CN103761114B - A kind of browser side loading extension and/or the method and device of plug-in unit - Google Patents
A kind of browser side loading extension and/or the method and device of plug-in unit Download PDFInfo
- Publication number
- CN103761114B CN103761114B CN201310493213.8A CN201310493213A CN103761114B CN 103761114 B CN103761114 B CN 103761114B CN 201310493213 A CN201310493213 A CN 201310493213A CN 103761114 B CN103761114 B CN 103761114B
- Authority
- CN
- China
- Prior art keywords
- plug
- extension
- unit
- security
- browser
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 49
- 238000009434 installation Methods 0.000 claims description 24
- 230000001360 synchronised effect Effects 0.000 claims description 19
- 230000000977 initiatory effect Effects 0.000 claims description 3
- 238000012550 audit Methods 0.000 abstract description 9
- 238000007726 management method Methods 0.000 description 14
- 238000012795 verification Methods 0.000 description 10
- 239000004606 Fillers/Extenders Substances 0.000 description 7
- 238000004458 analytical method Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 230000008901 benefit Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 3
- 241000707825 Argyrosomus regius Species 0.000 description 2
- 241000282485 Vulpes vulpes Species 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 239000004744 fabric Substances 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 235000008954 quail grass Nutrition 0.000 description 2
- 241000196324 Embryophyta Species 0.000 description 1
- 241001331845 Equus asinus x caballus Species 0.000 description 1
- 244000097202 Rathbunia alamosensis Species 0.000 description 1
- 235000009776 Rathbunia alamosensis Nutrition 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000003542 behavioural effect Effects 0.000 description 1
- 230000009172 bursting Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000001035 drying Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Landscapes
- Stored Programmes (AREA)
- Information Transfer Between Computers (AREA)
Abstract
The invention discloses a kind of loading extension of browser side and/or the method and device of plug-in unit, this method includes：Setting extension and/or plug-in security engine and the extension for the engine calling and/or plug-in security configuration file in browser side, wherein extension and/or plug-in security configuration file include the safe description information of browser extension and/or plug-in unit；Extension is loaded in browser side and/or during plug-in unit, extension and/or the extension of plug-in security engine calling and/or plug-in security configuration file, and judge the security of the extension and/or plug-in unit being loaded according to the safe description information of extension and/or plug-in unit；It will be deemed as safe extension and/or plug-in unit loaded in browser side.The efficiency of the security audits of browser extension and/or plug-in unit can be effectively improved by embodiments of the invention.
Description
Technical field
The present invention relates to the method for field of computer technology, more particularly to a kind of loading extension of browser side and/or plug-in unit
And device.
Background technology
For providing extension element in a browser, presently mainly three classes：The first kind, Development of Web Browser side are provided
Extension (i.e. official extends)；Equations of The Second Kind, the extension of affiliate's exploitation of browser；3rd class, third party, which provide, arrives browser
Extension central platform on extension element.
Mainly audited at present for the extension element provided by third party by operation maintenance personnel：For
The extension element of JavaScript types, the mainly source code by operation maintenance personnel for JavaScript are analyzed, or
Automatic decision is carried out by source code analysis tool；For the extension of compiled DLL forms, it can typically obtain its source code and enter
Row analysis, or test run is carried out in virtual environment, the behavioral parameters of the extension element are obtained so that it is determined that whether it has
Risk (for example changes system registry, changes the startup item of system, illegally carry out write operation to system file)；Main or fortune
After dimension personnel audit, the extension center for being just put into browser is reached the standard grade and is downloaded installation to browser client.
Due to needing operation maintenance personnel to audit extension element in the prior art, cause security audits inefficiency.
The content of the invention
In view of the above problems, it is proposed that the present invention so as to provide one kind overcome above mentioned problem or at least in part solve on
A kind of loading extension of browser side and/or the method and device of plug-in unit of problem are stated, browser extension profit/or plug-in unit is effectively improved
Security audits efficiency.
According to one aspect of the present invention there is provided a kind of loading extension of browser side and/or the method for plug-in unit, including：
Extension and/or plug-in security engine and the extension for the engine calling and/or plug-in security configuration text are set in browser side
Part, wherein the extension and/or plug-in security configuration file include the safe description information of browser extension and/or plug-in unit；
When the loading extension of browser side and/or plug-in unit, extension and/or the extension of plug-in security engine calling and/or plug-in security configuration text
Part, and according to the extension being loaded described in the safe description information judgement of extension and/or plug-in unit and/or the security of plug-in unit；
It will be deemed as safe extension and/or plug-in unit loaded in browser side.
Alternatively, the extension being loaded in browser side and/or plug-in unit are included in when browser starts and loaded
The extension installed in current browser and/or plug-in unit, user passes through browser during the use of browser
The renewal that extension center initiates the extension installed and/or plug-in unit, is extended in browser side and/or loads during update of plug-in
Extension and/or plug-in unit and for having logged in one in the extension and/or plug-in unit of the user of browser account when account is synchronous
Or it is multiple.
Alternatively, the extension and/or plug-in security configuration file are included extension and/or the safety description letter of plug-in unit
Breath includes：The information of the level of security of extension and/or the self information of plug-in unit and extension and/or plug-in unit；Wherein, the extension
And/or the self information of plug-in unit includes：Extension and/or the title of plug-in unit, the version information of extension and/or plug-in unit, extension and/or
The source of plug-in unit, No. ID of extension and/or plug-in unit, the description information and the hair of extension and/or plug-in unit of extension and/or plug-in unit
The cloth date.
Alternatively, the extension and/or plug-in security engine judge institute according to the safe description information of extension and/or plug-in unit
The step of security for stating the extension being loaded and/or plug-in unit, includes：By the extension being loaded in browser side and/or insert
The self information of part enters with the extension described in the safe description information of extension and/or plug-in unit and/or the self information of plug-in unit
Row matching, and obtain the information of the level of security of the extension and/or plug-in unit.
Alternatively, in the extension that will be loaded in browser side and/or the self information of plug-in unit and extension and/or plug-in unit
Safe description information described in the extension and/or the self information of plug-in unit matched, and obtain the extension and/or plug-in unit
Security level information the step of before also include：According to described in the extension and/or plug-in security configuration file
Whether the extension and/or plug-in unit being loaded described in the extension and/or the source judgement of plug-in unit being loaded are safe；Wherein, when
The source of the extension being loaded and/or plug-in unit is described clear described in the extension and/or plug-in security configuration file
Look at device exploitation side when, the extension and/or plug-in security engine judge that the extension being loaded and/or plug-in unit are safely
's；When the source right and wrong of the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file
During the exploitation side of the browser, then the self information by the extension profit/being loaded in browser side or plug-in unit is performed
Matched with the corresponding informance described in the extension and/or plug-in security configuration file and obtain the extension and/or plug-in unit
Security level information, judge that the extension being loaded and/or plug-in unit are according to matching result and the security level information
No safety.
Alternatively, the information of the level of security includes blacklist, gray list and white list, wherein, level of security is black
The extension of list and/or plug-in unit are confirmed as the presence of potential safety hazard, and extension and/or plug-in unit of the level of security for gray list are determined
To there is potential potential safety hazard, extension and/or plug-in unit of the level of security for white list are confirmed as the safety expansion without risk
Exhibition and/or plug-in unit.
Alternatively, methods described also includes：The extension and/or plug-in security engine are for being judged as unsafe extension
And/or plug-in unit carries out disabling or unloading operation, and carry out the display of prompting message automatically；For being judged as safety or existing potential
The extension of safety problem and/or plug-in unit then allow installation and upgrade.
Alternatively, methods described also includes：For being judged as unsafe extension and/or plug-in unit, after browser startup
Extension and/or plug-in management interface in the extension and/or plug-in unit are marked and/or reminded.
Alternatively, if it is determined that unsafe extension and/or plug-in unit are the extension and/or plug-in unit installed, then exist
The scheme of the icon of the extension and/or plug-in unit and description is set to grey in extension and/or plug-in management interface, and/or with red
Color word clearly points out the extension and/or plug-in unit dangerous.
Alternatively, if it is determined that extension and/or plug-in unit that browser side to be loaded are unsafe extension and/or plug-in unit,
The extension of safety and/or the installation link of plug-in unit are then provided.
