Patent Grant
10778680
This application claims priority to and the benefit of PCT/CN2014/081026, filed Jun. 27, 2014, which claims priority and the benefit of Chinese Patent Application Serial No. 201310334944.8, filed with the State Intellectual Property Office of P.R. China on Aug. 2, 2013, and Chinese Patent Application Serial No. 201310744195.6, filed with the State Intellectual Property Office of P.R. China on Dec. 30, 2013, the entire contents each of which is incorporated herein by reference in its entirety.
The present invention relates to the field of communication technologies, and more specifically, to a method and an apparatus for accessing a website.
A browser displays webpages on a terminal. A user may access desired websites through a browser to obtain corresponding information.
The process how a browser accesses a website mainly comprises the following steps: 1. the terminal acquires the web address typed by a user on the browser; 2. the terminal determines a server corresponding to the web address; 3. the terminal establishes a transport layer connection with the server; 4. the terminal sends a network request to the server through an established transport layer connection; and 5. the terminal receives webpage data of the website sent by the server, and renders the webpage according to the webpage data. By performing the above steps, a browser can access the content of a target website. Since the access process needs to go through the above series of steps, the user has to wait for a while to view the webpage of the target website on the browser after the user types the web address in the browser.
To shorten the waiting time of a user in the website access process, currently available technical solutions for pre-reading webpage contents mainly comprise the following steps: acquiring historical access data of web address on a terminal, the history data at least comprising web address access weights and web address historical access times; based on the web address access weights and web address historical access times, calculating an access probability coefficient for a web address, and selecting web addresses with access probability coefficients greater than a threshold; pre-reading contents of webpages corresponding to the selected predetermined number of web addresses; caching the pre-read webpage contents in the browser of the terminal. Some problems need to be addressed in the current techniques.
Since the pre-read webpage contents contain a lot of data, e.g. webpage main documents, CSS style, JS script and other data, the network data for acquiring these data will be wasted if the pre-read webpage contents have not been used throughout the website access process. Moreover, it requires plentiful system resources, such as memory and processor, to store these webpage contents. As a result, the existing method of pre-reading webpage contents will take up a relatively great amount of network data and consume a lot of system resources.
Embodiments of the present invention provide a method and an apparatus for accessing a website to ensure that the network data is reduced and the consumption of system resources is lowered, while webpages are rapidly accessed.
One embodiment of the present invention provides a method for accessing a website, the method comprising: acquiring a web address that meets a preset condition; determining a server corresponding to the web address; establishing a transport layer connection with the server; and upon receiving an instruction for accessing a website corresponding to the web address, using the transport layer connection to send a network request to the server for acquiring the webpage content of the website.
Another embodiment of the present invention provides an apparatus for accessing a website, the apparatus comprising: an acquisition module configured to acquire a web address that meets a preset condition; a determination module configured to determine a server corresponding to the web address; an establishing module configured to establish a transport layer connection with the server; and a sending module configured to, upon receiving an instruction for accessing a website corresponding to the web address, use the transport layer connection to send a network request to the server for acquiring the webpage content of the website.
These and other embodiments and advantages and features of the present invention are described further herein as a solution that not only saves the time to visit a web site, but also consumes less network and system resources.
Having thus described the example embodiments of the present invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
The present disclosure now will be described more fully with reference to the accompanying drawings, in which some, but not all embodiments of the disclosure are shown. This disclosure may be embodied in many different forms and should not be construed as limited to the embodiments set forth; rather, these example embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art. Like numbers refer to like elements throughout.
Embodiments of the present invention provide a method and an apparatus for accessing a website. Since there are a variety of ways to specifically implement the above method and apparatus for accessing a website, detailed description will be made below through specific examples:
Step S101: acquiring a web address that meets a preset condition.
The preset condition may be under a specific application scenario. Several specific application scenarios will be briefly introduced below.
In the first application scenario, when a terminal receives an instruction to start a browser a web address that meets a preset condition is acquired. In the first application scenario, the web address that meets a preset condition may be defined as condition met web address. The condition met web address includes the web address of the website that is historically accessed most frequently (hereinafter “most frequent accessed web address”) and the web address of the website that was last accessed prior to the previous exit (hereinafter “last access web address”), both of which are saved in the browser.
Specifically, when a user starts a browser on the terminal, the terminal will voluntarily acquire the most frequent accessed web address and the last accessed web address.
In the second application scenario, upon receipt of an instruction to click the website link, a web address of the desired website link is acquired. In the second application scenario, the web address that meets a preset condition is the web address associated with the desired website link. Specifically, when a user clicks on a webpage link or a link of a navigation logo in the browser, i.e. when the finger touches the screen, the web address of the desired webpage link or the link of the navigation logo will be immediately acquired. When the user opens a webpage associated with the desired website link or disconnection occurs due to instable network or various reasons, the desired webpage link is immediately acquired.
In the third application scenario, upon receipt of an instruction to enter a preset interface of a browser, a web address in the preset interface that meets a preset condition is acquired. In the third application scenario, the preset interface of the browser has a number of types. For example, the preset interface may be a functional interface, a web address input interface or a search interface. The functional interface may be a navigation, bookmark or application center.
Specifically, upon receipt of an instruction to enter a functional interface of a browser, a web address of the website that was accessed the most recently and a web address of the website that is most frequently accessed in the functional interface is acquired; upon receipt of an instruction to enter a web address input interface of a browser, top three web addresses displayed in the web address matching list as well as a web address of the website that was accessed the most recently are acquired. Upon receipt of an instruction to enter a search interface of a browser, a web address of the selected search engine is acquired.
In the fourth application scenario, upon receipt of an instruction to enter a target website, a desired web address associated with a website link that meets a preset condition in the target website is acquired. In the fourth application scenario, the target website may be a website randomly selected by a user. The web address includes all web addresses contained in webpages of the target website. In a preferred solution, the step of acquiring the desired web address may further comprise the following steps: acquiring all web addresses contained in webpages of the target website; identifying servers corresponding to these web addresses; identifying a server associated with the most web addresses; acquiring web address of the server.
