WO2017036220A1 - 网络安全存储方法和装置 - Google Patents

网络安全存储方法和装置 Download PDF

Info

Publication number
WO2017036220A1
WO2017036220A1 PCT/CN2016/084909 CN2016084909W WO2017036220A1 WO 2017036220 A1 WO2017036220 A1 WO 2017036220A1 CN 2016084909 W CN2016084909 W CN 2016084909W WO 2017036220 A1 WO2017036220 A1 WO 2017036220A1
Authority
WO
WIPO (PCT)
Prior art keywords
window
storage area
secure
created
rendering process
Prior art date
Application number
PCT/CN2016/084909
Other languages
English (en)
French (fr)
Inventor
徐华荣
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2017036220A1 publication Critical patent/WO2017036220A1/zh
Priority to US15/728,332 priority Critical patent/US10915646B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/80—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in storage media based on magnetic or optical technology, e.g. disks with sectors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/0604—Improving or facilitating administration, e.g. storage management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0629—Configuration or reconfiguration of storage systems
    • G06F3/0631—Configuration or reconfiguration of storage systems by allocating resources to storage systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a network security storage method and apparatus.
  • Embodiments of the present invention provide a network security storage method and apparatus to improve browser security.
  • a network security storage method applied to a client browser including:
  • a window is created for the client, and a storage area is created or allocated for the window, and a correspondence between the window and the storage area is established;
  • a rendering process is newly created or allocated for the window, and a storage area corresponding to the window to which the rendering process belongs is determined according to the established correspondence, and the storage service is provided for the rendering process by using the determined storage area.
  • a device for implementing secure network storage comprising:
  • a window module configured to create a window for the client when the client requests the new window, and create or allocate a storage area for the window, and establish a correspondence between the window and the storage area;
  • a rendering process module configured to create or allocate a rendering process for the window, determine a storage area corresponding to the window to which the rendering process belongs according to the established correspondence, and use the determined storage area to provide a storage service for the rendering process.
  • a device for implementing secure network storage comprising:
  • a memory coupled to the processor
  • the memory stores machine readable instructions, and the processor executes the machine readable instructions to perform the following operations:
  • a window is created for the client, and a storage area is created or allocated for the window, and a correspondence between the window and the storage area is established;
  • a rendering process is newly created or allocated for the window, and a storage area corresponding to the window to which the rendering process belongs is determined according to the established correspondence, and the storage service is provided for the rendering process by using the determined storage area.
  • a client creates a window while creating or allocating a storage area, and records a correspondence between the window and the storage area, so that the rendering process of some windows can be different.
  • the storage area provides storage services for secure network storage on the same browser. In this way, when the user needs to perform sensitive data operations, the created window can be corresponding to a separate storage area, which effectively avoids the attack behavior by using the stored data of the browser, and provides a safer and more stable browsing experience environment for the user. .
  • FIG. 1 is a schematic diagram of a process storage model in the embodiment of the present application.
  • 2A-2C are schematic diagrams of a process storage model in an embodiment of the present application.
  • FIG. 3 is a flowchart of a network security storage method according to an embodiment of the present application.
  • FIG. 4 is a flowchart of a network security storage method according to another embodiment of the present application.
  • FIG. 5 is a flowchart of a network security storage method according to another embodiment of the present application.
  • FIG. 6 is a structural diagram of an apparatus for implementing network secure storage according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a composition of a network security storage device according to an embodiment of the present application.
  • Figure 1 is a schematic diagram of a process storage model. As shown in Figure 1, the browser only creates a non-secure storage area for the client. The cache service of all rendering processes in the browser is implemented by the non-secure storage area. The rendering process in Figure 1, the data that needs to be stored in the rendering process 2 are all stored in the non-secure storage area. The inventor of the present application found in the process of exploring the present application that when the user performs sensitive data operations on the client of FIG. 1, some important data caches are also saved by the non-secure storage area, which increases the adoption. The risk of storing data for web attacks.
  • the embodiment of the present application proposes a technical solution.
  • a window is created, and a storage area is created or allocated for the created window, and a correspondence between the window and the storage area is established; and a rendering process is created or allocated for the window, according to the established
  • the corresponding relationship determines a storage area corresponding to the window to which the rendering process belongs, and uses the determined storage area to provide a storage service for the rendering process.
  • the technical solution provided by the embodiments of the present application enables the rendering process of some windows to provide storage services by different storage areas, thereby achieving the purpose of secure network storage on the same browser, effectively reducing the risk of being attacked by storing data. .
  • FIG. 2A is a schematic diagram of a process storage model according to an embodiment of the present invention. As shown in FIG. 2A, the browser creates a non-secure storage area 210 and a secure storage area 212 for the client (you can continue to create a secure storage area according to actual needs).
  • the user when a user wants to perform a webpage news browsing, the user first requests a new non-secure window through the client, and the browser creates a non-secure window 241 and a non-secure storage area 240 for the client.
  • the browser creates a new non-secure window 242 for the user terminal, and creates a new rendering process for the new non-secure window 242, or assigns a new rendering process for other non-secure windows to the new one.
  • the non-secure window is multiplexed, and all cached data generated when the user browses the webpage through the new or assigned rendering process for the new non-secure window 242 is saved in the previously created non-secure storage area 240; when the user wants to perform
  • the client requests a new security window, and the client
  • the browser creates a security window 261 and a corresponding secure storage area 260 for the client, and creates a new rendering process for the security window 261, so that the user stores the information such as the account of the online banking operation for the newly created rendering process of the security window 261 in the secure storage.
  • area 260 In area 260.
  • the client's browser creates a security window 282 and a security window 292 for the client, and a corresponding secure storage area 280 and secure storage area 290, and creates a new rendering process A for the security window 282.
  • a new rendering process B is created for the security window 292, so that the user logs in to QQ1 through the rendering process A established for the security window 282, and stores related information in the secure storage area 280, and logs in to QQ2 through the rendering process B of the security window 292, and The related information is stored in the secure storage area 290; alternatively, the secure window 282 multiplexes the rendering process C, the secure window 292 multiplexes the rendering process D, and the rendering process C and the rendering process D are respectively two different security windows before the browser (The two different security windows are neither the security window 282 nor the security window 292) the rendering process is established, and the user multiplexes the rendering through the secure window 282.
