World wide web (WEB) hotlinking protection method and gateway system thereof

Abstract

The invention relates to a world wide web (WEB) hotlinking protection method and a gateway system thereof. The gateway system comprises a gateway configuration module, a hotlinking protection identification generating and distributing module and a hotlinking protection identification extracting and verifying module. 1) A pre-gateway is built between a client-end and a WEB server, the pre-gateway configurates hotlinking protection file types for the WEB server represented by the pre-gateway, the hotlinking protecting function is activated after the configuration takes effect. 2) According to a request type from the client-end, the pre-gateway judges whether a resource request is in the hotlinking protection file types. 3) The hotlinking protection identification is extracted and verified, the resource request meeting set conditions is transmitted to the WEB server from the pre-gateway. By means of the WEB hotlinking protection method and the gateway system thereof, a hotlinking attack can be confirmed in time, the source request is rejected, the WEB server and the diversity and the differentiation of an operation system are shielded, the software configuration of the server does not need to be changed, the service to WEB is transparent, and the previous management model is not affected.

Description

technical field [0001] The present invention relates to computer network security. Specifically, it relates to a method and system for implementing hotlink protection for websites based on a front-end gateway. Background technique [0002] With the development of Internet technology, the website is no longer limited to only providing text information to the outside world. A large number of multimedia information such as pictures, videos, and audios appear on the website. While enriching the form of the website, the multimedia information also brings security issues to the website. Hotlinking attack is the most obvious one. Hotlinking means that the service provider does not provide the content of the service itself, bypasses other beneficial end user interfaces through technical means, and directly provides the service content of other service providers to the end user on its own website. Hotlinking attacks do not need to provide resources or provide a very small amount of...

AI Technical Summary

Problems solved by technology

[0009] First, hotlink protection needs to be adapted to different WEB applications and even operating systems, which will lead to problems of large amount of development and poor versatility;

[0010] Second, the main function of the server is to respond to HTTP requests. If a large number of encryption and decryption, verification, and redirection functions are added, its performance will inevitably be affected. An attacker only needs to send a large number of requests that require encryption, decryption, verification, and redirection functions. It can increase the load on the server side suddenly;

[0011] Third, the server needs to modify the URL information accessed by the client, resulting in an obvious modification of the client's access request

[0012] The main method of client protection is to send a downloader to the client when the client requests resources. The downloader runs on the client to verify the client information, and returns the client request data when the verification is passed. Otherwise, it will interrupt the connection between the client and the server. Connection, this method reduces the pressure on the server side, but because the client plug-in needs to adapt to different browsers, there are also problems of large development and poor compatibility. Powerful tool at the end

Images