According to another aspect of the present invention, the device of a kind of browser side loading extension and/or plug-in unit, bag are additionally provided
Include：Setup module, suitable for browser side set extension and/or plug-in security engine and for the engine calling extension and/
Or plug-in security configuration file, extended and/or plug-in unit wherein the extension and/or plug-in security configuration file include browser
Safe description information；Security judge module, loads in browser side suitable for the extension and/or plug-in security engine and extends
And/or during plug-in unit, the extension and/or plug-in security configuration file are called, and according to extension and/or the safety description letter of plug-in unit
The extension being loaded described in breath judgement and/or the security of plug-in unit；Load-on module, suitable for will be deemed as safe extension and/
Or plug-in unit is loaded in browser side.
Alternatively, the extension being loaded in browser side and/or plug-in unit include：To be loaded when browser starts
The extension installed in current browser and/or plug-in unit, user passes through browser during the use of browser
The renewal that extension center initiates the extension installed and/or plug-in unit, is extended in browser side and/or loads during update of plug-in
Extension and/or plug-in unit and for having logged in one in the extension and/or plug-in unit of the user of browser account when account is synchronous
Or it is multiple.
Alternatively, the extension and/or plug-in security configuration file are included extension and/or the safety description letter of plug-in unit
Breath includes：The information of the level of security of extension and/or the self information of plug-in unit and extension and/or plug-in unit；Wherein, the extension
And/or the self information of plug-in unit includes：Extension and/or the title of plug-in unit, the version information of extension and/or plug-in unit, extension and/or
The source of plug-in unit, No. ID of extension and/or plug-in unit, the description information and the hair of extension and/or plug-in unit of extension and/or plug-in unit
The cloth date.
Alternatively, the security judge module is further adapted for the extension that will be loaded in browser side and/or inserted
The self information of part enters with the extension described in the safe description information of extension and/or plug-in unit and/or the self information of plug-in unit
Row matching, and obtain the information of the level of security of the extension and/or plug-in unit.
Alternatively, the security judge module is further adapted for remembering according in the extension and/or plug-in security configuration file
Whether the extension and/or plug-in unit being loaded described in the extension being loaded and/or the source judgement of plug-in unit carried are safe；
Wherein, when the source of the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file is
The extension being loaded during the exploitation side of the browser described in the extension and/or the judgement of plug-in security engine and/or plug-in unit
It is safe；When coming for the extension being loaded described in the extension and/or plug-in security configuration file and/or plug-in unit
When source is the exploitation side of the non-browser, then perform by the extension being loaded in browser side and/or plug-in unit from
Body information with it is described extension and/or plug-in security configuration file described in corresponding informance matched and obtain the extension and/
Or the security level information of plug-in unit, according to matching result and the security level information judge the extension being loaded and/or
Whether plug-in unit is safe.
Alternatively, the information of the level of security includes blacklist, gray list and white list, wherein, level of security is black
The extension of list and/or plug-in unit are confirmed as the presence of potential safety hazard, and extension and/or plug-in unit of the level of security for gray list are determined
To there is potential potential safety hazard, extension and/or plug-in unit of the level of security for white list are confirmed as the safety expansion without risk
Exhibition and/or plug-in unit.
Alternatively, described device also includes：Disabled module, suitable for the extension and/or plug-in security engine for judging
It is that unsafe extension and/or plug-in unit carry out disabling or unloading operation, and carry out the display user of prompting message automatically；Upgrading mould
Block, suitable for then allowing installation and upgrade for being judged as safety or there is the extension of potential safety problem and/or plug-in unit.
Alternatively, described device also includes：First prompting module, suitable for for being judged as unsafe extension and/or inserting
Part, is marked and/or reminds to the extension and/or plug-in unit in the extension and/or plug-in management interface after browser startup.
Alternatively, described device also includes：Second prompting module, suitable for if it is determined that the extension to be loaded of browser side
And/or plug-in unit is unsafe extension and/or plug-in unit, then by the extension and/or plug-in unit in extension and/or plug-in management interface
Icon and the scheme of description be set to grey, and/or clearly point out the extension and/or plug-in unit dangerous with red text.
Alternatively, described device also includes：Link is installed module is provided, it is described in the expansion to be loaded of browser side suitable for working as
Linked when exhibition and/or plug-in unit are judged as unsafe extension and/or plug-in unit there is provided the extension of safety and/or the installation of plug-in unit.
In an embodiment of the present invention, extension and/or the security engine of plug-in unit and its are added in browser main program
It is corresponding extension and/or plug-in security configuration file, extension and/or plug-in security engine browser side load extension and/or
During plug-in unit, extension and/or plug-in security configuration file are called, and judge institute according to the safe description information of extension and/or plug-in unit
State the security of the extension being loaded and/or plug-in unit；It will be deemed as safe extension and/or plug-in unit added in browser side
Carry, be easy to browser to be managed for the security audit and control of the extension of quantity increasing browser and/or plug-in unit, effectively carry
The efficiency of the security audits of high browser extension and/or plug-in unit.
Described above is only the general introduction of technical solution of the present invention, in order to better understand the technological means of the present invention,
And can be practiced according to the content of specification, and in order to allow above and other objects of the present invention, feature and advantage can
Become apparent, below especially exemplified by the embodiment of the present invention.
Brief description of the drawings
By reading the detailed description of hereafter preferred embodiment, various other advantages and benefit is common for this area
Technical staff will be clear understanding.Accompanying drawing is only used for showing the purpose of preferred embodiment, and is not considered as to the present invention
Limitation.And in whole accompanying drawing, identical part is denoted by the same reference numerals.In the accompanying drawings：
Fig. 1 shows the flow chart of the method for browser side loading extension and/or plug-in unit in embodiments in accordance with the present invention；
Fig. 2 shows the example of the browser plug-in unit to be loaded；
Fig. 3 shows that extension according to an embodiment of the invention and/or plug-in security engine judge the extension being loaded
And/or a kind of implementation of the security of plug-in unit；
Fig. 4 shows the block diagram of the system of browser side loading extension and/or plug-in unit according to an embodiment of the invention；With
And
Fig. 5 shows the block diagram of the device of browser side loading extension and/or plug-in unit according to an embodiment of the invention.
Embodiment
To be fully understood by goal of the invention, feature and effect of the present invention, by following specific embodiments, to the present invention
Elaborate, but the present invention is not restricted to this.
Fig. 1 shows the flow of the method l00 of browser side loading extension and/or plug-in unit in embodiments in accordance with the present invention
Figure is as shown in figure 1, this method 100 starts from step mule S110, and in step s 110, in browser side, setting extension and/or plug-in unit are pacified
Full engine and the extension for the engine calling and/or plug-in security configuration file, wherein extension and/or plug-in security configuration text
Part includes the safe description information of browser extension and/or plug-in unit.
In an embodiment of the present invention, above-mentioned browser can be red fox browser (Firefox), Google's browser
(GoogleChrome), 360 secure browsers etc., it is of course possible to understanding, are not limited clear in an embodiment of the present invention
Look at the particular type of device.
In an embodiment of the present invention, the function of plug-in unit (Plugins) is exactly that the function of providing third party passes through
The application in the page of embed, object label, such as Flash plug-in units, Silverlight plug-in units, Quicktime plug-in units.
It is that can increase the Add-ons of some New functions to browser to extend (Extensions).In a browser, such as it is meagre to expand
Exhibition program, mail extension program, cloud disk extender, game extender etc., these extenders can be that some are clear for increase
The window or button look on device, to extend the function of browser.
Alternatively, in an embodiment of the present invention, extension and/or the extension that is included of plug-in security configuration file and/or
The safe description information of plug-in unit includes：The letter of the level of security of extension and/or the self information of plug-in unit and extension and/or plug-in unit
Breath；
Wherein, the self information of above-mentioned extension and/or plug-in unit includes：Extension and/or plug-in unit title, extension and/or insert
The version information of part, the source of extension and/or plug-in unit, No. ID of extension and/or plug-in unit, the description information of extension and/or plug-in unit,
And the issue date of extension and/or plug-in unit.
Here, the description information of extension and/or plug-in unit which show one on 360 secure browsers as shown in Fig. 2 insert
The diagram of part " 360 mails lead to ", the title that illustrated therein is plug-in unit is " 360 mails lead to ", the version number of the plug-in unit
" 2.2.1.1125 ", the issue date (i.e. uplink time) of plug-in unit is on June 3rd, 2011, and the source of plug-in unit is 360CN, plug-in unit
Description information including the upper left corner picture and word description " reminded in time when having new mail, support 163,126, Gmail,
The mailboxes such as Sina, Sohu "
The information of the level of security of above-mentioned extension and/or plug-in unit includes：Blacklist, gray list and white list, wherein, safety
Extension and/or plug-in unit of the rank for blacklist are confirmed as the presence of potential safety hazard；Level of security is the extension of gray list and/or inserted
Part is confirmed as the presence of potential potential safety hazard；Extension and/or plug-in unit of the level of security for white list are confirmed as no risk
Security extension and/or plug-in unit.