  • the process C logs in to the QQ1, stores the related information in the secure storage area 280, logs in to the QQ2 through the rendering process D multiplexed by the security window 292, and stores the related information in the secure storage area 290, so that multiple QQ accounts can be implemented. Simultaneous login on the browser, and also ensure the security of the data of the multiple QQ accounts.
  • the secure storage area is isolated from the non-secure storage area.
  • the secure storage area is invisible, and only the secure storage area corresponds to the security.
  • the rendering process of the window can access the data of the secure storage area, and the non-secure window or other rendering process of the other security window does not have access to the data in the secure storage area. Therefore, the technical solution of the embodiment of the present application improves the secure storage area.
  • the security of the data is the data of the secure storage area.
  • FIG. 3 is a flowchart of a network security storage method according to an embodiment of the present disclosure.
  • the technical solution of the embodiment of the present application is applied to a browser of a client, where the client refers to a terminal device having a data calculation processing function. , including but not limited to (smartphones, PDAs, tablets, smart TVs, personal PCs, etc.).
  • Operating systems are installed on these communication terminals, including but not limited to: Android operating system, Symbian operating system, Windows mobile operating system, and Apple iPhone OS operating system.
  • Step 301 When it is detected that the client requests a new window, create a window for the client, and create or allocate a storage area for the window, and establish a correspondence between the window and the storage area.
  • the windows requested by the client in this step are divided into two categories: a secure window and a non-secure window.
  • the created window is a security window
  • a matching secure storage area is created for the security window, and a correspondence between the matched secure storage area and the security window is established;
  • the created window is a non-secure window If the client requests to create a new non-secure window for the first time, create a non-secure storage area for the first newly created non-secure window, and establish a correspondence between the newly created non-secure window and the currently created non-secure storage area; If the client does not request to create a new non-secure window for the first time, assign a non-secure window that is not newly created for the first time to the non-secure storage area that has been created, and establish the non-secure window that is not newly created for the first time and the allocated non-secure window. Correspondence between secure storage areas.
  • establishing a correspondence between the window and the storage area may specifically include:
  • the created window is assigned a one-to-one corresponding window attribute value, and the correspondence between the window attribute value and the identifier of the storage area created or allocated for the window is saved in the window storage list.
  • Table 1 shows an example of a window storage list.
  • the window attribute value is 0 to match the non-secure storage area
  • the window attribute value is 1 to match the secure storage area 1
  • the window attribute value is 2 to match the secure storage area 2, that is, the window.
  • the data that needs to be saved in all the rendering processes in the non-secure window with the attribute value of 0 is saved in the non-secure storage area.
  • the data that needs to be saved in all the rendering processes in the security window with the window attribute value of 1 is saved in the secure storage area 1, and the window attribute is saved.
  • the data that needs to be saved by all rendering processes in the security window with a value of 2 is saved in Full storage area 2.
  • Step 302 Create or allocate a rendering process for the created window, determine a storage area corresponding to the window to which the rendering process belongs according to the established correspondence, and use the determined storage area to provide a storage service for the rendering process.
  • This step further creates or allocates a rendering process for the window created for the client in step 301, and creates or allocates a storage area for the newly created window of the client in step 301, which is used to provide a rendering process newly created or allocated for the window in this step.
  • Storage service
  • the determining, by the step, the storage area corresponding to the window to which the rendering process belongs according to the established correspondence includes:
  • the secure storage area corresponding to the security window closed by the client is determined according to the established correspondence and the secure storage area is released.
  • This process can specifically include:
  • the security window is used for sensitive data operations, after the security window is closed, releasing the security storage area corresponding to the security window can ensure the security and benefits of the user, and can make the storage space of the client be used efficiently; the non-secure storage area Serving the rendering process established in the non-secure window. Since non-secure data operations are performed on non-secure windows, some cached data or images are saved on the client. When the user accesses again, it is saved in the non-secure storage area of the client. Data can provide users with faster The browsing experience of the embodiment of the present application does not release the non-secure storage area when the client closes the non-secure window.
  • FIG. 4 is a flowchart of a method for securely storing a browser network according to an embodiment of the present application. As shown in FIG. 4, the method includes the following steps.
  • Step 401 It is monitored that the client first requests to create a new non-secure window, creates a non-secure window, assigns a corresponding window attribute value, creates a non-secure storage area for the non-secure window, and sets the window attribute value and the identifier of the non-secure storage area. The correspondence between the two is saved in the window storage list; a new rendering process is created for the non-secure window, and the information that the rendering process needs to store is stored in the non-secure storage area.
  • the client when the client first requests to create a new non-secure window, it creates a non-secure window, assigns a corresponding window attribute value, and creates a corresponding non-secure storage area for the non-secure window, and saves it in the window storage list.
  • Each client's browser creates a non-secure storage area only when the client first requests a new non-secure window. When it subsequently detects that the client requests a new non-secure window, it assigns the created non-secure storage area to the re-created.
  • the non-secure window is used to provide a storage service for the rendering process established by the newly created non-secure window, that is, all non-secure windows on the client share the same non-secure storage area.
  • Step 402 Monitor the client requesting a new security window, and create a security window carrying the window attribute value.
  • a security window carrying the window attribute value is created for the client, and the security window is presented to the client. Assume that the client assigns a window attribute value of 5 to the newly created security window in this step.
  • Step 403 Create a secure storage area for the security window, and save the one-to-one correspondence between the window attribute value and the secure storage area in the window storage list.
  • a matching secure storage area is created for the created security window, and the one-to-one correspondence between the window attribute value of the security window and the secure storage area is saved in the window storage list.
  • the window storage list at this time is shown in Table 3.
  • Step 404 Create a new rendering process for the security window, and query the window storage list according to the window attribute value of the window to which the rendering process belongs to determine the matching entry.
