CN102111385A - Webpage security trust scoring method - Google Patents

Abstract

The invention discloses a webpage security trust scoring method, which comprises that: a webpage publisher embeds a digital signature comprising an abstract and a suggested score into a hypertext markup language (HTML) code of a webpage; a plurality of authentication centers give a security score to each webpage; and a browser automatically calculates a final score S0 according to a set mechanism, and determines security rights endowed to the webpage according to the score. Compared with the prior art, the invention has the advantage that: the problems of insufficient manual input and single-site authentication force and particularly incapability of determining specific security levels of the single webpage are solved.

Description

A kind of webpage security trust scoring method

Technical field

The present invention relates to network security technology, particularly a kind of safe web page is trusted the method for scoring.

Background technology

Along with the development of Internet and the continuous progress of network technology, when people experienced surfing on the net with rapid changepl. never-ending changes and improvements and experience, the behavior of various infringement user information safeties was grown just darkling. Using the browser browsing page has not been the foolproof thing of part, and the assailant may embed malicious code in the webpage of former safety, make the user download virus or wooden horse unconsciously, and then cause losing of the system failure or important information. Evaluation safe web page rank makes browser automatically make security response, is an important method that prevents webpage operation malicious code.

Common prior art has at present: 1, secure browser rank and safety zone arrange; 2, safe web page authentication center. Simply be described below:

Prior art one: secure browser rank and safety zone arrange

Scheme: the high, normal, basic level of security of Denging is set in browser, and every kind of rank gives different security permissions, such as allowing ActiveX etc. And the safety zones such as trusted site are set, level of security corresponding to each safety zone.

Shortcoming: need the artificial web path that adds in mutually required safety zone, and safe granularity can not refine to single webpage, allow the different pages have different security permissions.

Prior art two: webpage security authentication center

Scheme: when browser is opened webpage, check that automatically certain is equivalent to the website of authentication center, gives the security permission of this website with reference to authentication center.

Shortcoming: depend on the trust to single authentication center, fairness and reliability are difficult to guarantee. And the safe granularity at current authentication center only refine to for website usually. If refine to for single webpage, the storage capacity of single authentication center and disposal ability can be challenged.

In sum, prior art Existence dependency user manually adds or relies on the authentication capability of single website, and these 2 all can not be trusted fully. And prior art is only carried out man-rate for website, can't be granulated to the safe class of each webpage, and this is that underaction is with actual.

Summary of the invention

The embodiment of the invention provides a kind of method of safe web page scoring, and it is inadequate to solve the manual input and the single site authentication dynamics that exist in the prior art, and especially level of security can not be granulated to the problem of single webpage.

A kind of webpage security trust scoring method comprises:

The webpage publisher uses the digital digest of webpage and suggestion scoring and is packaged into digital signature behind the encrypted private key and is embedded in the former web page code;

Give each webpage a security scoring by a plurality of authentication centers, S finally marks₀Automatically calculated according to setting mechanism by browser, browser determines to give webpage what kind of security permission according to this scoring;

Browser calculates final scoring S automatically₀Mechanism comprise:

According to formula $S_{}$ ${}_0=\frac{\mathrm{\Σ}{S}_i{A}_i}{n}$ (i=1,2 ..., n) calculate final scoring S₀； 

In the formula, S₁Be webpage publisher's suggestion scoring, A₁Credit rating for the webpage publisher; When i＞1, S_iBe the guarantee scoring of certain authentication center to this webpage, A_iCredit rating for corresponding authentication center;

S ₁Acquisition methods be: browser extracts the digital signature of webpage, the deciphering that uses public-key, the suggestion that obtains the webpage publisher S that marks₁； 

A ₁Acquisition methods be: browser calculates webpage publisher's credit rating A according to the webpage publisher's of its preservation credit record₁If this network publisher has then A of record of bad behavior₁Reduce, without bad record A then₁Increase;

S _iAcquisition methods be: after browser received webpage, automatically asking a plurality of authentication centers was webpage test and appraisal, and each authentication center provides the guarantee scoring S to this webpage_i； 

A _iAcquisition methods be: browser obtains the credit rating A of corresponding authentication center according to the credit record of the authentication center of its preservation_iIf there is then A of record of bad behavior in this authentication center_iReduce, without bad record A then_iIncrease.