For example, herein below can have been recorded in extension and/or plug-in security configuration file：
Above-mentioned extension and/or plug-in security configuration file have recorded extension/plug-in unit of 2 white lists, the expansion of 1 gray list
Extension/plug-in unit of exhibition/plug-in unit and 1 blacklist.
Then, in step s 130, when loading extension and/or plug-in unit in browser side, the extension and/or plug-in security
Engine is activated and calls extension and/or plug-in security configuration file, and sentences according to the safe description information of extension and/or plug-in unit
The disconnected extension being loaded and/or the security of plug-in unit.
Alternatively, in an embodiment of the present invention, the extension and/or plug-in unit being loaded in browser side include：Clear
The extension installed in current browser to be loaded and/or plug-in unit when device of looking at starts, during the use of browser
User initiates the extension installed and/or plug-in unit by the extension center of browser, be extended in browser side and/or plug-in unit more
The extension of the renewal loaded when new and/or plug-in unit and for having logged in extension of the user of browser account when account is synchronous
One or more of and/or plug-in unit.
Fig. 3 shows that extension and/or plug-in security engine judge the one of the security for the extension and/or plug-in unit being loaded
Plant implementation.
As shown in figure 3, in step S1310, when loading extension and/or plug-in unit in browser side, the extension and/or plug-in unit
Security engine is activated.
Then, in step S1320, extension and/or plug-in security are matched somebody with somebody described in the extension and/or plug-in security engine calling
Put file.The safe description information of the extension and/or plug-in unit as previously described, is drawn as the extension and/or plug-in security
Hold up occurrence used when judging the security of the extension being loaded and/or plug-in unit.
Then, in step S1330, the extension and/or plug-in security engine are according to extension and/or the safety description of plug-in unit
The extension being loaded described in information judgement and/or the security of plug-in unit.
In step S1330, the extension being loaded in browser side and/or plug-in unit for different situations, the expansion
Exhibition and/or plug-in security engine carry out security judgement and provide different judged results.
Situation one, for the extension installed in current browser to be loaded when browser starts and/plug-in unit
When browser starts, the extension and/or plug-in unit of extension and/or plug-in security engine to start-up loading are according to extension
And/or plug-in security configuration file carries out verification matching (such as fit version information, extension/plugin name, safety level information
Deng), extension and/or plug-in unit to matching then allow browser to load；For existing during unmatched occurrence, the expansion is judged
Open up and/or plug-in unit is unsafe extension and/or plug-in unit, not load.
Situation two, the extension for the extension center initiation installation that user passes through browser during the use of browser
And/or plug-in unit
In browser in use, when carrying out newly extension and/or the installation of new plug-in unit, extending and/or plug-in security engine
Need to carry out verification matching to the new extension and/or new plug-in unit according to extension and/or plug-in security configuration file in time, enter
The occurrence of row matching is foregoing extension and/or the level of security of the self information of plug-in unit and extension and/or plug-in unit
Information.Extension and/or plug-in unit for matching, are determined as safe extension and/or plug-in unit, it is allowed to which browser is loaded；For
When there is unmatched occurrence, judge that the extension and/or plug-in unit, as unsafe extension and/or plug-in unit, are not loaded.
Situation three, for the extension of renewal for being extended and/or being loaded during update of plug-in in browser side and/or plug-in unit
When browser starts extension and/or the renewal of plug-in unit, the extension of extension and/or plug-in security engine to being updated
And/or extension and/or plug-in security configuration file of the plug-in unit according to the renewal carry out verification matching, for the expansion of the renewal of matching
Exhibition and/or plug-in unit, are determined as safe extension and/or plug-in unit, it is allowed to which browser loading updates；For there is unmatched matching
Xiang Shi, judge the renewal extension and/or plug-in unit as unsafe extension and/or plug-in unit, not load.
Situation four, for having logged in the extension and/or plug-in unit of the user of browser account when account is synchronous
, when account is synchronous, there are some in the synchronous extension in browser side in the user for having logged in browser account
And/or plug-in unit, extension and/or plug-in security engine to this synchronous extension in browser side and/or plug-in unit according to the extension and/
Or plug-in unit secure configuration file carry out verification matching, extension and/or plug-in unit for matching, be determined as safe extension and/
Or plug-in unit, it is allowed to it is synchronous in browser side；For existing during unmatched occurrence, judge the extension and/or plug-in unit as uneasiness
Full extension and/or plug-in unit, then do not synchronize in browser side.
Alternatively, for a kind of any of the above described situation, when extension and/or plug-in security engine judge to be loaded in browser
Extension and/or plug-in unit be unsafe extension and/or plug-in unit when, browser startup after extension and/or plug-in management circle
Pointed out in face it is described be judged as unsafe extension and/or plug-in unit is dangerous, such as by unsafe extension and/or slotting
The icon and descriptive text of part are set to grey.Further optionally, clearly point out the extension and/or plug-in unit uneasy with red text
Entirely, it is proposed that user unloads.Again alternatively, the extension of secure match and/or plug-in unit are recommended into user to be installed.Above-mentioned functions
Can be realized by extension and/or plug-in security engine, i.e. extension and/or plug-in security engine can have to extension and/
Or the function that plug-in unit is controlled, specifically, it is mainly manifested in：Extension and/or plug-in unit for unsafe blacklist, are carried out
Automatically disabling or unloading operation, and point out user, for example, eject a window, pointed out with prompting message.For safety
White list extension and/or plug-in unit, then allow its installation and upgrade, and allow it to be connect using extra extension and/or plug-in unit
Mouth function., can be by addition, audit safe extension and/or the plug-in unit of no risk for expanded and/or plug-in security engine
The extension and/or plug-in unit are put into white list；For determining there is the extension of potential safety hazard and/or plug-in unit to be then put into black name through examination ＆ verification
Dan Zhong.
Alternatively, in embodiments of the invention, in step s 130, by the extension being loaded in browser side and/or
The self information of plug-in unit and the extension profit/or the self information of plug-in unit described in the safe description information of extension and/or plug-in unit
Matched, and obtain the information of the level of security of the extension and/or plug-in unit, extension is designated with the information of the level of security
And/or the level of security of plug-in unit, the extension that can be loaded with intuitive judgment and/or the security of plug-in unit.
Alternatively, in an embodiment of the present invention, above-mentioned by the extension being loaded in browser side and/or plug-in unit
The self information progress of self information and the extension described in the safe description information of extension and/or plug-in unit and/or plug-in unit
It can also include before the step of matching somebody with somebody, and obtain the security level information of the extension and/or plug-in unit：
Sentence in the source of the extension being loaded and/or plug-in unit according to described in extension and/or plug-in security configuration file
Whether the disconnected extension being loaded and/or plug-in unit are safe；Wherein, when extension and/or plug-in security configuration file described in will quilt
When the extension of loading and/or the source of plug-in unit are the exploitation sides of browser, extension and/or plug-in security engine judge to be loaded
Extension and/or plug-in unit be safe；
When the extension being loaded described in extension and/or plug-in security configuration file and/or the source of plug-in unit are non-clear
Look at device exploitation side's (be, for example, third party) when, then perform the extension profit/that will be loaded in browser side or plug-in unit itself
Information is matched with the corresponding informance described in extension and/or plug-in security configuration file and obtains the extension and/or plug-in unit
Security level information, judge whether the extension being loaded and/or plug-in unit pacify according to matching result and security level information
Entirely.
When judging extension and/or plug-in unit in step s 130 for extension and/or the plug-in unit of safety, then step is entered
S150.In step S150, it will be deemed as safe extension and/or plug-in unit loaded in browser side.
Alternatively, then allow to install and rise for being judged as safety or there is the extension of potential safety problem and/or plug-in unit
Level.