  • a rendering process is further created for the security window, and the matching list is determined according to the window attribute value of the window to which the rendering process belongs.
  • Each rendering process is subordinate to a window, and each window has a unique window property value. Therefore, according to the window property value, the matching table entry in the window storage list can be determined, thereby determining the storage area corresponding to the rendering process.
  • This step assumes that the rendering process is created for the security window 5, and the window attribute value of the window to which the rendering process belongs is 5, and the table 3 is queried according to the window attribute value, and the obtained matching table items are as shown in Table 4.
  • Step 405 Save the information that the rendering process needs to store in the matching storage area.
  • the information that needs to be stored in the rendering process is saved in the determined matching storage area, that is, all the stored data of the rendering process created in step 404 is saved in the secure storage area 1.
  • the scenario in which the client creates a new security window may be an online shopping or online banking operation involving money, so that sensitive data is stored in a secure storage area different from the non-secure storage area, and the cookie is not used for CSRF attack or cache.
  • Cache timing attacks, etc. can also be different account operations for the same application, such as logging in different QQ numbers, different mailboxes, different Weibo accounts, different game accounts, etc. on the web page. Since the technical solution of the embodiment of the present application implements network security storage, the storage data generated by the rendering process of different security windows may be isolated without affecting each other.
  • FIG. 5 is a flowchart of a method for securely storing a browser network according to an embodiment of the present application. As shown in FIG. 5, the method includes the following steps.
  • Step 501 Monitor the client to close the security window, and check the value of the window attribute of the closed security window.
  • the query window stores a list to determine the matching entries.
  • the window storage list shown in Table 5 is queried according to the window attribute value, and the matched entry is determined, and the determined matching entry is determined as a table. 6 is shown.
  • Non-secure storage area 1 Secure storage area 1 2 Secure storage area 2 5 Secure storage area 3
  • Step 502 Delete the matched matching entry and release the secure storage area corresponding to the matching entry.
  • the matching entry determined in step 501 is deleted, and the full storage area 3 corresponding to the matched entry is released, and the secure storage area 3 created before the security window with the window attribute value of 5 is deleted.
  • the secure storage area occupied by the failed security window is released, so that the storage space of the client can be cleaned in time to improve the utilization of the storage space.
  • FIG. 6 is a schematic structural diagram of a network security storage device according to an embodiment of the present disclosure. As shown in Figure 6, the device includes the following modules:
  • a window module 601 configured to create a window for the client when the client requests to create a new window, and create or allocate a storage area for the window, and establish a correspondence between the window and the storage area;
  • a rendering process module 602 configured to create or allocate a rendering process for the window, determine a storage area corresponding to the window to which the rendering process belongs according to the established correspondence, and provide a storage service for the rendering process by using the determined storage area.
  • the window module 601 is further configured to create a match for the security window when the created window is a security window.
  • a secure storage area establishing a correspondence between the security window and the matched secure storage area, creating a new rendering process in the security window, and the matching secure storage area is the The rendering process created by the security window provides a storage service;
  • the created window is a non-secure window
  • create or allocate a rendering process for the non-secure window if the client requests a new non-secure window for the first time, create a non-secure storage area for the first newly created non-secure window, and Establish a correspondence between the newly created non-secure window and the currently created non-secure storage area; if the client does not request to create a new non-secure window for the first time, assign a non-secure window that is not newly created for the first time to the created non-secure window.
  • a storage area is established, and a correspondence between the non-secure window that is not newly created and the allocated non-secure storage area is established, and the non-secure storage area provides a storage service for all rendering processes established for the non-secure window.
  • the window module 601 is further used to:
  • the rendering process module 602 is further configured to:
  • the device also includes a storage area release module 603 for:
  • the secure storage area corresponding to the security window closed by the client is determined according to the established correspondence and the secure storage area is released.
  • the storage area release module 603 is further configured to: determine a matching entry in the window storage list according to a window attribute value of the security window that is closed by the client, and determine, according to the identifier of the storage area recorded in the matched entry And the secure storage area corresponding to the security window that is closed by the client, and the security storage area is released, and the matched entry is deleted.
  • FIG. 7 is a schematic structural diagram of hardware implementation of a network secure storage device according to an embodiment of the present application.
  • the apparatus for implementing secure network storage may include a processor 710, a memory 720, a port 730, and a bus 740.
  • Processor 710 and memory 720 are interconnected by a bus 740.
  • Processor 710 can receive and transmit data through port 730.
  • the processor 710 is configured to execute a machine readable instruction module stored in the memory 720.
  • the memory 720 stores machine readable instruction modules executable by the processor 710, including: a window module 721 and a rendering process module 722.
  • the memory area release module 723 can be further included in the memory 720.
  • the device and the method for implementing the network security storage provided by the foregoing embodiments are in the same concept.
  • each functional module in each embodiment of the present application may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • each of the embodiments of the present application can be implemented by a data processing program executed by a data processing device such as a computer.
  • the data processing program constitutes the present application.
  • a data processing program usually stored in a storage medium is executed by directly reading a program out of a storage medium or by installing or copying the program to a storage device (such as a hard disk and or a memory) of the data processing device. Therefore, such a storage medium also constitutes the present application.
  • the storage medium can use any type of recording method, such as paper storage medium (such as paper tape, etc.), magnetic storage medium (such as floppy disk, hard disk, flash memory, etc.), optical storage medium (such as CD-ROM, etc.), magneto-optical storage medium (such as MO, etc.).
  • paper storage medium such as paper tape, etc.
  • magnetic storage medium such as floppy disk, hard disk, flash memory, etc.
  • optical storage medium such as CD-ROM, etc.
  • magneto-optical storage medium Such as MO, etc.
  • an embodiment of the present application further provides a storage medium in which a data processing program is stored, and the data processing program is used to execute any one of the foregoing methods of the present application.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Virology (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Information Transfer Between Computers (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种网络安全存储方法，该方法包括：当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系（301）；为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务（302）。该方法实现了浏览器的网络安全存储，提高了浏览器的安全性。

