TW201917595A - Cloud safety network browsing method and system - Google Patents

Abstract

A cloud safety network browsing method and system are provided. A user sends a URL request through a browser. A proxy server determines whether the URL is the address in a trust intra network list. If so, the intra resource can be accessed. If not, a connection of VPN would be established, and a cloud virtual browser is operated based on a virtualization technique, such that the browser can obtain page content of the distrust URL request and present a screen of the page content on the browser, to protect safety of the intra enterprise environment. In addition, the user can download a purified document file in the external environment or provide the same to intra enterprise environment.

Description

Cloud security network browsing method and system

The present invention relates to a security technology, and in particular to a cloud security network browsing method and system.

With the rapid development of technology, various types of enterprises or companies and even the general public have computer hosts to assist users in their work, information, or entertainment. For the network security of enterprises or companies, although people have been accustomed to using the web browser on the computer to connect to the Internet to obtain relevant resources, there are still many resources inside the enterprise that need special protection and must not be allowed to obtain freely. . Although most enterprises have firewalls to block abnormal connections, in recent years, malicious programs have been frequently transmitted, and the firewall mechanism alone is not enough to isolate the internal network from the outside world. It can be seen that how to enable users to browse the web and protect the internal resources of the enterprise is the information security issue and technology that all enterprises value.

In view of this, the present invention provides a cloud security network browsing method and system, which executes and presents an external Internet webpage through a cloud virtual browser, thereby ensuring the security of internal resources and realizing the isolation between internal and external networks.

The cloud Anyuan web browsing system of the invention comprises a proxy server and a cloud virtual browser server. The proxy server determines whether the desired connection URL is related to internal resources. If the desired connection URL is not related to internal resources, the proxy server establishes a virtual private network (VPN) to connect to the cloud virtual browser. The cloud virtual browser server runs the cloud virtual browser based on the virtualization technology, and controls the cloud virtual browser to perform the browsing operation of the desired connection URL via the virtual private network.

The cloud security network browsing method of the present invention comprises the following steps. Determine if the desired connection URL is related to internal resources. If the desired connection URL is not related to internal resources, create a virtual private network to connect to the cloud virtual browser. The cloud virtual browser is run based on the virtualization technology, and the cloud virtual browser is controlled to perform the browsing operation of the desired connection URL via the virtual private network.

Based on the foregoing, in the embodiment of the present invention, the web address requirement of the non-access internal resource is performed by the cloud virtual browser via the virtual private network, so that the internal and external network environments are isolated, and the external malicious program can only be virtualized in the cloud. The implementation of the device does not affect the internal network, ensuring the security of the internal resources of the enterprise.

The above described features and advantages of the invention will be apparent from the following description.

1 is a schematic diagram of a cloud secure network browsing system 1 in accordance with an embodiment of the present invention. Referring to FIG. 1, the cloud security network browsing system 1 includes a computer host 20, a proxy server 30, an internal database 40, a firewall and a VPN server 50, a cloud virtual browser server 60, a springboard server 70, and a file cleaning gate. Road 90.

The host computer 20 can be a networked electronic device such as a desktop computer, a notebook computer, a mobile phone, a tablet computer, a smart TV, etc., which can run a web browser (for example, chrome, Firefox, Internet Explore, etc.).

The proxy server 30 can be an electronic device of various types of servers, personal computers, workstations, and the like. In this embodiment, the proxy server 30 includes an intranet whitelist determination module 31 and a VPN client connection module 32.

The internal database 40 can be a network attached storage device (Network Attached Storage), a server, a personal computer, etc. with an internal storage space 41 (for example, a hard disk drive, a solid-state drive, or Electronic device similar to the component). It should be noted that the host computer 20, the proxy server 30, and the internal database 40 are located in the internal network 10.

The firewall and VPN server 50 can be connected to electronic devices such as gateway devices, servers, and network access devices. In this embodiment, the proxy server 30 includes a VPN connection status notification module 51. The firewall and VPN server 50 is located between the internal network 10 and the external network.

The cloud virtual browser server 60 can be an electronic device of various types of servers, personal computers, workstations, and the like. In this embodiment, the cloud virtual browser server 60 includes a virtual resource pool management and adjustment module 61, a virtual resource pool 62, one or more cloud virtual browsers 63, and a download file management module 64.