The method 100 of embodiments in accordance with the present invention, the browser side loading extension and/or plug-in unit can also include one
Individual or multiple optional steps, to realize extra or additional function, but these optional steps are for realizing the present invention's
It is not indispensable, the method that browser side loads extension and/or plug-in unit according to an embodiment of the invention for purpose
100 can realize the purpose of the present invention in the case of these no optional steps completely.These optional steps are not in Fig. 1
Show, but their priorities between above steps perform can by those skilled in the art according to following teachings easily
Draw.It is pointed out that unless otherwise specified, these optional steps can basis together with the execution sequence of above-mentioned steps
It is actually needed and is selected.
Alternatively, when judging extension and/or plug-in unit in step s 130 for unsafe extension and/or plug-in unit, then enter
Enter to step S170.In step S170, for being judged as unsafe extension and/or plug-in unit, the expansion after browser startup
The extension and/or plug-in unit are marked and/or reminded in exhibition and/or plug-in management interface.
Alternatively, if it is determined that unsafe extension and/or plug-in unit are the extension and/or plug-in unit installed, then exist
The scheme of the icon of the extension and/or plug-in unit and description is set to grey in extension and/or plug-in management interface, and/or with red
Color word clearly points out the extension and/or plug-in unit dangerous.
Alternatively, if it is determined that unsafe extension and/or plug-in unit are the extension and/or plug-in unit installed, extension
And/or plug-in security engine is for being judged as that unsafe extension and/or plug-in unit carry out disabling or unloading operation, and carry out automatically
The display of prompting message, such as prompting message can be " dangerous ", points out user's extension and/or plug-in unit dangerous.
Alternatively, if the extension and/or plug-in unit to be loaded in browser side are judged as unsafe extension and/or inserted
Part is linked there is provided the extension of safety and/or the installation of plug-in unit, for example, show the safe extension by a pop-up window
And/or the installation link of plug-in unit.
Fig. 4 shows the block diagram of the system of browser side loading extension and/or plug-in unit according to an embodiment of the invention.Such as
Shown in Fig. 4, it illustrates the correlation between browser side and server side.Server receives the browser that browser is uploaded
Either crash info or request browser upload exception or the crash info that browser side is produced to the exception that side is produced, its
Described in the exception that is uploaded or crash info generally include the crash reason and collapse that user fills in manually after collapse occurs
The crash data bag for the browser that operating system is obtained when bursting, here, the crash data bag is comprising which plug-in unit and/or extension
The operating system of collapse field data, browser or browser can be preliminary by being carried out to the exception or crash info
Analysis, analyze collapse plug-in unit and/or extension after report server, can also be directly by the exception or crash info
Upload onto the server, analyzed by server side be which plug-in unit, extension collapse.Here extension and/or plug-in unit is usual
It is that third party is provided.
Then, server receives the expansion that the current browser side that browser is extended and/or plug-in security engine is uploaded is used
Exhibition and/or plug-in security configuration file or its version number；Exception or crash info that server is produced according to browser side
And the extension that uses of current browser side and/or plug-in security configuration file or its version number are analyzed, and are determined
Cause the analysis result of described abnormal or collapse extension and/or plug-in unit, and analysis result is stored in matching somebody with somebody for server side
Put in library.As shown in figure 3, title, the level of security of extension and/or plug-in unit are contained in configuration file storehouse etc..
Alternatively, when browser starts or regularly by the extension of the configuration file storehouse of server side and browser side
And/or plug-in security configuration file is synchronized.As shown in figure 3, in extension and/or plug-in security configuration file, for each
Extension and/or plug-in unit, including the occurrence such as extension and/or No. ID of plug-in unit, level of security, description information.
Alternatively, enter in extension of the configuration file storehouse of server side with browser side and/or plug-in security configuration file
The data in the configuration file storehouse of server side can also be encrypted before row synchronization, for example, (be used to transmit with Base64
One of coded system of 8Bit syllabified codes) it is encrypted.
According to the second aspect of the invention, with browser side loading extension according to an embodiment of the invention as described above
And/or the method 100 of plug-in unit is corresponding, present invention also offers a kind of loading extension of browser side and/or the device of plug-in unit
500。
Fig. 5 shows the structure of the device 500 of browser side loading extension and/or plug-in unit according to an embodiment of the invention
Schematic diagram.As shown in figure 5, the device 500 includes：Setup module 510, security judge module 530 and load-on module 550.
In an embodiment of the present invention, setup module 510 is suitable to set extension and/or plug-in security engine in browser side
And the extension for the engine calling and/or plug-in security configuration file, wherein the extension and/or plug-in security configuration file
Safe description information including browser extension and/or plug-in unit.
In an embodiment of the present invention, above-mentioned browser can be red fox browser (Firefox), Google's browser
(GoogleChrome), 360 secure browsers etc., it is of course possible to understanding, are not limited clear in an embodiment of the present invention
Look at the particular type of device.The function of plug-in unit (plugins) is exactly that the function of providing third party passes through embed, object label
The application in the page, such as Flash plug-in units, Silverlight plug-in units, Quicktime plug-in units.Extend (Extensions)
It is that can increase the Add-ons of some New functions to browser.In a browser, such as meagre extender, mail extension journey
Sequence, cloud disk extender, game extender etc., these extenders can be increase window on some browsers or by
Button, to extend the function of browser.In an embodiment of the present invention, security judge module 530 is suitable in the loading of browser side
When extension and/or plug-in unit, the extension and/or plug-in security engine are activated and call the extension and/or plug-in security to match somebody with somebody
File is put, and according to the extension being loaded described in the safe description information judgement of extension and/or plug-in unit and/or the safety of plug-in unit
Property.
Alternatively, security judge module 530 is directed to the extension being loaded in browser side of different situations and/or inserted
Part, carries out security judgement and provides different judged results.
Situation one, for the extension installed in current browser to be loaded when browser starts and/plug-in unit
When browser starts, security judge module 530 to the extension of start-up loading and/or plug-in unit according to extension and/
Or plug-in security configuration file carries out verification matching (such as fit version information, extension/plugin name, safety level information
Deng), extension and/or plug-in unit to matching then allow browser to load；For existing during unmatched occurrence, the expansion is judged
Open up and/or plug-in unit is unsafe extension and/or plug-in unit, not load.
Situation two, the extension for the extension center initiation installation that user passes through browser during the use of browser
And/or plug-in unit
In browser in use, when carrying out newly extension and/or the installation of new plug-in unit, security judge module 530 needs
Verification matching, progress are carried out to the new extension and/or new plug-in unit according to extension and/or plug-in security configuration file in time
The occurrence matched somebody with somebody is foregoing extension and/or the letter of the level of security of the self information of plug-in unit and extension and/or plug-in unit
Breath.Extension and/or plug-in unit for matching, are determined as safe extension and/or plug-in unit, it is allowed to which browser is loaded；For existing
During unmatched occurrence, judge that the extension and/or plug-in unit, as unsafe extension and/or plug-in unit, are not loaded.
Situation three, for the extension of renewal for being extended and/or being loaded during update of plug-in in browser side and/or plug-in unit
When browser starts extension and/or the renewal of plug-in unit, extension that 530 pairs of security judge module is updated and/
Or extension and/or plug-in security configuration file of the plug-in unit according to the renewal carry out verification matching, for the extension of the renewal of matching
And/or plug-in unit, it is determined as safe extension and/or plug-in unit, it is allowed to which browser loading updates；For there is unmatched occurrence
When, the extension and/or plug-in unit for judging the renewal extend profit/or plug-in unit to be unsafe, not load.
Situation four, for having logged in the extension and/or plug-in unit of the user of browser account when account is synchronous
, when account is synchronous, there are some in the synchronous extension in browser side in the user for having logged in browser account
And/or plug-in unit, 530 pairs of security judge module should be in the synchronous extension in browser side and/or plug-in unit is according to the extension and/or inserts
The secure configuration file of part carries out verification matching, extension and/or plug-in unit for matching, is determined as safe extension and/or inserts
Part, it is allowed to synchronous in browser side；For existing during unmatched occurrence, judge the extension and/or plug-in unit to be unsafe
Extension and/or plug-in unit, then do not synchronize in browser side.
In an embodiment of the present invention, load-on module 550 is suitable to will be deemed as safe extension and/or plug-in unit in browser
Side is loaded.
Alternatively, in an embodiment of the present invention, the extension being loaded in browser side and/or plug-in unit include：
The extension installed in current browser to be loaded when browser starts and/or plug-in unit, the use in browser
User initiates the extension installed and/or plug-in unit by the extension center of browser, is extended and/or inserts in browser side in journey
The extension of renewal that part is loaded when updating and/or plug-in unit and for having logged in the user of browser account when account is synchronous
One or more of extension and/or plug-in unit.
