A non-invasive web proxy execution method, system, device and medium

Abstract

The application discloses a non-invasive webpage proxy execution method, system, device and medium, relates to the technical field of computer software and Internet, and adopts a four-layer decoupling architecture of "cloud reasoning and local execution". Zero-invasion integration with an original system is realized through front-end CSP adaptive bypass injection technology, an end-side credential full-life-cycle security protection system is constructed by using a WebAssembly trusted execution environment Wasm-TEE, and in combination with end-cloud collaborative dynamic permission control technology, safe and automatic closed-loop operation on a target webpage interface is realized on the premise that authentication data is ensured not to leave the end and execution instructions are ensured not to be tampered with.

Description

Technical Field

[0001] This invention relates to the fields of computer software and Internet technology, and in particular to a non-intrusive webpage proxy execution method, system, device and medium. Background Technology

[0002] Intelligent automation technology for web pages refers to intelligent systems that integrate AI (such as large language models and visual understanding) with traditional browser automation tools (such as Playwright and Selenium) to achieve natural language-driven, adaptive web page interaction. The core objective is to "understand intent → autonomously plan → stably execute" web page operations.

[0003] Currently, intelligent automation technologies for web pages are mainly divided into two categories: one is embedded AI assistants, represented by Microsoft Copilot, and the other is automation agents based on browser plugins or WebDriver, represented by Browser-use or AutoGPT. Embedded AI assistants typically use deeply coupled SDK injection or API integration methods, directly embedding dialog windows into the user interface of the original system. Their working principle relies on the original system actively opening specific data interfaces to send user commands to the backend large model for semantic understanding and logical processing. This type of solution is a highly intrusive integration, which not only requires developers to modify the backend API logic of the original system, but also to deeply adapt the frontend code to integrate the SDK. Automation agent plugins are mainly driven by browser extensions or WebDriver, directly reading and parsing the DOM tree information of the web page. Their working principle is to use visual recognition or XPath to locate elements to simulate manual clicks and input, or to achieve automated operations by intercepting and replaying network requests.

[0004] Embedded AI assistants, when modified for both backend and frontend, cannot bypass the Content Security Policy (CSP) restrictions of modern browsers, resulting in extremely high adaptation costs and difficulty in applying them to legacy systems. Automated agent plugins, on the other hand, require uploading user credentials (such as Session Tokens and Cookies) to the cloud for them to initiate requests, posing a serious risk of privacy leaks. It is evident that the commonly recognized risk in embedded AI assistant and automated agent plugin solutions lies in the potential for credential leaks due to uploading credentials to the cloud. Researchers typically propose an architecture that "does not store credentials in the cloud," meaning credentials are only stored and used locally on the client side. However, even with this improvement, credentials are still stored and used in plaintext in the browser's memory, making them highly vulnerable to theft by malicious scripts, third-party plugins, or memory dumping tools, posing a serious risk of permission leaks. Furthermore, if execution instructions issued from the cloud are transmitted in plaintext, they are susceptible to man-in-the-middle attacks, leading to unexpected malicious operations by the local agent and triggering "spoofed agent attacks." Therefore, current solutions struggle to efficiently build a security system to address the risks of credential leaks and instruction tampering. Summary of the Invention

[0005] This invention provides a non-intrusive webpage proxy execution method, system, device, and medium, which can solve the problems existing in the prior art.

[0006] This invention provides a non-intrusive webpage proxy execution method, comprising the following steps: Register a temporary ServiceWorker in the browser that only intercepts requests for static resources on the target webpage. When the temporary ServiceWorker intercepts any JavaScript static resource, it appends a bootstrap script to the end of the resource file. This bootstrap script is used to asynchronously load the code of the proxy component. Create a trusted execution environment on the browser side that is based on WebAssembly and is completely memory isolated from the browser's main thread and the DOM environment of the target webpage; When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system of the current browser session from the browser's local memory, and sends the access authorization credential directly into the trusted execution environment. Inside the trusted execution environment, the front-end dynamic environment information of the current browser session is extracted based on the access authorization credential. A dynamic derived key is generated for the front-end dynamic environment information based on HKDF. The dynamic derived key is used to independently encrypt multiple data fragments cut from the access authorization credential to generate an encrypted storage state that does not contain any complete plaintext credential information. After receiving the user's target interface call instruction, the browser verifies it. If the verification is successful, the encrypted storage state of the access authorization credential is reassembled in real time within the trusted execution environment to generate a same-origin request message. Based on the same-origin request message, a same-origin interface request is initiated to complete the web page proxy service.

[0007] Preferably, the creation and execution of the temporary ServiceWorker includes: Register a temporary ServiceWorker in the browser that only applies to the current target webpage. This temporary ServiceWorker is configured to only intercept requests for static resource files from the target webpage, without intercepting or modifying any other business interface requests. When the target webpage loads any original JavaScript static resource, the temporary ServiceWorker appends a bootstrap script of less than 1KB to the end of the original JavaScript static resource file without modifying the original binary content of the original JavaScript static resource. The bootstrap script is injected into the target webpage execution context by concatenating the response body of a legitimate static resource. Its execution source and context are consistent with the original website's native script. After the bootstrap script is executed, it asynchronously loads the code of the proxy component to dynamically mount the proxy component into the DOM tree of the target webpage.

[0008] Preferably, the creation of the trusted execution environment includes: Create a trusted execution environment based on WebAssembly on the browser side. This trusted execution environment uses WebAssembly's linear memory mechanism to build an encrypted sandbox that is independent of the browser's main thread and the target webpage's DOM environment. The encrypted sandbox is completely isolated from the external environment in terms of memory, and does not share any variables, objects or memory areas. It only opens standardized instruction input interfaces and result output interfaces.

