WO2015078170A1 - Resource access method and apparatus, and server and terminal - Google Patents

Abstract

Provided are a resource access method and apparatus, and a server and a terminal, wherein the method comprises: receiving, by the server, a hypertext transfer protocol request of accessed terminal resources, and establishing a specialised control message channel with a browser of a corresponding terminal; and authenticating, by the server, the hypertext transfer protocol request, and processing same according to an authentication result.

Description

 Method, device, server and terminal for resource access

 The present invention relates to mobile internet technologies, and in particular, to a method and device for accessing resources, a server, and a terminal. Background technique

 With the development of HTML5 (Hyper Text Markup Language 5) and related WEB (web page) technology, the development of webApp (web application) using HTML5 technology is increasingly accepted and favored by developers. The traditional native app (local application), webapp has the advantages of lower development cost, simpler upgrade, easier maintenance and no need to install and not consume user storage space. In essence, the so-called webApp is for Iphone, Android (Android). The disadvantages of web sites optimized by mobile terminals are also obvious. In order to prevent developers from abusing local resources and to ensure user information security, webApp access to local resources is restricted, such as searching local databases, reading local files, Operate terminal hardware resources, etc. Summary of the invention

 In view of this, the embodiments of the present invention provide a method and device for accessing resources, a server, and a terminal, so as to ensure secure access of the webApp to local resources.

 The embodiment of the invention provides a method for resource access, including:

 The server receives the hypertext transfer protocol request of the visited terminal resource, and establishes a dedicated control message channel with the browser of the corresponding terminal;

 The server authenticates the hypertext transfer protocol request and processes according to the authentication result.

Preferably, after the server establishes a dedicated control message channel with the browser of the corresponding terminal, Also includes:

 The server will establish a peer-to-peer network connection relationship with the browser of the terminal into the connection table. Preferably, the server authenticating the access includes:

 The server extracts an application identifier and user login information of the browser from the hypertext transfer protocol request;

 And detecting, according to the application identifier, whether the version of the browser is legal, and detecting the access right of the user according to the user login information. If the version of the browser is legal and the user has the access right, the authentication is passed.

 Preferably, the processing by the server according to the authentication result includes:

 If the authentication is passed, the corresponding access control command message is sent to the browser; if the authentication fails, the access restricted message is sent to the browser.

 The embodiment of the invention further provides a server, which includes:

 Establishing a module, configured to receive a hypertext transfer protocol request, and establish a dedicated control message channel with a browser of the corresponding terminal;

 And the processing module is configured to: if the hypertext transfer protocol is requested to access the resource of the terminal, perform authentication on the access, and perform processing according to the authentication result.

 Preferably, the establishing module is further configured to put a peer-to-peer network connection with a browser of the terminal into a connection table.

 Preferably, the processing module authenticating the access includes: extracting, by the hypertext transfer protocol request, an application identifier of the browser and user login information; and detecting, according to the application identifier, whether the version of the browser is If the version of the browser is legal and the user has access rights, the authentication is passed.

 Preferably, the processing by the processing module according to the authentication result includes: sending, by the browser, a corresponding access control command message, if the authentication is passed; if the authentication fails, sending the access restricted to the browser Message.

The embodiment of the invention further provides a method for resource access, including: When the web application is opened, a hypertext transfer protocol request for accessing the terminal resource is sent to the server, and a dedicated control message channel is established with the server;

 Receiving an access control command message sent by the server, and performing access processing according to the access control command message.

 Preferably, after performing the access processing according to the access control command message, the method includes: sending an access result to the server.

 The embodiment of the invention further provides a device for accessing resources, which includes:

 a sending module, configured to open a webpage application, send a hypertext transfer protocol request for accessing the terminal resource to the server, and establish a dedicated control message channel with the server;

 The processing module is configured to receive an access control command message sent by the server, and perform access processing according to the access control command message.

 Preferably, the processing module is further configured to: after the access processing is performed according to the access control command message, send the access result to the server.

 Preferably, the device comprises: a browser.

 The embodiment of the invention further provides a terminal, including the above device.

 The embodiment of the present invention further provides a computer readable storage medium, the storage medium includes an embodiment of the invention, and a computer readable storage medium, the storage medium includes a set of computer executable instructions, and the instructions are used by the A method of performing resource access on the terminal side.

