Resource access control method and device, equipment and storage medium
By creating a Web Worker thread in the main thread of the browser tab to send heartbeat signals and monitor their updates, the problem of unauthorized access caused by session credential hijacking is solved, and reliable access control of protected resources is achieved.
Patent Information
- Application Number
- CN202511570419.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-30
- Publication Date
- 2026-02-27
AI Technical Summary
In existing session-based authentication mechanisms, if session credentials have not expired and are stored in the browser, attackers can impersonate users and initiate unauthorized access to resources through methods such as tab hijacking, resulting in unauthorized and continuous access to protected resources.
By creating a Web Worker thread on the main thread of the target tab, the Web Worker thread is configured to periodically send heartbeat signals to the browser's local storage area. The main thread then determines whether the heartbeat signal is updated within the timeout threshold. If it is updated, the access permission is maintained; otherwise, the access permission is terminated.
It enables precise monitoring of tab activity, preventing unauthorized resource access due to page freezing, crashes, or malicious hijacking, ensuring the reliability and real-time nature of access permissions, and is independent of the main thread's runtime environment.
Smart Images
Figure CN121580429A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet technology, and in particular to a resource access control method, a resource access control device, a computer device, and a computer-readable storage medium. Background Technology
[0002] Currently, platforms such as enterprise internal management systems, online office platforms, and online education systems widely adopt session-based authentication mechanisms. After a user logs in, the server issues a session credential for identity verification for subsequent resource access. However, as long as the session credential has not expired and is stored in the browser, attackers can impersonate the user and initiate unauthorized resource access through methods such as tab hijacking. Summary of the Invention
[0003] This invention provides a resource access control method, a resource access control device, a computer device, and a computer-readable storage medium, which can effectively prevent unauthorized and continuous access to protected resources and improve the controllability of resource access.
[0004] On one hand, the resource access control method provided by the present invention includes: A Web Worker thread is created by the main thread that accesses the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread. The main thread then updates the browser's local storage area with the received heartbeat signals. The main thread determines whether the heartbeat signal in the local storage area has been updated within the timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the access permissions of the target tab to the protected resource will be terminated via the main thread.
[0005] In a second aspect, the resource access control device provided by the present invention includes: The heartbeat configuration module is used to create a Web Worker thread by the main thread accessing the target tab of the protected resource, and configure the Web Worker thread to periodically send heartbeat signals to the main thread, which then updates the browser's local storage area with the received heartbeat signals. The heartbeat detection module is used by the main thread to determine whether the heartbeat signal in the local storage area has been updated within the timeout threshold. The access control module is used to maintain the target tab's access to the protected resource via the main thread when the heartbeat signal in the local storage area is updated within the timeout threshold; or to terminate the target tab's access to the protected resource via the main thread when the heartbeat signal in the local storage area is not updated within the timeout threshold.
[0006] Optionally, in one embodiment, the access control module is used to send a session termination request to the server of the target tab via the main thread, requesting the server to clear the session information associated with the target tab; and to clear the session credential information associated with the target tab in the local storage area via the main thread.
[0007] Optionally, in one embodiment, the access control module is used to send a random challenge message to the Web Worker thread through the main thread and receive the response result returned by the Web Worker thread if the heartbeat signal in the local storage area is updated within the timeout threshold; if the response result meets the preset response rules, the main thread maintains the access rights of the target tab to the protected resources.
[0008] Optionally, in one embodiment, the access control module is further configured to terminate the target tab's access to the protected resource via the main thread when the response result does not conform to the preset response rules.
[0009] Optionally, in one embodiment, the access control module is used to obtain the current network status through the main thread when the heartbeat signal in the local storage area is not updated within the timeout threshold; if the current network status is normal, the access permission of the target tab to the protected resource is terminated through the main thread.
[0010] Optionally, in one embodiment, the heartbeat signal is obtained by encoding the periodically acquired heartbeat reference value by a Web Worker thread after concatenating it with a preset perturbation parameter.
[0011] Optionally, in one embodiment, the resource access control device provided by the present invention further includes a life maintenance module, which is used to send a survival certificate to the server of the target tab through the main thread after receiving a heartbeat signal sent by the Web Worker thread. The survival certificate is used to instruct the server to reject resource access requests carrying session credential information initiated by non-target tabs.