In the fifth application scenario, a desired web address of a website link that meets a preset condition is acquired when the browser system configurations are changed. In the fifth application scenario, when a user enables the compression-transfer setting on web client, web address of an intermediary will be automatically acquired and a connection with the intermediary is established. When the user opens a desired webpage associated with the website link or disconnection occurs due to instable network or various reasons, the webpage link is immediately acquired.
In the sixth application scenario, when a browser displays in the address bar a desired web address typed by a user, the browser may perform real-time character input parsing and determination on the user's input. When the user inputs .com, .cn, .org, or .net or symbols, it is determined that a preset condition is met. The desired web address is acquired from the address bar. In embodiments of the present invention, a plurality of web addresses may be obtained according to the user's input.
The above six application scenarios are all specific scenarios of acquiring a condition met web address, which is certainly not limited thereto. Many kinds of application scenarios are not described. However, any application scenarios that can acquire a condition met web address shall be included by the present invention.
Step S102: determining web server with which the desired web address is associated.
When a desired web address that meets a preset condition is acquired, it may need to determine a web server with which the desired web address is associated. The web address that meets a preset condition may be defined as condition met web address. The process to determine the web server is as follows: a terminal determines the IP address of the web server via a DNS server. When the IP address of the web server is acquired, the web server is determined.
Step S103: establishing a transport layer connection with the web server.
The transport layer connection comprises TCP connection and UDP connection. When the web server is determined, the terminal may establish a transport layer connection with the web server. In this step, a transport layer connection is established without initiating a network request such as HTTP. When the transport layer connection is established between the client and the server, therefore, only a small number of network data packets will be generated, which will not result in the waste of data. Moreover, in the process of establishing a transport layer connection, the occupation of system resources such as memory and processor is very low.
After Step S103, when the terminal does not receive an instruction to access a desired website within a period of time, or when web addresses accessed on the terminal do not contain the desired website corresponding to the condition met web address, the established transport layer connection between the terminal and the server may be disconnected because these two circumstances indicate that the user may not use the established transport layer connection. Although the transport layer connection can remain connected, such a transport layer connection that has been successfully established but not used will nevertheless occupy certain memory, and will consume part of the data. Therefore, when it is determined that the established transport layer connection will not be used, it may be disconnected.
Step S104: upon receipt of an instruction to access a desired website associated with the desired web address, the transport layer is used to send a network request to the server for acquiring the webpage content of the desired website.
When the terminal receives an instruction to access the desired website, the transport layer connection with the web server may be used. Since the transport layer connection has been established, the time to establish a transport layer connection is saved, thereby increasing the speed of the terminal to access the desired website.
In the embodiment shown in
Step S201: determining whether the network access point is switched to a proxy gateway. If yes, go to Step S202. Otherwise, go to Step S205.
The proxy gateway may specifically be a WAP (Wireless Application Protocol) gateway, comprising cmwap (China Mobile wap), ctwap (China Telecom wap) and 3gwap. The network access point may be set up on a terminal. If a user switches the network access point to a proxy gateway, a transport layer connection may be established with the proxy gateway in advance. When the user accesses a website, the established transport layer connection may be used, thereby increasing the speed of accessing websites in the presence of a proxy gateway.
Step S202: establishing a transport layer connection with the proxy gateway.
When a transport layer connection with the proxy gateway is established, if the transport layer connection between the client and the proxy gateway is disconnected due to instable network or various reasons, the transport layer connection may be re-established. When the network access point is switched to a non-proxy gateway, the transport layer connection between the client and the proxy gateway is disconnected.
Step S203: determining if an instruction to access a preset website is received, if yes, go to Step S204.
Step S204: a network request may be sent to the proxy gateway using the established transport layer connection with the proxy gateway to acquire the webpage content of the preset website.
When the proxy gateway receives a network request from the terminal to acquire the webpage content of the desired website, the proxy gateway may determine a server according to the web address specified in the network request, and send the network request to the server. When the proxy gateway receives the webpage content of the desired website from the server, the proxy gateway will send the webpage content of the desired website to the terminal via the established transport layer connection. The terminal then performs operations of loading, parsing, setting and rendering on the webpage content of the desired website, so as to generate a webpage of the desired website for user.
Step S205: acquiring a desired web address that meets preset condition.
The web address that meets preset condition may be defined as condition met web address. The preset condition may be a specific application condition in some specific application scenarios. The specific application scenarios are the same as the scenarios of the condition met web address in Example I, which will not be repeated herein.
Step S206: determining a web server with which the web address is associated.
When a desired condition met web address is acquired, it may need to determine a web server with which the desired web address is associated. The process to determine the web server is as follows: a terminal determines the IP address of the web server via a DNS server. When the IP address of the web server is acquired, the web server is determined.
Step S207: establishing a transport layer connection with the web server.
The transport layer connection comprises TCP connection and UDP connection. When the web server is determined, the terminal may establish a transport layer connection with the web server. In this step, a transport layer connection is established without initiating a network request such as HTTP network request. When the transport layer connection is established between the client and the server, therefore, only a small number of network data packets will be generated, which will avoid waste of data. Moreover, in the process of establishing a transport layer connection, the occupation of system resources such as memory and processor is very low.
After step S207 is performed, when the terminal does not receive an instruction to access a desired website within a period of time, or when web addresses being accessed does not contain the desired website corresponding to the condition met web address, the established transport layer connection between the terminal and the server may be disconnected, since the established transport layer connection may not be used. Although the transport layer connection can remain connected, it will nevertheless occupy certain memory, and will consume part of the data. Therefore, when it is determined that the established transport layer connection will not be used, the transport layer connection may be disconnected.
Step S208: upon receipt of an instruction to access a website associated with the desired web address, a network request is sent to the server using the transport layer to acquire the webpage content of the desired website.
When the terminal receives an instruction to access the desired website, the transport layer connection with the web server may be used. Since the transport layer connection has been established, the time to establish a transport layer connection is saved, thereby increasing the speed of the terminal to access the desired website.
The embodiment shown in
Step S301: determining whether the compression-transfer setting of the intermediary is enabled. If yes, go to Step S302. Otherwise, go to Step S305.