The springboard server 70 can be an electronic device of various types of servers, personal computers, workstations, and the like. In this embodiment, the springboard server 70 includes a cloud virtual browser selection and connection module 71 and a cloud virtual browser internet screen presentation module 72.

The file cleaning gateway 90 can be an electronic device such as a gateway device, a server, or a network access device. In the present embodiment, the file cleaning gateway 90 includes a file cleaning module 91. The file cleanup gateway 90 is located between the internal network 10 and the external network.

It should be noted that the software modules recorded by the proxy server 30, the firewall and VPN server 50, the cloud virtual browser server 60, the springboard server 70, and the file cleaning gateway 90 are composed of, for example, a CPU and a microcontroller. A processor such as a chip is loaded and executed, and its detailed operation is detailed in the subsequent embodiments. In addition, the proxy server 30, the firewall and VPN server 50, and the file clearing gateway 90 may be integrated into a single device or a plurality of devices as a software module, and the present invention is not limited thereto.

In order to facilitate the understanding of the operation flow of the embodiment of the present invention, the operation of the cloud security network browsing system 1 in the embodiment of the present invention will be described in detail below. FIG. 2 is a flowchart illustrating a cloud security network browsing method according to an embodiment of the invention. Referring to FIG. 2, the method of this embodiment is applicable to each device in the cloud security network browsing system 1 of FIG. Hereinafter, the methods and embodiments of the cloud security network browsing system 1 will be described with reference to the methods described in the embodiments of the present invention. The various processes of the method can be adjusted accordingly according to the implementation situation, and are not limited thereto.

When there is a need for external web browsing within the enterprise, the web browser on the host computer 20 accepts the desired connection URL input by the user, and sends a request for the global resource locator (URL), and the URL request will be sent. Go to proxy server 30. It is judged by the proxy server 30 whether or not the desired connection URL is associated with the internal resource stored in the internal storage space 41 (step S210). The intranet whitelist determination module 31 determines whether the desired connection URL exists in the URL recorded in the trusted intranet whitelist (for example, the link in the internal storage space 41). If it exists in the trusted intranet whitelist, the host computer 20 can directly access the internal resources stored in the internal storage space 41 of the internal repository 40 (step S220).

If it does not exist in the trusted intranet whitelist, the web browser running by the computer host 20 will launch the VPN client connection module 32, and use the web browser to establish a VPN dial-up connection to the firewall and VPN server 50. After the VPN connection is successful, the VPN connection status notification module 51 provides the VPN status change list information to the virtual resource pool management and adjustment module 61 in the cloud virtual browser server 60. The cloud virtual browser resource pool management and adjustment module 61 performs the cloud virtual browser resource adjustment operation of the virtual resource pool 62 on the Docker or the virtual platform based on the virtualization technology based on the inventory information. After the VPN dial-up connection is successful, the firewall and VPN server module 50 will dynamically dispatch firewall rules, so that the web browser of the host computer 20 is connected to the cloud virtual browser Internet screen presentation mode in the springboard server module 70. Group 72. The cloud virtual browser selection and connection module 71 randomly selects any cloud virtual browser 63 that has not been used in the virtual resource pool 62 to connect (step S230).

Then, the cloud virtual browser 63 can receive operation information of a keyboard and a mouse mouse or other input device (for example, a touchpad, a tablet, a joystick, etc.) on the host computer 20 to obtain a URL request typed by the user, and the cloud The virtual browser 63 can obtain the page content of the URL request from the Internet 80, and perform the browsing job presentation of the URL request content through the cloud virtual browser Internet screen presentation module 72, so that the cloud virtual browser 60 can execute the computer. The browsing operation of the host 20 to connect to the web site (for example, scrolling a web page, clicking a web page, filling in a message, etc.) (step S240). In other words, the host computer 20 only performs the acquisition of the web page and the input operation, and the actual browsing operation is all performed by the cloud virtual browser 60.

When the host computer 20 wants to use the user interface of the cloud virtual browser 63 to download the required file, the download file management module 64 determines whether the file type is in the file white list (for example, doc, pdf, etc.); If the file is not in the white list of the file, the download file management module 64 deletes or quarantines the file, so that the file cannot be transferred to the host computer 20; if it exists in the file white list, the downloaded file is transmitted to the file clearing gateway. 90. The file cleaning module 91 filters out malicious programs, objects, and grammars in the file, and stores the cleaned files in the internal storage space 41, so that the web browser running on the host computer 20 inputs a specific URL and enters the internal storage. The space 41 is used to obtain a cleaned file.