[0009] Preferably, the formation of the encrypted storage state includes: When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system for the current browser session from the browser's local memory and sends the access authorization credential directly into the trusted execution environment; Within the trusted execution environment, the multidimensional front-end environment entropy and the device's unique fingerprint information of the current browser session are collected. The multidimensional front-end environment entropy includes the depth hash of the current DOM tree, the coordinate hash of key DOM nodes, and the page rendering timestamp. The multidimensional front-end environment entropy and the device's unique fingerprint information are used as input key material IKM. A truly random number generated based on the current browser session ID is used as the salt value Salt, and a pseudo-random key PRK is generated by calculating it using the HMAC-SHA256 algorithm. Based on the pseudo-random key PRK, the hash value of the current browser timestamp and the complete URL of the current page is used as application-specific information Info. A dynamically derived key DK is generated through HMAC iterative expansion. This dynamically derived key DK is bound to the current session, the current page, and the current time window. The system uses a dynamically derived key (DK) to independently encrypt multiple data fragments that are cut into the access authorization credential within the trusted execution environment. It uses the DOM depth parameter in the multidimensional front-end environment entropy as the storage index offset and the node coordinate hash as the fragment content obfuscation factor. The encrypted fragments are non-contiguously discretized and stored in the isolated memory of the trusted execution environment to generate an encrypted storage state.

[0010] Preferably, the formation of the target interface invocation instruction includes: A knowledge graph containing the dependencies and parameter topology of all business APIs is pre-built on the browser side. When the user inputs natural language commands through the interactive interface of the proxy component, the structured features of the API knowledge graph are extracted using a lightweight graph neural network, while the semantic features of the natural language commands are extracted using a large language model. The semantic features and structured features are matched through a cross-attention mechanism to transform the natural language commands into pathfinding tasks on the knowledge graph. During the pathfinding process, a target interface call instruction sequence is obtained by performing graph inference on the call dependencies, parameter flow constraints, and permission levels between API knowledge graph nodes. This target interface call instruction sequence is described in JSON format and includes the request method, request path, request body parameters, and call order.

[0011] Preferably, the execution of the webpage proxy service includes: After the target interface call instruction sequence is generated, the complete content of the instruction payload is digitally signed using the tenant-specific private key based on elliptic curve or RSA algorithm, and a unique timestamp and instruction sequence number are added to package it into a secure instruction package. After receiving the security instruction packet, the browser performs security verification. If the security verification passes, the request body to be encapsulated and the target request path are forwarded to the encrypted sandbox. Inside the encrypted sandbox, the current browser's front-end state hash is read in real time, and all credential fragments are read and decrypted from the encrypted storage state to reconstruct the complete access authorization credential plaintext. The access authorization credential plaintext is then encapsulated into a same-origin request message containing the credential. The encapsulated request message is then output through the encrypted sandbox interface. The encapsulated request message initiates a same-origin Fetch / XHR request through the trusted execution environment's dedicated fetch interface and performs web page proxy execution.

[0012] Preferably, after the webpage proxy service is completed, the credentials are destroyed and the interface is displayed, including: After the same-origin request is successfully sent, the trusted execution environment clears the storage address pointers of all data fragments to zero, overwrites the buffer of the dynamic derived key DK and its intermediate calculation results with random values ​​and then releases it, and overwrites and destroys the plaintext bytes of the reconstructed credential. The response data of the same-origin request is returned to the interaction layer of the proxy component. The interaction layer extracts the business information in the response data and converts it into a natural language description, which is then presented in the user interface.

[0013] This invention also provides a non-intrusive web page proxy execution system, comprising: The embedding layer is used to register a temporary ServiceWorker in the browser that only intercepts requests for static resources on the target webpage. When the temporary ServiceWorker intercepts any JavaScript static resource, it appends a bootstrap script to the end of the resource file. This bootstrap script is used to asynchronously load the code of the proxy component. The authentication inheritance layer is used to create a trusted execution environment on the browser side that is based on WebAssembly and is completely memory isolated from the browser's main thread and the DOM environment of the target webpage. When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system of the current browser session from the browser's local memory, and sends the access authorization credential directly into the trusted execution environment. Inside the trusted execution environment, the front-end dynamic environment information of the current browser session is extracted based on the access authorization credential. A dynamic derived key is generated for the front-end dynamic environment information based on HKDF. The dynamic derived key is used to independently encrypt multiple data fragments cut from the access authorization credential to generate an encrypted storage state that does not contain any complete plaintext credential information. In the local execution layer, after the browser receives the user's target interface call instruction and verifies it, if the verification is successful, the encrypted storage state of the access authorization credential is reassembled in real time within the trusted execution environment to generate a same-origin request message. Based on the same-origin request message, a same-origin interface request is initiated to complete the web page proxy service.

[0014] This invention also provides an electronic device, including a memory and a processor; The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the steps of the non-intrusive webpage proxy execution method described above.

[0015] This invention also provides a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the steps of a non-intrusive webpage proxy execution method as described above.

[0016] This invention provides a non-intrusive webpage proxy execution method, system, device, and medium, which has the following advantages compared with the prior art: This invention registers a temporary ServiceWorker and appends a bootstrap script to the end of JavaScript static resources loaded on the target webpage. This dynamically mounts the intelligent proxy component to the DOM tree. The bootstrap script is injected into the page execution context through the concatenation of the response body of a legitimate static resource. Its execution context is completely consistent with the original website's native script, thus completely bypassing the CSP script-src restrictions of mainstream browsers. It achieves zero-intrusion integration of plaintext with the original business system corresponding to the target webpage without modifying any security configurations of the original business system. This fundamentally avoids the risk of permission leaks caused by malicious scripts, third-party plugins, or memory dumping tools. Furthermore, it creates a trusted execution environment on the browser side that is isolated from the browser and based on WebAssembly, ensuring that any external scripts... It is impossible to read or modify any memory data within this trusted execution environment. Furthermore, a dynamic credential fragmentation and discrete storage mechanism based on HKDF is constructed. Under this mechanism, access authorization credentials are directly sent to the trusted execution environment, never remaining in plaintext form in the browser's main process or JavaScript heap memory. After being sent, the plaintext of the access authorization credential is immediately and completely converted into an encrypted fragment state. It never leaves the trusted execution environment nor is it uploaded to the cloud. Therefore, the access authorization credential is always retained in the client's (browser's) memory and encrypted throughout its lifecycle. The plaintext credential never leaves the trusted isolation environment, physically eliminating the risk of identity credential leakage during cross-domain transmission and the risk of credentials being stolen by malicious scripts or memory dumps. Ultimately, this enables the constructed security protection system to effectively address the risks of credential leakage and instruction tampering. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the processing system architecture provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the processing flow provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a discretization storage mechanism based on HKDF in a multidimensional environment provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the dual-drive model pathfinding technology architecture provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0019] Currently, web-based intelligent assistants mainly fall into two categories: one is embedded AI assistants, represented by Microsoft Copilot; the other is automated agents based on plug-in or driver control, represented by Browser-use or AutoGPT.