The compression-transfer setting may be enabled on web client. The user may enable or disable the compression-transfer setting depending upon his/her demand. If the compression-transfer setting is enabled on web client browser, the web client browser needs to go through an intermediary before accessing the server of the website. If the compression-transfer setting is enabled on the web client browser, the transport layer connection with the intermediary may be established in advance which can save the time for a client to access the web server.
Step S302: establishing a transport layer connection with the intermediary.
When a transport layer connection with the intermediary is established, if the transport layer connection between the client and the intermediary is disconnected due to instable network or various reasons, the transport layer connection between the client and the intermediary may be re-established. When the compression-transfer setting is disabled, the transport layer connection between the client and the intermediary is disconnected.
Step S303: determining whether an instruction to access a desired website is received. If yes, go to Step S304.
Step S304: a network request may be sent to the intermediary using the established transport layer connection with the intermediary to acquire the webpage content of the desired website.
When the intermediary receives a network request to acquire the webpage content of the desired website from the terminal, the intermediary may determine a web server according to the web address specified in the network request, and send the network request to the web server. When the intermediary receives the webpage content of the desired website from the web server, the intermediary will perform compression process on files, such as images, in the webpage content so as to reduce the storage space occupied by the webpage content, and send the compressed webpage content to the terminal. The terminal then performs operations of loading, parsing, setting and rendering on the compressed webpage content, so as to generate a webpage of the desired website for user.
Step S305: acquiring a desired web address that meets preset condition.
The preset condition may be a specific application condition in some specific application scenarios. The web address that meets preset condition may be defined as condition met web address. The specific application scenarios are the same as the scenarios in Example I, which will not be repeated herein.
Step S306: determining a web server with which the web address is associated.
When the desired condition met web address is acquired, it may need to determine a web server with which the desired web address is associated. The process to determine the web server is as follows: a terminal determines the IP address of the web server via a DNS server. When the IP address of the web server is acquired, the web server is determined.
Step S307: establishing a transport layer connection with the web server.
The transport layer connection comprises TCP connection and UDP connection. When the web server is determined, the terminal may establish a transport layer connection with the web server. In this step, a transport layer connection is established without initiating a network request such as HTTP network request. When the transport layer connection is established between the client and the server, therefore, only a small number of network data packets will be generated, which will not result in the waste of data. Moreover, in the process of establishing a transport layer connection, the occupation of system resources such as memory and processor is very low.
After Step S307, when the terminal does not receive an instruction to access a desired website within a period of time, or when web addresses accessed on the terminal do not contain the desired website corresponding to the condition met web address, the established transport layer connection between the terminal and the server may be disconnected because the established transport layer connection may not be used. Although the transport layer connection can remain connected, it may occupy certain memory and consume part of the data. Therefore, when it is determined that the established transport layer connection will not be used, it may be disconnected.
Step S308: upon receipt of an instruction to access a desired website associated with the desired web address, a network request may be sent to the web server using the transport layer connection to acquire the webpage content of the desired website.
When the terminal receives an instruction to access the desired website, the transport layer connection with the web server may be used. Since the transport layer connection has been established, the time to establish a transport layer connection is saved, thereby increasing the speed of the terminal to access the desired website.
The embodiment shown in
Functions of the apparatus 400 shown in
Functions of the apparatus 500 shown in
Functions of the apparatus 600 shown in
In the Application Example I, all of the scenarios are situations in which a terminal can directly access a web server of a desired website without going through an intermediary or a proxy gateway. Several scenarios that can apply the solutions according to the present invention will be introduced below:
Scenario I: when a user starts a browser on a terminal, the terminal receives an instruction to start the browser. The terminal acquires the most frequent accessed web address of the website and last accessed web address. For instance, the most frequent accessed web address of the website is www.baidu.com and the last accessed web address is also www.baidu.com. When Baidu server is determined, a transport layer connection with the Baidu server is established. If the user opens the Baidu website on the terminal, the terminal sends a network request to the Baidu server using the established transport layer connection to acquire the webpage content of Baidu. When the terminal receives the webpage data of the Baidu website from the Baidu server, the terminal will perform operations of loading, parsing, setting and rendering on the webpage data of the Baidu website, which are ultimately displayed on the browser of the terminal.
In Scenario I, by establishing a transport layer connection with the Baidu server in advance, the terminal can rapidly access the Baidu server, thereby saving the time to access the Baidu website. If the website accessed by the user is not the last accessed website or not the most frequent accessed web address, the established transport layer connection will be disconnected.
Scenario II: a user has started a browser on a terminal. When the user clicks on a navigation logo or a webpage link, the web address of the navigation logo or the webpage link is immediately acquired when user's finger touches the screen. A transport layer connection with the web server is established. The finger may be in contact with touch screen for about 200 to 500 milliseconds. When the finger leaves the touch screen, the terminal sends a network request to the web server using the established transport layer connection to acquire the webpage content of the website. When the terminal receives the webpage data of the website from the web server, the terminal may perform operations of loading, parsing, setting and rendering on the webpage data of the website, which are ultimately displayed on the browser of the terminal.
In Scenario II, by establishing a transport layer connection, the terminal can rapidly access the server, thereby saving the time to access the website. If the finger is in contact with the touch screen for a period of time that meets a predefined long-press requirement a pop-up menu is needed for subsequent operation. No network request will be generated.
Scenario III: a user has started a browser on a terminal. When the user clicks on a functional interface, a web address of the website that was accessed the most recently and a web address of the website that is most frequently accessed in the functional interface are acquired. A transport layer connection with these web addresses is established. When the user opens a website corresponding to the above web addresses, the terminal sends a network request to the web server corresponding to the web address using the transport layer connection to acquire the webpage content of the website. When the terminal receives the webpage data of the website from the web server, the terminal will perform operations of loading, parsing, setting and rendering on the webpage data of the website, which are ultimately displayed on the browser of the terminal.
In Scenario III, by establishing a transport layer connection, the terminal can rapidly access the web server, thereby saving the time to access the website. The functional interface in this scenario may be a navigation, bookmark or application center. When the user does not open the webpage but exits the interface, or the user opens a webpage in the interface that is not the desired web addresses, the established transport layer connection will be disconnected.