Alternatively, in an embodiment of the present invention, the extension that the extension and/or plug-in security configuration file are included
And/or the safe description information of plug-in unit includes：Extension and/or the safe level of the self information of plug-in unit and extension and/or plug-in unit
Other information；Wherein, the self information of the extension and/or plug-in unit includes：Extension profit/or plug-in unit title, extension and/or insert
The version information of part, the source of extension and/or plug-in unit, No. ID of extension and/or plug-in unit, the description information of extension and/or plug-in unit,
And the issue date of extension and/or plug-in unit.
Alternatively, in an embodiment of the present invention, the security judge module 530 is further adapted in browser side
The extension being loaded and/or the self information of plug-in unit and the extension described in the safe description information of extension and/or plug-in unit
And/or the self information of plug-in unit is matched, and obtain the information of the level of security of the extension and/or plug-in unit.
Alternatively, in an embodiment of the present invention, the security judge module is further adapted for according to the extension and/or inserted
The extension being loaded described in judgement of originating of the extension being loaded and/or plug-in unit described in part secure configuration file
And/or whether plug-in unit is safe；Wherein, when the expansion being loaded described in the extension and/or plug-in security configuration file
, will quilt described in the extension and/or the judgement of plug-in security engine when the source of exhibition and/or plug-in unit is the exploitation side of the browser
The extension of loading and/or plug-in unit are safe；It is loaded when described described in the extension and/or plug-in security configuration file
Extension and/or the source of plug-in unit when being the exploitation side of the non-browser, then perform and be loaded described in browser side
Extension and/or plug-in unit self information with it is described extension and/or plug-in security configuration file described in corresponding informance carry out
The security level information of the extension and/or plug-in unit is matched and obtains, judging according to matching result and the security level information should
Whether the extension being loaded and/or plug-in unit are safe.
Alternatively, in an embodiment of the present invention, the information of the level of security includes blacklist, gray list and white name
It is single, wherein, extension and/or plug-in unit of the level of security for blacklist are confirmed as the presence of potential safety hazard, and level of security is gray list
Extension and/or plug-in unit be confirmed as the presence of potential potential safety hazard, level of security for white list extension and/or plug-in unit it is true
It is set to security extension and/or plug-in unit without risk.
Alternatively, security judge module 530 can also have following function：In the extension for judging to load in browser
And/or plug-in unit be unsafe extension and/or plug-in unit when, browser startup after extension and/or plug-in management interface in carry
It is dangerous that unsafe extension and/or plug-in unit are judged as described in showing, such as by unsafe extension and/or the figure of plug-in unit
Mark and descriptive text are set to grey.Further optionally, clearly point out the extension and/or plug-in unit dangerous with red text, it is proposed that
User unloads.Again alternatively, the extension of secure match and/or plug-in unit are recommended into user to be installed.
Alternatively, security judge module 530 can be realized by extension and/or plug-in security engine.At this moment, extend
And/or plug-in security engine can have the function being controlled to extension and/or plug-in unit, for extension and/or the control of plug-in unit
Mainly include：(1) extension for unsafe blacklist and/or plug-in unit, carry out automatically disabling or unloading operation, and point out
User, for example, eject a window, pointed out with prompting message.(2) the white list extension for safety and/or plug-in unit, then
Allow its installation and upgrade, and allow it to use extra extension and/or card i/f function.(3) for expanded and/or
Plug-in security engine audits safe extension and/or the plug-in unit of no risk, can add the extension and/or plug-in unit and be put into white name
Dan Zhong；(4) for determining there is the extension of safe hidden danger and/or plug-in unit to be then put into blacklist through examination ＆ verification.
Alternatively, security judge module 530 can also include disabled module, upgraded module, the first prompting module, second
Prompting module and installation link provide module.When security judge module 530 by extension and/or plug-in security engine come reality
Now, the disabled module, upgraded module, the first prompting module, the second prompting module and install link module is provided can be with
Extension and/or plug-in security engine are contained in, can also be independently of extension and/or plug-in security engine and with extending and/or inserting
Part security engine cooperates together.Again alternatively, disabled module, upgraded module, the first prompting module, the second prompting module,
And installation link offer module can also be independently of security judge module 530.
Wherein, disabled module be suitable to for it is described extension and/or plug-in security engine be judged as it is unsafe extension and/or
Plug-in unit carries out disabling or unloading operation automatically, and carries out the display user of prompting message, and such as prompting message can be " uneasy
Entirely " etc., point out user's extension and/or plug-in unit dangerous.
Upgraded module is suitable to then allow to install for being judged as safety or there is the extension of potential safety problem and/or plug-in unit
And upgrading.
First prompting module is suitable to for being judged as unsafe extension and/or plug-in unit, the extension after browser startup
And/or the extension and/or plug-in unit are marked and/or reminded in plug-in management interface.
It is unsafe extension and/or plug-in unit that second prompting module, which is suitable in the extension and/or plug-in unit for judging to have installed,
When, then the scheme of the icon of the extension and/or plug-in unit and description is set to grey in extension and/or plug-in management interface, and/
Or clearly point out the extension and/or plug-in unit dangerous with red text.
Link offer module is installed and is judged as uneasiness suitable for working as the extension to be loaded in browser side and/or plug-in unit
Linked when full extension and/or plug-in unit there is provided the extension of safety and/or the installation of plug-in unit, such as it is aobvious by a pop-up window
The safe extension and/or the installation of plug-in unit link are shown.
In the specification that this place is provided, numerous specific details are set forth.It is to be appreciated, however, that the implementation of the present invention
Example can be put into practice in the case of these no details.In some instances, known method, structure is not been shown in detail
And technology, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that in order to simplify the disclosure and help to understand one or more of each inventive aspect, exist
Above in the description of the exemplary embodiment of the present invention, each feature of the invention is grouped together into single implementation sometimes
In example, figure or descriptions thereof.However, the method for the disclosure should be construed to reflect following intention：It is i.e. required to protect
The application claims of shield features more more than the feature being expressly recited in each claim.More precisely, such as following
Claims reflect as, inventive aspect is all features less than single embodiment disclosed above.Therefore,
Thus the claims for following embodiment are expressly incorporated in the embodiment, wherein each claim is in itself
All as the separate embodiments of the present invention.
Those skilled in the art, which are appreciated that, to be carried out adaptively to the module in the equipment in embodiment
Change and they are arranged in one or more equipment different from the embodiment.Can be the module or list in embodiment
Member or component be combined into a module or unit or component, and can be divided into addition multiple submodule or subelement or
Sub-component.In addition at least some in such feature and/or process or unit exclude each other, it can use any
Combination is disclosed to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so to appoint
Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (including adjoint power
Profit is required, summary and accompanying drawing) disclosed in each feature can or similar purpose identical, equivalent by offer alternative features come generation
Replace.
Although in addition, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments
In included some features rather than further feature, but the combination of the feature of be the same as Example does not mean in of the invention
Within the scope of and form different embodiments.For example, embodiment claimed in detail in the claims is one of any
Mode it can use in any combination.
The present invention all parts embodiment can be realized so as to part, or with one or more processor operation
Software module realize, or realized with combinations thereof.It will be understood by those of skill in the art that can use in practice
Microprocessor or digital signal processor (DSP) come realize in browser client according to embodiments of the present invention some or
The some or all functions of person's whole part.The present invention is also implemented as perform method as described herein one
Divide or whole equipment or program of device (for example, computer program and computer program product).It is such to realize this hair
Bright program can be stored on a computer-readable medium, or can have the form of one or more signal.It is such
Signal can be downloaded from internet website and obtained, and either provided or provided in any other form on carrier signal.
It should be noted that the present invention will be described rather than limits the invention for above-described embodiment, and ability
Field technique personnel can design alternative embodiment without departing from the scope of the appended claims.Word "comprising" is not arranged
Except there is element or step not listed in the claims.Word "a" or "an" before element does not exclude the presence of many
Individual such element.The present invention can be by means of including the hardware of some different elements and by means of properly programmed calculating
Machine is realized.In if the unit claim of equipment for drying is listed, several in these devices can be by same
Hardware branch is embodied.The use of word first, second, and third does not indicate that any order.Can be by these word solutions
It is interpreted as title.
