WO2014048186A1

WO2014048186A1 - Method and system for verifying website security

Info

Publication number: WO2014048186A1
Application number: PCT/CN2013/081632
Authority: WO
Inventors: 邓振波; 苏云琳; 贺立华; 权庆安
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2012-09-26
Filing date: 2013-08-16
Publication date: 2014-04-03
Also published as: CN102957690B; CN102957690A

Abstract

Disclosed are a method and a system for verifying website security. The method may comprise: determining login information of a user in a web scanning site; generating a class account according to the login information in the web scanning site and sending the class account back to a management control center of an enterprise-edition security product; when the management control center of the enterprise-edition security product receives a request for performing security verification on a specified website, using the class account to log in to the web scanning site to obtain a corresponding security verification result. Through the present invention, a security verification process for a web page can be simplified.

Description

Website security test method and system

The present invention relates to the field of computer technologies, and in particular, to a website security verification method and system. BACKGROUND As websites become more and more diversified, content or information is updated from time to time, and each new page or link may bring new vulnerabilities. Therefore, the security of the website is detected before going online or It is a job that must be checked every time it is updated. However, manual website detection is a big burden for users. Especially when the current website is hundreds to thousands of pages, it is almost impossible to manually perform security detection on each page. Detection tools for security testing of websites have emerged. This detection tool can comprehensively detect the security vulnerabilities in the website, identify the mainstream type of hanging horses and the hanging horse code on the market, and effectively identify sensitive, vulgar content and black chains (hidden links) in the website pages, etc. Wait. Through this detection tool, the security detection of the website can be completed conveniently and automatically, and the final detection report can visually find out whether there is a security risk in the website. Of course, the detailed security test report generally only has the permission of the webmaster or administrator, and ordinary users can only see the security score of the website. However, in the prior art, if the webmaster or administrator of the website wants to view the security information of the website, it needs to register with a special web scanning site, and the detailed scanning result can be seen after logging in, which is cumbersome. Summary of the invention

In view of the above problems, the present invention has been made in order to provide a website security verification method and a corresponding website security verification system that overcome the above problems or at least partially solve or alleviate the above problems. According to an aspect of the present invention, a website security verification method is provided, including: determining login information of a user in a web scan site; Generating a class account according to the login information in the web scanning site, and transmitting the class account to the management control center of the enterprise security product; the management control center of the enterprise security product receives the pair When the website is requested to perform security verification, the account is logged in to the web scanning site to obtain a corresponding security verification result. According to another aspect of the present invention, a website security verification system is provided, including: a login information determining unit, configured to determine login information of a user in a web scan site; and a backhaul unit, configured to be according to the webpage Scanning the login information in the site to generate a class account, and returning the class account to the management control center of the enterprise security product; the single sign-on unit, the management control center for the enterprise security product receives the pair When the website is requested to perform security verification, the account is logged in to the web scanning site to obtain a corresponding security verification result.

According to still another aspect of the present invention, a computer program comprising computer readable code causing the server to perform any of claims 1-6 when run on a server The website security verification method described.

According to still another aspect of the present invention, a computer readable medium storing the computer program according to claim 14 is provided. The beneficial effects of the present invention are: According to the website security verification method and system of the present invention, the function of the web scan can be combined with the management control center of the enterprise security product, and the login information of the user in the web scan site is generated after the account is generated. Back to the management and control center of the enterprise security product, so when logging in to the management control center of the enterprise security product, it is equivalent to logging in to the web scanning site, and then you can directly view the security verification result of the specified website. Therefore, the process of securely verifying a web page can be simplified.

The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below. DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawings: FIG. 1 shows a flow chart of a method in accordance with one embodiment of the present invention; and FIG. 2 shows a schematic diagram of a system in accordance with one embodiment of the present invention;

Figure 3 schematically shows a block diagram of a server for performing the method according to the invention;

Fig. 4 schematically shows a memory unit for holding or carrying a program code implementing a method according to the invention. Specific embodiment

The invention is further described below in conjunction with the drawings and specific embodiments.

S101: determining login information of the user in the web scanning site;

First of all, in order to facilitate the security verification of the site, in the embodiment of the present invention, the site security verification function can be combined with the enterprise security product. For ease of understanding, a brief introduction to the enterprise security product is provided.