Description

网络安全存储方法和装置
本申请要求于2015年8月28日提交中国专利局、申请号为201510542767.1，发明名称为“网络安全存储方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及互联网技术领域，尤其涉及一种网络安全存储方法和装置。
发明背景
随着网页内容的越加丰富，很多网页已不再只是一个文档，而更像是一个应用程序。这种变化也促使浏览器已不再只是渲染和显示文档的工具，而更像是管理着这些复杂应用程序的操作系统。在传统的浏览器中，主进程中所有渲染进程的存储服务都通过同样的存储区域来实现，攻击者可以利用浏览器的存储数据进行攻击，如利用服务器暂存在计算机上的资料(Cookie)进行跨站请求伪造(Cross-Site Request Forgery，CSRF)攻击，利用高速缓存(Cache)进行高速缓存计时攻击(Cache Timing Attack)等。
发明内容
本发明实施例提供一种网络安全存储方法和装置，以提高浏览器的安全性。
本发明实施例的技术方案是这样实现的：
一种网络安全存储方法，应用于客户端的浏览器，包括：
当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
一种实现网络安全存储的装置，包括：
窗口模块，用于当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
渲染进程模块，用于为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
一种实现网络安全存储的装置，包括：
处理器；
与所述处理器连接的存储器；
所述存储器中存储有机器可读指令，所述处理器执行所述机器可读指令以执行以下操作：
当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
根据本发明实施例提供的方法和装置，为客户端创建窗口的同时为其创建或分配存储区域，并记录窗口与存储区域之间的对应关系，从而使得某些窗口的渲染进程可以由不同的存储区域提供存储服务，从而实现在同一个浏览器上进行网络安全存储的目的。这样，在用户需要进行敏感数据操作时，可以令所创建的窗口对应独立的存储区域，有效避免了利用浏览器的存储数据进行的攻击行为，为用户提供一个更安全、更稳定的浏览体验环境。
附图简要说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1本申请实施例中一种进程存储模型示意图。
图2A-2C为本申请实施例中进程存储模型示意图。
图3为本申请实施例提供的网络安全存储方法的流程图。
图4为本申请另一实施例提供的一种网络安全存储方法的流程图。
图5为本申请另一实施例提供的一种网络安全存储方法的流程图。
图6为本申请实施例提供的实现网络安全存储的装置结构图。
图7为依据本申请一实施例的实现网络安全存储装置的组成示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
图1为一种进程存储模型示意图，如图1所示，浏览器只为客户端创建了一个非安全存储区域，浏览器中的所有渲染进程的缓存服务都通过该非安全存储区域实现，即图1中的渲染进程1、渲染进程2需要存储的数据都保存在非安全存储区域中。本申请的发明人在发掘本申请的过程中发现，当用户在图1这种客户端上进行敏感数据操作时，一些重要数据的缓存也是由非安全存储区域进行保存的，这就增加了通过存储数据进行网页攻击的风险。
为了保证用户敏感数据操作的安全性，本申请实施例提出了一种技术方案。其中，当监测到客户端请求新建窗口时，创建窗口，并为创建的窗口创建或分配存储区域，建立窗口与存储区域之间的对应关系；同时为该窗口创建或分配渲染进程，根据所建立的对应关系确定渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。本申请实施例提供的技术方案使得某些窗口的渲染进程可以由不同的存储区域提供存储服务，从而实现在同一个浏览器上进行网络安全存储的目的，有效降低了通过存储数据被攻击的风险。
基于本申请技术方案的一个实例中，不同的非安全窗口共享相同的非安全存储区域，安全窗口和安全存储区域一一对应，即浏览器仅创建一个非安全存储区域，可以创建多个安全存储区域。图2A为本申请实施例提供的一种进程存储模型示意图，如图2A所示，浏览器为客户端创建了非安全存储区域210、安全存储区域212(根据实际需要还可以继续创建安全存储区域214、安全存储区域216等)，非安全窗口232中建立的渲染进程1、渲染进程2的存储服务通过非安全存储区域210提供，安全窗口234中新建的渲染进程3、渲染进程4的存储服务通过安全存储区域212提供。
例如，在本发明一个实施例中，参见图2B，用户要进行网页新闻浏览时，首次通过客户端请求新建非安全窗口，则浏览器为客户端创建非安全窗口241以及非安全存储区域240，并为该非安全窗口241新建渲染进程，将用户通过该渲染进程进行网页新闻浏览时产生的所有缓存数据保存在非安全存储区域240中，后续如果用户通过客户端关闭该非安全窗口241后再次要在非安全窗口中浏览网页时，浏览器为用户终端创建新的非安全窗口242，以及为该新的非安全窗口242新建渲染进程，或者将其它非安全窗口新建的渲染进程分配给该新的非安全窗口进行复用，将用户通过为新的非安全窗口242新建的或分配的渲染进程进行浏览网页时产生的所有缓存数据保存在之前创建的非安全存储区域240中；当用户要进行网上银行相关操作时，通过客户端请求新建安全窗口，则客户端的浏览器为该客户端创建安全窗口261以及对应的安全存储区域260，并为安全窗口261新建渲染进程，使得用户通过为安全窗口261新建的渲染进程进行网银操作的账号等信息存储在安全存储区域260中。