Scenario IV: a user has started a browser on a terminal. When the user clicks on a web address input interface, top three web addresses being displayed in a web address matching list as well as a web address of the website that was accessed the most recently are acquired. A transport layer connection with these web addresses is established. When the user opens a website corresponding to the desired web addresses, the terminal sends a network request to the web server corresponding to the desired web address using the transport layer connection to acquire the webpage content of the website. When the terminal receives the webpage data of the website from the web server, the terminal will perform operations of loading, parsing, setting and rendering on the webpage data of the website, which are ultimately displayed on the browser of the terminal.
In Scenario IV, when the user does not open the webpage but exits the interface, or the webpage opened in the interface is not the above desired website, the established transport layer connection will be disconnected.
Scenario V: a user has started a browser on a terminal. When the user clicks on a search interface, web address of the selected search engine is acquired. A transport layer connection with the web address is established. When the user conduct search using the search engine, the terminal sends a network request to the web server corresponding to the search engine using the transport layer connection to acquire the webpage content of the website. When the terminal receives the webpage data of the website from the server, the terminal will perform operations of loading, parsing, setting and rendering on the webpage data of the website, which are ultimately displayed on the browser of the terminal.
In Scenario V, when the user switches the search engine, a transport layer connection is established with the new search engine in advance. When the user exits the search interface, or the selected search engine is not being used in the search interface, the transport layer connection will be disconnected.
Scenario VI: a user has started a browser on a terminal. When the user opens a website, all web addresses contained in webpages of the desired website are acquired. Web servers corresponding to these web addresses are acquired. A desired web server associated with the most web addresses is identified. Web address corresponding to the desired web server is acquired. A transport layer connection with the web address is established. When the user opens the website corresponding to the web server, the terminal sends a network request to the web server associated with the search engine using the transport layer connection to acquire the webpage content of the website. When the terminal receives the webpage data of the website from the web server, the terminal will perform operations of loading, parsing, setting and rendering on the webpage data of the website, which are ultimately displayed on the browser of the terminal.
In Scenario VI, when the user switches to other websites, or opens a web address that is not associated with the desired website, the transport layer connection may be disconnected in 2 minutes.
In the Application Example II, a terminal accesses a desired web server of a website through an intermediary or a proxy gateway. Two exemplary embodiments are introduced below:
Scenario I: a user switches the network access point to a proxy gateway when the user is using a terminal. A transport layer connection with the proxy gateway is established in advance. When the user accesses a website by a browser of the terminal, the terminal may send a network request to the proxy gateway using established transport layer connection to acquire webpage data of the website. The terminal may then perform operations of loading, parsing, setting and rendering, which can save the time for the client to access the website.
In Scenario I, when a transport layer connection with the proxy gateway is established, if the transport layer connection between the client and the proxy gateway is disconnected due to instable network or various reasons, the transport layer connection between the client and the proxy gateway is re-established. When the network access point is switched to a non-proxy gateway, the transport layer connection between the client and the proxy gateway is disconnected.
Scenario II: when a user enables the compression-transfer setting on the browser of the terminal, the terminal may establish a transport layer connection with the intermediary in advance. When the user uses the browser of the terminal to access a website, the terminal may send a network request to the intermediary using the established transport layer connection to acquire webpage data of the website, and then perform operations of loading, parsing, setting and rendering, which may save the time for the client to access the website.
In Scenario II, when a transport layer connection with the intermediary is established, if the transport layer connection between the client and the intermediary is disconnected due to instable network or various reasons, the transport layer connection between the client and the intermediary is re-established. When the compression-transfer setting is disabled, the transport layer connection between the client and the intermediary may be disconnected.
It should be noted that embodiments shown in
According to another aspect of the present invention, to keep authority control of a user access independent of business modules, and to improve the entire system's security and protect user information, fingerprint signature may be applied to a webpage being accessed by user. The fingerprint signature is generated using the URL of the webpage as well as the local cookie information of the webpage (which stores the user's fingerprint information). After the fingerprint signature is generated, URLs of all related webpages of the current website carry the user's fingerprint signature. The related webpages are webpages associated with the user who accesses the webpage. As a result, the URL of a related webpage is unique. When the webpage is accessed by a user again, the web serve performs a verification on the fingerprint signature to determine whether the user has the authority to access the webpage.
As shown in
S700: acquiring a user's local cookie information of a current website as well as original URLs of all related webpages of the current website in accordance with a first access request to access a webpage generated by the user.
According to the embodiment of the present invention, a user accesses a website and browses a webpage via a browser client. When the user sends the first access request to the web server, the browser client checks whether cookie information corresponding to the website is saved locally. If the browser client determines that cookie information of the current website is saved locally, it may automatically upload the cookie information to the web server when the first access request is generated. The cookie information (typically encrypted) may be saved on user's local terminal and used to identify user's identity and track session. Cookie information is set by the web server at the browser client when the user registers and logs on the website for the first time.
Related webpages may be defined as webpages having resources available to a particular user. For instance, when the current website is an e-Business website, related webpages are webpages of which have content information that is associated with the user. For example, pages that contain a list of products that the user purchased and made payments for, a list of products that the user selected but has not made payments for, user's payment account, and user's account balance. Namely, only registered user himself/herself has the authority to access related webpages.
It should be noted herein that acquiring a user's local cookie information is to acquire the user fingerprint information in the user's local cookie information. The user fingerprint information can identify the user's unique identity, which is typically saved in the user's local cookie information. Acquiring original URLs of all related webpages of the current website is to perform encryption to both the original URLs of all related webpages of the current website and the user's fingerprint information together.
S701: performing user fingerprint signature in accordance with the user's local cookie information of the current website as well as the original URLs of all related webpages of the current website, and generating encrypted URLs of all related webpages of the current website. The encrypted URLs carry user fingerprint signature.
Step S701 may further comprise extracting user fingerprint information from the user's local cookie information, acquiring original URLs of all related webpages of the current website, performing encryption based upon the user fingerprint information as well as the original URLs of all related webpages, generating ciphertexts for each of the original URLs of all related webpages, and embedding the ciphertexts into each of the original URLs of all related webpages. The ciphertexts are the user fingerprint signature or information that contains the user fingerprint signature, which is usually a character string, e.g. “40837a8d5df24b799ba4997d1c84d6db” or “79assfh”.