In the traditional enterprise network environment, various security desktop products, such as anti-virus software, are accumulated on the enterprise terminal computers. These software products usually come from different vendors, cannot be managed uniformly, and occupy a large amount of system resources, which greatly affects the enterprise. Work efficiency. To solve this security problem, enterprise security products have emerged. The enterprise security product usually consists of two parts: the management control center and the security product client. The management control center is deployed on the machine of the IT staff such as the network management system. The client is installed on the PC terminal of each employee, and the management control center is the enterprise centralized. The management intranet computer has built an all-round platform, which satisfies the urgent needs of enterprises for centralized anti-virus, physical examination and patching on a unified platform.

It can be seen that the management and control center of the enterprise security product has the same thing as the site security scanning product: It is used by IT personnel such as enterprise network management, and is generally used by IT personnel such as enterprise network management. demand. In other words, in a business, The personnel who perform centralized management operations such as centralized anti-virus on all computers in the enterprise are the same as those who need to inquire about the detailed security report of the enterprise portal. Therefore, based on the above features, it is in the embodiment of the present invention. The site security scanning function can be combined with the enterprise security product to facilitate the IT staff of the enterprise network management to query the security report of the enterprise portal.

In practical applications, site security scanning can be used as a functional module of the enterprise security product. After the network administrator logs in to the management control center of the enterprise security product, the operation portal of "enterprise portal security" can be seen from the interface. .

In the specific implementation, the aforementioned "Enterprise Portal Security" function module itself is actually a web scanning site. In order to be able to query the security report of an enterprise portal website, the network management of the enterprise is also required to log in at the web scanning site. In the embodiment of the present invention, in order to facilitate the user to query the security report of the enterprise portal website, and avoid re-logging to the web scanning site every time the query is performed, a class account may be generated according to the login information of the user in the web scanning site. A class account, similar to an account's credentials, usually consists of multiple factors (eg, username, password, etc.). By returning the class account back to the management control center of the enterprise security product, the effect of single sign-on can be realized, that is, the user only logs in to the web control site by logging in to the management control center of the enterprise security product. In turn, you can directly obtain security reports from your own corporate portal without having to manually specify the login to the web scan site.

There are many ways to determine the login information of the user in the web scanning site. For example, one way may be to provide the user with an entry for registering in the web scan site (including inputting a username, a password, etc.), and after receiving the user's registration request through the web scan site registration portal, the web can be completed. Scan the registration in the site, and then based on this registration information, you can get the login information of the user in the web scanning site.

The above method of obtaining user login information by means of registration is equivalent to creating a brand new credential for the user, and in another way, the method of binding an account can be used, that is, using some existing credential, here Add new permissions based on the basis. It should be noted that, in general, a user should separately register different login information on different websites or systems. However, if the user does not want to remember too many account login information, he can directly have previously been in other systems. The registered account information is bound to the current system, so that the account information registered in other systems can be directly used to log in to the current system. For example, if a user binds his or her own login information in the instant messaging system to a forum, the user can log in directly with the login information in the instant messaging system when logging in to the forum, and so on. Therefore, in this implementation manner, the user may be provided with an interface for binding an account information, and the binding request of the user is received through the web scanning site binding portal, and the existing account related information carried in the binding request is compared with the web scanning site. Binding is performed, and then the login information of the user in the web scanning site can be obtained according to the binding result.

S102: Generate a class account according to the login information in the web scanning site, and return the class account to the management control center of the enterprise security product;

After obtaining the login information in the web scanning site, a class account can be generated and returned to the management control center of the enterprise security product for single sign-on.

S103: When the management control center of the enterprise security product receives the request for performing security verification on the specified website, the user logs in to the web scanning site to obtain a corresponding security verification result.

After the registration or binding of the above account is implemented, for the user, the request for security verification of the specified website can be initiated directly on the management control center interface of the enterprise security product, and the management control center of the enterprise security product is received. After the request, the user can automatically log in to the web scanning site according to the previously generated class account, and obtain the security verification report of the user-specified website. After the report is obtained, it can be provided to the user for presentation, or it can be returned to the requester when receiving a query request from another program, and so on.

