generation of a securely distributable public network link.

[0029] For example, upon receiving a link encapsulation request, the connector accesses the corresponding page resources based on the business link contained in the request, actively obtains the current complete HyperText Markup Language (HTML) source code of the page, and ensures that the obtained content is consistent with the server output when the user actually accesses it. Then, it performs a hash algorithm operation on the obtained HTML source code to generate a fixed-length original hash value. This hash value is used as a digital fingerprint of the initial state of the page for subsequent integrity verification. After the calculation is completed, the connector submits the original hash value and the original business link to the security gateway as the basic data for establishing the mapping relationship between public network links and page content.

[0030] In some examples, after calculating the original hash value, the connector combines the hash value with the original business link to form a data pair. This data pair is then transmitted to the cloud security gateway through an established secure tunnel. Upon receiving the data, the security gateway verifies its integrity. If the data is correct, it initiates the link encapsulation process, converting the original business link into a public link with a unique identifier. This public link can be publicly disseminated. Simultaneously, the security gateway establishes and persistently stores the association between this public link, the original business link, and the corresponding original hash value in its mapping table. This ensures that subsequent user accesses can accurately find the corresponding verification benchmark data through the public link and complete the page integrity comparison.

[0031] For example, after the security gateway completes the encapsulation of the public network link and the mapping and storage with the original hash value, it determines the target receiving terminal based on the previously uploaded user whitelist, and sends the encapsulated public network link to the super SIM card of each authorized user through the SIM card message channel provided by the operator. This transmission process is implemented using the dedicated channel of the operator's network, without relying on the conventional Internet transmission path, ensuring the security and reachability of the link distribution process. After receiving the public network link, the terminal user can use it for subsequent access operations. Clicking the link triggers the secure access process to the business system, realizing trusted page access without the need to pre-install additional applications or plugins.

[0032] Step 102: Use the private key stored in the connector to encrypt the first hash value of the target page and generate a digital signature.

[0033] Optionally, step 102 may specifically include: calculating a first hash value based on the source code of the target page; using the private key stored in the connector to perform encryption operations on the first hash value to generate a digital signature; and embedding the digital signature into the target page.

[0034] For example, when a user terminal clicks on a public network link received through the SIM card message channel, the access request is first directed to the cloud security gateway. The security gateway parses the public network link in the request and verifies its validity. After confirming that the link is registered and has not expired, it forwards the request to the connector of the corresponding business system. After receiving the access request, the connector immediately initiates a page retrieval operation to the internal business system, and captures the latest source code of the HTML page that is actually responded to by the server in real time to ensure that the obtained content reflects the real page state at the current moment. Then, it performs the same hash algorithm as the initial stage on the obtained latest source code to calculate the latest hash value corresponding to this access, that is, the first hash value, which provides the data foundation for the subsequent generation of digital signature.

[0035] In some examples, after calculating the latest hash value, the connector calls the private key pre-stored in its controlled storage area to perform asymmetric encryption on the hash value, generating a unique digital signature. This signing process is completed locally by the connector, ensuring that the private key does not participate in network transmission. The generated digital signature serves as a verification credential for page integrity and is embedded in the response header field of the HTML page or in the hidden metadata inside the page.

[0036] For example, each time a user visits the page, the system recalculates the latest hash value of the HTML page and compares it with the original hash value. Combined with the digital signature technology of the Super SIM card, efficient and reliable real-time security can be achieved even in public network environments, promptly detecting and handling potential security threats and ensuring that the page has not been tampered with.

[0037] Step 103: Send the target page containing the digital signature to the terminal.

[0038] For example, the connector returns an HTML page containing a digital signature to the security gateway, which then forwards it to the user terminal, so that the digital signature is transmitted along with the page content for the super SIM card on the terminal side to use in subsequent verification processes.

[0039] Step 104: Receive the second hash value returned by the terminal.

[0040] The second hash value is obtained by the terminal decrypting the digital signature using the public key stored in the Super SIM card's security chip.

[0041] In some examples, the security gateway receives a second hash value returned by the Super SIM card on the terminal side. This second hash value is the result obtained by the Super SIM card extracting the digital signature from the received HTML page during the page loading process, and then decrypting the digital signature by calling the stored public key inside its security chip. The decryption process is completed in the trusted execution environment of the security chip, and the public key is not output to the outside of the chip in plaintext, ensuring the confidentiality and integrity of the decryption operation. After receiving the second hash value, the security gateway uses it as the client verification data for this access and compares it with the original hash value recorded by the server.