[0020] Embedded AI assistants typically employ a deep coupling approach through SDK injection or API integration, embedding a dialog window directly into the original system's UI. Their working principle relies on specific data interfaces actively exposed by the original system to send user commands to a large backend model for logical processing. This type of solution is a highly intrusive integration, often requiring large-scale modifications to the original system's backend program. Furthermore, it cannot bypass the content security policies (CSP) restrictions of modern browsers, resulting in extremely high adaptation costs and making it difficult to apply to outdated legacy systems.

[0021] Automated Agent Plugins: Primarily driven by browser extensions or WebDriver, these plugins directly read the webpage's DOM tree information. Their working principle involves using visual recognition or HTML parsing to locate elements, simulating manual clicks and input, or automating operations by intercepting and replaying network requests. These solutions typically require uploading user credentials (such as Session Tokens or Cookies) to the cloud for proxy requests, posing a serious risk of privacy leaks. Even if some solutions manage to hide credentials in the cloud, they are still stored in plaintext in the client's memory, making them highly vulnerable to malicious scripts. Furthermore, cloud-based plaintext commands are susceptible to man-in-the-middle attacks, leading to "forged proxy attacks."

[0022] The main drawbacks of these two types of solutions are: 1. The system is highly coupled and intrusive: Embedded assistants often require developers to modify the backend API logic of the original system or to make deep modifications to the frontend code to adapt to the SDK. For legacy systems with outdated internal architectures, this approach is extremely costly, time-consuming, and risky.

[0023] 2. Lack of core security compliance: This is the most serious problem. Traditional solutions typically require uploading user identity credentials (such as Session Tokens and Cookies) to a cloud server, with the cloud initiating the request on their behalf. This "credential-originating" model is highly susceptible to the leakage of sensitive permissions, seriously violating enterprise-level information security audit and compliance requirements.

[0024] 3. Insufficient protection of client-side credentials: Even if some improved solutions achieve credential not being on the cloud, the credentials are still stored and used in plaintext in the client-side memory, which makes them extremely vulnerable to being stolen by malicious scripts, third-party plugins or memory dump tools, posing a serious risk of permission leakage.

[0025] 4. Lack of security in command transmission: Execution commands issued from the cloud are transmitted in plaintext, which is vulnerable to man-in-the-middle attacks and tampering, causing local agents to perform malicious operations (such as changing the transfer amount from 100 yuan to 10,000 yuan), triggering a "forged agent attack".

[0026] 5. Limited tool calling capabilities: Existing solutions heavily rely on the native function calling capabilities of large models. The tool calling formats of different models are not consistent, resulting in extremely high adaptation costs. Furthermore, the tool calling robustness of open-source models is poor, which cannot meet the needs of complex enterprise-level multi-tool scenarios.

[0027] 6. Limited execution capabilities and closed-loop functionality: Most solutions remain at the question-and-answer stage, unable to natively inherit the original system permissions to complete fine-grained CRUD operations; and lack dynamic risk management mechanisms, making it difficult to balance automation efficiency and business security.

[0028] Based on this, such as Figure 1 As shown, this invention proposes a four-layer decoupled architecture based on "cloud inference and local execution," and innovatively introduces a dynamic permission convergence and risk adaptive control system for end-cloud collaboration. The specific architecture includes: I. Embedding Layer.

[0029] This layer employs a CSP adaptive bypass injection engine. Without modifying the original business system's backend code, frontend code, or security configuration, it dynamically mounts the intelligent proxy's UI components, core logic scripts, and security sandbox module to the target webpage's DOM tree, achieving truly zero-intrusive access. This layer is only responsible for presenting the user interaction entry point and forwarding basic events; it does not store any business data or authentication information and does not affect the normal operation of the original system.

[0030] Core technology: CSP adaptive bypass injection engine.

[0031] Existing technologies commonly inject scripts directly into the DOM tree, which is strictly blocked by the Content Security Policy (CSP) of all modern browsers, making it unusable in over 90% of enterprise systems. This invention designs a static resource concatenation-based bypass injection mechanism based on browser ServiceWorker proxies, completely bypassing the CSP script -src restrictions of mainstream browsers.

[0032] 1. Register a temporary ServiceWorker in the browser that only applies to the current tab. This Worker only intercepts static resource requests for the current page and does not intercept any business interface requests, thus causing zero interference to the original system's business logic.

[0033] 2. When the original page loads any JavaScript static resource, ServiceWorker will append a minimalist guide script of less than 1KB to the end of the resource without modifying the original resource content.

[0034] 3. The bootstrap script is responsible for asynchronously loading the core code of the smart proxy. Since this script is injected through "legal static resource concatenation", its execution context is completely consistent with the original website's native script. Therefore, it can bypass all source-based CSP script execution restrictions without modifying any security configuration of the original website.

[0035] II. Auth Inheritance Layer.

[0036] This layer implements native secure inheritance of authentication permissions from the original Web system. Its core capability is to read the authentication credentials (such as Bearer Token) of the current session from the browser's local memory and complete secure takeover through a dynamic credential fragmentation and reorganization mechanism based on HKDF and multi-dimensional environment entropy. All credentials generated by this layer only have access to the local execution layer and do not participate in any cloud network transmission, thus preventing credentials from being stolen or tampered with during transmission.