Of course, in an actual application, only the administrator of a certain enterprise or the administrator of the enterprise portal has the right to query the detailed security verification result of the portal. Therefore, in the embodiment of the present invention, the website is inquired for the query. After the request for the security verification result, the administrator identity can also be verified first. If the verification is passed, the class account is used to log in to the web scanning site to obtain the corresponding security verification result. There are many ways to verify the identity of an administrator. For example, in one of the modes, the user may be notified to add the specified code to the specified page of the website to be verified. If the page element corresponding to the specified code (such as a picture or text, etc.) appears in the specified page, the verification is passed. . That is to say, only the website management or maintenance personnel can perform the operation of adding code to the website. Therefore, if the success can be added in the specified manner, it can be proved that the current requester is the management or maintenance personnel of the website, View the permissions for detailed security verification results.

Alternatively, in another mode, the user may be notified to download the special file to the specified website, and the special file is uploaded to the website to be inquired. If the special file appears in the website to be verified, the verification is passed. Similar to the first method, generally only the management or maintenance personnel of the website have the authority to add a file to the website. The information displayed completes the operation of adding a file to the website, and the executor of the operation (ie, the requesting party of the query) has the right to query the detailed security verification result of the website.

The first verification method described above is equivalent to the way of code verification, and the second verification method is equivalent to the file verification method. In addition, it can also be implemented by means of customer service verification. For example, the user is prompted to post their own login ID in the instant messaging (IM) system on the page of the website to be verified, and use the ID to send some specified information (such as verification URL, login mailbox, etc.) to a specified ID. Alternatively, the user may be notified that if the website to be verified obtains the official certification of a Weibo website, the user may be authenticated by the user to pay attention to a specified Weibo, and the official authentication microblog will send information such as the website to be verified. To the specified Weibo, if the operation is successful, it can prove that the current operator has the administrator status and has the right to obtain detailed security verification results.

In summary, in the embodiment of the present invention, the function of the web scan can be combined with the management control center of the enterprise security product, and the login information of the user in the web scan site is generated into an account, and then returned to the management of the enterprise security product. The control center, in this way, when logging in to the management control center of the enterprise security product, it is equivalent to logging in to the web scanning site, and then directly viewing the security verification result of the specified website. Therefore, the process of securely verifying the webpage can be simplified.

Corresponding to the website security verification method provided by the embodiment of the present invention, the embodiment of the present invention further provides a website security verification system. Referring to FIG. 2, the system may include:

The login information determining unit 201 is configured to determine login information of the user in the web scanning site;

The returning unit 202 is configured to generate a class account according to the login information in the web scanning site, and return the class account to the management control center of the enterprise security product; the single sign-on unit 203, When the management control center for the enterprise security product receives the request for performing security verification on the specified website, the user logs in to the web scanning site to obtain the corresponding security verification result.

In a specific implementation, the login information determining unit 201 may include:

a registration subunit, configured to receive a registration request of the user through the web scan site registration portal, and complete registration in the web scan site;

The first determining subunit is configured to determine, according to the registration information, the login information of the user in the web scanning site.

Alternatively, in another implementation manner, the login information determining unit 201 may include: a binding subunit, configured to receive a binding request of the user through the web scanning site binding entry, and bind the existing account related information carried in the binding request to the web scanning site; The login information of the user in the web scan site is determined according to the binding result.

In practical applications, the system may further include:

An authentication unit, where the management control center for the enterprise security product receives the request for performing security verification on the specified website, and then verifies the viewing right of the user;

And a triggering unit, configured to trigger, when the verification is passed, the step of logging in to the web scanning site by using the account to acquire a corresponding security verification result.

The identity verification unit includes:

a first notification subunit, configured to notify the user to add the specified code to the specified page of the website to be verified;

a first verification subunit, configured to pass the page element corresponding to the specified code in the specified page.

Alternatively, the identity verification unit may also include:

a second notification sub-unit, configured to notify the user to download a special file to the specified website, and upload the special file to the website to be queried;

a second verification subunit, configured to pass the verification if the special file appears in the website to be verified.

In the above system provided by the embodiment of the present invention, the function of the web scan can be combined with the management control center of the enterprise security product, and the login information of the user in the web scan site is generated into an account, and then transmitted back to the enterprise version. The management and control center of the security product, in this way, when logging in to the management control center of the enterprise security product, it is equivalent to logging in to the web scanning site, and then directly viewing the security verification result of the specified website. Therefore, the process of securing the security of the webpage can be simplified. The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the functionality of a microprocessor or digital signal processor (DSP) may be used in practice. The invention may also be embodied as a device or device program (eg, a computer program and a computer program) for performing some or all of the methods described herein. Product). Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form. Device, such as an application server. The server conventionally includes a processor 310 and a computer program product or computer readable medium in the form of a memory 320. Memory 320 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. The memory 320 has a memory space 330 for program code 331 for performing any of the method steps described above. For example, storage space 330 for program code may include various program code 331 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to FIG. The storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 320 in the server of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 33, i.e., code that can be read by a processor, such as 310, which, when executed by a server, causes the server to perform various steps in the methods described above.