[0012] Thirdly, the computer device provided by the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the resource access control method provided by the present invention.
[0013] Fourthly, the computer-readable storage medium provided by the present invention stores a computer program that, when executed by a processor, implements the resource access control method provided by the present invention.
[0014] This invention provides a resource access control scheme. A Web Worker thread is created from the main thread of the target tab accessing the protected resource. This Web Worker thread is configured to periodically send heartbeat signals to the main thread, which then updates the received heartbeat signals in the browser's local storage area. The main thread determines whether the heartbeat signal in the local storage area is updated within a timeout threshold. If it is, the main thread maintains the target tab's access to the protected resource. If it is not, the main thread terminates the target tab's access to the protected resource. Compared to related technologies, this invention achieves precise monitoring of tab activity through the collaborative mechanism of the Web Worker thread and the main thread, effectively preventing unauthorized resource access caused by page freezing, crashes, or malicious hijacking. Furthermore, since the generation and updating of the heartbeat signal are independent of the main thread's runtime environment, the heartbeat mechanism continues to operate even if the main thread is briefly interrupted due to page lag or script blocking, ensuring the reliability and real-time performance of access control. Attached Figure Description
[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 This is a flowchart illustrating the resource access control method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the resource access control device provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0017] To make the technical problems solved, the technical solutions, and the beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
[0018] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0019] It should also be understood that the term “and / or” as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0020] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."
[0021] Furthermore, in the description of this invention and the appended claims, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.
[0022] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of the invention include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.
[0023] This invention provides a resource access control method, a resource access control device, a computer device, and a storage medium. The resource access control method can be executed by the resource access control device or by a computer device integrating the resource access control device. Specifically, a Web Worker thread is created by the main thread accessing the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread. The main thread updates the received heartbeat signals to the browser's local storage area. The main thread determines whether the heartbeat signal in the local storage area is updated within a timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the main thread terminates the target tab's access to the protected resource.
[0024] Please refer to Figure 1 This is a flowchart illustrating a resource access control method disclosed in an embodiment of the present invention, as shown below. Figure 1 As shown, the flow of this resource access control method can be as follows: In S110, a Web Worker thread is created by the main thread that accesses the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread, which then updates the browser's local storage area with the received heartbeat signals.
[0025] Tabs play a crucial role as the basic building blocks of a browser when browsing web pages. Each tab has its own independent main thread, dedicated to executing script code and rendering page content, ensuring that operations between different tabs do not interfere with each other, thereby improving browsing efficiency and user experience.
[0026] A Web Worker is a JavaScript thread that runs independently in the background, enabling it to perform complex calculations or scheduled tasks without blocking the main thread, thus avoiding impacting page responsiveness.
[0027] Protected resources refer to web page resources that require access control, including specific pages, interface data, or sensitive information content.
[0028] The following embodiments use a computer device as the execution subject to describe in detail the resource access control method provided by the present invention.
[0029] In this embodiment of the invention, the tab in the browser that accesses the protected resource is designated as the target tab. The computer device creates a Web Worker thread through the main thread of the target tab and configures it to periodically send heartbeat signals to the main thread. The content and sending period of the heartbeat signal are not limited here and can be flexibly configured according to the actual security policy. For example, the computer device can configure the Web Worker thread to send a heartbeat signal every 1000 milliseconds through the main thread, which is then received by the main thread and updated in the browser's local storage area.
[0030] After the main thread receives a heartbeat signal from the Web Worker thread, the computer device updates the heartbeat signal to the browser's local storage area through the main thread. The local storage area can use storage mechanisms such as LocalStorage, SessionStorage, or IndexedDB to ensure that the heartbeat signal can still be retrieved after a page refresh or brief shutdown. Through this mechanism, the computer device can accurately determine whether the heartbeat has timed out during subsequent permission checks, thereby deciding whether to maintain access to the protected resource.
[0031] For example, if you want the heartbeat state to remain valid throughout the session on the target tab and expire when the target tab is closed, you can use SessionStorage for storage. Its lifecycle is bound to the session, which can effectively avoid the risk of misjudgment of permissions caused by the heartbeat state remaining across sessions.
[0032] For example, when using localStorages, the computer device can store heartbeat signals in key-value pairs, where the key name can be set to "heartbeat" and the corresponding value is the currently received heartbeat signal; each time a heartbeat signal is received from a WebWorker thread, the computer device updates the value through the main thread.