Described above is only the embodiment of the present invention, it is noted that for the ordinary skill people of this area
Member for, without departing from the spirit of the invention, can make it is some improve, modification and deform, these improve, modification,
It is regarded as in the protection domain of the application with deformation.
The embodiment of the present invention is further disclosed：
A1. a kind of method that browser side loads extension and/or plug-in unit, including：
Extension and/or plug-in security engine and the extension for the engine calling and/or plug-in unit peace are set in browser side
Full configuration file, wherein the extension and/or plug-in security configuration file include browser extension and/or the safety description of plug-in unit
Information；
When loading extension and/or plug-in unit in browser side, the extension and/or plug-in security engine are activated and call institute
Extension and/or plug-in security configuration file are stated, and is loaded according to described in the safe description information judgement of extension and/or plug-in unit
Extension and/or plug-in unit security；
It will be deemed as safe extension and/or plug-in unit loaded in browser side.
A2. the method according to A1, it is characterised in that
The extension being loaded in browser side and/or plug-in unit be included in browser start when to be loaded exist
The extension installed in current browser and/or plug-in unit, the extension center that user passes through browser during the use of browser
The extension for the renewal for initiate the extension installed and/or plug-in unit, being extended in browser side and/or loading during update of plug-in and/
Or plug-in unit and for having logged in one or more of the extension and/or plug-in unit of the user of browser account when account is synchronous.
A3. the method according to A1 or A2, it is characterised in that
The extension and/or the safe description information of plug-in unit that the extension and/or plug-in security configuration file are included include：
The information of the level of security of extension and/or the self information of plug-in unit and extension and/or plug-in unit；
Wherein, the self information of the extension and/or plug-in unit includes：Extension and/or plug-in unit title, extension and/or insert
The version information of part, the source of extension and/or plug-in unit, No. ID of extension and/or plug-in unit, the description information of extension and/or plug-in unit,
And the issue date of extension and/or plug-in unit.
A4. the method according to A3, it is characterised in that
Will quilt described in the extension and/or the extension of plug-in security engine foundation and/or the safe description information judgement of plug-in unit
The step of security of the extension of loading and/or plug-in unit, includes：
The safety of the self information of the extension being loaded in browser side and/or plug-in unit and extension and/or plug-in unit is retouched
The self information for stating the extension described in information and/or plug-in unit is matched, and obtains the safe level of the extension and/or plug-in unit
Other information.
A5. the method according to A4, it is characterised in that
In the extension that will be loaded in browser side and/or the self information of plug-in unit and extension and/or the safety of plug-in unit
The self information of the extension and/or plug-in unit described in description information is matched, and obtains the safety of the extension and/or plug-in unit
Also include before the step of class information：
The extension being loaded according to described in the extension and/or plug-in security configuration file and/or plug-in unit
Source whether safely judge the extension being loaded and/or plug-in unit；
Wherein, when the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file
Source when being the exploitation side of the browser, the extension and/or plug-in security engine judge described in the extension that is loaded
And/or plug-in unit is safe；
When coming for the extension being loaded described in the extension and/or plug-in security configuration file and/or plug-in unit
When source is the exploitation side of the non-browser, then perform by the extension being loaded in browser side and/or plug-in unit from
Body information with it is described extension and/or plug-in security configuration file described in corresponding informance matched and obtain the extension and/
Or the security level information of plug-in unit, according to matching result and the security level information judge the extension being loaded and/or
Whether plug-in unit is safe.
A6. the method according to A3, it is characterised in that
The information of the level of security includes blacklist, gray list and white list, wherein,
Extension and/or plug-in unit of the level of security for blacklist are confirmed as the presence of potential safety hazard,
Extension and/or plug-in unit of the level of security for gray list are confirmed as the presence of potential potential safety hazard,
Extension and/or plug-in unit of the level of security for white list are confirmed as security extension and/or plug-in unit without risk.
A7. the method according to any one of A1 ~ A6, it is characterised in that methods described also includes：
The extension and/or plug-in security engine are for being judged as that unsafe extension and/or plug-in unit are disabled automatically
Or unloading operation, and carry out the display of prompting message；
Then allow installation and upgrade for being judged as safety or there is the extension of potential safety problem and/or plug-in unit.
A8. the method according to any one of A1 ~ A7, it is characterised in that methods described also includes：
For being judged as unsafe extension and/or plug-in unit, extension and/or plug-in management interface after browser startup
In the extension and/or plug-in unit are marked and/or reminded.
A9. the method according to A8, it is characterised in that methods described also includes：
If it is determined that it is unsafe extension and/or plug-in unit be the extension and/or plug-in unit installed, then extension and/
Or the scheme of the icon of the extension and/or plug-in unit and description is set to grey in plug-in management interface, it is and/or bright with red text
Really point out the extension and/or plug-in unit dangerous.
Al0. the method according to any one of A1 ~ A9, it is characterised in that methods described also includes：
If it is determined that extension and/or plug-in unit that browser side to be loaded are unsafe extension and/or plug-in unit, then peace is provided
Full extension and/or the installation link of plug-in unit.
The embodiment of the present invention further discloses the device of a kind of browser side loading extensions of B11. and/or plug-in unit, including：
Setup module, suitable for setting extension and/or plug-in security engine and the expansion for the engine calling in browser side
Exhibition and/or plug-in security configuration file, wherein it is described extension and/or plug-in security configuration file include browser extend and/or
The safe description information of plug-in unit；
Security judge module, during suitable for loading extension and/or plug-in unit in browser side, the extension and/or plug-in unit peace
Full engine start simultaneously calls the extension and/or plug-in security configuration file, and according to extension and/or the safety description letter of plug-in unit
The extension being loaded described in breath judgement and/or the security of plug-in unit；
Load-on module, is loaded suitable for will be deemed as safe extension and/or plug-in unit in browser side.
B12. the device according to B11, it is characterised in that
The extension being loaded in browser side and/or plug-in unit include：To be loaded when browser starts
In the extension installed in current browser and/or plug-in unit, the extension that user passes through browser during the use of browser
The extension for the renewal that the heart initiates the extension installed and/or plug-in unit, is extended in browser side and/or loads during update of plug-in
And/or plug-in unit and for having logged in one or many in the extension and/or plug-in unit of the user of browser account when account is synchronous
It is individual.
B13. the device according to B11 or B12, it is characterised in that
The extension and/or the safe description information of plug-in unit that the extension and/or plug-in security configuration file are included include：
The information of the level of security of extension and/or the self information of plug-in unit and extension and/or plug-in unit；
Wherein, the self information of the extension and/or plug-in unit includes：Extension and/or plug-in unit title, extension and/or insert
The version information of part, the source of extension and/or plug-in unit, No. ID of extension and/or plug-in unit, the description information of extension and/or plug-in unit,
And the issue date of extension and/or plug-in unit.
B14. the device according to B13, it is characterised in that
The security judge module is further adapted for itself of the extension that will be loaded in browser side and/or plug-in unit
Information is matched with the extension described in the safe description information of extension and/or plug-in unit and/or the self information of plug-in unit, and
Obtain the information of the level of security of the extension and/or plug-in unit.
B15. the device according to B14, it is characterised in that the security judge module is further adapted for according to the extension
And/or to be added described in the extension being loaded and/or the source judgement of plug-in unit described in plug-in security configuration file
Whether the extension of load and/or plug-in unit are safe；
Wherein, when the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file
Source when being the exploitation side of the browser, the extension and/or plug-in security engine judge described in the extension that is loaded
And/or plug-in unit is safe；
When coming for the extension being loaded described in the extension and/or plug-in security configuration file and/or plug-in unit
When source is the exploitation side of the non-browser, then perform by the extension being loaded in browser side and/or plug-in unit from
Body information with it is described extension and/or plug-in security configuration file described in corresponding informance matched and obtain the extension and/
Or the security level information of plug-in unit, according to matching result and the security level information judge the extension being loaded and/or
Whether plug-in unit is safe.
B16. the device according to B13, it is characterised in that
The information of the level of security includes blacklist, gray list and white list, wherein,
Extension and/or plug-in unit of the level of security for blacklist are confirmed as the presence of potential safety hazard,
Extension and/or plug-in unit of the level of security for gray list are confirmed as the presence of potential potential safety hazard,
Extension and/or plug-in unit of the level of security for white list are confirmed as security extension and/or plug-in unit without risk.