Any existing encryption algorithm may be used to perform the encryption. For example, the encryption may be performed using MD5 algorithm. In other words, when user accesses aa.com/1.html, MD5 algorithm may be used to perform encryption. The encrypted user fingerprint information may be 79assfh. The above description is an example of encryption, and the encryption algorithms described herein are not limited thereto.
S702: returning desired information. The desired information may comprise the encrypted URLs of all related webpages as well as the content information of the website page corresponding to the first access request. According to an embodiment of the present invention, the web server may return the desired information to the browser client for display.
To control the access to the webpage, because the URL of related webpages are encrypted based upon the user fingerprint information, a user cannot manually modify the webpage links.
S803: receiving a second access request to access a related webpage of the current website, the related webpage is associated with an encrypted URL which carries a user fingerprint signature.
In an embodiment of the present invention, when a user is browsing a business website on the browser client and needs to further browse the webpage resources of the current website that belong to the user, the user clicks on the encrypted URL displayed on the webpage. The click operation may generate a second access request. The second access request is sent to the web server.
S804: performing a user fingerprint verification in response to the second access request.
In an embodiment of the present invention, the step of performing user fingerprint verification further comprises: extracting the original URL of the desired webpage specified in the second access request from the URLs of related webpages, extracting user fingerprint information from the user's local cookie information uploaded along with the second access request, performing encryption based upon the original URL of the desired webpage and the user fingerprint information, and generating a verification ciphertext in response to the second access request. If the verification ciphertext is consistent with the ciphertext carried by the second access request, it is determined that the user who issued the second access request has the access authority. Otherwise, it is determined that the user who issued the second access request does not have the access authority. An allowable access authority may be provided for user. It should be noted that the encryption method in this step is consistent with the encryption method in the step S801 or employs the same algorithm. For example, encryption may be performed by using MD5 algorithm. When the user accesses aa.com/79assfh/1.html, the original URL of aa.com/1.html is extracted and MD5 algorithm is used for encryption. A verification ciphertext 79assfh is obtained which is consistent with the ciphertext carried in the URL aa.com/79assfh/1.html clicked by the user, indicating that the user is accessing an encrypted URL that is returned by the web server. In this manner, it is determined that the user has the access authority. Encryption method and authority control method are not limited to this embodiment.
When a user is viewing his/her own webpage resources, the web system does not need to additionally determine whether the webpage resources belong to this user. User fingerprint verification can be performed while opening the webpage resources by clicking on the encrypted URLs returned by the web server, which reduces the conflict between authority control for a user access and business logic. Therefore, the authority control is independent from a website's business modules. Authority control of user access to webpage resources are central-controlled.
In another example according to the present invention, if the user fingerprint verification fails due to abnormal local cookie information, the web server will jump to the account login page and provide the account login page to the browser client in response to the second access request to the encrypted URL. When the user re-types the user name and password and successfully logs in, the user fingerprint verification will be performed again on the encrypted URL.
Since each user fingerprint is unique, the encrypted URL is unique as well. To perform fingerprint verification on the encrypted URL, the ciphertext generated by encrypting the URL of the related webpage is compared with the user's local cookie information. The comparison result may determine whether the user has the authority to access the webpage without enabling the web server to check database to determine the ownership of the webpage resource.
According to embodiments of the present invention, therefore, on one hand, the encrypted URL of related webpages are associated with the user fingerprint information, such that a user cannot manually modify the webpage links. On the other hand, absence of checking database by the web server, SQL injection security vulnerability is avoided, which improves the efficiency of the web server.
The present invention further provides an apparatus for authority control of user access to a webpage.
The apparatus 900 may be implemented at the web server. The apparatus 900 installed at the web server which may reduce additional burden on operations and data processing at client side.
In one example of the present invention, the apparatus 1100 is implemented in the browser client on a mobile terminal, such as a cell phone.
In the method, apparatus and server for authority control of user access according to embodiments of the present invention, a web server generates encrypted URLs of all related webpages by performing fingerprint signature on URLs of the related webpages as well as the user's local cookie information. The encrypted URLs are unique. For subsequent access to the encrypted URLs, the web server may verify whether the encrypted URL is consistent with the local cookie information, thereby determining whether the user has the authority to access the desired webpage without enabling the web server to check database to determine the ownership of the webpage resource. As a result, the conflict between authority control for a user access and business logic is reduced. SQL injection security vulnerability is avoided, making it impossible for hackers to launch malicious attacks against the website by making modifications to the webpage URL. Work efficiency of the web server may be improved. Moreover, it improves the entire system's security class and protects user information.
The method of authority control is illustrated in detail according to exemplary embodiment of the present invention.
(1) User A types an original URL https://gcmall.uc.cn/goodslist/?goodsId=123. The browser client acquires user A's local cookie information related to the typed original URL, and sends user A's request to access the webpage associated with the typed original URL and the local cookie information.
(2) The web server retrieves from the access request the user fingerprint information in the local cookie information. The access request is uploaded by the browser client. An encryption is performed on the typed URL and the user fingerprint information to generate a ciphertext “40837a8d5df24b799ba4997d1c84d6db.” The ciphertext is embedded into a new related webpage to generate an encrypted URL. Namely, the ciphertext “40837a8d5df24b799ba4997d1c84d6db” is added to the typed original URL https://gcmall.uc.cn/goodslist/?goodsId=123 to generate the encrypted URL https://gcmall.uc.cn/goodslist/40837a8d5df24b799ba4997d1c84d6db/?goodsId=123. The web server returns to the browser client the encrypted URL along with the content information of the desired web page to which the first access request is sent.
(3) When the user opens the webpage using the encrypted URL at the browser client, user fingerprint verification is performed on the encrypted URL. In other words, the original URL is extracted from the encrypted URL and user fingerprint information is extracted from the user's local cookie information which is uploaded along with the request to access the encrypted URL https://gcmall.uc.cn/goodslist/40837a8d5df24b799ba4997d1c84d6db/?goodsId=123. Encryption is then performed based upon the original URL and user fingerprint information to generate a verification ciphertext corresponding to the access request. If the verification ciphertext is consistent with the ciphertext carried by the access request to URL https://gcmall.uc.cn/goodslist/40837a8d5df24b799ba4997d1c84d6db/?goodsId=123, it is determined that the access request has the access authority. Otherwise, the access request does not have the access authority. A corresponding access authority is provided.