[0033] It should be noted that communication between Web Worker threads and the main thread can be based on an event-driven message passing mechanism to ensure the security and non-blocking nature of data exchange. For example, a Web Worker thread can send a heartbeat signal to the main thread via the `postMessage` method, and the main thread can receive the heartbeat signal by listening for the `message` event.
[0034] In S120, the main thread determines whether the heartbeat signal in the local storage area has been updated within the timeout threshold.
[0035] In this embodiment of the invention, the computer device periodically checks whether the heartbeat signal in the local storage area is updated within the timeout threshold according to the configured heartbeat detection cycle.
[0036] It should be noted that, with the constraint that the timeout threshold must be greater than the heartbeat detection period, the values of the timeout threshold and the heartbeat detection period can be reasonably set by those skilled in the art based on actual security requirements and system performance. For example, the heartbeat detection period can be set to once every 1000 milliseconds, and the timeout threshold can be set to 3000 milliseconds, which ensures that the heartbeat is considered valid within the interval between three heartbeat signal transmissions, avoiding false judgments due to short delays. Alternatively, assuming both the heartbeat detection period and the timeout threshold are set to 1000 milliseconds, if a heartbeat signal arrives late, it will exceed the timeout threshold, leading to a false judgment of a heartbeat timeout.
[0037] For example, the timeout threshold can be dynamically adjusted according to the application scenario or user behavior pattern. For instance, in a high-security scenario, the timeout threshold can be set to 2000 milliseconds to improve response sensitivity, while in a normal scenario with frequent user interaction, the timeout threshold can be relaxed to 5000 milliseconds to enhance fault tolerance.
[0038] In S130, if the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource.
[0039] If the heartbeat signal is detected to have been updated within the timeout threshold, it means that the Web Worker thread is still running normally. The computer device will maintain access to the protected resource through the main thread, allowing the user to continue to access the protected resource through the target tab, thus ensuring the continuity and security of the operation.
[0040] In S140, if the heartbeat signal in the local storage area is not updated within the timeout threshold, the access rights of the target tab to the protected resource are terminated by the main thread.
[0041] If the heartbeat signal fails to update within the timeout threshold, it indicates that the Web Worker thread may have been interrupted or blocked, posing a potential security risk. In this case, the computer device will immediately terminate the target tab's access to the protected resource through the main thread, severing its connection with the protected resource to prevent unauthorized access or data leakage.
[0042] For example, if the target tab is closed abnormally (such as closing the tab directly, browser crash, process being killed, etc.), the Web Worker thread running in the target tab will terminate and will be unable to continue sending heartbeat signals. When the computer device reads the heartbeat signal in the local storage area through the main thread in the next heartbeat detection cycle, it will find that it has not been updated within the timeout threshold, and then trigger the permission termination mechanism. For example, when a computer device enters a hibernation state, all background threads, including Web Worker threads, will pause execution, and the heartbeat signal will stop updating. When the computer device wakes up, it will restart heartbeat detection. At this time, the heartbeat signal read is still the heartbeat signal before hibernation. If it is found that the heartbeat signal has not been updated within the timeout threshold, the permission termination mechanism will be triggered.
[0043] It is understandable that, in addition to the above situations, abnormal situations such as network congestion, thread deadlock, or exhaustion of system resources may also cause delays or interruptions in heartbeat signal updates, which will also trigger the permission termination mechanism, and will not be elaborated here.
[0044] Optionally, in one embodiment, terminating the target tab's access to the protected resource via the main thread includes: The main thread sends a session termination request to the server of the target tab, requesting the server to clear the session information associated with the target tab; The main thread clears the session credential information associated with the target tab from the local storage area.
[0045] This invention provides an optional permission termination mechanism, which aims to ensure the complete termination of access permissions by collaboratively cleaning up session-related data from both ends.
[0046] On the one hand, the computer device sends a session termination request to the server of the target tab in the main thread, requesting the server to clear the session information associated with the target tab, so that the server will no longer recognize subsequent requests from that session, thereby effectively preventing replay attacks or session hijacking risks. The session information includes, but is not limited to, sensitive data such as session credentials, user identification, permission context, and temporary encryption keys. On the other hand, the computer device also clears the session credential information associated with the target tab from the local storage area via the main thread to prevent the page from regaining access if it is maliciously restored or replayed locally. This session credential information includes, but is not limited to, sensitive data such as tokens and session identifiers.