In order to make the reader more aware of the operation of the embodiment of the present invention, a contextual example is described below. It should be noted that the parameters or steps mentioned in the context example may be adjusted by themselves, without departing from the spirit of the invention of the foregoing embodiments.

The internal user of the enterprise executes the internal browser of the enterprise through the host computer 20 to send a URL request, and the URL request is sent to the proxy server 30. Assuming that the URL request submitted by the user is 〝tw.yahoo.com, the intranet whitelist judgment module 31 of the proxy server 30 determines that 〝tw.yahoo.com is not in the intranet whitelist, indicating that The URL is an untrusted external request, and a reminder page will be presented on the internal browser of the enterprise to present the user's "tw.yahoo.com as an unknown URL domain" warning slogan, and provide a "VPN dial-up connection cloud" on the reminder page. The "Virtual Browser" button allows the user to dial in to connect to the VPN.

If the user still wants to browse the content, click the button of "VPN broadcast number to connect to the cloud virtual browser" on the reminder page. The host computer 20 can connect to the firewall and VPN server through the VPN client connection module 32. 50.

After the VPN dial-up connection is successful, the VPN connection status notification module 51 will automatically transmit the VPN status change information to the cloud virtual browser resource pool management and adjustment module 61 in the cloud virtual browser server 60. The cloud virtual browser resource pool management and adjustment module 61 performs the cloud virtual browser resource adjustment operation of the cloud virtual browser resource pool 62 on the Docker or the virtual platform according to the VPN state change information. In addition, while the VPN broadcast connection is successful, the firewall and VPN server module 50 also dynamically dispatch firewall rules, so that the host computer 20 is connected to the cloud virtual browser Internet screen presentation module in the springboard server module 70. 72. In addition, the cloud virtual browser selection and connection module 71 connects any unused cloud virtual browser 63 in the randomly selected virtual resource pool 62, and the cloud virtual browser receives the URL request entered by the user, and will be connected to the Internet. The content of the page requested by 〝tw.yahoo.com is obtained on the network 80, and the webpage screen is presented by the cloud virtual browser Internet screen presentation module 72, so that the internal browser of the enterprise can present the request of the cloud virtual browser 63. .yahoo.com〞 page content.

On the other hand, suppose the user needs to download the document.docx file on the page to the inside of the enterprise, and download the document.docx file to the single directory on the page. The download file management module 64 will monitor the change of the single directory file. State. After downloading the file management module 64, the new file 〝document.docx〞 is found, and the document.docx is determined to be a general file file, and then the document.docx file is transmitted to the file cleaning gateway 90, which is filtered by the file cleaning module 91. After the malicious dynamic program syntax, the cleaned file 〝purified-document.docx〞 is stored in the internal storage space 41.

If the user wants to obtain the cleaned file file, the URL request of the internal network storage space can be submitted through the host computer 20, and the URL request is sent to the proxy server 30. The intranet whitelist judging module 31 of the proxy server 30 determines that the URL of the internal network storage space is in the trusted intranet whitelist, indicating that the URL is related to the internal resource, and the computer host 20 can directly browse and access. The cleaned file of the internal storage space of the enterprise 〝purified-document.docx〞.

In summary, the embodiment of the present invention provides an enterprise cloud security network browsing system, which has the following features. Isolating the internal and external environment of the enterprise, so that external malicious programs can only be executed in the cloud virtual browser, which can ensure the internal resources of the enterprise. All content or files that do not trust the external URL page can only be executed on the cloud virtual browser to protect the resources in the enterprise from the external environment. Internal users can only connect to the springboard browser through the HyperText Transfer Protocol (HTTP) protocol to present the web content of the cloud virtual browser. The rest of the external connections are forbidden, ensuring the internal resources of the enterprise and avoiding enterprise connections. To an external relay station. The cloud virtual browser selection and connection module can quickly select and connect to the cloud virtual browser in the virtual resource pool. During the VPN connection, any cloud virtual browser in the virtual resource pool is randomly selected, and the cloud virtual browser renders the content of the untrusted external URL page. Even if it is threatened by malicious attack, the next time it reconnects, For the sake of security, you have never used a cloud virtual browser to ensure that every time you use the cloud virtual browser is safe. The malicious dynamic grammar of the file file is removed and the file file downloaded by the cloud virtual browser is filtered out by the file cleaning module to filter out the malicious dynamic program grammar, and the purified file is transmitted and stored in the internal storage space of the enterprise, ensuring that all the external network is provided. The roads entering the company's internal file files are safe and sound.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and any one of ordinary skill in the art can make some changes and refinements without departing from the spirit and scope of the present invention. The scope of the invention is defined by the scope of the appended claims.

