Method and device for providing access page

Patent metadata

Field	Value
Publication number	US-10558807-B2
Application number	US-201715482609-A
Country	US
Kind code	B2
Filing date	Apr 7, 2017
Priority date	Oct 17, 2014
Publication date	Feb 11, 2020
Grant date	Feb 11, 2020

Abstract

A method and an apparatus of providing an access page are disclosed. The apparatus firstly obtains an access page that is sent by a network device and is to be provided to a user device, determines an XSS processing module corresponding to the access page, and forwards the XSS processing module and the access page to the user device, wherein the XSS processing module is executed to process XSS information on the access page when the access page is loaded by the user device. The disclosed apparatus can configure a processing module for detecting XSS information that is tailored to each access page, thus avoiding false negatives in detection of an access page in the existing technologies, and ensuring to prompt and stop anomalies on the access page in time when the access page is insecure.

First claim

What is claimed is:

1. A method implemented by a computing device, the method comprising:
obtaining an access page that is sent by a network device and is to be provided to a user device, wherein obtaining the access page that is sent by the network device and is to be provided to the user device comprises:
obtaining a page access request submitted by the user device to the network device; and
detecting whether the page access request is a normal access request according to preset attack request detection rules, the preset attack request detection rules comprising at least detecting whether an SQL statement that is included in the page access request includes script information conforming to a format of preset script information;

determining an XSS processing module corresponding to the access page; and
forwarding the XSS processing module and the access page to the user device.

2. The method according to claim 1 , wherein obtaining the access page that is sent by the network device and is to be provided to the user device further comprises:
forwarding the page access request to the network device, and receiving the access page that is sent by the network device and is to be provided to the user device based on the page access request if the page access request is the normal access request.

3. The method according to claim 1 , wherein forwarding the XSS processing module and the access page to the user device further comprises:
forwarding the access page that includes the XSS processing module to the user device.

4. The method according to claim 1 , wherein the XSS processing module is executed to process XSS information on the access page when the access page is loaded by the user device, and processing the XSS information on the access page comprises:
detecting whether the access page includes XSS information, and stopping an execution of the XSS information if the access page includes the XSS information; or
detecting whether the access page includes XSS-like information, and reporting the XSS-like information if the access page includes the XSS-like information.

5. The method according to claim 4 , further comprising obtaining the XSS-like information, and creating or updating XSS processing rules for generating a subsequent XSS processing module based on the XSS-like information.

6. The method according to claim 1 , wherein determining the XSS processing module corresponding to the access page comprises determining the XSS processing module corresponding to the access page according to access-related information corresponding to the access page.

7. The method according to claim 6 , wherein the access-related information comprises at least one of browser type information of the user device, page type information of the access page, or access source information of the access page.

8. The method according to claim 7 , wherein the access-related information comprises the browser type information of the user device, and wherein determining the XSS processing module corresponding to the access page comprises:
if the browser type information of the user device includes a supported CSP response header, determining the XSS processing module as an XSS processing module including security policy information configured in the CSP response header corresponding to the access page; or
if the browser type information of the user device includes a non-supported CSP response header, determining the XSS processing module as an XSS processing module including security information for detecting XSS information on the access page, and intercepting and reporting an illegitimate reference of an external resource.

9. The method according to claim 7 , wherein the access-related information comprises the page type information of the access page, and wherein determining the XSS processing module corresponding to the access page comprises:
if the page type information of the user device includes a login page, determining the XSS processing module as an XSS processing module including security information against a theft of form content; or
if the page type information of the user device includes a back-end page, determining the XSS processing module as an XSS processing module including security information for detecting an abnormal external resource access.

10. An apparatus comprising:
one or more processors;
memory;
a first module stored in the memory and executable by the one or more processors to obtain an access page that is sent by a network device and is to be provided to a user device, wherein obtaining the access page that is sent by the network device and is to be provided to the user device comprises:
obtaining a page access request submitted by the user device to the network device; and

detecting whether the page access request is a normal access request according to preset attack request detection rules, the preset attack request detection rules comprising at least detecting whether an SQL statement that is included in the page access request includes script information conforming to a format of preset script information;
a second module stored in the memory and executable by the one or more processors to determine an XSS processing module corresponding to the access page; and
a third module stored in the memory and executable by the one or more processors to forward the XSS processing module and the access page to the user device.

11. The apparatus according to claim 10 , wherein the first module is further configured to:
forward the page access request to the network device, and receive the access page that is sent by the network device and is to be provided to the user device based on the page access request if the page access request is the normal access request.

12. The apparatus according to claim 10 , wherein the third module is further configured to:
forward the access page that includes the XSS processing module to the user device.

13. The apparatus according to claim 10 , wherein the XSS processing module is executed to process XSS information on the access page when the access page is loaded by the user device, and processing the XSS information on the access page comprises:
detecting whether the access page includes the XSS information, and stopping an execution of the XSS information if the access page includes the XSS information; or
detecting whether the access page includes XSS-like information, and reporting the XSS-like information if the access page includes the XSS-like information.

14. The apparatus according to claim 13 , further comprising a fourth module configured to obtain the XSS-like information, and create or update XSS processing rules for generating a subsequent XSS processing module based on the XSS-like information.

15. The apparatus according to claim 10 , wherein the second module is configured to determine an XSS processing module corresponding to the access page according to access-related information corresponding to the access page.

16. The apparatus according to claim 15 , wherein the access-related information comprises at least one of browser type information of the user device, page type information of the access page, or access source information of the access page.

17. The apparatus according to claim 16 , wherein the access-related information comprises the browser type information of the user device, and wherein the second module is configured to:
if the browser type information of the user device includes a supported CSP response header, determine the XSS processing module as an XSS processing module including

Assignees

• Alibaba Group Holding Ltd

Inventors

• Zhang Lei

Classifications

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F2221/2115

  Third party · CPC title