[0047] In addition, computer devices can also redirect the target tab to the login page via the main thread, clearly informing the user that the current session has expired and that re-authentication is required to continue accessing the site.
[0048] By synchronously cleaning up the session state between the client (i.e., computer device) and the server, the access permissions to the protected resources are completely invalidated, thereby effectively preventing security threats such as session hijacking or credential replay and further improving the overall security of the system.
[0049] Optionally, in one embodiment, if the heartbeat signal in the local storage area is updated within a timeout threshold, the main thread maintains the target tab's access to the protected resource, including: If the heartbeat signal in the local storage area is updated within the timeout threshold, a random challenge message is sent to the Web Worker thread through the main thread, and the response result returned by the Web Worker thread is received. If the response meets the preset response rules, the target tab's access to the protected resources will be maintained through the main thread.
[0050] This invention further introduces a random challenge-response mechanism to ensure that the target tab remains in a controllable execution environment.
[0051] In this process, after the computer device detects that the heartbeat signal in the local storage area has been updated within a timeout threshold, it sends a random challenge message to the Web Worker thread via the main thread to verify the authenticity of its running status. Upon receiving the challenge, the Web Worker thread generates a corresponding response based on a preset algorithm and sends it back. Correspondingly, the main thread waits to receive the response from the Web Worker thread in response to the random challenge message.
[0052] After the main thread receives the response from the Web Worker thread, the computer device immediately performs rule verification on the response. If it conforms to the preset response rules, it determines that the Web Worker thread is running normally and has not been tampered with, thus confirming that the target tab is still in a trusted execution environment. At this point, the computer device maintains the target tab's access to the protected resource through the main thread, allowing the user to continue accessing the protected resource through the target tab.
[0053] For example, a computer device can generate an unpredictable random value (such as a random string, random number, or timestamp hash) as a random challenge message and send it to the Web Worker thread. The Web Worker thread uses a preset key to perform an HMAC-SHA256 signature operation on the random value, and encodes the signature result in Base64 before sending it back to the main thread as a response. After receiving the response, the main thread parses the Base64 encoding and verifies the integrity and correctness of the HMAC signature. If the verification passes, it confirms that the Web Worker thread is running normally and continues to maintain the target tab's access rights to the protected resources.
[0054] In addition, the computer device can monitor the return latency of the response result. Only if the response result is returned within the preset latency threshold and the verification is passed will the Web Worker thread be determined to be running normally, and the main thread will continue to maintain the target tab's access to the protected resources.
[0055] Optionally, in one embodiment, after receiving the response result returned by the Web Worker thread, the method further includes: If the response does not conform to the preset response rules, the main thread will terminate the target tab's access to the protected resource.
[0056] In this embodiment of the invention, after receiving the response result returned by the Web Worker thread, if the response structure does not conform to the preset response rules, it is determined that the Web Worker thread may have been hijacked or there is an abnormality in the environment. At this time, the computer device also terminates the access rights of the target tab to the protected resource through the main thread, cuts off its connection with the protected resource, and prevents unauthorized access or data leakage.
[0057] In addition, computer devices can trigger security alert mechanisms, recording abnormal events to the log system via the main thread and notifying the server for further risk assessment and response. For example, the server can determine whether an attack is malicious based on historical behavior analysis and device fingerprint information, and dynamically adjust protection strategies accordingly.
[0058] Optionally, in one embodiment, after receiving the response result returned by the Web Worker thread, the method further includes: If the main thread does not receive a response from the Web Worker thread within the preset latency threshold, the main thread will terminate the target tab's access to the protected resource.
[0059] In this embodiment of the invention, after the computer device sends a random challenge message to the Web Worker thread through the main thread, it starts a timer to monitor the response latency. If no response result is received from the Web Worker thread within a preset latency threshold, it is determined that the Web Worker thread may have lost its response or is in an abnormal execution environment. At this time, the computer device terminates the target tab's access to the protected resource through the main thread, cuts off its connection channel with the protected resource, and prevents the potential security threat from spreading further.
[0060] It should be noted that the preset latency threshold in this embodiment of the invention can be dynamically adjusted according to specific application scenarios to balance security and user experience. For example, in high-risk operation scenarios, the preset latency threshold can be shortened to improve detection sensitivity; while in normal browsing scenarios, the preset latency threshold can be appropriately relaxed to avoid accidental triggering of permission interruption.