[0037] Core technology: A dynamic credential fragmentation and recombination mechanism based on the fusion of HKDF and multidimensional environmental entropy (e.g., Figure 3 (As shown).

[0038] This mechanism is built upon the browser's WebAssembly Trusted Execution Environment (Wasm-TEE), achieving closed-loop security control over the entire lifecycle of authentication credentials, from acquisition and storage to use. This invention is the first to deeply integrate the NIST standard HKDF (HMAC-based Extract-Extend Key Derivation Function) into a multi-dimensional environment entropy discretization storage process, constructing a standardized, highly secure dynamic key derivation and credential protection system. This solves the common industry problems of insufficient key entropy values, weak binding to the runtime environment, and susceptibility to memory theft in traditional front-end credential storage. Specifically:

[0039] 1. Initialize the trusted isolation environment.

[0040] The system first creates an encrypted sandbox independent of the browser's main thread and the original webpage DOM environment. This sandbox is completely isolated from the external environment in memory, and only exposes standardized command input and result output interfaces. Malicious scripts, third-party plugins, and browser extensions cannot access the internal memory space of the sandbox, fundamentally blocking the attack path for credential theft and providing a trusted execution foundation for subsequent HKDF calculation and credential processing.

[0041] 2. Multidimensional environmental entropy discretization storage based on HKDF.

[0042] This module deeply integrates HKDF's "extraction-expansion" two-stage standard process with front-end multi-dimensional environmental entropy and device fingerprinting, achieving integrated security protection for dynamic key generation and fragmented credential storage. The specific implementation is as follows: (1) Basic information collection: Read the current session authentication credentials and extract multi-dimensional front-end environment entropy (DOM depth, node coordinate hash, page rendering timestamp, etc.) and device unique fingerprint information to provide high-entropy input materials for subsequent key derivation.

[0043] (2) HKDF two-stage dynamic key derivation (following the NIST SP 800-56C standard) takes the front-end dynamic environment information as the core input of HKDF and generates a high-entropy dynamic derivation key through a two-stage process.

[0044] Extraction stage: Multidimensional environmental entropy and device fingerprint are concatenated as input key material (IKM), and a true random number generated based on session ID is used as salt. The pseudo-random key (PRK) is generated by calculating the HMAC-SHA256 algorithm, which completes the initial aggregation and purification of high-entropy environmental information and solves the problem of insufficient entropy value of traditional single input key.

[0045] Extension phase: Based on the above PRK, and combined with application-specific information (Info) such as the current timestamp and page URL hash, the final dynamically derived key (DK) that meets the encryption length requirements is generated through HMAC iterative extension, ensuring that the key is strongly bound to the current session context.

[0046] (3) Dynamic key-driven fragmented discrete storage of credentials.

[0047] Once the authentication credentials enter the Wasm-TEE trusted sandbox, they are immediately fragmented into multiple data fragments of random size. This invention further realizes the dual value reuse of environmental entropy: the dynamically derived key generated by HKDF is not only used for fragment content encryption, but also combined with multi-dimensional parameters in environmental entropy (such as DOM depth as storage index offset and node coordinate hash as fragment content obfuscation factor) to discretize and map the data fragments in isolated memory.

[0048] 3. Instantaneous closed-loop reorganization and destruction.

[0049] Only at the microsecond-level instant when a business request is triggered at the local execution layer will the system read the real-time front-end state hash, verify that the runtime environment has not been tampered with, reconstruct the complete credentials in the sandbox memory, and initiate a same-origin request; after the request is completed, the address pointers of all data fragments, the HKDF derived key, and the intermediate calculation results will be immediately cleared from memory, completely preventing memory dumping and API replay attacks that are out of the current page context.

[0050] III. Semantic Decision Layer (Cloud Reasoning Layer).

[0051] The semantic decision layer is deployed in the cloud. Its core function is to receive the user's pure natural language intent, complete deep semantic parsing, and output standardized "operation intent instructions". This layer does not receive, process, or store any user identity information, authentication credentials, or business-sensitive data, thus eliminating the risk of sensitive information being leaked to the cloud from the source.

[0052] This invention abandons the traditional text retrieval enhancement (RAG) technology and innovatively designs an API intent alignment and self-evolutionary routing mechanism based on heterogeneous graph neural networks (GNNs). It also combines private knowledge base retrieval to construct a dual-engine architecture of "graph-driven API calls + knowledge base-assisted question answering".

[0053] Core technologies: 1. Multi-model adaptive Prompt template orchestration and context management technology: Design a pluggable Prompt template engine with a built-in multi-model feature adaptation library. It can automatically orchestrate tool definitions, system rules, risk control strategies, and user history dialogue context into the optimal Prompt based on the inference capabilities, output preferences, and context window limitations of the underlying large model. At the same time, it has a built-in multi-turn dialogue context management mechanism, which supports automatic context truncation and key information retention. There is no need to manually rewrite the Prompt for different models, realizing seamless switching and unified calling of large models.

[0054] 2. Graph-based dual-drive model pathfinding technology (such as...) Figure 4 As shown): The system pre-builds a topology graph containing the dependencies and parameters of all business APIs; when a user intent is received, the cloud uses a lightweight graph neural network and the semantic representation of a large language model to perform feature fusion, transforming the intent into a "pathfinding" task on the graph; by performing graph inference on the call dependencies, parameter flow, and permission constraints between API nodes, the system automatically outputs the optimal API call chain (i.e., standardized operation intent instructions).

[0055] 3. Lightweight local anomaly repair and verification technology based on tool metadata: The built-in lightweight format repair and logic verification engine can automatically complete local repair and verification based on the tool metadata definition for common problems in model output, such as JSON format errors, missing required parameters, parameter type mismatches, and contradictory calling logic, without having to call the large model again. This mechanism improves the overall success rate of complex multi-tool calling scenarios by more than 40%, while significantly reducing the calling cost and latency of large models.