又如，在本发明另一个实施例中，如图2C所示，当用户想通过浏览器在同一客户端上同时登录两个不同的QQ账号(例如QQ1和QQ2，两个账号互不影响)时，请求新建两个不同的安全窗口，则客户端的浏览器为客户端创建安全窗口282和安全窗口292，以及对应的安全存储区域280和安全存储区域290，并为安全窗口282新建渲染进程A，为安全窗口292新建渲染进程B，使得用户通过为安全窗口282建立的渲染进程A登录QQ1，并将相关信息存储在安全存储区域280中，通过安全窗口292的渲染进程B登录QQ2，并将相关信息存储在安全存储区域290中；或者，安全窗口282复用渲染进程C，安全窗口292复用渲染进程D，且渲染进程C和渲染进程D分别是浏览器之前为两个不同的安全窗口(这两个不同的安全窗口既非安全窗口282，也非安全窗口292)建立的渲染进程，用户通过安全窗口282复用的渲染进程C登录QQ1，并将相关信息存储在安全存储区域280中，通过安全窗口292复用的渲染进程D登录QQ2，并将相关信息存储在安全存储区域290中，这样可以实现多个QQ帐号在浏览器上的同时登录，同时还可以保证该多个QQ帐号的相关数据的安全性。
通过图2A-2C可以得到，安全存储区域与非安全存储区域之间是隔离的，对于非安全存储区域来说，安全存储区域是不可见的，只有该安全存储区域对应的安全 窗口的渲染进程可以访问本安全存储区域的数据，非安全窗口、或其它安全窗口的其它渲染进程均无权访问该安全存储区域中的数据，由此本申请实施例技术方案提高了安全存储区域的数据的安全性。
图3为本申请实施例提供的网络安全存储方法的流程图，如图3所示，本申请实施例技术方案应用于客户端的浏览器，所述客户端是指具有数据计算处理功能的终端设备，包括但不限于(安装有通信模块的)智能手机、掌上电脑、平板电脑、智能电视(Smart TV)、个人PC等。这些通信终端上都安装有操作系统，包括但不限于：Android操作系统、Symbian操作系统、Windows mobile操作系统、以及苹果iPhone OS操作系统等等。
本申请实施例技术方案包括以下步骤：
步骤301：当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系。
在一个实例中，本步骤中客户端请求新建的窗口分为两类：安全窗口和非安全窗口。
所创建的窗口为安全窗口时，为所述安全窗口创建匹配的安全存储区域，并建立所述匹配的安全存储区域与所述安全窗口之间的对应关系；所创建的窗口为非安全窗口时，若所述客户端是首次请求新建非安全窗口，则为首次新建的非安全窗口创建非安全存储区域，并建立首次新建的非安全窗口与当前创建的非安全存储区域之间的对应关系；若所述客户端并非首次请求新建非安全窗口，则将非首次新建的非安全窗口分配给已创建的非安全存储区域，并建立所述非首次新建的非安全窗口与所述已分配的非安全存储区域之间的对应关系。
在一个实例中，建立所述窗口与所述存储区域之间的对应关系可以具体包括：
为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中。
表1为窗口存储列表的示例，如表1所示，窗口属性值为0匹配非安全存储区域，窗口属性值为1匹配安全存储区域1，窗口属性值为2匹配安全存储区域2，即窗口属性值为0的非安全窗口中所有渲染进程需要保存的数据均保存在非安全存储区域，窗口属性值为1的安全窗口中所有渲染进程需要保存的数据均保存在安全存储区域1，窗口属性值为2的安全窗口中所有渲染进程需要保存的数据均保存在安 全存储区域2。
表1
窗口属性值 存储区域
0 非安全存储区域
1 安全存储区域1
2 安全存储区域2
步骤302：为创建的窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
本步骤进一步为步骤301中为客户端创建的窗口新建或分配渲染进程，步骤301中为客户端新建的窗口创建或分配的存储区域，用来为本步骤中为窗口新建或分配的渲染进程提供存储服务。
在一个实例中，本步骤中根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域具体包括：
根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域。
在另一实例中，为了使得客户端的存储区域进行高效利用，当监测到客户端关闭安全窗口时，根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域，这一过程可具体包括：
根据所述客户端关闭的安全窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域，删除所述匹配的表项。
由于安全窗口用于进行敏感数据操作，因此操作完关闭安全窗口后，释放安全窗口对应的安全存储区域既可以保证用户的安全和利益，又可以使得客户端的存储空间得到高效利用；非安全存储区域为非安全窗口中建立的渲染进程提供服务，由于在非安全窗口进行的是非敏感数据操作，一些缓存数据或图片等保存在客户端，当用户再次访问时，保存在客户端非安全存储区域的数据可以给用户提供更加快速 的浏览体验，因此，当客户端关闭非安全窗口时，本申请实施例的技术方案并不释放非安全存储区域。
图4是本申请实施例的一种浏览器网络安全存储方法的流程图，如图4所示，该方法包括以下步骤。
步骤401：监测到客户端首次请求新建非安全窗口，创建非安全窗口，分配一一对应的窗口属性值，为非安全窗口创建非安全存储区域，将窗口属性值与非安全存储区域的标识之间的对应关系保存在窗口存储列表中；为非安全窗口新建渲染进程，该渲染进程需要存储的信息保存在非安全存储区域中。
本步骤中，监测到客户端首次请求新建非安全窗口，则创建非安全窗口，分配一一对应的窗口属性值，并且为非安全窗口创建对应的非安全存储区域，并在窗口存储列表中保存非安全窗口属性值与非安全存储区域的对应关系。假设本步骤创建的非安全窗口的属性值为0，则此时的窗口存储列表如表2所示。
表2
窗口属性值 存储区域
0 非安全存储区域
每个客户端的浏览器仅为客户端首次请求新建非安全窗口时创建一个非安全存储区域，当后续再次监测到客户端请求新建非安全窗口时，将已创建的非安全存储区域分配给再次创建的非安全窗口，用于为再次创建的非安全窗口建立的渲染进程提供存储服务，即客户端上所有非安全窗口共享同一个非安全存储区域。
步骤402：监测到客户端请求新建安全窗口，创建携带窗口属性值的安全窗口。
本步骤中，监测到客户端请求新建安全窗口，则为客户端创建携带窗口属性值的安全窗口，并将该安全窗口呈现给客户端。假设本步骤中客户端为新建的安全窗口分配的窗口属性值为5。
步骤403：为安全窗口创建安全存储区域，将窗口属性值与安全存储区域的一一对应关系保存在窗口存储列表中。
本步骤中，继为客户端创建安全窗口之后，为该创建的安全窗口创建匹配的安全存储区域，并将该安全窗口的窗口属性值与安全存储区域的一一对应关系保存在窗口存储列表中，此时的窗口存储列表如表3所示。