"an embodiment," or "one or more embodiments" as used herein means that the particular features, structures, or characteristics described in connection with the embodiments are included in at least one embodiment of the invention. In addition, it is noted that the phrase "in one embodiment" herein does not necessarily refer to the same embodiment.

Numerous specific details are set forth in the description provided herein. However, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of the specification.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to limit the scope of the invention, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or the steps in the claims. The word "a" or "an" preceding the <RTIgt; The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected primarily for the purpose of readability and teaching, and is not intended to be interpreted or limited. Therefore, many modifications and variations will be apparent to those of ordinary skill in the art. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

Rights request

1. A website security 3 full certificate method, including: determining the user's login information in the web scanning site; generating a class account based on the login information in the web scanning site, and returning the class account to The management and control center of the enterprise version security product; When the management control center of the enterprise version security product receives a request for security verification of the designated website, it uses the class account to log in to the web scanning site to obtain the corresponding security verification. result.

2. The method of claim 1, wherein determining the user's login information in the web scanning site includes the steps of: receiving the user's registration request through the web scanning site registration portal, and completing the registration in the web scanning site; according to The registration information determines the user's login information in the web scanning site.

3. The method of claim 1, wherein determining the user's login information in the web scanning site includes the steps of: receiving the user's binding request through the web scanning site binding portal, and binding the existing account carried in the binding request. The relevant information is bound to the web scanning site; and the user's login information in the web scanning site is determined according to the binding result.

4. The method according to any one of claims 1 to 3, after the management control center of the enterprise version security product receives a request for security verification of the designated website, it further includes the step of: verifying the user's viewing authority; If the verification is passed, the step of logging in to the web scanning site using the class account to obtain the corresponding security verification result is triggered.

5. The method of claim 4, wherein verifying the user's viewing authority includes the steps: Notify the user to add the specified code to the specified page of the website to be verified; if the page element corresponding to the specified code appears in the specified page, the verification is passed.

6. The method of claim 4, wherein the verification of the user's viewing authority includes the steps of: notifying the user to download a special file from a designated website, and uploading the special file to the website to be queried; if the to-be-queried website If the special file appears in the verification website, the verification is passed.

7. A website security verification system, including: a login information determination unit, used to determine the user's login information in the web scanning site; a return unit, used to generate a class based on the login information in the web scanning site account, and transmit the account number back to the management control center of the enterprise version security product; a single sign-on unit, used when the management control center of the enterprise version security product receives a request for security verification of the designated website , use the said account to log in to the web scanning site to obtain the corresponding security verification result.

8. The system of claim 7, the login information determination unit includes: a registration subunit, configured to receive a user's registration request through a web scanning site registration portal, and complete registration in the web scanning site; first The determination subunit is used to determine the user's login information in the web scanning site based on the registration information.

9. The system of claim 7, the login information determination unit includes: a binding subunit, configured to receive the user's binding request through the web scanning site binding portal, and convert the existing account carried in the binding request The relevant information is bound to the web scanning site; the second determination subunit is used to determine the user's login information in the web scanning site according to the binding result.

10. The system according to any one of claims 7 to 9, further comprising: The identity verification unit is used to verify the user's viewing permissions after the management control center of the enterprise version security product receives a request for security verification of the designated website; the triggering unit is used to trigger the utilization if the verification is passed. The step of logging in to the web scanning site with the account type to obtain corresponding security verification results.

11. The system according to claim 10, the identity verification unit includes: a first notification subunit, used to notify the user to add the specified code to the specified page of the website to be verified; a first verification subunit, used if If the page element corresponding to the specified code appears in the specified page, then all certificates 3 are passed.

12. The system according to claim 10, the identity verification unit includes: a second notification subunit, used to notify the user to download a special file from a designated website, and upload the special file to the website to be queried; The second verification subunit is used to pass the verification if the special file appears in the website to be verified.

13. A computer program, including computer readable code, which when the computer readable code is run on a server, causes the server to execute the website security verification method according to any one of claims 1-6.

14. A computer-readable medium in which the computer program according to claim 13 is stored.