[0061] Optionally, in one embodiment, if the heartbeat signal in the local storage area is not updated within the timeout threshold, the access permission of the target tab to the protected resource is terminated via the main thread, including: If the heartbeat signal in the local storage area is not updated within the timeout threshold, the current network status is obtained through the main thread; If the current network status is normal, the main thread will terminate the target tab's access permissions to the protected resources.
[0062] This invention further introduces a network status collaborative judgment mechanism to avoid the heartbeat signal delay caused by network anomalies being misjudged as a security event.
[0063] In this process, after determining whether the heartbeat signal in the local storage area has been updated within the timeout threshold, if the computer device detects that the heartbeat signal in the local storage area has not been updated within the timeout threshold, it further obtains the browser's current network status to determine whether it is caused by a network anomaly. If the current network status is normal, but the heartbeat signal still has not been updated, it is determined that the Web Worker thread may have escaped the controlled execution environment or been hijacked. At this time, the computer device terminates the target tab's access to the protected resource through the main thread, cutting off its connection with the protected resource and preventing the spread of potential security risks.
[0064] For example, computer devices can use the navigator.onLine property to determine the network connection status. If it returns true, it indicates that the network status is normal; if it returns false, it indicates that the network status is abnormal.
[0065] In other embodiments, if an abnormal network status is detected, it indicates that a network connection problem may cause a delay in the heartbeat signal update. In this case, the permission termination mechanism is not triggered immediately. Instead, a warning message is output to prompt the user to check the network connection status, and a delayed retry mechanism is started. After the network is restored, the heartbeat signal update is re-verified to ensure that service availability is maintained in non-malicious abnormal scenarios. At the same time, subsequent heartbeat cycles are continuously monitored to determine whether the normal execution environment has been restored.
[0066] Optionally, in one embodiment, the heartbeat signal is obtained by encoding the periodically acquired heartbeat reference value by a Web Worker thread after concatenating it with a preset perturbation parameter.
[0067] The heartbeat reference value is a core parameter used to generate heartbeat signals. It can be generated based on a timestamp or a counter, such as by obtaining the current system timestamp or incrementing the counter value through a Web Worker thread, to ensure that each heartbeat signal is unique and timely.
[0068] The preset perturbation parameter is embedded as a randomization factor in the heartbeat signal generation process to prevent attackers from simulating legitimate heartbeats by predicting timestamps or counting patterns. For example, the current timestamp at the time of the splicing operation can be used as the preset perturbation parameter, or the preset perturbation parameter can be set to a pseudo-random number generated by a Web Worker thread.
[0069] In this embodiment of the invention, when a heartbeat cycle is triggered, the Web Worker thread first obtains a heartbeat reference value and a preset perturbation parameter. Then, it concatenates these two values in a fixed format to form an original heartbeat string. The original heartbeat string is then encoded according to a configured encoding strategy to obtain the heartbeat signal, which is then sent to the main thread. This mechanism effectively enhances the anti-spoofing capability of the heartbeat signal, ensuring that the main thread can verify the legitimacy and real-time nature of the heartbeat source based on the decoding result, thereby improving the overall protection strength.
[0070] For example, a Web Worker thread can obtain the current timestamp as a heartbeat reference value, concatenate it with a preset perturbation parameter generated by a pseudo-random number generator, forming an original heartbeat string such as "1730245289.123|8a3f5c7b", and then send it to the main thread after Base64 encoding. On the other hand, when the main thread verifies the heartbeat signal, it first decodes the heartbeat signal to restore the original string, then parses the timestamp according to the agreed format, and verifies whether the deviation between the timestamp and the current system time exceeds the timeout threshold. If it does not exceed the timeout threshold, the heartbeat signal is considered valid, that is, the heartbeat signal in the local storage area is updated within the timeout threshold; if it exceeds the timeout threshold, the heartbeat signal is considered invalid, that is, the heartbeat signal in the local storage area is not updated within the timeout threshold.
[0071] Optionally, in one embodiment, the resource access control method provided by the present invention further includes: After the main thread receives the heartbeat signal sent by the Web Worker thread, it sends a liveness certificate to the server of the target tab. The liveness certificate is used to instruct the server to reject resource access requests that carry session credential information initiated by non-target tabs.