B17. the device according to any one of B11 ~ B16, it is characterised in that described device also includes：
Disabled module, suitable for the extension and/or plug-in security engine for being judged as unsafe extension and/or plug-in unit
Carry out disabling or unloading operation, and carry out the display user of prompting message automatically；
Upgraded module, suitable for then allowing peace for being judged as safety or there is the extension of potential safety problem and/or plug-in unit
Dress and upgrading.
B18. the device according to any one of B11 ~ B17, it is characterised in that described device also includes：
First prompting module, suitable for for being judged as unsafe extension and/or plug-in unit, the extension after browser startup
And/or the extension and/or plug-in unit are marked and/or reminded in plug-in management interface.
B19. the device according to any one of B11 ~ B18, it is characterised in that described device also includes：
Second prompting module, suitable for if it is determined that the extension and/or plug-in unit that browser side to be loaded are unsafe extension
And/or plug-in unit, then the scheme of the icon of the extension and/or plug-in unit and description is set in extension and/or plug-in management interface
Grey, and/or clearly point out the extension and/or plug-in unit dangerous with red text.
B20. the device according to any one of B11 ~ B19, it is characterised in that described device also includes,
Link is installed module is provided, be judged as not suitable for the extension and/or plug-in unit to be loaded described in browser side
Linked when the extension of safety and/or plug-in unit there is provided the extension of safety and/or the installation of plug-in unit.
Claims (16)
1. a kind of browser side loading extension and/or the method for plug-in unit, methods described include：
Extension and/or plug-in security engine and the extension for supplying the engine calling and/or plug-in security is set to match somebody with somebody in browser side
File is put, browser extends and/or the safety of plug-in unit describes letter wherein the extension and/or plug-in security configuration file include
Breath；The safe description information includes the letter of the level of security of extension and/or plug-in unit self information and extension and/or plug-in unit
Breath；
When loading extension and/or plug-in unit in browser side, the extension and/or plug-in security engine are activated and call the expansion
Exhibition and/or plug-in security configuration file, and according to the expansion being loaded described in the safe description information judgement of extension and/or plug-in unit
Exhibition and/or the security of plug-in unit；
According to described in the extension and/or plug-in security configuration file the extension that is loaded and/or plug-in unit come
Whether the extension being loaded described in the judgement of source and/or plug-in unit are safe；
Wherein, coming when the extension being loaded described in the extension and/or plug-in security configuration file and/or plug-in unit
When source is the exploitation side of the browser, the extension and/or plug-in security engine judge described in the extension that is loaded and/or
Plug-in unit is safe；
When the source of the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file is
During the exploitation side of the non-browser, then perform itself letter of the extension being loaded in browser side and/or plug-in unit
Cease and matched with the corresponding informance described in the extension and/or plug-in security configuration file and obtain the extension and/or insert
The security level information of part, the extension being loaded and/or plug-in unit are judged according to matching result and the security level information
It is whether safe；And
The extension being loaded in browser side and/or the safety description of the self information of plug-in unit and extension and/or plug-in unit are believed
The self information of the extension and/or plug-in unit described in breath is matched, and obtain the level of security of the extension and/or plug-in unit
Information；
It will be deemed as safe extension and/or plug-in unit loaded in browser side.
2. according to the method described in claim 1, it is characterised in that
The extension being loaded in browser side and/or plug-in unit be included in browser start when to be loaded current
The extension installed in browser and/or plug-in unit, the extension center initiation that user passes through browser during the use of browser
The extension of installation and/or plug-in unit, the extension for the renewal for being extended in browser side and/or loading during update of plug-in and/or insert
Part and for having logged in one or more of the extension and/or plug-in unit of the user of browser account when account is synchronous.
3. method according to claim 1 or 2, it is characterised in that
The self information of the extension and/or plug-in unit includes：The version letter of extension and/or the title of plug-in unit, extension and/or plug-in unit
Breath, extension and/or the source of plug-in unit, No. ID of extension and/or plug-in unit, extension and/or description information and the extension of plug-in unit
And/or the issue date of plug-in unit.
4. method according to claim 3, it is characterised in that
The information of the level of security includes blacklist, gray list and white list, wherein,
Extension and/or plug-in unit of the level of security for blacklist are confirmed as the presence of potential safety hazard,
Extension and/or plug-in unit of the level of security for gray list are confirmed as the presence of potential potential safety hazard,
Extension and/or plug-in unit of the level of security for white list are confirmed as security extension and/or plug-in unit without risk.
5. the method according to any one of claim 1,2 or 4, it is characterised in that methods described also includes：
The extension and/or plug-in security engine are for being judged as that unsafe extension and/or plug-in unit are disabled or unloaded automatically
Operation is carried, and carries out the display of prompting message；
Then allow installation and upgrade for being judged as safety or there is the extension of potential safety problem and/or plug-in unit.
6. the method according to any one of claim 1,2 or 4, it is characterised in that methods described also includes：
It is right in the extension and/or plug-in management interface after browser startup for being judged as unsafe extension and/or plug-in unit
The extension and/or plug-in unit are marked and/or reminded.
7. method according to claim 6, it is characterised in that methods described also includes：
If it is determined that unsafe extension and/or plug-in unit are the extension and/or plug-in unit installed, are then extending and/or inserting
The scheme of the icon of the extension and/or plug-in unit and description is set to grey in part administration interface, and/or clearly carried with red text
Show that the extension and/or plug-in unit are dangerous.
8. the method according to any one of claim 1,2,4 or 7, it is characterised in that methods described also includes：
If it is determined that extension and/or plug-in unit that browser side to be loaded are unsafe extension and/or plug-in unit, then safety is provided
Extension and/or the installation of plug-in unit link.
9. a kind of browser side loading extension and/or the device of plug-in unit, described device include：
Setup module, suitable for browser side set extension and/or plug-in security engine and for the engine calling extension and/
Or plug-in security configuration file, extended and/or plug-in unit wherein the extension and/or plug-in security configuration file include browser
Safe description information；The safe description information includes the safety of extension and/or plug-in unit self information and extension and/or plug-in unit
The information of rank；
Security judge module, during suitable for loading extension and/or plug-in unit in browser side, the extension and/or plug-in security are drawn
Hold up and start and call the extension and/or plug-in security configuration file, and sentence according to the safe description information of extension and/or plug-in unit
The disconnected extension being loaded and/or the security of plug-in unit；
The security judge module is further adapted for will quilt according to described in the extension and/or plug-in security configuration file
Whether the extension and/or plug-in unit being loaded described in the extension of loading and/or the source judgement of plug-in unit are safe；
Wherein, coming when the extension being loaded described in the extension and/or plug-in security configuration file and/or plug-in unit
When source is the exploitation side of the browser, the extension and/or plug-in security engine judge described in the extension that is loaded and/or
Plug-in unit is safe；
When the source of the extension being loaded and/or plug-in unit described in the extension and/or plug-in security configuration file is
During the exploitation side of the non-browser, then perform itself letter of the extension being loaded in browser side and/or plug-in unit
Cease and matched with the corresponding informance described in the extension and/or plug-in security configuration file and obtain the extension and/or insert
The security level information of part, the extension being loaded and/or plug-in unit are judged according to matching result and the security level information
It is whether safe；
The security judge module is further adapted for the extension being loaded in browser side and/or the self information of plug-in unit
Matched, and obtained with the extension described in the safe description information of extension and/or plug-in unit and/or the self information of plug-in unit
The information of the level of security of the extension and/or plug-in unit；
Load-on module, is loaded suitable for will be deemed as safe extension and/or plug-in unit in browser side.
10. device according to claim 9, it is characterised in that
The extension being loaded in browser side and/or plug-in unit include：What is loaded when browser starts is working as
The extension installed in preceding browser and/or plug-in unit, the extension center hair that user passes through browser during the use of browser
The extension for the renewal for act the extension installed and/or plug-in unit, being extended in browser side and/or loading during update of plug-in and/or
Plug-in unit and for having logged in one or more of the extension and/or plug-in unit of the user of browser account when account is synchronous.
11. the device according to claim 9 or 10, it is characterised in that
The self information of the extension and/or plug-in unit includes：The version letter of extension and/or the title of plug-in unit, extension and/or plug-in unit
Breath, extension and/or the source of plug-in unit, No. ID of extension and/or plug-in unit, extension and/or description information and the extension of plug-in unit
And/or the issue date of plug-in unit.