[0042] Step 105: By comparing the second hash value with the original hash value of the public network link, determine whether the target page has undergone data changes during transmission.

[0043] Optionally, step 105 may specifically include: if the second hash value is consistent with the original hash value, it is determined that the target page has not undergone data changes during transmission; if the second hash value is inconsistent with the original hash value, it is determined that the target page has undergone data changes during transmission.

[0044] For example, the security gateway compares the second hash value with the original hash value bit by bit. If the two data are exactly the same, it is determined that the target page has not changed during the generation and transmission process on the server. If there is a difference, it is determined that the page content has been modified in the transmission link or on the server. The security gateway executes the corresponding processing procedure based on the comparison result.

[0045] Optionally, the method in this embodiment may further include: if data changes are detected on the target page during transmission, generating risk alarm information; pushing the risk alarm information to the terminal side through a security gateway, and sending a corresponding abnormal notification to the management end of the business system.

[0046] For example, when a data change is detected, the security gateway interrupts the page display process, pushes a risk warning message to the user terminal, and simultaneously generates an anomaly alarm notification and sends it to the management terminal of the business system so that the administrator can check the page status and system security.

[0047] Step 106: If it is detected that the target page has not undergone data changes during transmission, then display the target page to the user.

[0048] For example, if it is determined that no data change has occurred, the current page access request is allowed to continue, and the normal page content is returned to the user terminal.

[0049] In some examples, such as Figure 2 As shown, in response to a page access request initiated by a terminal via a public network link, the cloud security gateway on the server side first verifies the identity and permissions of the received request, confirming that the public network link is valid and within the legal access period. Subsequently, based on the unique identifier of the public network link, the cloud security gateway looks up the corresponding original business link and associated information in its local mapping table and forwards the access request to the connector deployed in the DMZ zone. Upon receiving the request, the connector initiates a page retrieval request to the internal network business system, actively pulling the HTML source code of the target page at the current moment to ensure that the retrieved content is the latest, uncached, and unmodified. After successful retrieval, the connector recalculates the hash value of the current HTML source code (i.e., the latest hash value) as the integrity benchmark for this access. Next, the connector uses the private key stored in its secure storage area to perform asymmetric encryption on the latest hash value, generating a digital signature. This signature is then embedded into the HTML page response (e.g., via HTTP headers or page metadata), and finally, the target page containing the digital signature is returned to the cloud security gateway, which forwards it to the end user.

[0050] Compared with existing technologies, by applying the technical solution of this embodiment, the system first responds to a page access request initiated by the terminal based on a public network link, and obtains the target page corresponding to the public network link; then, it uses the private key stored in the connector to encrypt the first hash value of the target page to generate a digital signature; the target page containing the digital signature is sent to the terminal; the system receives the second hash value returned by the terminal, which is obtained by the terminal decrypting the digital signature using the public key stored in the super SIM card security chip; by comparing the second hash value with the original hash value of the public network link, it is determined whether the target page has undergone data changes during transmission; if it is detected that the target page has not undergone data changes during transmission, the target page is displayed to the user. This embodiment constructs a comprehensive security protection system from user authorization to final security checks. User authorization authentication ensures that only whitelisted users can access business resources, preventing unauthorized access. In the key management and distribution stage, encryption algorithms generate public-private key pairs, storing the private key in a connector and writing the public key into the super SIM card's security chip to ensure key security. In the link encapsulation stage, a hash algorithm calculates the original hash value of the page and establishes a mapping relationship with the encapsulated public network link. In the access verification stage, the hash value is recalculated and a digital signature is generated each time a user accesses the page. Combined with the super SIM card's decryption capabilities, terminal-side verification is completed. All stages work collaboratively, using encryption algorithms, hash algorithms, and digital signatures to ensure page integrity and access legitimacy throughout the entire process, while reducing resource consumption.

[0051] Accordingly, to further illustrate the specific implementation process of page detection, this embodiment provides the following: Figure 3 The specific method shown is applied to the terminal side, and the method includes: Step 201: Initiate a page access request to the server based on the public network link.

[0052] In some examples, the user terminal initiates a page access request to the server based on a public network link received through the SIM card message channel. This public network link points to a cloud security gateway as the access entry point. After clicking the link, the terminal submits an access request to the security gateway via standard HTTP or HTTPS protocols. The request contains the complete identification information of the public network link, which is used to trigger the subsequent page integrity verification process. The terminal includes a mobile device integrated with a Super SIM card. The Super SIM card stores a public key corresponding to the current business system. This public key is used to decrypt and verify the digital signature issued by the server during the page loading phase, ensuring that the terminal has hardware-level security authentication capabilities and providing basic support for the subsequent return of the decrypted hash value.