表3
窗口属性值 存储区域
0 非安全存储区域
5 安全存储区域1
步骤404：为安全窗口新建渲染进程，根据该渲染进程所属窗口的窗口属性值查询窗口存储列表确定匹配的表项。
本步骤中，进一步为安全窗口创建渲染进程，根据该渲染进程所属窗口的窗口属性值查询存储列表确定匹配的表项。每一个渲染进程都从属于一个窗口，每一个窗口都有唯一的窗口属性值，因此根据窗口属性值可以确定窗口存储列表中匹配的表项，进而确定该渲染进程对应的存储区域。
本步骤假设为安全窗口5创建渲染进程，则渲染进程所属窗口的窗口属性值为5，则根据窗口属性值为5查询表3，得到的匹配的表项如表4所示。
表4
5 安全存储区域1
步骤405：将渲染进程需要存储的信息保存在匹配的存储区域中。
本步骤中，根据表4所示，将渲染进程需要存储的信息保存在确定出的匹配的存储区域中，即将步骤404中创建的渲染进程的所有存储数据都保存在安全存储区域1中。
本实施例中，客户端新建安全窗口的场景可以是进行涉及金钱的网购或网银操作，使得敏感数据保存在不同于非安全存储区域的安全存储区域中，避免利用cookie进行CSRF攻击、或cache进行cache timing攻击等；也可以是进行同一应用程序的不同账号操作，如同时在网页上登录不同的QQ号、不同的邮箱、不同的微博账号、不同的游戏账号等。由于本申请实施例的技术方案实现了网络安全存储，则可以将不同安全窗口的渲染进程产生的存储数据进行隔离，互不影响。
图5是本申请实施例的一种浏览器网络安全存储方法的流程图。如图5所示，该方法包括以下步骤。
步骤501：监测到客户端关闭安全窗口，根据关闭的安全窗口的窗口属性值查 询窗口存储列表，确定匹配的表项。
本步骤中，假设客户端关闭了窗口属性值为5的安全窗口，则根据该窗口属性值查询表5所示的窗口存储列表，确定匹配的表项，假设确定出的匹配的表项如表6所示。
表5
窗口属性值 存储区域
0 非安全存储区域
1 安全存储区域1
2 安全存储区域2
5 安全存储区域3
表6
5 安全存储区域3
步骤502：删除查询到的匹配的表项，并将该匹配表项对应的安全存储区域释放。
为了节省客户端的存储空间，将步骤501确定出的匹配的表项删除，并释放该匹配的表项对应的全存储区域3，删除之前为窗口属性值为5的安全窗口创建的安全存储区域3中保存的数据。
本实施例通过释放失效的安全窗口所占的安全存储区域，使得客户端的存储空间能够及时进行清理，提高存储空间的利用率。
图6为本申请实施例提供的一种实现网络安全存储装置的结构示意图。如图6所示，该装置包括以下模块：
窗口模块601，用于当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
渲染进程模块602，用于为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
窗口模块601还用于，所创建的窗口为安全窗口时，为所述安全窗口创建匹配 的安全存储区域，建立所述安全窗口与所述匹配的安全存储区域之间的对应关系，在所述安全窗口中新建渲染进程，通过所述对应关系使得所述匹配的安全存储区域为所述安全窗口新建的所述渲染进程提供存储服务；
所创建的窗口为非安全窗口时，为所述非安全窗口新建或分配渲染进程；若所述客户端是首次请求新建非安全窗口，则为首次新建的非安全窗口创建非安全存储区域，并建立首次新建的非安全窗口与当前创建的非安全存储区域之间的对应关系；若所述客户端并非首次请求新建非安全窗口，则将非首次新建的非安全窗口分配给已创建的非安全存储区域，并建立非首次新建的非安全窗口与所述已分配的非安全存储区域之间的对应关系，所述非安全存储区域为所有为非安全窗口建立的渲染进程提供存储服务。
窗口模块601进一步用于：
为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
所述渲染进程模块602还用于：
根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域。
该装置还包括存储区域释放模块603，用于：
当监测到客户端关闭安全窗口时，根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域。
存储区域释放模块603进一步用于：根据所述客户端关闭的安全窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域，删除所述匹配的表项。
图7为依据本申请一实施例的实现网络安全存储装置的硬件结构示意图。该实现网络安全存储的装置可包括：处理器710，存储器720，端口730以及总线740。处理器710和存储器720通过总线740互连。处理器710可通过端口730接收和发送数据。
其中，处理器710用于执行存储器720存储的机器可读指令模块。
存储器720存储有处理器710可执行的机器可读指令模块，包括：窗口模块721和渲染进程模块722。在一些实施例中，存储器720中可以进一步包括存储区域释放模块723。其中，处理器710执行窗口模块721、渲染进程模块722以及存储区域释放模块723中的指令时，可以分别实现上述窗口模块721、渲染进程模块722和存储区域释放模块723的各种功能。
上述实施例提供的实现网络安全存储的装置与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理单元中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
另外，本申请的每一个实施例可以通过由数据处理设备如计算机执行的数据处理程序来实现。显然，数据处理程序构成了本申请。此外，通常存储在一个存储介质中的数据处理程序通过直接将程序读取出存储介质或者通过将程序安装或复制到数据处理设备的存储设备(如硬盘和或内存)中执行。因此，这样的存储介质也构成了本申请。存储介质可以使用任何类型的记录方式，例如纸张存储介质(如纸带等)、磁存储介质(如软盘、硬盘、闪存等)、光存储介质(如CD-ROM等)、磁光存储介质(如MO等)等。
因此本申请一实施例还提供了一种存储介质，其中存储有数据处理程序，该数据处理程序用于执行本申请上述方法的任何一种实施例。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (18)