In the embodiment of the invention, automatically determine the safe web page authority by browser, need not manually add web path to the safety zone; Security permission is accurate to webpage, rather than for the website; Web page code embeds digital signature, greatly reduces by webpage to hang the chance that wooden horse is invaded browser; The embodiment of the invention does not rely on single authentication center and gives safety evaluation; and adopt safety scoring and credit underwriting mechanism; be similar to the method for the anti-swindle of financial sector, operative constraint webpage making person and guarantee person's (authentication center) dishonest conduct.

Description of drawings

Fig. 1 is that the embodiment of the invention is that safe web page is trusted scoring and the application scenarios figure that assures;

Fig. 2 is that the embodiment of the invention is that safe web page is trusted scoring and the group method flow chart of assuring;

Fig. 3 is the method flow diagram that browser calculates the final safety scoring of webpage in the embodiment of the invention;

The specific embodiment

Inadequate for the manual input and the single site authentication dynamics that exist in the prior art; especially level of security can not be granulated to the problem of single webpage; the embodiment of the invention proposes a kind of method of safe web page scoring; can be in user's browsing page; the webpage recommending scoring that provides according to authentication result and the webpage publisher of a plurality of authentication centers; automatically calculate the level of security of webpage by browser, and give corresponding browse right, solved the problems referred to above.

As shown in Figure 1, there are some special websites in the internet, can test and assess to the webpage security that arrives user browser, claim that these websites are the test and appraisal center.

The webpage publisher reaches the webpage distributor with webpage, then by web page server webpage is distributed to extraneous Internet. The user receives webpage by the internet, because the insecurity of webpage, before the browser execution web page code, at first check the authentication center in the present networks zone, send the test and appraisal request to authentication center, the authentication center that receives the test and appraisal request provides marks to the guarantee of this webpage, and browser receives the guarantee scoring of this webpage, and then calculates final safety scoring according to these parameters by user browser.

Simultaneously, in the process of user's browsing page, the security situation at webpage publisher and test and appraisal center all can affect the credit record to them of preserving in the browser.

As shown in Figure 2, the overall procedure for the scoring of safe web page trust and guarantee of the embodiment of the invention comprises:

Step 201, webpage publisher embed the suggestion scoring and comprise S in the webpage HTML code₁, then the digital signature of digital digest is uploaded to webpage and is published to extraneous Internet in the webpage publisher server.

Step 202, browser receive webpage, and then the authentication center in the network sends webpage evaluation and test request, and the authentication center that receives the evaluation and test request authenticates webpage, provide separately the guarantee scoring S to this webpage_i, be transmitted back to the browser that request is tested and assessed.

Step 203, browser receive the guarantee scoring at the center of respectively testing and assessing, and the digital signature of then checking webpage detects the primitiveness of webpage etc., and obtain the credit rating at this web site publisher and each test and appraisal center according to the browser credit record. According to formula $S_{}$ ${}_0=\frac{\mathrm{\Σ}{S}_i{A}_i}{n}$ (i=1,2 ..., n) calculate the final scoring S of this webpage₀。 

Step 204, according to the final scoring S of webpage₀, browser gives webpage corresponding authority. Such as S₀All outer functions of=0 o'clock forbidding text display, S₀Allow to download unsigned ActiveX control etc. when higher.

In the step 201, because be not that each webpage needs very large security permission, issuing the page such as the information of pure words does not just need the ActiveX function. Therefore the webpage publisher is according to the actual conditions of each webpage, only need to add digital signature and suggestion scoring to some page, whether good this page of forethought needs to move JavaScript code or ActiveX control etc., and gives the required enough scorings of corresponding authority and get final product. And for the ordinary pages that does not have digital signature, final safety scoring is made as 0 without exception, gives the most basic function of browse authority.

In the step 201, the method that embeds digital signature in the webpage is:

Adopt certain HASH function calculation to go out digital digest to the webpage that will issue;

Encrypted private key is adopted in digital digest and suggestion scoring, be embedded in the webpage after both packings;

The PKI of deciphering usefulness sends in the user browser by secure way.

In the step 202, the preferential principle of region and familiarity is taked in the selection of authentication center, and is preferential at the same network segment and credit rating is higher in user browser authentication center with the user. But the authentication center that participates in test and appraisal can not be less than two.

All records are obtained with calculating all and are finished by user browser in the step 203.

As shown in Figure 3, the method flow that browser calculates the final safety scoring of webpage automatically in the embodiment of the invention comprises:

Step 301, browser receive webpage, at first detect whether contain digital signature in the webpage. For the webpage that does not contain digital signature, the final scoring of order S₀Be 0, namely only give minimum browse right.