1‧‧‧Cloud Security Network Browsing System

20‧‧‧Computer host

30‧‧‧Proxy server

31‧‧‧Intranet Whitelist Judgment Module

32‧‧‧Virtual Private Network Client Connection Module

40‧‧‧Internal database

41‧‧‧Internal storage space

50‧‧‧Firewall and virtual private network server

51‧‧‧Virtual Private Network Connection Status Notification Module

60‧‧‧Cloud virtual browser server

61‧‧‧Virtual Resource Pool Control and Adjustment Module

62‧‧‧Virtual Resource Pool

63‧‧‧Cloud virtual browser

64‧‧‧Download file management module

70‧‧‧springboard server

71‧‧‧Cloud virtual browser selection and connection module

72‧‧‧Cloud virtual browser Internet screen rendering module

80‧‧‧Internet

90‧‧‧File clearing gateway

91‧‧‧File Purification Module

S210~S240‧‧‧Steps

1 is a schematic diagram of a cloud security network browsing system according to an embodiment of the invention. 2 is a flow chart of a cloud security network browsing method according to an embodiment of the invention.

Claims (10)

A cloud security network browsing system, comprising: a proxy server, determining whether a desired connection URL is related to an internal resource, and if the desired connection URL is not related to the internal resource, establishing a virtual private network (Virtual Private Network, VPN) to connect to a cloud virtual browser; and a cloud virtual browser server, running the cloud virtual browser based on a virtualization technology, and controlling the cloud virtual browser via the virtual private The network performs a browsing operation of the desired connection URL. The cloud security network browsing system of claim 1, wherein the proxy server records a trusted intranet whitelist, and the proxy server determines whether the desired connection URL exists in the trusted intranet. In the list, it is determined whether the website URL of the website is related to the internal resource. The cloud security network browsing system described in claim 1 further includes: a springboard server, selecting any unused cloud virtual browser in the virtual resource pool to connect, and presenting the browsing operation. Picture. The cloud security web browsing system of claim 1, wherein the cloud virtual browser server records a file whitelist, and the cloud virtual browser server determines whether the file downloaded by the cloud virtual browser is Exists in the white list of the file; if it exists in the white list of the file, the malicious program, object and grammar in the file downloaded by the cloud virtual browser are filtered out; if not in the white list of the file, Delete the file downloaded by the cloud virtual browser. The cloud security web browsing system of claim 1, wherein if the desired connection URL is related to the internal resource, the proxy server accesses the internal resource based on the desired connection URL. A cloud security network browsing method includes: determining whether a desired connection URL is related to an internal resource; if the desired connection URL is not related to the internal resource, establishing a virtual private network to connect to a cloud virtual browser; and running the cloud virtual browser based on a virtualization technology, and controlling the cloud virtual browser to perform the browsing operation of the desired connection URL via the virtual private network. The cloud security network browsing method of claim 6, wherein determining whether the desired connection URL is related to the internal resource comprises: determining whether the desired connection URL exists in a trusted intranet whitelist. in. The cloud security network browsing method of claim 6, wherein controlling the cloud virtual browser to perform the browsing operation of the desired connection URL via the virtual private network comprises: selecting any one of the virtual resource pools The cloud virtual browser that is not used is connected; and the screen of the browsing job is presented through the selected cloud virtual browser. The cloud security network browsing method of claim 6, wherein controlling the cloud virtual browser to perform the browsing operation of the desired connection URL via the virtual private network comprises: determining the cloud virtual browser Whether the downloaded file exists in the white list of the file; if it exists in the white list of the file, the malicious program, the object and the grammar in the file downloaded by the cloud virtual browser are filtered out; and if it does not exist in the file In the white list, the file downloaded by the cloud virtual browser is deleted. The cloud security network browsing method of claim 6, wherein determining whether the desired connection URL is related to the internal resource further comprises: if the desired connection URL is related to the internal resource, Accessing the internal resource based on the desired connection URL.