  1. 一种网络安全存储方法，其特征在于，应用于客户端的浏览器，该方法包括：
    当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
    为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
  2. 根据权利要求1所述的方法，其特征在于，所创建的窗口为安全窗口时，为所述安全窗口创建匹配的安全存储区域，建立所述安全窗口与所述匹配的安全存储区域之间的对应关系，为所述安全窗口新建渲染进程，通过所述对应关系使得所述匹配的安全存储区域为所述安全窗口新建的所述渲染进程提供存储服务。
  3. 根据权利要求2所述的方法，其特征在于，该方法进一步包括：
    当监测到客户端关闭安全窗口时，根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域。
  4. 根据权利要求3所述的方法，其特征在于，所述建立所述窗口与所述存储区域之间的对应关系具体包括：
    为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域具体包括：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域；
    所述根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域具体包括：
    根据所述客户端关闭的安全窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域，删除所述匹配的表项。
  5. 根据权利要求1所述的方法，其特征在于，所创建的窗口为非安全窗口时，为所述非安全窗口新建或分配渲染进程；
    若所述客户端是首次请求新建非安全窗口，则为首次新建的非安全窗口创建非安全存储区域，并建立首次新建的非安全窗口与当前创建的非安全存储区域之间的对应关系；若所述客户端并非首次请求新建非安全窗口，则将非首次新建的非安全窗口分配给已创建的非安全存储区域，并建立非首次新建的非安全窗口与所述已分配的非安全存储区域之间的对应关系，所述非安全存储区域为所有非安全窗口对应的渲染进程提供存储服务。
  6. 根据权利要求1所述的方法，其特征在于，所述建立所述窗口与所述存储区域之间的对应关系具体包括：
    为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域具体包括：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域。
  7. 一种实现网络安全存储的装置，其特征在于，该装置包括：
    窗口模块，用于当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
    渲染进程模块，用于为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
  8. 根据权利要求7所述的装置，其特征在于，所述窗口模块还用于：
    所创建的窗口为安全窗口时，为所述安全窗口创建匹配的安全存储区域，建立所述安全窗口与所述匹配的安全存储区域之间的对应关系，在所述安全窗口中新建渲染进程，通过所述对应关系使得所述匹配的安全存储区域为所述安全窗口新建的所述渲染进程提供存储服务。
  9. 根据权利要求8所述的装置，其特征在于，所述装置还包括存储区域释放模块，用于：
    当监测到客户端关闭安全窗口时，根据所建立的对应关系确定客户端关闭的安 全窗口对应的安全存储区域并释放该安全存储区域。
  10. 根据权利要求9所述的装置，其特征在于，
    所述窗口模块进一步用于，为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述渲染进程模块进一步用于：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域；
    所述存储区域释放模块进一步用于：根据所述客户端关闭的安全窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域，删除所述匹配的表项。
  11. 根据权利要求7所述的装置，其特征在于，所述窗口模块还用于：
    所创建的窗口为非安全窗口时，为所述非安全窗口新建或分配渲染进程；若所述客户端是首次请求新建非安全窗口，则为首次新建的非安全窗口创建非安全存储区域，并建立首次新建的非安全窗口与当前创建的非安全存储区域之间的对应关系；若所述客户端并非首次请求新建非安全窗口，则将非首次新建的非安全窗口分配给已创建的非安全存储区域，并建立非首次新建的非安全窗口与所述已分配的非安全存储区域之间的对应关系，所述非安全存储区域为所有为非安全窗口建立的渲染进程提供存储服务。
  12. 根据权利要求7所述的装置，其特征在于，
    所述窗口模块进一步用于：
    为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述渲染进程模块还用于：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域。
  13. 一种网络安全存储装置，其特征在于，包括：
    处理器；
    与所述处理器连接的存储器；
    所述存储器中存储有机器可读指令，所述处理器执行所述机器可读指令以执行以下操作：
    当监测到客户端请求新建窗口时，为所述客户端创建窗口，并为所述窗口创建或分配存储区域，建立所述窗口与所述存储区域之间的对应关系；
    为所述窗口新建或分配渲染进程，根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域，使用所确定出的存储区域为所述渲染进程提供存储服务。
  14. 根据权利要求13所述的装置，其特征在于，所创建的窗口为安全窗口时，为所述安全窗口创建匹配的安全存储区域，建立所述安全窗口与所述匹配的安全存储区域之间的对应关系，为所述安全窗口新建渲染进程，通过所述对应关系使得所述匹配的安全存储区域为所述安全窗口新建的所述渲染进程提供存储服务。
  15. 根据权利要求14所述的装置，其特征在于，该方法进一步包括：
    当监测到客户端关闭安全窗口时，根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域。
  16. 根据权利要求15所述的装置，其特征在于，所述建立所述窗口与所述存储区域之间的对应关系具体包括：
    为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域具体包括：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域；
    所述根据所建立的对应关系确定客户端关闭的安全窗口对应的安全存储区域并释放该安全存储区域具体包括：
    根据所述客户端关闭的安全窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述客户端关闭的安全 窗口对应的安全存储区域并释放该安全存储区域，删除所述匹配的表项。
  17. 根据权利要求13所述的装置，其特征在于，所创建的窗口为非安全窗口时，为所述非安全窗口新建或分配渲染进程；
    若所述客户端是首次请求新建非安全窗口，则为首次新建的非安全窗口创建非安全存储区域，并建立首次新建的非安全窗口与当前创建的非安全存储区域之间的对应关系；若所述客户端并非首次请求新建非安全窗口，则将非首次新建的非安全窗口分配给已创建的非安全存储区域，并建立非首次新建的非安全窗口与所述已分配的非安全存储区域之间的对应关系，所述非安全存储区域为所有非安全窗口对应的渲染进程提供存储服务。
  18. 根据权利要求13所述的装置，其特征在于，所述建立所述窗口与所述存储区域之间的对应关系具体包括：
    为所创建的窗口分配一一对应的窗口属性值，将所述窗口属性值与为所述窗口创建或分配的存储区域的标识之间的对应关系保存在窗口存储列表中；
    所述根据所建立的对应关系确定所述渲染进程所属窗口对应的存储区域具体包括：
    根据所述渲染进程所属窗口的窗口属性值在所述窗口存储列表中确定匹配的表项，根据所述匹配的表项中记录的存储区域的标识确定所述渲染进程所属窗口对应的存储区域。
PCT/CN2016/084909 2015-08-28 2016-06-06 网络安全存储方法和装置 WO2017036220A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/728,332 US10915646B2 (en) 2015-08-28 2017-10-09 Method and apparatus for network secure storage