 The embodiment of the invention provides a method, a device, a server and a terminal for resource access, which can ensure secure access of the webApp to local resources. DRAWINGS

 1 is a flowchart of a method for resource access on a terminal side according to an embodiment of the present invention;

 2 is a flowchart of a method for resource access on a server side according to an embodiment of the present invention;

3 is a schematic diagram of a protocol field according to an embodiment of the present invention; 4 is a schematic diagram of a server according to an embodiment of the present invention;

 FIG. 5 is a schematic diagram of an apparatus for resource access according to an embodiment of the present invention. detailed description

 In many cases, webApps are software that performs a specific task. The functions are relatively simple. They are mainly used to meet a specific user's usage requirements. However, in order to enhance the user experience and make full use of the unique features of the webApp. At the same time, it is better to replace the native app. The webApp also needs to have some features of the native app. One of the most important ones is how to ensure the secure access of the webApp to local resources.

 The embodiment of the invention provides a method for resource access, and the browser-based webApp securely accesses local resources. For example, the browser integrates a web fiction reading software with night mode and day switching functions, as well as saving bookmarks, viewing bookmarks, etc., when the user views the bookmark list, the terminal database needs to be accessed, and the webApp is essentially It is a web page that is like a native app and displayed through the browser kernel. Although there are some technologies that can support front-end JS (Java script program, which is used to implement various logic functions in WEB applications), directly access local resources, such as phonegap. Etc., but in order to prevent the abuse of local resources by developers or some malware and to protect the security of user information, it has made many restrictions. This solution provides a secure access mechanism through server authentication, which is determined according to the security level. Which terminal resources and devices can be accessed. When the front-end JS needs to access a certain local resource, the server is first notified. After the server authentication is passed, the special control protocol is used to interact with the terminal browser in a dedicated control message channel to complete the terminal resource. Access and Control of the device and feedback the results to the front end.

 In order to make the objects, the technical solutions and the advantages of the present invention more comprehensible, the embodiments of the present invention will be described in detail below. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments of the present invention may be arbitrarily combined with each other.

FIG. 1 is a flowchart of a method for accessing a resource on a terminal side according to an embodiment of the present invention. As shown in FIG. 1 , the method in this embodiment may include: Step 11: When the terminal opens the webpage application, the browser sends an HTTP (Hyper Text Transfer Protocol) request for accessing the terminal resource to the server, and establishes a dedicated control message channel with the server;

 Step 12: The browser of the terminal receives the access control command message sent by the server, and performs access processing according to the access control command message.

 2 is a flowchart of a method for resource access on the server side. As shown in FIG. 2, the method in this embodiment may include:

 Step 21: The server receives the HTTP request, and establishes a dedicated control message channel with the browser of the corresponding terminal.

 Step 22: If the server finds that the HTTP request is to access the resource of the terminal, the server authenticates the access and performs processing according to the authentication result.

 Compared with the prior art, the embodiment of the present invention aims to enable the webApp to securely access terminal resources. Currently, technologies such as the phonegap framework also support web applications to directly access local resources, but phonegap cannot guarantee that terminal resources are not abused or guaranteed. The user information is secure. In order to ensure the security of the user information, there are many restrictions on the access of the terminal resources. Other similar technical standards also use the access restriction method. The embodiment of the present invention uses the indirect access method through the server. The server performs security management in a unified manner, which avoids the above problems to some extent.

 The present invention will be described in detail below with reference to the overall flow of a specific embodiment, which may include the following steps:

 Step 101: First, when the user opens a webApp, send an HTTP request to the server; the server acquires the user terminal information according to the HTTP request header field, and establishes a dedicated control information channel with the terminal browser.

 webAp runs on the browser.

In this embodiment, the connection control management module is responsible for establishing a P2P connection with the terminal browser, and placing the connection table for management, and the management module can close the connection according to the terminal status or network status. Delete the corresponding index in the connection table, retrieve the connection table according to the server requirements, and so on. Step 102: After receiving the HTTP request, the server finds that it needs to access the terminal resource (such as accessing the terminal database to obtain a bookmark, etc.), and then invokes the authentication module to calculate the access security level, and determines whether the accessed terminal resource is allowed according to the security level.

 In the embodiment of the present invention, the user security level may be determined by the terminal browser AppID and the user login information. The server first extracts the terminal browser AppID and the user login information; and then determines whether to publish the version for the official channel according to the AppID of the terminal browser. Since the application published by the official channel has been tested in advance, it is ensured that the malicious plug-in is not included, and has certain Reliability, so set its security level to 1, allowing webApps running on this browser to have certain terminal resource access rights; then checking user login information, such as the user is already a logged-in user, automatically has the highest access Permissions.

 Step 103: If the authentication is passed, the server sends a corresponding control command message to the terminal browser.