12. device according to claim 11, it is characterised in that
The information of the level of security includes blacklist, gray list and white list, wherein,
Extension and/or plug-in unit of the level of security for blacklist are confirmed as the presence of potential safety hazard,
Extension and/or plug-in unit of the level of security for gray list are confirmed as the presence of potential potential safety hazard,
Extension and/or plug-in unit of the level of security for white list are confirmed as security extension and/or plug-in unit without risk.
13. the device according to any one of claim 9,10 or 12, it is characterised in that described device also includes：
Disabled module, suitable for the extension and/or plug-in security engine for being judged as that unsafe extension and/or plug-in unit are carried out
Automatic disabling or unloading operation, and carry out the display user of prompting message；
Upgraded module, suitable for for be judged as safety or there is the extension of potential safety problem and/or plug-in unit then allow to install and
Upgrading.
14. the device according to any one of claim 9,10 or 12, it is characterised in that described device also includes：
First prompting module, suitable for for being judged as unsafe extension and/or plug-in unit, extension after browser startup and/
Or the extension and/or plug-in unit are marked and/or reminded in plug-in management interface.
15. the device according to any one of claim 9,10 or 12, it is characterised in that described device also includes：
Second prompting module, suitable for if it is determined that extension that browser side to be loaded and/or plug-in unit for unsafe extension and/or
Plug-in unit, then be set to grey in extension and/or plug-in management interface by the scheme of the icon of the extension and/or plug-in unit and description,
And/or clearly point out the extension and/or plug-in unit dangerous with red text.
16. the device according to any one of claim 9,10 or 12, it is characterised in that described device also includes,
Link is installed module is provided, be judged as suitable for the extension and/or plug-in unit to be loaded described in browser side dangerous
Extension and/or link there is provided the extension of safety and/or the installation of plug-in unit during plug-in unit.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310493213.8A CN103761114B (en) | 2013-10-18 | 2013-10-18 | A kind of browser side loading extension and/or the method and device of plug-in unit |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310493213.8A CN103761114B (en) | 2013-10-18 | 2013-10-18 | A kind of browser side loading extension and/or the method and device of plug-in unit |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103761114A CN103761114A (en) | 2014-04-30 |
| CN103761114B true CN103761114B (en) | 2017-10-17 |
Family
ID=50528358
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310493213.8A Active CN103761114B (en) | 2013-10-18 | 2013-10-18 | A kind of browser side loading extension and/or the method and device of plug-in unit |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103761114B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020135129A1 (en) * | 2018-12-25 | 2020-07-02 | 中兴通讯股份有限公司 | Method and device for loading plug-in of application, and terminal |
Families Citing this family (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103677898B (en) * | 2013-11-08 | 2017-11-03 | 北京奇虎科技有限公司 | The extension of server side examination ＆ verification loading and/or the method and server of plug-in unit |
| CN104156235A (en) * | 2014-07-22 | 2014-11-19 | 北京奇虎科技有限公司 | Browser plugin and/or extension updating method and device |
| CN105260206B (en) * | 2015-10-10 | 2018-10-16 | 北京京东尚科信息技术有限公司 | Data source plug-in implementation method and server |
| CN105511909B (en) * | 2015-11-26 | 2018-09-11 | 北京奇虎科技有限公司 | Handle the method and device of plug-in unit |
| CN105430001A (en) * | 2015-12-18 | 2016-03-23 | 北京奇虎科技有限公司 | Detecting method, terminal device, server and system of APT (Advanced Persistent Threat) attack |
| CN105631328A (en) * | 2015-12-18 | 2016-06-01 | 北京奇虎科技有限公司 | Detection method and device of unknown risks of browser plugin |
| CN106919581A (en) * | 2015-12-24 | 2017-07-04 | 北京奇虎科技有限公司 | The means of defence and device of a kind of browser |
| CN106919832A (en) * | 2015-12-24 | 2017-07-04 | 北京奇虎科技有限公司 | A kind of browser side extension element management method and device |
| CN106919830A (en) * | 2015-12-24 | 2017-07-04 | 北京奇虎科技有限公司 | The generation method and device of a kind of expanding library |
| CN108427884B (en) * | 2018-03-16 | 2021-09-10 | 北京奇虎科技有限公司 | Warning method and device for webpage ore mining script |
| CN108959937A (en) * | 2018-06-29 | 2018-12-07 | 北京奇虎科技有限公司 | Plug-in unit processing method, device and equipment |
| CN112068899A (en) * | 2020-09-01 | 2020-12-11 | 北京五八信息技术有限公司 | Plug-in loading method and device, electronic equipment and storage medium |
| CN113590179B (en) * | 2021-08-02 | 2024-03-12 | 上海米哈游璃月科技有限公司 | Plug-in detection method and device, electronic equipment and storage medium |
| CN113709154B (en) * | 2021-08-25 | 2023-08-15 | 平安国际智慧城市科技股份有限公司 | Browser security processing method and device, computer equipment and storage medium |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101960446A (en) * | 2008-03-02 | 2011-01-26 | 雅虎公司 | Application based on the safety browser |
| CN102883324A (en) * | 2012-10-19 | 2013-01-16 | 广州市动景计算机科技有限公司 | Security verification method, security verification device and mobile terminal for plugin call in mobile terminal |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101510167B (en) * | 2009-03-31 | 2016-04-20 | 阿里巴巴集团控股有限公司 | A kind of method of plug-in component operation, Apparatus and system |
| CN102682014A (en) * | 2011-03-14 | 2012-09-19 | 腾讯科技（深圳）有限公司 | Open-type plug-in module management platform implemented on browser and open-type plug-in module management method |
| US9135445B2 (en) * | 2012-03-19 | 2015-09-15 | Google Inc. | Providing information about a web application or extension offered by website based on information about the application or extension gathered from a trusted site |
-
2013
- 2013-10-18 CN CN201310493213.8A patent/CN103761114B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101960446A (en) * | 2008-03-02 | 2011-01-26 | 雅虎公司 | Application based on the safety browser |
| CN102883324A (en) * | 2012-10-19 | 2013-01-16 | 广州市动景计算机科技有限公司 | Security verification method, security verification device and mobile terminal for plugin call in mobile terminal |
Non-Patent Citations (1)
| Title |
|---|
| 检测浏览器插件是否安全;震震有词;《网友世界》;20100615;第37页 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020135129A1 (en) * | 2018-12-25 | 2020-07-02 | 中兴通讯股份有限公司 | Method and device for loading plug-in of application, and terminal |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103761114A (en) | 2014-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103761114B (en) | A kind of browser side loading extension and/or the method and device of plug-in unit | |
| CN103677898B (en) | The extension of server side examination ＆ verification loading and/or the method and server of plug-in unit | |
| CN103177204B (en) | Password information tip method and device | |
| CN103595708B (en) | The browser processing method of closing, system, browser and server extremely | |
| CN105825131B (en) | A kind of computer safety start means of defence based on UEFI | |
| SA517381942B1 (en) | Systems, Methods, and Computer Medium to Enhance Redeployment of Web Applications After Initial Deployment | |
| CN105555638B (en) | The software upgrading of non-critical component in the crucial distributed system of dual safety | |
| CN106164861A (en) | For the method disposing one group of software application | |
| CN106708571A (en) | Resource file loading method and device and source file reinforcing method and device | |
| CN102236764A (en) | Method and monitoring system for Android system to defend against desktop information attack | |
| CN104036182B (en) | A kind of information processing method, reminding method, server and electronic equipment | |
| CN107291487A (en) | CONFIG.SYS amending method and system | |
| CN107656750A (en) | Update of plug-in method and device | |
| CN109063481A (en) | A kind of risk checking method and device | |
| CN109117605A (en) | A kind of method for authenticating and its device, equipment and storage medium | |
| CN104965701B (en) | Obtain the method and device of application message | |
| CN103119559B (en) | Information generating system and its method | |
| CN103677936B (en) | A kind of application version upgrade method and electronic equipment | |
| CN105740261A (en) | Processing method for uploading overdue added-value tax red-character invoice information table | |
| CN111222181B (en) | AI model supervision method, system, server and storage medium | |
| CN109032592A (en) | A kind of method that software code is shared mutually | |
| CN106657385A (en) | Plug-in calling method, plug-in management method, client side and management server | |
| CN106529222A (en) | Protection method and protection system for preventing secondary packaging and cracking of application program | |
| CN109901850A (en) | Software installation method, device, terminal and computer readable storage medium | |
| CN109753788A (en) | Integrity checking method and computer readable storage medium when kernel is run |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220726 Address after: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |
|
| TR01 | Transfer of patent right |