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510542767.1A CN106485159B (zh) 2015-08-28 2015-08-28 网络安全存储方法和装置
CN201510542767.1 2015-08-28

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/728,332 Continuation US10915646B2 (en) 2015-08-28 2017-10-09 Method and apparatus for network secure storage

Publications (1)

Publication Number Publication Date
WO2017036220A1 true WO2017036220A1 (zh) 2017-03-09

Family

ID=58186706

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/084909 WO2017036220A1 (zh) 2015-08-28 2016-06-06 网络安全存储方法和装置

Country Status (3)

Country Link
US (1) US10915646B2 (zh)
CN (1) CN106485159B (zh)
WO (1) WO2017036220A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2575664B (en) * 2018-07-18 2022-08-24 Airbus Defence & Space Ltd Secure remote computer system

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102375947A (zh) * 2010-08-16 2012-03-14 伊姆西公司 用于隔离计算环境的方法和系统
CN102663318A (zh) * 2012-03-22 2012-09-12 百度在线网络技术（北京）有限公司 浏览器及客户端
US20120260327A1 (en) * 2011-04-08 2012-10-11 Microsoft Corporation Multi-browser authentication
US20120304265A1 (en) * 2011-05-26 2012-11-29 Michael Judd Richter Browser with Integrated Privacy Controls and Dashboard for Social Network Data
CN102843394A (zh) * 2011-06-22 2012-12-26 腾讯科技（深圳）有限公司 网络应用的框架装置及运行方法
CN104239514A (zh) * 2014-09-16 2014-12-24 可牛网络技术（北京）有限公司 网页渲染方法、装置及移动终端

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020141584A1 (en) * 2001-01-26 2002-10-03 Ravi Razdan Clearinghouse for enabling real-time remote digital rights management, copyright protection and distribution auditing
US8635254B2 (en) * 2002-08-08 2014-01-21 Axeda Corporation Maintaining independent states for multiple web browser instances
JP2008084117A (ja) * 2006-09-28 2008-04-10 Fujitsu Ltd リクエスト送信制御プログラム，装置，および方法
US8527740B2 (en) * 2009-11-13 2013-09-03 International Business Machines Corporation Mechanism of supporting sub-communicator collectives with O(64) counters as opposed to one counter for each sub-communicator
US9536089B2 (en) * 2010-09-02 2017-01-03 Mcafee, Inc. Atomic detection and repair of kernel memory
GB2483648A (en) * 2010-09-14 2012-03-21 Mastek Uk Ltd Obfuscation of data elements in a message associated with a detected event of a defined type
TW201239730A (en) * 2011-03-24 2012-10-01 Acer Inc Method for customizing user interface and electronic device thereof
US9117061B1 (en) * 2011-07-05 2015-08-25 Symantec Corporation Techniques for securing authentication credentials on a client device during submission in browser-based cloud applications
CN103914456A (zh) * 2012-12-31 2014-07-09 北京中交兴路信息科技有限公司 一种数据存储方法和系统
JP2015164018A (ja) * 2014-02-28 2015-09-10 株式会社東芝 コンテンツ提供装置、コンテンツ提供方法及びプログラム
CN104092702B (zh) * 2014-07-22 2017-05-31 北京京东尚科信息技术有限公司 一种分布式系统的网络安全验证方法和系统
CN104618556B (zh) * 2014-12-31 2018-02-13 宇龙计算机通信科技(深圳)有限公司 信息保存方法和终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102375947A (zh) * 2010-08-16 2012-03-14 伊姆西公司 用于隔离计算环境的方法和系统
US20120260327A1 (en) * 2011-04-08 2012-10-11 Microsoft Corporation Multi-browser authentication
US20120304265A1 (en) * 2011-05-26 2012-11-29 Michael Judd Richter Browser with Integrated Privacy Controls and Dashboard for Social Network Data
CN102843394A (zh) * 2011-06-22 2012-12-26 腾讯科技（深圳）有限公司 网络应用的框架装置及运行方法
CN102663318A (zh) * 2012-03-22 2012-09-12 百度在线网络技术（北京）有限公司 浏览器及客户端
CN104239514A (zh) * 2014-09-16 2014-12-24 可牛网络技术（北京）有限公司 网页渲染方法、装置及移动终端

Also Published As

Publication number Publication date
CN106485159A (zh) 2017-03-08
CN106485159B (zh) 2020-05-29
US20180032752A1 (en) 2018-02-01
US10915646B2 (en) 2021-02-09

Similar Documents

Publication Publication Date Title
US10033637B2 (en) Method and apparatus for switching data between virtual machines, and communications system
US9305174B2 (en) Electronic clipboard protection
CN113010818B (zh) 访问限流方法、装置、电子设备及存储介质
WO2016101635A1 (zh) 一种同步登录状态的方法、装置、设备和计算机存储介质
US9584628B2 (en) Zero-copy data transmission system
TW201220197A (en) for improving the safety and reliability of data storage in a virtual machine based on cloud calculation and distributed storage environment
US20130238742A1 (en) Tiers of data storage for web applications and browser extensions
WO2013177925A1 (zh) 数据同步方法、系统及设备
WO2016070718A1 (zh) 进行文件下载的方法、装置和浏览器
WO2015103794A1 (zh) 一种文件访问权限控制方法及装置
US10001933B1 (en) Offload pipeline for data copying
CN102346823B (zh) 一种互联网中用户登录的方法及系统
WO2017201984A1 (zh) 一种数据处理的方法、相关设备及存储系统
US20150295823A1 (en) Packet processing method and background server
US20140325089A1 (en) Method, terminal, server and system for page jump
US20240106902A1 (en) Communication protocols for an online content management system
WO2020134833A1 (zh) 一种数据共享方法、装置、设备及系统
US20210034760A1 (en) Caching for high-performance web applications
CN106446075A (zh) 页面请求处理方法及装置
US10691310B2 (en) Copying/pasting items in a virtual desktop infrastructure (VDI) environment
WO2019114246A1 (zh) 一种身份认证方法、服务器及客户端设备
CN103067500B (zh) 基于云终端的网页浏览方法
US9130994B1 (en) Techniques for avoiding dynamic domain name system (DNS) collisions
WO2016169212A1 (zh) 文件管理方法和装置
WO2017036220A1 (zh) 网络安全存储方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16840649

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 20.07.2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16840649

Country of ref document: EP

Kind code of ref document: A1