 The corresponding control command message corresponds to the request sent by the webApp. For example, if the webApp wants to access the terminal database, the HTTP request sent to the server, after receiving the request, the server finds that it needs to access the database on the terminal, and then goes to the terminal browser. The message requesting access to the database is sent through a dedicated control information channel, and after receiving the message, the browser performs related data operations and returns the result.

Control messages between the server and the terminal browser can interact with a custom internal protocol format. The specific composition of the protocol field in this embodiment is shown in Figure 3. The length of the protocol data is not fixed, and varies according to the number of parameters and the length of the parameter values. T is used as a separator between the parts of the protocol field, and T is also used between the parameters. The protocol parsing unit extracts relevant parameters according to the command. For example, if the browser receives a command to adjust the brightness of the screen of the terminal, it searches for the corresponding keyword in the field, and then extracts the brightness value parameter. Pass commands and parameters to the command execution unit. Finally, the command execution unit calls the corresponding system interface to complete the adjustment of the screen brightness control. If the authentication fails, you can give the user a corresponding prompt, and ask the user to log in. Step 104: After receiving the command message, the terminal browser performs a corresponding operation, and returns the operation result to the server.

 For example, the request sent by the server to the terminal browser to operate the local resource, such as the server requesting access to the local database of the terminal, the browser will perform the operation of accessing the database after receiving and parsing the message, and return the operation to the server. result.

 Step 105: The server sends an HTTP response to the front end of the webApp, and delivers the access result and the return data to the front end.

 Step 106: After receiving the response, the webAp front end performs the corresponding subsequent action.

 For example, the webApp front end can display the results of the query after receiving the message.

 The connection relationship between the server and the terminal browser is relatively simple, and the positions of the network elements are equivalent, which is a typical star structure.

 FIG. 4 is a schematic diagram of a server according to an embodiment of the present invention. As shown in FIG. 4, the server 10 of this embodiment includes:

 The establishing module 11 is configured to receive the hypertext transfer protocol request, and establish a dedicated control message channel with the browser of the corresponding terminal;

 The processing module 12 is configured to: if the hypertext transfer protocol is requested to access the resource of the terminal, perform authentication on the access, and perform processing according to the authentication result.

 The establishing module 11 may be further configured to put a peer-to-peer network connection with a browser of the terminal into a connection table.

 The processing module 12, the authenticating the access may include: extracting, by the hypertext transfer protocol request, an application identifier and user login information of the browser; and detecting, by the application identifier, the browser If the version is legal, the user's access rights are detected according to the user login information. If the version of the browser is valid and the user has access rights, the authentication is passed.

The processing module 12, when processing according to the authentication result, may include: sending, by the browser, a corresponding access control command message, if the authentication is passed; if the authentication fails, the browsing is performed to the browser It should be noted that the foregoing establishing module 11 and the processing module 12 may be configured by a central processing unit (CPU), a processor (MPU, a Micro Processing Unit), a digital signal processor (DSP), or Programmable Array (FPGA) implementation.

 FIG. 5 is a schematic diagram of an apparatus for accessing resources according to an embodiment of the present invention. In this embodiment, the apparatus for accessing a resource includes a browser installed on the terminal. As shown in FIG. 5, the apparatus 20 of this embodiment may include:

 The sending module 21 is configured to: when the webpage application is opened, send a hypertext transfer protocol request for accessing the terminal resource to the server, and establish a dedicated control message channel with the server;

 The processing module 22 is configured to receive an access control command message sent by the server, and perform access processing according to the access control command message.

 The processing module 22 may be further configured to: after performing the access processing according to the access control command message, send the access result to the server.

 It should be noted that the foregoing sending module 21 and processing module 22 can be implemented by a CPU, MPU, DSP or FPGA of a device accessed by a resource.

 Of course, the function modules in the server and the device in this embodiment may have different partitions according to specific functions. For example, the webApp server includes a user security level authentication unit, a protocol data processing unit, and a peer router (P2P). a communication control unit or the like; the terminal browser includes a protocol processing unit, a command execution unit, and a P2P communication control unit.

 In the embodiment of the present invention, the web application front end cannot directly access the local resource by using the JS, and the webApp indirectly completes the access to the terminal resource and the device through the server, that is, the server and the terminal browser establish a dedicated control message channel, when the terminal resource needs to be accessed, The corresponding command message is sent to the terminal browser, and the browser performs the corresponding access operation after receiving the command and returns the result.

The user security level authentication unit of the server performs authentication according to the AppID and user login information of the terminal browser to determine the security access level of the webApp to the terminal resource, different security, etc. The terminal resources and devices that the level allows to access are also different.