[0056] IV. Local Execution Layer.

[0057] The local execution layer runs on the browser side, and its core mission is to securely execute standardized operation instructions issued from the cloud and complete the closed-loop call of business interfaces. This layer innovatively designs a cross-layer instruction asymmetric signature verification architecture that runs through the cloud semantic decision layer and the local execution layer. Together with the aforementioned end-side trusted encryption authentication architecture, it forms a dual security protection system, which comprehensively ensures the absolute trustworthiness of local API calls from the two dimensions of credential security and instruction security.

[0058] Core execution processes and technologies: 1. Command Reception and Anti-Tampering Verification: After receiving the operation command from the cloud, the local execution layer first triggers the command integrity verification process. After the cloud generates the target operation command, it uses the tenant's exclusive private key based on Elliptic Curve Control (ECC) or RSA algorithm to digitally sign the command payload and attach a unique timestamp and command sequence number before sending it out. Before the client executes any subsequent operations, it must complete the signature verification and replay attack detection through the pre-set public key. Once an anomaly is detected, execution is immediately blocked and an alarm is reported.

[0059] 2. Secure credential injection within the TEE sandbox: After the instruction verification is passed, the local execution layer only forwards the "request body to be encapsulated + request path" to the Wasm-TEE encrypted sandbox of the authentication inheritance layer, without touching any plaintext authentication credentials throughout the process; the request header encapsulation, credential injection and SM3 hash integrity verification of the request body are completed independently within the TEE sandbox, and the encapsulated request message is output through the sandbox's dedicated interface.

[0060] 3. Same-origin API closed-loop execution: Finally, a same-origin Fetch / XHR request is initiated through the sandbox's dedicated fetch API to avoid the request being intercepted or tampered with by browser middleware or third-party plugins; after the request is executed, the business API return result is sent back to the front-end embedded layer to complete the entire intelligent proxy business closed loop.

[0061] V. Cross-layer collaboration technology: Dynamic permission convergence and risk adaptive control system for edge-cloud collaboration.

[0062] Existing technologies typically rely on a single physical layer encryption or application layer authentication for security, lacking horizontal linkage and vertical collaboration between different layers. This results in the system being unable to make an immediate and dynamic response when faced with complex abnormal behaviors or account theft risks.

[0063] This invention presents a groundbreaking dynamic permission convergence and risk adaptive management system for edge-cloud collaboration. This technology no longer relies on static "one-time authentication," but achieves a generational leap from "static permission allocation" to "dynamic adaptive risk management" through cross-layer data flow and logical feedback between the embedding layer, authentication inheritance layer, and cloud semantic decision layer.

[0064] 1. Cross-layer risk data collection and preprocessing: (1) Environmental risk perception (embedded layer): Real-time collection of the underlying characteristics of terminal devices, including but not limited to hardware and environmental data such as device fingerprint, geographical location (IP address), login time window, and browser plugin environment, to identify whether there is an emulator or untrusted environment.

[0065] (2) Behavioral feature capture (authentication inheritance layer): Synchronously collect high-frequency behavioral features of users during the interaction process, such as operation frequency, click path, historical operation inertia and specific operation type (such as high-frequency sensitive data query).

[0066] (3) Privacy Protection Reporting: To ensure user privacy and data security, all the above-mentioned sensitive data must be de-identified using a Differential Privacy algorithm before being uploaded. The de-identified data is reported to the cloud semantic decision layer to ensure data security and compliance.

[0067] 2. Risk Level Assessment: After receiving the anonymized data, the cloud-based semantic decision layer uses a pre-built risk control engine and deep learning model for comprehensive analysis. The model combines current environmental data with historical user behavior benchmarks to calculate the risk weight of the current session in real time. Based on the calculation results, the current operating status of the intelligent agent is divided into three levels: low risk, medium risk, and high risk, which serves as the direct basis for permission adjustments.

[0068] Dynamic permission convergence: Based on the risk level returned from the cloud, this invention uses a closed-loop feedback mechanism to converge and adjust the execution permissions of the intelligent agent in real time.

[0069] Low risk level: The system maintains full functionality and the intelligent agent has full execution permissions.

[0070] Medium risk level: Triggers the "permission convergence" mechanism, restricting the smart agent from performing sensitive operations involving data modification, asset transfer, etc., and retaining only read-only permissions for querying.

[0071] High risk level: Immediately triggers "forced circuit breaker", the system automatically locks all execution logic of the smart agent and forces the user to re-perform multi-factor authentication (MFA).

[0072] like Figure 2 The diagram illustrates the non-intrusive webpage intelligent proxy execution steps of the present invention, specifically including: Step 1: Proxy Embedding Step: By using the static resource splicing bypass injection technology based on ServiceWorker, the intelligent proxy component is mounted into the DOM tree of the target webpage, bypassing the browser's content security policy (CSP) restrictions, and achieving zero-intrusion integration with the target webpage system.

[0073] Step 2: Trusted Environment Initialization Steps: Create a WebAssembly-based Trusted Execution Environment (Wasm-TEE) on the browser side. This environment is completely isolated from the browser's main thread and the original webpage DOM environment.

[0074] Step 3: Credential Acquisition Step: The intelligent proxy component reads the access authorization credentials of the current session from the browser's local memory and sends them directly into the trusted execution environment. The credentials are encrypted and stored using HKDF two-stage key derivation and fragmented discrete storage technology. The access authorization credentials are not uploaded to the cloud throughout the entire process.

[0075] Step 4: Intent parsing step: The natural language command input by the user is sent to the cloud decision layer. Based on the fusion technology of heterogeneous graph neural network and large language model, the path is searched on the API dependency topology graph to generate a standardized target interface call command. The target interface call command does not contain the access authorization credential.

[0076] Step 5: Command Security Verification and Execution Steps: After receiving the target interface call command, the client first performs asymmetric signature verification and anti-replay verification; after the verification is successful, the access authorization credential is encapsulated in the trusted execution environment, and a same-origin interface request is initiated to complete the business operation.