When user A regularly requests an access to the webpage, the webpage URL is https://gcmall.uc.cn/goodslist/40837a8d5df24b799ba4997d1c84d6db/?goodsId=123. If user A maliciously makes changes the webpage URL to https://gcmall.uc.cn/goodslist/40837a8d5df24b799ba4997d1c84d6db/?goodsId=321, because the ciphertexts carried by the changed URL is different than the verification ciphertexts, user A is unable to access the network resources using the changed URL. As a result, the user information is protected.
It can be seen from the description of the above embodiment that, an encrypted URL is generated based upon a web address being accessed by a user as well as the local cookie information carrying the user fingerprint information. When the user subsequently accesses the web address again, the web server may determine if the user has the authority to access the webpage by verifying whether the web address is consistent with the local cookie information. By means of such an encryption method, a user's access authority is determined based on the user fingerprint information carried by the URL without enabling the web server to check database to determine the ownership of the webpage resource.
Those skilled in the art should understand that units and algorithm of each examples disclosed herein can be implemented by hardware or combinations of software program and hardware. Whether such functions are implemented by software or hardware depends on specific applications and design conditions. Many modifications and other example embodiments set forth herein will come to mind to one skilled in the art to which these example embodiments pertain having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the embodiments are not to be limited to the specific ones disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Moreover, although the foregoing descriptions and the associated drawings describe example embodiments in the context of certain example combinations of elements and/or functions, it should be appreciated that different combinations of elements and/or functions may be provided by alternative embodiments without departing from the scope of the appended claims. In this regard, for example, different combinations of elements and/or functions other than those explicitly described above are also contemplated as may be set forth in some of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.
It should be understood that the system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are only exemplary, for example, the division of units is only a division of logic functions, and other ways of division may exist in actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some ports, apparatuses or units, and may be in electrical, mechanical or other forms.
Units that are described as discrete parts may or may not be physically separated, parts displayed as units may or may not be physical units, namely, may be installed at one location, or distributed on a plurality of network units. Some or all of the units may be selected according to actual need to attain the object of the solutions of the embodiments.
In addition, all function units in all embodiments of the present invention may be integrated into one processing unit, or the units may exist as physical individuals, or two or more units may be integrated into one unit.
When a function is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such a understanding, the technical solution of the present invention in essence, or a part that contributes to the prior art or a part of the technical solution may be embodied in the form of a software product, said computer software product is stored in a storage medium, comprising a number of instructions to cause a computer device (which may be a personal computer, a server or a network device) or a processor to execute all or some steps of the method according to each embodiment of the present invention. The above-mentioned storage medium comprises a variety of media that can store program codes, such as flash drive, portable hard drive, ROM (Read-Only Memory), RAM (Random Access Memory), magnetic disk or CD.
Only specific embodiments of the present invention are described above, but the scope of the present invention is not limited thereto. Any variations or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention shall be encompassed by the present invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2013 1 0334944 | Aug 2013 | CN | national |
| 2013 1 0744195 | Dec 2013 | CN | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/CN2014/081026 | 6/27/2014 | WO | 00 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2015/014189 | 2/5/2015 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 5796952 | Davis | Aug 1998 | A |
| 5963915 | Kirsch | Oct 1999 | A |
| 6006264 | Colby | Dec 1999 | A |
| 6038598 | Danneels | Mar 2000 | A |
| 6427175 | Khan et al. | Jul 2002 | B1 |
| 6463533 | Calamera et al. | Oct 2002 | B1 |