 The server protocol processing unit receives the HTTP request and encapsulates the custom protocol data (the commands and parameters carried in the HTTP request), and then transmits the data to the communication control unit, and is also responsible for receiving the data from the communication control unit, and performing data on the data. Parsing and passing to the interactive interface single TL o

 The server communication control unit is responsible for completing the establishment of the connection, managing the dedicated control message channel with each terminal browser, transmitting and receiving protocol data, etc., while maintaining a P2P connection table between the server and each terminal browser, when The connection channel is updated as soon as it changes.

 The terminal browser side protocol processing unit also completes the parsing of the protocol data, and generates a control command to be transmitted to the command processing unit, and at the same time, the command execution result is encapsulated and transmitted to the communication unit and returned to the server.

 The browser side command execution unit is configured to execute various operation instructions such as adjusting screen brightness, saving bookmarks, accessing bookmarks, vibrating the mobile phone, etc., and returning the execution result to the protocol processing unit.

 The browser side P2P communication unit is responsible for establishing connections, transmitting and receiving protocol data.

 The embodiment of the present invention further provides a computer readable storage medium, the storage medium includes an embodiment of the invention, and a computer readable storage medium, the storage medium includes a set of computer executable instructions, and the instructions are used by the A method of performing resource access on the terminal side.

 One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by instructions to the associated hardware, which may be stored in a computer readable storage medium, such as a read only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above is only a preferred embodiment of the present invention, and of course, the present invention may be embodied in various other embodiments without departing from the spirit and scope of the present invention. The invention is susceptible to various modifications and variations, which are intended to be included within the scope of the appended claims.

Claims

claims 1. A method of resource access, including: The server receives the Hypertext Transfer Protocol request for the accessed terminal resource and establishes a dedicated control message channel with the browser of the corresponding terminal; The server authenticates the Hypertext Transfer Protocol request and processes it according to the authentication result. 2. The method of claim 1, wherein after the server establishes a dedicated control message channel with the browser of the corresponding terminal, it further includes: The server will establish a peer-to-peer network connection relationship with the browser of the terminal and put it into the connection table. 3. The method of claim 1, wherein the server authenticating the access includes: The server extracts the application identification and user login information of the browser from the Hypertext Transfer Protocol request; Detect whether the version of the browser is legal based on the application identifier, and detect the user's access rights based on the user login information. If the version of the browser is legal and the user has access rights, the authentication is passed. 4. The method according to any one of claims 1-3, wherein the server performs processing according to the authentication result including: If the authentication passes, a corresponding access control command message is sent to the browser; if the authentication fails, an access restricted message is sent to the browser. 5. A server, including: Establish a module configured to receive a Hypertext Transfer Protocol request and establish a dedicated control message channel with the browser of the corresponding terminal; a processing module configured to upon discovery of the Hypertext Transfer Protocol request to access the terminal resources, the access will be authenticated and processed based on the authentication results. 6. The server as claimed in claim 5, wherein, The establishment module is also configured to put the peer-to-peer network connection established with the browser of the terminal into the connection table. 7. The server as claimed in claim 5, wherein, The processing module, authenticating the access includes: extracting the application identification and user login information of the browser from the Hypertext Transfer Protocol request; detecting whether the version of the browser is legal based on the application identification, The user's access rights are detected based on the user login information. If the version of the browser is legal and the user has access rights, the authentication is passed. 8. The server according to any one of claims 5-7, wherein, The processing module, which performs processing according to the authentication result, includes: if the authentication passes, sending a corresponding access control command message to the browser; if the authentication fails, sending an access restricted message to the browser. 9. A method of resource access, including: When opening a web application, send a Hypertext Transfer Protocol request to access terminal resources to the server, and establish a dedicated control message channel with the server; Receive the access control command message sent by the server, and perform access processing according to the access control command message. 10. The method according to claim 9, wherein the access processing according to the access control command message includes: Send the access results to the server. 11. A resource access device, including: The sending module is configured to send a Hypertext Transfer Protocol request for accessing terminal resources to the server when the web application is opened, and establish a dedicated control message channel with the server; The processing module is configured to receive the access control command message sent by the server, and perform access processing according to the access control command message. 12. The device of claim 11, wherein, The processing module is also configured to, after performing access processing according to the access control command message, send the access result to the server. 13. The device according to claim 11 or 12, wherein, The device includes: a browser. 14. A terminal, characterized by comprising the device according to any one of claims 11-13. 15. A computer-readable storage medium, the storage medium includes a set of computer-executable instructions, the instructions are used to execute the resource access method described in any one of claims 1-4. 16. A computer-readable storage medium, the storage medium comprising a set of computer-executable instructions, the instructions being used to execute the resource access method described in any one of claims 9-10.