[0072] In this embodiment of the invention, the computer device declares the active status of the target tab to the server by sending a proof of liveness, ensuring that the session credential information is only valid in a legitimate context.
[0073] In this process, after the computer device receives the heartbeat signal sent by the Web Worker thread in the main thread, it also sends a liveness certificate to the server corresponding to the target tab through the main thread. This indicates to the server that the target tab is currently active and rejects resource access requests initiated by non-target tabs that carry session credential information corresponding to the target tab, effectively preventing cross-site forgery requests or credential theft.
[0074] It should be noted that the embodiments of the present invention do not limit the transmission method, frequency, and content format of the survival certificate, and can be configured according to actual security requirements. For example, the survival certificate may include information such as the decoded heartbeat signal, device identifier, and unique tag ID, and the computer device sends the survival certificate to the server once every N heartbeats.
[0075] As described above, the resource access control scheme provided by this invention creates a Web Worker thread from the main thread of the target tab accessing the protected resource, and configures the Web Worker thread to periodically send heartbeat signals to the main thread. The main thread then updates the received heartbeat signals to the browser's local storage area. The main thread determines whether the heartbeat signal in the local storage area is updated within a timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the main thread terminates the target tab's access to the protected resource. Compared to related technologies, this invention achieves precise monitoring of the tab's activity status through the collaborative mechanism of the Web Worker thread and the main thread, effectively preventing the protected resource from being continuously exposed in an uncontrollable execution environment. Furthermore, since the generation and updating of the heartbeat signal are independent of the main thread's running environment, even if the main thread is briefly suspended due to page lag or script blocking, the heartbeat mechanism can still continue to operate, ensuring the reliability and real-time performance of access control.
[0076] To facilitate better implementation of the above resource access control methods, this embodiment of the invention also provides a corresponding resource access control device. The meanings of the terms used are the same as in the above resource access control methods; for specific implementation details, please refer to the descriptions in the above method embodiments.
[0077] Please refer to Figure 2 The resource access control device may include a behavior heartbeat configuration module 210, a heartbeat detection module 220, and an access control module 230. Detailed descriptions of each functional module are as follows: The heartbeat configuration module 210 is used to create a WebWorker thread by the main thread accessing the target tab of the protected resource, and configure the WebWorker thread to periodically send heartbeat signals to the main thread, so that the main thread updates the received heartbeat signals to the browser's local storage area. Heartbeat detection module 220 is used to determine whether the heartbeat signal in the local storage area is updated within the timeout threshold through the main thread; The access control module 230 is used to maintain the target tab's access to the protected resource through the main thread when the heartbeat signal in the local storage area is updated within the timeout threshold; or to terminate the target tab's access to the protected resource through the main thread when the heartbeat signal in the local storage area is not updated within the timeout threshold.
[0078] Optionally, in one embodiment, the access control module 230 is used to send a session termination request to the server of the target tab through the main thread, requesting the server to clear the session information associated with the target tab; and to clear the session credential information associated with the target tab in the local storage area through the main thread.
[0079] Optionally, in one embodiment, the access control module 230 is used to send a random challenge message to the Web Worker thread through the main thread and receive the response result returned by the Web Worker thread if the heartbeat signal in the local storage area is updated within the timeout threshold; if the response result meets the preset response rules, the access rights of the target tab to the protected resources are maintained through the main thread.
[0080] Optionally, in one embodiment, the access control module 230 is further configured to terminate the access rights of the target tab to the protected resource through the main thread when the response result does not conform to the preset response rules.
[0081] Optionally, in one embodiment, the access control module 230 is used to obtain the current network status through the main thread when the heartbeat signal in the local storage area is not updated within the timeout threshold; if the current network status is normal, the access permission of the target tab to the protected resource is terminated through the main thread.
[0082] Optionally, in one embodiment, the heartbeat signal is obtained by encoding the periodically acquired heartbeat reference value by a Web Worker thread after concatenating it with a preset perturbation parameter.
[0083] Optionally, in one embodiment, the resource access control device provided by the present invention further includes a life maintenance module, which is used to send a survival certificate to the server of the target tab through the main thread after receiving a heartbeat signal sent by the Web Worker thread. The survival certificate is used to instruct the server to reject resource access requests carrying session credential information initiated by non-target tabs.