[0077] Step Six: Result Display Step: Capture the returned data of the interface request and convert it into natural language to feed back to the user interface.

[0078] In practical implementation, the target system of this invention is an enterprise-level ERP web application, and the implementation process is as follows: Step 1: System initialization and environment setup (e.g.) Figure 1 ).

[0079] 1. CSP Adaptive Bypass Injection: By including a single line of front-end script in the ERP system's HTML template.<scriptsrc="agent.js"> Alternatively, the script can be dynamically injected via a browser extension; after the script is loaded, a temporary ServiceWorker is automatically registered, and the CSP restriction is bypassed by splicing static resources to load the core code of the smart proxy.

[0080] 2. Component mounting: After the script is loaded, a floating interactive component (marked 101 in the attached figure) that is independent of the original system business logic is automatically created at the bottom layer of the web page DOM tree. This component includes an input box, a dialog display area, and a hidden logic processing unit.

[0081] 3. TEE Sandbox Initialization: The script automatically initializes a trusted execution environment based on WebAssembly, creating an encrypted sandbox that is completely isolated from the browser's main thread (see attached figure 105), and only exposes standardized command input and result output interfaces.

[0082] 4. Cloud configuration synchronization: The intelligent agent automatically synchronizes the current tenant's configuration information from the cloud, including API schema, domain whitelist, risk control policies and public key certificates.

[0083] Step Two: Interaction and Semantic Parsing Process (e.g.) Figure 1 and Figure 2 ).

[0084] 1. User input: The user inputs natural language commands in the interactive component (101), such as: "Help me create a product order with a unit price of 100 yuan and a quantity of 5".

[0085] 2. Context extraction and authentication: The browser initiates a POST request through embed.js. This request carries the user's instructions and the metadata of the current webpage (excluding tenant identity information) and sends it to the cloud semantic decision layer (102). At this layer, the domain whitelist is checked and the tenant is enabled and the status is legal. After passing the checks, the process proceeds to the next step.

[0086] 3. Graph Dual-Driven Intent Generation: The cloud decision layer (102) uses the fusion technology of heterogeneous graph neural network and large language model to perform path finding on the pre-built API dependency topology graph and calculate the optimal API call sequence; generate standard JSON instruction package: {"action": "API_CALL", "method": "POST", "url": " / order / create", "data": {"price": 100, "quantity": 5}}.

[0087] 4. Command Signing and Issuance: The cloud uses the tenant's exclusive private key to digitally sign the command package, attach a unique timestamp and command serial number, and then issues it to the client.

[0088] Step 3: Local security execution closed loop (e.g.) Figure 1 and Figure 2 ).

[0089] 1. Command tamper-proof verification: After receiving the command, the local execution layer (103) first uses the preset public key to sign and verify the signature, and verifies the timestamp and command sequence number to prevent replay attacks. If the verification fails, execution is immediately blocked and an alarm is reported.

[0090] 2. Secure Acquisition and Encrypted Storage of Credentials: The smart agent retrieves the Bearer Token of the current session from the browser's local memory (see attached diagram 201) and sends it directly into the TEE encrypted sandbox (105); inside the sandbox, HKDF two-stage key derivation is performed, and the Token is cut into multiple random fragments and stored in encrypted discrete form.

[0091] 3. Request encapsulation within the sandbox: The local execution layer only sends the "request body to be encapsulated + request path" to the TEE sandbox; the request header encapsulation, token injection and SM3 hash integrity verification of the request body are completed independently inside the sandbox, and the token in plaintext never leaves the sandbox throughout the process.

[0092] 4. Same-origin API call: The encapsulated request message initiates a same-origin POST request through the sandbox's dedicated fetch interface; since the script runs under the original system domain, the request automatically carries the context of the current session, and its behavior is completely consistent with the request triggered by the user manually clicking the button.

[0093] 5. Immediate Destruction of Credentials: After the request is sent, the sandbox immediately performs a memory zeroing operation, destroying all token fragments, HKDF derived keys, and intermediate calculation results.

[0094] Step 4: Result Feedback and Interface Update (e.g.) Figure 1 and Figure 2 ).

[0095] 1. Result capture: The local agent captures the HTTP status codes and response data returned by the interface.

[0096] 2. UI presentation: If 200 OK is returned, the interactive component (101) displays "Order created successfully, order number: XXXX" to the user; if an error is reported, the error message is converted into easy-to-understand natural language to inform the user.

[0097] The present invention has the following significant advantages and positive effects compared with the prior art: I. Extremely high level of security and privacy protection.

[0098] 1. Zero risk of identity credential leakage: Adopting a decoupled architecture of "cloud decision-making and local execution" ensures that sensitive authentication credentials such as tokens, headers, and signatures are always kept in the client (browser) memory; the risk of leakage caused by cross-domain transmission of identity credentials is eliminated from the physical mechanism, and the trust problem in the cloud proxy mode is solved.

[0099] 2. End-side credential lifecycle encryption protection: Based on the Wasm-TEE trusted execution environment and HKDF dynamic key derivation and fragmented discrete storage technology, it realizes full-process encryption protection of authentication credentials from acquisition, storage, use to destruction. The credential plaintext never leaves the trusted isolation environment, completely solving the problem of malicious scripts and memory dumps stealing credentials.

[0100] 3. Anti-tampering and anti-replay of execution instructions: Through a cross-layer asymmetric signature verification architecture, it is ensured that the execution instructions issued by the cloud cannot be tampered with or replayed in the transmission link, fundamentally eliminating the possibility of "forgery proxy attacks".

[0101] 4. End-to-end cloud collaborative dynamic risk management: It breaks through the limitations of traditional static permission management and can dynamically adjust the execution permissions of intelligent agents according to real-time environment and behavioral characteristics, thereby improving automation efficiency while ensuring business security.