[0053] Optionally, the method in this embodiment may further include: receiving a public key corresponding to the business system sent by the server, wherein the public key is generated by the server based on the user whitelist; and saving the public key into the security chip of the super SIM card.

[0054] For example, the terminal receives the public key corresponding to the business system distributed by the server through the security gateway. This public key is part of the asymmetric key pair generated by the security gateway for the business system after receiving the user whitelist uploaded by the business system, and is distributed to users in the whitelist. After receiving the public key data, the terminal transmits it to the built-in super SIM card. The security chip of the super SIM card verifies and stores the public key, ensuring that the public key is written to the protected area inside the chip and can only be used for decryption operations inside the security chip. The plaintext key is not exposed to the terminal operating system or other applications, thus realizing the secure storage and isolated use of the public key on the terminal side.

[0055] Step 202: Receive the target page containing the digital signature sent by the server.

[0056] The digital signature is generated by the server using the private key stored in the connector to encrypt the first hash value of the target page.

[0057] In some examples, the target page content includes the original HTML source code and an embedded digital signature. The digital signature is generated by the server using a private key stored in the connector to encrypt the latest hash value of the page, and is transmitted along with the page via an HTTP response header or page metadata field. The terminal recognizes the signature information during the page loading process and passes it to the security chip of the Super SIM card, providing data input for subsequent decryption and verification using the public key stored in the security chip, ensuring that the page integrity verification process can be started in a hardware-level security environment.

[0058] Step 203: Decrypt the digital signature using the public key stored in the Super SIM card security chip to obtain the second hash value.

[0059] For example, after receiving an HTML page containing a digital signature, the user terminal's browser begins loading content and simultaneously triggers a secure communication mechanism with the Super SIM card. The Super SIM card extracts the embedded digital signature from the page response data and uses the stored public key within its built-in security chip to perform an asymmetric decryption operation on the digital signature. This decryption process is completed in the trusted execution environment of the security chip, and the public key is not exposed externally. After successful decryption, the latest hash value generated by the server, i.e., the second hash value, is restored. The second hash value represents the integrity state of the page when it was generated by the server. The Super SIM card temporarily stores the latest hash value obtained from decryption in a secure area, preparing to send it back to the server's security gateway through a secure channel to participate in integrity comparison.

[0060] Step 204: Send the second hash value back to the server.

[0061] The second hash value is used to determine whether the target page has undergone data changes during transmission.

[0062] For example, after completing the digital signature decryption and obtaining the latest hash value, the Super SIM card securely transmits the hash value back to the cloud security gateway through the operator's SIM card dedicated communication channel. After receiving the hash value, the security gateway looks up the original hash value associated with it in the mapping table according to the public network link used for the current access. This original hash value is the initial integrity benchmark of the page pre-stored during the link encapsulation stage. The security gateway compares the latest hash value transmitted back with the stored original hash value bit by bit to confirm whether the two are consistent. The comparison result serves as the basis for judging whether any data changes have occurred during the generation, transmission and reception of the page content on the server.

[0063] Compared to existing technologies, the technical solution of this embodiment first initiates a page access request to the server based on a public network connection; then, it receives a target page containing a digital signature sent by the server. The digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector. Next, it decrypts the digital signature using a public key stored in the Super SIM card's security chip to obtain a second hash value. The second hash value is then sent back to the server, where it is used to determine whether the target page has undergone data changes during transmission. This embodiment, by utilizing the Super SIM card's built-in security chip to store and use the public key, ensures that the decryption process is completed in a trusted execution environment, preventing key theft or forgery. It achieves hardware-level identity authentication and content integrity verification, improving the security and reliability of the page anti-tampering mechanisms included during transmission and on the terminal side.

[0064] Furthermore, as Figure 1 The specific implementation of the method shown in this embodiment provides a page detection device applied to the server side, such as... Figure 4 As shown, the device includes: an acquisition module 31, a generation module 32, a sending module 33, a receiving module 34, a judgment module 35, and a display module 36.

[0065] The acquisition module 31 is configured to acquire the target page corresponding to the public network link in response to a page access request initiated by the terminal based on the public network link; The generation module 32 is configured to encrypt the first hash value of the target page using a private key stored in the connector to generate a digital signature; Sending module 33 is configured to send a target page containing the digital signature to the terminal; The receiving module 34 is configured to receive a second hash value returned by the terminal, the second hash value being obtained by the terminal decrypting the digital signature using a public key stored in the Super SIM card security chip; The judgment module 35 is configured to determine whether the target page has undergone data changes by comparing the second hash value with the original hash value of the public network link. The display module 36 is configured to display the target page to the user if it is detected that no data change has occurred on the target page.