Step 302, for the webpage that contains digital signature, the decrypted digital signature that uses public-key obtains the digital digest of former webpage and webpage publisher to the suggestion scoring S of this webpage₁ Detect whether former webpage of webpage according to the digital digest of webpage. If the digital digest of finding after testing current web page is unequal with the former digital digest that decrypts, then illustrate webpage victim maliciously distort, make S at once₀=0, only give the webpage least privilege. Give the alarm to the user simultaneously, and be recorded in the security log.

Step 303, determine that webpage is former webpage after testing, then browser obtains this webpage publisher's credit rating A according to the credit record of this webpage publisher in browser₁。 

Step 304, for the authentication center that tests and assesses for this webpage, browser obtains the credit rating A of this authentication center according to the credit record at this test and appraisal center_i, 2≤i≤n wherein.

Step 305, extract corresponding test and appraisal center to the guarantee scoring S of this webpage_i, 2≤i≤n wherein.

Step 306, successively to promising this webpage authentication center's execution in step 304 and the step 305 of testing and assessing.

Step 307, the web site publisher who obtains according to front several steps advise the S that marks₁, web site publisher's credit rating A₁, the guarantee scoring S at each center of testing and assessing_iAnd credit rating A_i, according to formula $S_{}$ ${}_0=\frac{\mathrm{\Σ}{S}_i{A}_i}{n}$ (i=1,2 ..., n) calculate the final scoring S of this webpage₀。 

In the step 301, the webpage that does not contain digital signature has two kinds of situations, and the one, the webpage publisher thinks that according to the particular content of this webpage only giving least privilege can normally show, does not therefore add signature; The 2nd, webpage victim in issue and transmission course has been deleted digital signature, in this case, although webpage be tampered, because of S₀Be 0, browser is forbidden moving the code that may work the mischief, so user's browsing page remains safe.

In the step 303, certain webpage publisher's credit rating can change along with the historical performance of the security of own publishing web page. Be similar to bank card, have record of bad behavior can reduce credit, it's not true, and credit increases gradually. And preserve credit record to some webpage publisher in each user browser, because the browsing histories of each browser self is different, also just different to webpage publisher's credit scoring. Under this mechanism, browser is always guarded to some extent to the website that logs in for the first time.

In the step 304, similar to webpage publisher's credit rating, the credit rating of certain authentication center, meeting is evaluated and tested the degree of accuracy of webpage along with self and is increased and decreased equally. Preserve the credit record of some authentication center in the browser, same, because each browser is not identical to the credit scoring of each authentication center to the historical difference of the request authentication of authentication center yet. If never be the tested and assessed authentication center of webpage of this browser before one of the browse request, the credit rating of this authentication center is just not too high so. Also Just because of this, browser should be selected the relatively authentication center of " being familiar with " when the selective authenticate center.

Claims (2)

1. webpage security trust scoring method is characterized in that the method comprises:

The webpage publisher uses the digital digest of webpage and suggestion scoring and is packaged into digital signature behind the encrypted private key and is embedded in the former web page code;

Give each webpage a security scoring by a plurality of authentication centers, S finally marks₀Automatically calculated according to setting mechanism by browser, browser determines to give webpage what kind of security permission according to this scoring;

Browser calculates final scoring S automatically₀Mechanism comprise:

According to formula $S_0=\frac{\mathrm{\Σ}{S}_i{A}_i}{n}$ (i=1,2 ..., n) calculate final scoring S₀；

In the formula, S₁Be webpage publisher's suggestion scoring, A₁Credit rating for the webpage publisher; When i＞1, S_iBe the guarantee scoring of certain authentication center to this webpage, A_iCredit rating for corresponding authentication center;

S ₁Acquisition methods be: browser extracts the digital signature of webpage, the deciphering that uses public-key, the suggestion that obtains the webpage publisher S that marks₁；

A ₁Acquisition methods be: browser calculates webpage publisher's credit rating A according to the webpage publisher's of its preservation credit record₁If this network publisher has then A of record of bad behavior₁Reduce, without bad record A then₁Increase;

S _iAcquisition methods be: after browser received webpage, automatically asking a plurality of authentication centers was webpage test and appraisal, and each authentication center provides the guarantee scoring S to this webpage_i；

A _iAcquisition methods be: browser obtains the credit rating A of corresponding authentication center according to the credit record of the authentication center of its preservation_iIf there is then A of record of bad behavior in this authentication center_iReduce, without the then Ai increase of bad record.

2. the method for claim 1 is characterized in that, described S_iAcquisition methods in, follow nearby during selective authenticate center test and appraisal webpage and with regard to the principle of high degree of belief.

Images