| 6523115 | Ono | Feb 2003 | B1 |
| 6631360 | Cook | Oct 2003 | B1 |
| 6748386 | Li | Jun 2004 | B1 |
| 6948063 | Ganesan | Sep 2005 | B1 |
| 6957334 | Goldstein | Oct 2005 | B1 |
| 6977911 | Geen | Dec 2005 | B1 |
| 6993591 | Klemm | Jan 2006 | B1 |
| 7137006 | Grandcolas | Nov 2006 | B1 |
| 7318234 | Dharmarajan | Jan 2008 | B1 |
| 7325045 | Manber | Jan 2008 | B1 |
| 7349975 | Kikinis | Mar 2008 | B2 |
| 7552338 | Swildens | Jun 2009 | B1 |
| 7590406 | Aaltonen | Sep 2009 | B2 |
| 7594189 | Walker | Sep 2009 | B1 |
| 7725718 | Langford | May 2010 | B2 |
| 7865394 | Calloway | Jan 2011 | B1 |
| 7957525 | Gentry | Jun 2011 | B2 |
| 8131594 | Yehoshua | Mar 2012 | B1 |
| 8166135 | Ganesh | Apr 2012 | B2 |
| 8239926 | Lin | Aug 2012 | B1 |
| 8271778 | Zhou | Sep 2012 | B1 |
| 8290146 | Takashima | Oct 2012 | B2 |
| 8364682 | Gershony | Jan 2013 | B1 |
| 8478882 | Iwade et al. | Jul 2013 | B2 |
| 8539359 | Rapaport et al. | Sep 2013 | B2 |
| 8972376 | Gailis | Mar 2015 | B1 |
| 9262446 | Katragadda | Feb 2016 | B1 |
| 9658738 | Park et al. | May 2017 | B1 |
| 20010052003 | Seki | Dec 2001 | A1 |
| 20020019828 | Mortl | Feb 2002 | A1 |
| 20020032701 | Gao et al. | Mar 2002 | A1 |
| 20020049601 | Asokan | Apr 2002 | A1 |
| 20020083178 | Brothers | Jun 2002 | A1 |
| 20020094870 | Murray | Jul 2002 | A1 |
| 20020108050 | Raley | Aug 2002 | A1 |
| 20020116528 | Vale | Aug 2002 | A1 |
| 20020184256 | Reich | Dec 2002 | A1 |
| 20030044077 | Okada | Mar 2003 | A1 |
| 20030081125 | Sheldon et al. | May 2003 | A1 |
| 20030084170 | de Jong | May 2003 | A1 |
| 20030084453 | Laughlin | May 2003 | A1 |
| 20030163740 | Thjai | Aug 2003 | A1 |
| 20030195801 | Takakura | Oct 2003 | A1 |
| 20040039794 | Biby | Feb 2004 | A1 |
| 20040049673 | Song | Mar 2004 | A1 |
| 20040152477 | Wu et al. | Aug 2004 | A1 |
| 20040172528 | Tenereillo | Sep 2004 | A1 |
| 20040187027 | Chan | Sep 2004 | A1 |
| 20040236962 | Wong | Nov 2004 | A1 |
| 20040250075 | Anthe et al. | Dec 2004 | A1 |
| 20040250118 | Andreev | Dec 2004 | A1 |
| 20050022132 | Herzberg | Jan 2005 | A1 |
| 20050071256 | Singhal | Mar 2005 | A1 |
| 20050114435 | DiPlacido | May 2005 | A1 |
| 20050119941 | James | Jun 2005 | A1 |
| 20050132201 | Pitman | Jun 2005 | A1 |
| 20050149880 | Postrel | Jul 2005 | A1 |
| 20050216516 | Calistri-Yeh | Sep 2005 | A1 |
| 20050277405 | Noguchi | Dec 2005 | A1 |
| 20060026104 | Abe | Feb 2006 | A1 |
| 20060047662 | Barik | Mar 2006 | A1 |
| 20060059125 | Yan | Mar 2006 | A1 |
| 20060068818 | Leitersdorf | Mar 2006 | A1 |
| 20060143688 | Futoransky | Jun 2006 | A1 |
| 20060159088 | Aghvami | Jul 2006 | A1 |
| 20060168202 | Reshef et al. | Jul 2006 | A1 |
| 20060168509 | Boss | Jul 2006 | A1 |
| 20060200855 | Willis | Sep 2006 | A1 |
| 20060277308 | Morse et al. | Dec 2006 | A1 |
| 20070067305 | Ives | Mar 2007 | A1 |
| 20070088820 | Kwak et al. | Apr 2007 | A1 |
| 20070094352 | Choi | Apr 2007 | A1 |
| 20070143120 | Phadnis et al. | Jun 2007 | A1 |
| 20070150285 | Friedman | Jun 2007 | A1 |
| 20070168877 | Jain et al. | Jul 2007 | A1 |
| 20070174905 | Martherus | Jul 2007 | A1 |
| 20070174913 | Kuroda | Jul 2007 | A1 |
| 20070180021 | Hickman | Aug 2007 | A1 |
| 20070189217 | Wang et al. | Aug 2007 | A1 |
| 20070213064 | Togahara | Sep 2007 | A1 |
| 20070218912 | Song et al. | Sep 2007 | A1 |
| 20070242680 | Signaoff et al. | Oct 2007 | A1 |
| 20070245224 | Hsu et al. | Oct 2007 | A1 |
| 20070255702 | Orme | Nov 2007 | A1 |
| 20080046616 | Verzunov | Feb 2008 | A1 |
| 20080077697 | Chu | Mar 2008 | A1 |
| 20080104255 | Volodarsky | May 2008 | A1 |
| 20080163367 | Lee | Jul 2008 | A1 |
| 20080172341 | Crandell | Jul 2008 | A1 |
| 20080177709 | Chiu | Jul 2008 | A1 |
| 20080195409 | Shankland | Aug 2008 | A1 |
| 20080288489 | Kim | Nov 2008 | A1 |
| 20090064047 | Shim | Mar 2009 | A1 |
| 20090082003 | Thorell | Mar 2009 | A1 |
| 20090094361 | Srinivasan | Apr 2009 | A1 |
| 20090144288 | Refuah et al. | Jun 2009 | A1 |
| 20090144308 | Huie et al. | Jun 2009 | A1 |
| 20090157802 | Kang | Jun 2009 | A1 |
| 20090172775 | Mardikar | Jul 2009 | A1 |
| 20090210391 | Hall | Aug 2009 | A1 |
| 20090216760 | Bennett | Aug 2009 | A1 |
| 20090300351 | Lei | Dec 2009 | A1 |
| 20090313318 | Dye | Dec 2009 | A1 |
| 20100005347 | Kim | Jan 2010 | A1 |
| 20100030752 | Goldentouch | Feb 2010 | A1 |
| 20100104094 | Takashima | Apr 2010 | A1 |
| 20100138485 | Chow | Jun 2010 | A1 |
| 20100306184 | Wang | Dec 2010 | A1 |
| 20100306547 | Fallows | Dec 2010 | A1 |
| 20100318890 | Billharz | Dec 2010 | A1 |
| 20100325195 | Kamp | Dec 2010 | A1 |
| 20110035505 | Jakobsson | Feb 2011 | A1 |
| 20110066732 | Iwade et al. | Mar 2011 | A1 |
| 20110072038 | Burge | Mar 2011 | A1 |
| 20110106637 | Goto | May 2011 | A1 |
| 20110125092 | Hepworth et al. | May 2011 | A1 |
| 20110149737 | Muthiah | Jun 2011 | A1 |
| 20110161479 | Freishtat | Jun 2011 | A1 |
| 20110207433 | Miyamoto | Aug 2011 | A1 |
| 20110231482 | Benna | Sep 2011 | A1 |
| 20120016975 | Rothschild | Jan 2012 | A1 |