[0066] In some examples of this embodiment, the generation module 32 is specifically configured to calculate the first hash value based on the source code of the target page; call the private key stored in the connector to perform encryption operation on the first hash value to generate the digital signature; and embed the digital signature into the target page.

[0067] In some examples of this embodiment, the acquisition module 31 is specifically configured to, in response to a link encapsulation request initiated by the business system, acquire the page source code corresponding to the business link; perform a hash operation on the page source code to generate an original hash value; encapsulate the business link into a public network link and store the mapping relationship between the public network link and the original hash value; and send the public network link to the terminal through the SIM card message channel.

[0068] In some examples of this embodiment, the acquisition module 31 is further configured to receive a user whitelist uploaded by the business system; generate a private key and a public key corresponding to the business system based on the user whitelist; distribute the private key to a connector for storage through a secure tunnel; and send the public key to the terminal of an authorized user.

[0069] In some examples of this embodiment, the judgment module 35 is specifically configured to determine that the target page has not undergone data changes during transmission if the second hash value is consistent with the original hash value; and to determine that the target page has undergone data changes during transmission if the second hash value is inconsistent with the original hash value.

[0070] In some examples of this embodiment, the judgment module 35 is further configured to generate risk alarm information if it detects that the target page has undergone data changes during transmission; push the risk alarm information to the terminal side through the security gateway; and send a corresponding abnormal notification to the management end of the business system.

[0071] Furthermore, as Figure 3 The specific implementation of the method shown in this embodiment provides a page detection device applied to the terminal side, such as... Figure 5As shown, the device includes: an initiation module 41, a receiving module 42, a decryption module 43, and a return module 44.

[0072] Initiation module 41 is configured to initiate a page access request to the server based on a public network connection; The receiving module 42 is configured to receive a target page containing a digital signature sent by the server, wherein the digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector; Decryption module 43 is configured to decrypt the digital signature using the public key stored in the Super SIM card security chip to obtain a second hash value; The return module 44 is configured to return the second hash value to the server, and the second hash value is used to determine whether the target page has undergone data changes.

[0073] In some examples of this embodiment, the receiving module 42 is further configured to receive the public key corresponding to the business system sent by the server, the public key being generated by the server based on the user whitelist; and to save the public key into the security chip of the super SIM card.

[0074] It should be noted that for other corresponding descriptions of the functional units involved in the page detection device provided in this embodiment, please refer to... Figure 1 and Figure 3 The corresponding descriptions in [the document] will not be repeated here.

[0075] Based on the above, Figure 1 and Figure 3 Accordingly, this embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method. Figure 1 and Figure 3 The method shown.

[0076] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0077] Based on the above, Figure 1 and Figure 3 The method shown, and Figure 4 and Figure 5To achieve the above objectives, the present application also provides an electronic device, such as a personal computer, server, laptop computer, intelligent robot, or other intelligent terminal, as illustrated in the virtual device embodiment. This device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to implement the above-described virtual device. Figure 1 and Figure 3 The method shown.

[0078] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0079] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0080] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0081] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented using software plus necessary general-purpose hardware platforms, or it can be implemented using hardware. Compared with existing technologies, this embodiment achieves high real-time performance and low resource consumption through a multi-layered collaborative protection system. The system constructs a complete protection chain covering user authorization, key distribution, link encapsulation, access verification, and tamper detection, forming a closed loop from access entry to terminal verification. Access permissions are controlled through a whitelist mechanism, keys and links are distributed using secure channels, and an end-to-end page integrity verification mechanism based on a super SIM card is constructed. This strengthens the anti-tampering capability of the business system in a public network environment and improves the level of identity trust and data integrity protection during user access. This embodiment relies on the operator's network infrastructure and hardware-level security modules to achieve closed-loop management of the entire process of access subject identity authentication, link distribution, content signing, and terminal verification, effectively preventing security risks such as unauthorized access, page hijacking, and man-in-the-middle attacks. In industries with stringent information security requirements, such as finance, government, healthcare, and manufacturing, the system meets the needs for high compliance and strong identity authentication through mechanisms such as whitelist control, local storage of private keys, hardware-level protection of public keys, and dynamic verification of digital signatures. This enhances the anti-attack capabilities and auditability of critical business systems, while reducing reliance on additional software and hardware, simplifying deployment processes, and lowering operation and maintenance costs. It allows enterprise IT resources to focus more on core business innovation and the construction of a security system, improving remote access security while optimizing overall operational efficiency.