[0102] 5. Strict security audit and access control: Built-in domain name whitelist and interface authentication mechanism, combined with multi-tenant isolation architecture, effectively prevents interface abuse and meets high-standard enterprise compliance and audit requirements.

[0103] II. Low-cost, non-intrusive system integration and maintenance.

[0104] 1. CSP Adaptive Zero-Intrusion Deployment: Adopting static resource splicing bypass injection technology based on ServiceWorker, it does not require modification of any code, interface or security configuration of the original system. Deployment can be completed by simply introducing a line of JS script, which completely solves the problem of traditional solutions being intercepted by CSP.

[0105] 2. Intelligent Schema Construction: To address the time-consuming and error-prone nature of manually writing traditional OpenAPI Schemas, this invention utilizes the understanding capabilities of the Large Language Model (LLM) to achieve automated mapping from raw Markdown documents to API Schemas, significantly shortening the system initialization cycle.

[0106] 3. Model-independent general tool invocation capability.

[0107] 1. Multi-model adaptive Prompt: Built-in pluggable Prompt template engine and multi-model adaptation library, which can automatically generate the optimal Prompt adapted to different models, while supporting intelligent context truncation and key information retention, eliminating the need for manual rewriting and greatly reducing the cost of multi-model adaptation.

[0108] 2. Local anomaly repair and verification mechanism: Introducing a lightweight local format repair and logic verification engine, common JSON format, parameter, and logic errors can be automatically repaired without re-tuning large models, significantly reducing calling costs and latency, and increasing the success rate of complex multi-tool calls to over 99%.

[0109] 3. High compatibility: Fully compatible with various open-source and closed-source generation models, enterprises can freely switch between different cost-effective models as needed without code modification, and the model replacement cost is close to zero.

[0110] IV. In-depth business execution closed loop and precise risk control.

[0111] 1. The leap from "auxiliary suggestions" to "direct execution": The system can reuse the original system's authentication system to directly call the interface; through intelligent calling strategies, it can automatically execute query commands in a closed loop and present the results, significantly improving business processing efficiency.

[0112] 2. Differentiated risk triggering mechanism: For high-risk commands such as Delete / Update, the system can intelligently convert them into standardized operation guidelines through semantic recognition, guiding users to manually confirm before execution, which improves automation while ensuring the controlled execution of core business.

[0113] 3. Dual-Engine Driven Mode: This mode employs a dual-engine architecture of "graphical dual-drive API dynamic invocation + private knowledge base-assisted question answering." It supports user-uploaded documents with titles and content matching to build a private knowledge base. During dialogue, the knowledge base content is prioritized for answering, and dynamic data is obtained through real-time API calls, significantly improving the accuracy of the intelligent assistant's answers and the professionalism of its business processing.

[0114] V. Excellent business scalability and billing transparency.

[0115] 1. Multi-tenant logical isolation capability: Supports independent configuration of API documentation, authentication methods and domain whitelists for different tenants, realizing highly customized integration capabilities under the same platform.

[0116] 2. Fair and Transparent Billing Model: It innovatively adopts a "dialogue round" billing model, rather than unpredictable token or API call count billing. This model is more intuitive for users, effectively prevents billing disputes, and improves the predictability of business solutions.

[0117] The ServiceWorker registered in this invention only intercepts static resources and explicitly excludes all business interface requests (such as API calls), thus avoiding any delays or tampering risks to the original system's network communication. Simultaneously, after the bootstrap script loads the core proxy code, all UI components are mounted in independent DOM subtrees, using shadow DOM to isolate styles and events, completely avoiding interference with the original system's interaction logic. Therefore, this invention breaks the industry convention that "intelligent assistant integration requires modification of the business system," enabling numerous outdated and unmaintained ERP / CRM / OA systems within enterprises to acquire AI automation capabilities "at zero cost and zero risk." Furthermore, because it bypasses CSP restrictions, this invention can be deployed in any modern browser environment without compromising browser security policies.

[0118] This invention establishes a "trustworthy instruction semantics" security paradigm for the first time in the field of intelligent web proxy. Even if an attacker completely controls the instruction transmission channel (e.g., a malicious WiFi hotspot launches a man-in-the-middle attack), or compromises the browser extension and hijacks the network request API, any attempt to tamper with the instruction semantics will be immediately detected and blocked due to signature invalidation.

[0119] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A non-intrusive webpage proxy execution method, characterized in that, Includes the following steps: Register a temporary ServiceWorker in the browser that only intercepts requests for static resources on the target webpage. When the temporary ServiceWorker intercepts any JavaScript static resource, it appends a bootstrap script to the end of the resource file. This bootstrap script is used to asynchronously load the code of the proxy component. Create a trusted execution environment on the browser side that is based on WebAssembly and is completely memory isolated from the browser's main thread and the DOM environment of the target webpage; When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system of the current browser session from the browser's local memory, and sends the access authorization credential directly into the trusted execution environment. Inside the trusted execution environment, the front-end dynamic environment information of the current browser session is extracted based on the access authorization credential. A dynamic derived key is generated for the front-end dynamic environment information based on HKDF. The dynamic derived key is used to independently encrypt multiple data fragments cut from the access authorization credential to generate an encrypted storage state that does not contain any complete plaintext credential information. After receiving the user's target interface call instruction, the browser verifies it. If the verification is successful, the encrypted storage state of the access authorization credential is reassembled in real time within the trusted execution environment to generate a same-origin request message. Based on the same-origin request message, a same-origin interface request is initiated to complete the web page proxy service.

2. The non-intrusive webpage proxy execution method according to claim 1, characterized in that, The creation and execution of the temporary ServiceWorker includes: Register a temporary ServiceWorker in the browser that only applies to the current target webpage. This temporary ServiceWorker is configured to only intercept requests for static resource files from the target webpage, without intercepting or modifying any other business interface requests. When the target webpage loads any original JavaScript static resource, the temporary ServiceWorker appends a bootstrap script of less than 1KB to the end of the original JavaScript static resource file without modifying the original binary content of the original JavaScript static resource. The bootstrap script is injected into the target webpage execution context by concatenating the response body of a legitimate static resource. Its execution source and context are consistent with the original website's native script. After the bootstrap script is executed, it asynchronously loads the code of the proxy component to dynamically mount the proxy component into the DOM tree of the target webpage.