| 20120030774 | Keith | Feb 2012 | A1 |
| 20120036178 | Gavini | Feb 2012 | A1 |
| 20120124372 | Dilley | May 2012 | A1 |
| 20120210413 | Akula | Aug 2012 | A1 |
| 20120246737 | Paxton et al. | Sep 2012 | A1 |
| 20120266090 | Nealer et al. | Oct 2012 | A1 |
| 20120304263 | Lee | Nov 2012 | A1 |
| 20120324227 | Swildens | Dec 2012 | A1 |
| 20130055078 | Berger | Feb 2013 | A1 |
| 20130124651 | Ding | May 2013 | A1 |
| 20130138964 | Joyce, III | May 2013 | A1 |
| 20130173912 | Cui | Jul 2013 | A1 |
| 20130212679 | Ansari et al. | Aug 2013 | A1 |
| 20130227713 | Keith | Aug 2013 | A1 |
| 20130246509 | Sakiyama et al. | Sep 2013 | A1 |
| 20130275264 | Lindenberg | Oct 2013 | A1 |
| 20130290865 | Kageyama | Oct 2013 | A1 |
| 20130339842 | Zhang et al. | Dec 2013 | A1 |
| 20140006399 | Vasudevan et al. | Jan 2014 | A1 |
| 20140012751 | Kuhn | Jan 2014 | A1 |
| 20140059029 | Magill | Feb 2014 | A1 |
| 20140075525 | Ferlin | Mar 2014 | A1 |
| 20140082715 | Grajek | Mar 2014 | A1 |
| 20140133354 | Scharf et al. | May 2014 | A1 |
| 20140165132 | Stuntebeck | Jun 2014 | A1 |
| 20140165153 | Dabbiere | Jun 2014 | A1 |
| 20140208199 | Peleg | Jul 2014 | A1 |
| 20140214671 | Desilva | Jul 2014 | A1 |
| 20140317120 | Ghose | Oct 2014 | A1 |
| 20140334622 | Smyth | Nov 2014 | A1 |
| 20140351236 | Zhu | Nov 2014 | A1 |
| 20140359424 | Lin et al. | Dec 2014 | A1 |
| 20140359578 | Jesse | Dec 2014 | A1 |
| 20140380477 | Li | Dec 2014 | A1 |
| 20150039442 | Sidman | Feb 2015 | A1 |
| 20150200994 | Jain | Jul 2015 | A1 |
| 20160150044 | Sze | May 2016 | A1 |
| 20160285861 | Chester | Sep 2016 | A1 |
| 20170024423 | Liang | Jan 2017 | A1 |
| 20170109797 | Boffa | Apr 2017 | A1 |
| 20170171200 | Bao | Jun 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 1578938 | Feb 2005 | CN |
| 101034981 | Sep 2007 | CN |
| 101034981 | Sep 2007 | CN |
| 101150407 | Mar 2008 | CN |
| 101309275 | Nov 2008 | CN |
| 100576797 | Dec 2009 | CN |
| 101620531 | Jan 2010 | CN |
| 101807180 | Aug 2010 | CN |
| 102024012 | Apr 2011 | CN |
| 10227113 | Dec 2011 | CN |
| 102271123 | Dec 2011 | CN |
| 102446222 | May 2012 | CN |
| 102546530 | Jul 2012 | CN |
| 102591916 | Jul 2012 | CN |
| 102647481 | Aug 2012 | CN |
| 102682009 | Sep 2012 | CN |
| 103116723 | May 2013 | CN |
| 103414562 | Nov 2013 | CN |
| 103729440 | Apr 2014 | CN |
| 104182401 | Dec 2014 | CN |
| 2568378 | Mar 2013 | EP |
| 2010092144 | Apr 2010 | JP |
| 2011165156 | Aug 2011 | JP |
| 2012039198 | Feb 2012 | JP |
| WO 2004084071 | Sep 2004 | WO |
| WO 2015014189 | Feb 2015 | WO |
| WO-2015014189 | Feb 2015 | WO |
| WO 2014187218 | Nov 2017 | WO |
| Entry |
|---|
| Stratton, “Issues Essential to World Wide Marketing”, ACM SIGICE Bulletin, vol. 22, No. 4, Apr. 1997, pp. 2-16. (Year: 1997). |
| Bartell, “The MediaXact System—A Framework for Personalized Electronic Commerce Services”, Bell Labs Technical Journal, Apr.-Jun. 1999, pp. 153-173. (Year: 1999). |
| Office Action for U.S. Appl. No. 15/934,021, dated Jul. 5, 2018, 28 pages. (Year: 2018). |
| Chris Knowlton. Comparing Web servers to streaming media servers, Chris Knowlton's Blog, Aug. 13, 2007, 12 pages. (Year: 2007). |
| Beato, Filipe, Iulia Ion, Srdjan Ĉapkun, Bart Preneel, and Marc Langheinrich. “For some eyes only: protecting online information sharing.” In Proceedings of the third ACM conference on Data and application security and privacy, pp. 1-12. 2013. (Year: 2013). |
| Malik, Siddharth, and Anjali Sardana. “Secure Vault: A privacy preserving reliable architecture for Secure Social Networking.” In 2011 7th International Conference on Information Assurance and Security (IAS), pp. 116-121. IEEE, 2011. (Year: 2011). |
| International Search Report and Written Opinion for Application No. PCT/CN2014/081026 dated Sep. 26, 2014. |
| Radhakrishnan, et al., “TCP fast open.” In Proceedings of the Seventh Conference on emerging Networking Experiments and Technologies, p. 21. ACM, 2011. (Year: 2011). |
| Zhang, Lu et al., “Application-level attack against Tor's hidden service.” In Pervasive Computing and Applications (ICPCA), 2011 6th International Conference on, pp. 509-516. IEEE, 2011. (Year: 2011). |
| Office Action for U.S. Appl. No. 15/934,021 dated Jul. 5, 2018, 28 pages. |
| Office Action for Chinese Patent Application No. 201310744195.6 dated Dec. 19, 2016, 8 pages. |
| Office Action for Chinese Patent Application No. 201310334944.8 dated Dec. 5, 2016, 4 pages. |
| Office Action for Chinese Patent Application No. 201310334944.8 dated Nov. 25, 2015, 4 pages. |
| Office Action for Chinese Patent Application No. 2013103349448.8 dated May 23, 2016, 4 pages. |
| Office Action for Chinese Patent Application No. 201310744195.6 dated May 4, 2016, 7 pages. |
| Search Report for Chinese Patent Application No. 201310334944.8, dated Nov. 17, 2015, 2 pages. |
| Office Action for U.S. Appl. No. 15/934,021 dated Dec. 19, 2019, 34 pages. |
| Number | Date | Country | |
|---|---|---|---|
| 20160191522 A1 | Jun 2016 | US |