[0084] Specific limitations regarding the resource access control device can be found in the limitations of the resource access control method described above, and will not be repeated here. Each module in the aforementioned resource access control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0085] In one embodiment, a computer device is provided, the internal structure of which can be shown as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The network interface connects to external wireless clients, providing wireless network access services to the connected clients. When executed by the processor, the computer program implements the resource access control method provided by this invention.
[0086] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the resource access control method described in the above embodiment, for example: A Web Worker thread is created by the main thread that accesses the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread. The main thread then updates the browser's local storage area with the received heartbeat signals. The main thread determines whether the heartbeat signal in the local storage area has been updated within the timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the access permissions of the target tab to the protected resource will be terminated via the main thread.
[0087] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When executed by a processor, the computer program implements the resource access control method described in the above embodiment, for example: A Web Worker thread is created by the main thread that accesses the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread. The main thread then updates the browser's local storage area with the received heartbeat signals. The main thread determines whether the heartbeat signal in the local storage area has been updated within the timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the access permissions of the target tab to the protected resource will be terminated via the main thread.
[0088] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0089] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.
[0090] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.
[0091] It should be noted that when the above embodiments of the present invention are applied to specific products or technologies, and user-related data is involved, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.
Claims
1. A resource access control method, characterized in that, include: A Web Worker thread is created by the main thread that accesses the target tab of the protected resource, and the Web Worker thread is configured to periodically send heartbeat signals to the main thread, which then updates the browser's local storage area with the received heartbeat signals. The main thread determines whether the heartbeat signal in the local storage area is updated within the timeout threshold. If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource. If the heartbeat signal in the local storage area is not updated within the timeout threshold, the main thread terminates the target tab's access to the protected resource.
2. The resource access control method according to claim 1, characterized in that, The step of terminating the target tab's access to the protected resource via the main thread includes: The main thread sends a session termination request to the server of the target tab, requesting the server to clear the session information associated with the target tab; The main thread clears the session credential information associated with the target tab in the local storage area.
3. The resource access control method according to claim 1, characterized in that, If the heartbeat signal in the local storage area is updated within the timeout threshold, the main thread maintains the target tab's access to the protected resource, including: If the heartbeat signal in the local storage area is updated within the timeout threshold, a random challenge message is sent from the main thread to the Web Worker thread, and the response result returned by the Web Worker thread is received. If the response result conforms to the preset response rules, the main thread maintains the target tab's access to the protected resource.
4. The resource access control method according to claim 3, characterized in that, After receiving the response result returned by the Web Worker thread, the process also includes: If the response result does not conform to the preset response rules, the main thread will terminate the target tab's access to the protected resource.
5. The resource access control method according to claim 1, characterized in that, If the heartbeat signal in the local storage area is not updated within the timeout threshold, the main thread terminates the target tab's access to the protected resource, including: If the heartbeat signal in the local storage area is not updated within the timeout threshold, the current network status is obtained through the main thread; If the current network status is normal, the main thread will terminate the target tab's access to the protected resource.
6. The resource access control method according to claim 1, characterized in that, The heartbeat signal is obtained by the WebWorker thread by concatenating periodically acquired heartbeat reference values with preset perturbation parameters and then encoding them.
7. The resource access control method according to claim 1, characterized in that, Also includes: After the main thread receives the heartbeat signal sent by the Web Worker thread, it sends a liveness certificate to the server of the target tab. The liveness certificate is used to instruct the server to reject resource access requests that do not originate from the target tab and carry the session credential information.
8. A resource access control device, characterized in that, The resource access control device includes: The heartbeat configuration module is used to create a Web Worker thread by the main thread accessing the target tab of the protected resource, and configure the Web Worker thread to periodically send heartbeat signals to the main thread, and the main thread updates the received heartbeat signals to the browser's local storage area. The heartbeat detection module is used to determine, through the main thread, whether the heartbeat signal in the local storage area is updated within the timeout threshold. The access control module is used to maintain the target tab's access to the protected resource via the main thread when the heartbeat signal in the local storage area is updated within the timeout threshold; or to terminate the target tab's access to the protected resource via the main thread when the heartbeat signal in the local storage area is not updated within the timeout threshold.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the resource access control method according to any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the resource access control method according to any one of claims 1 to 7.