3. The non-intrusive webpage proxy execution method according to claim 1, characterized in that, The creation of the trusted execution environment includes: Create a trusted execution environment based on WebAssembly on the browser side. This trusted execution environment uses WebAssembly's linear memory mechanism to build an encrypted sandbox that is independent of the browser's main thread and the target webpage's DOM environment. The encrypted sandbox is completely isolated from the external environment in terms of memory, and does not share any variables, objects or memory areas. It only opens standardized instruction input interfaces and result output interfaces.

4. The non-intrusive webpage proxy execution method according to claim 3, characterized in that, The formation of the encrypted storage state includes: When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system for the current browser session from the browser's local memory and sends the access authorization credential directly into the trusted execution environment; Within the trusted execution environment, the multidimensional front-end environment entropy and the device's unique fingerprint information of the current browser session are collected. The multidimensional front-end environment entropy includes the depth hash of the current DOM tree, the coordinate hash of key DOM nodes, and the page rendering timestamp. The multidimensional front-end environment entropy and the device's unique fingerprint information are used as input key material IKM. A truly random number generated based on the current browser session ID is used as the salt value Salt, and a pseudo-random key PRK is generated by calculating it using the HMAC-SHA256 algorithm. Based on the pseudo-random key PRK, the hash value of the current browser timestamp and the complete URL of the current page is used as application-specific information Info. A dynamically derived key DK is generated through HMAC iterative expansion. This dynamically derived key DK is bound to the current session, the current page, and the current time window. The system uses a dynamically derived key (DK) to independently encrypt multiple data fragments that are cut into the access authorization credential within the trusted execution environment. It uses the DOM depth parameter in the multidimensional front-end environment entropy as the storage index offset and the node coordinate hash as the fragment content obfuscation factor. The encrypted fragments are non-contiguously discretized and stored in the isolated memory of the trusted execution environment to generate an encrypted storage state.

5. The non-intrusive webpage proxy execution method according to claim 4, characterized in that, The formation of the target interface call instruction includes: A knowledge graph containing the dependencies and parameter topology of all business APIs is pre-built on the browser side. When the user inputs natural language commands through the interactive interface of the proxy component, the structured features of the API knowledge graph are extracted using a lightweight graph neural network, while the semantic features of the natural language commands are extracted using a large language model. The semantic features and structured features are matched through a cross-attention mechanism to transform the natural language commands into pathfinding tasks on the knowledge graph. During the pathfinding process, a target interface call instruction sequence is obtained by performing graph inference on the call dependencies, parameter flow constraints, and permission levels between API knowledge graph nodes. This target interface call instruction sequence is described in JSON format and includes the request method, request path, request body parameters, and call order.

6. The non-intrusive webpage proxy execution method according to claim 5, characterized in that, The execution of the webpage proxy service includes: After the target interface call instruction sequence is generated, the complete content of the instruction payload is digitally signed using the tenant-specific private key based on elliptic curve or RSA algorithm, and a unique timestamp and instruction sequence number are added to package it into a secure instruction package. After receiving the security instruction packet, the browser performs security verification. If the security verification passes, the request body to be encapsulated and the target request path are forwarded to the encrypted sandbox. Inside the encrypted sandbox, the current browser's front-end state hash is read in real time, and all credential fragments are read and decrypted from the encrypted storage state to reconstruct the complete access authorization credential plaintext. The access authorization credential plaintext is then encapsulated into a same-origin request message containing the credential. The encapsulated request message is then output through the encrypted sandbox interface. The encapsulated request message initiates a same-origin Fetch / XHR request through the trusted execution environment's dedicated fetch interface and performs web page proxy execution.

7. The non-intrusive webpage proxy execution method according to claim 6, characterized in that, After the webpage proxy service is completed, the credentials are destroyed and the interface is displayed, including: After the same-origin request is successfully sent, the trusted execution environment clears the storage address pointers of all data fragments to zero, overwrites the buffer of the dynamic derived key DK and its intermediate calculation results with random values ​​and then releases it, and overwrites and destroys the plaintext bytes of the reconstructed credential. The response data of the same-origin request is returned to the interaction layer of the proxy component. The interaction layer extracts the business information in the response data and converts it into a natural language description, which is then presented in the user interface.

8. A non-intrusive webpage proxy execution system, characterized in that, include: The embedding layer is used to register a temporary ServiceWorker in the browser that only intercepts requests for static resources on the target webpage. When the temporary ServiceWorker intercepts any JavaScript static resource, it appends a bootstrap script to the end of the resource file. This bootstrap script is used to asynchronously load the code of the proxy component. The authentication inheritance layer is used to create a trusted execution environment on the browser side that is based on WebAssembly and is completely memory isolated from the browser's main thread and the DOM environment of the target webpage. When the web page proxy is executed, the proxy component reads the access authorization credential for the original business system of the current browser session from the browser's local memory, and sends the access authorization credential directly into the trusted execution environment. Inside the trusted execution environment, the front-end dynamic environment information of the current browser session is extracted based on the access authorization credential. A dynamic derived key is generated for the front-end dynamic environment information based on HKDF. The dynamic derived key is used to independently encrypt multiple data fragments cut from the access authorization credential to generate an encrypted storage state that does not contain any complete plaintext credential information. In the local execution layer, after the browser receives the user's target interface call instruction and verifies it, if the verification is successful, the encrypted storage state of the access authorization credential is reassembled in real time within the trusted execution environment to generate a same-origin request message. Based on the same-origin request message, a same-origin interface request is initiated to complete the web page proxy service.

9. An electronic device, characterized in that, include: Memory and processor; The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the steps of the non-intrusive web page proxy execution method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the steps of a non-intrusive webpage proxy execution method as described in any one of claims 1 to 7.

Images