[0082] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0083] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A page detection method, characterized in that, Applied to the server side, including: In response to a page access request initiated by a terminal based on a public network link, the target page corresponding to the public network link is obtained; The first hash value of the target page is encrypted using the private key stored in the connector to generate a digital signature; Send the target page containing the digital signature to the terminal; Receive a second hash value returned by the terminal, the second hash value being obtained by the terminal decrypting the digital signature using the public key stored in the Super SIM card security chip; By comparing the second hash value with the original hash value of the public network link, it is determined whether the target page has undergone data changes during transmission; If it is detected that the target page has not undergone data changes during transmission, the target page is displayed to the user.

2. The method according to claim 1, characterized in that, The step of encrypting the first hash value of the target page using the private key stored in the connector to generate a digital signature includes: The first hash value is calculated based on the source code of the target page; The first hash value is encrypted using the private key stored in the connector to generate the digital signature; The digital signature is embedded into the target page.

3. The method according to claim 1, characterized in that, Before responding to a page access request initiated by a terminal via a public network link and obtaining the target page corresponding to the public network link, the method further includes: In response to a link encapsulation request initiated by the business system, obtain the page source code corresponding to the business link; Perform a hash operation on the page source code to generate the original hash value; The business link is encapsulated into a public network link, and the mapping relationship between the public network link and the original hash value is stored; The public network link is sent to the terminal via the SIM card message channel.

4. The method according to claim 1, characterized in that, The method further includes: Receive user whitelists uploaded by the business system; Based on the user whitelist, generate the private key and public key corresponding to the business system; The private key is distributed to the connector for storage via a secure tunnel, and the public key is sent to the terminal of the authorized user.

5. The method according to claim 1, characterized in that, The step of comparing the second hash value with the original hash value of the public network link to determine whether the target page has undergone data changes during transmission includes: If the second hash value is consistent with the original hash value, it is determined that the target page has not undergone data changes during transmission; If the second hash value is inconsistent with the original hash value, it is determined that the target page has undergone data changes during transmission.

6. The method according to claim 5, characterized in that, After determining that the target page has undergone data changes during transmission, the method further includes: If data changes are detected on the target page during transmission, a risk warning message is generated. The risk alarm information is pushed to the terminal side through the security gateway, and the corresponding abnormal notification is sent to the management end of the business system.

7. A page detection method, characterized in that, Applied to the terminal side, including: Initiate a page access request to the server based on a public network link; The server receives a target page containing a digital signature, wherein the digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector. The digital signature is decrypted using the public key stored in the Super SIM card's security chip to obtain a second hash value; The second hash value is sent back to the server. The second hash value is used to determine whether the target page has undergone data changes during transmission.

8. The method according to claim 7, characterized in that, Before initiating a page access request to the server based on a public network link, the method further includes: Receive the public key corresponding to the business system sent by the server, the public key being generated by the server based on the user whitelist; The public key is saved to the security chip of the super SIM card.

9. A page detection device, characterized in that, Applied to the server side, including: The acquisition module is configured to, in response to a page access request initiated by the terminal based on a public network link, acquire the target page corresponding to the public network link; The generation module is configured to encrypt the first hash value of the target page using a private key stored in the connector, thereby generating a digital signature; The sending module is configured to send a target page containing the digital signature to the terminal; The receiving module is configured to receive a second hash value returned by the terminal, the second hash value being obtained by the terminal decrypting the digital signature using a public key stored in the Super SIM card security chip; The judgment module is configured to determine whether the target page has undergone data changes by comparing the second hash value with the original hash value of the public network link; The display module is configured to display the target page to the user if it detects that no data change has occurred on the target page.

10. A page detection device, characterized in that, Applied to the terminal side, including: The initiation module is configured to send page access requests to the server via a public network connection. The receiving module is configured to receive a target page containing a digital signature sent by the server, wherein the digital signature is generated by the server encrypting a first hash value of the target page using a private key stored in the connector; The decryption module is configured to decrypt the digital signature using a public key stored in the Super SIM card security chip to obtain a second hash value; The return module is configured to return the second hash value to the server, and the second hash value is used to determine whether the target page has undergone data changes.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8.

12. An electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 8.

13. A computer program product having a computer program stored thereon, characterized in that, When the computer program product is executed by a processor, it implements the method of any one of claims 1 to 8.

Images