CN102984277B - Prevent the system and method that malice connects - Google Patents

Abstract

The invention provides a kind of system preventing malice from connecting, comprising: browser client, for sending connection request to distributor, and connecting with corresponding socket server according to the distribution of described distributor; Distributor, for receiving the connection request that browser client sends, and be this browser client distribution socket server, and be this connection distribution connection identifier (CID, the link information of distributed socket server and this connection identifier (CID are sent to browser client by distributor, and are cached in buffer by relevant information; Socket server, for receiving described connection identifier (CID with the connection of described browser client from browser client via set up, and according to buffer memory connection identifier (CID in both the buffers, the connection identifier (CID that this receives is verified, keep according to the result or disconnect described connection.Utilize the solution of the present invention can stop taking in a large number and shelving of storage resources, and prevent the generation of illegal connection.

Description

Systems and methods for preventing malicious connections

technical field

The invention relates to the field of information technology data synchronization, in particular to a system and method for preventing malicious connections.

Background technique

At present, with the development of network technology, the Internet, as a huge information resource, has become the most convenient and fast way for people to obtain information. At present, a user usually uses a personal computer to access the Internet (Internet), and accesses a webpage through a browser installed in the personal computer to obtain required information. With the development of mobile communication technologies, users can also access the Internet through mobile terminals supporting browser functions, such as mobile phones and personal digital assistants (Personal Digital Assistant, PDA for short).

However, whether it is a browser on a personal computer or a browser on a mobile terminal, generally no push service is provided, and the information interaction between the server and the client depends on the connection initiated by the client, and the server cannot actively send information to the client , so that real-time synchronization of information between the server and the browser client cannot be realized.

In the prior art, the most commonly used way to synchronize browser data between the browser client and the server is that the browser client sends a request to the server at a certain frequency, such as once a week or once a month. Updates to the information capture this information. However, the applicant found that this data synchronization method has the following technical defects: relatively low efficiency, takes up a lot of resources, and cannot achieve true real-time synchronous update of content.

In order to achieve real-time data synchronization of the browser client and maintain the connection between the browser client and the network side, there are cases where some browser clients maliciously initiate connection requests to the network side continuously, but the network side does not Continuously allocating network resources to these browser client users and continuously storing the allocation information in the corresponding storage repository will occupy a large amount of storage resources, resulting in a large waste of storage resources. An effective mechanism to prevent illegal connections is lacking in the prior art.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a system and method for preventing malicious connections that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a system for preventing malicious connections is provided, the system includes: a browser client, configured to send a connection request to a distributor to request to establish a connection with a socket server, and according to the distribution The distributor establishes a connection with the corresponding socket server; the distributor is used to receive the connection request sent by the browser client, and allocate a socket server to the browser client according to the connection request, and allocate a socket server to the connection. A globally unique connection identifier, the distributor sends the allocated socket server connection information and the connection identifier to the browser client, and caches the information related to the connection request and the connection identifier to In the cache; the socket server is configured to receive the connection identifier from the browser client via the established connection with the browser client, and receive the received connection identifier according to the connection identifier cached in the cache. The connection identifier is verified, and the connection is maintained or disconnected according to the verification result.

According to another aspect of the present invention, a method for preventing malicious connections is provided, the method comprising: the browser client sends a connection request to the distributor to request to establish a connection with the socket server, and according to the distributor's Assign and establish a connection with the corresponding socket server; the distributor receives the connection request sent by the browser client, and allocates a socket server to the browser client according to the connection request, and assigns a globally unique connection identifier to the connection character, the distributor sends the allocated socket server connection information and the connection identifier to the browser client, and caches the information related to the connection request and the connection identifier in the buffer; The socket server receives the connection identifier from the browser client via the established connection with the browser client, and verifies the received connection identifier according to the connection identifier cached in the cache, according to The verification result maintains or disconnects the connection.

According to another aspect of the present invention, a system for preventing malicious connections in browser real-time synchronization is provided, the system includes a cloud storage server, a push server, and multiple browser clients, distributors and socket servers, wherein : The cloud storage server end is used to send condition information and command information to the push server when there is data update; the push server is used to determine in the plurality of browser clients according to the condition information The target client, and the command information is sent to the target client through the socket server; and the target client is used to realize data synchronization with the cloud storage server according to the command information; the distributor, It connects the multiple browser clients and the socket server, is used to receive the connection requests sent by the multiple browser clients to connect with the socket server, and provides the browser client with the connection request according to the connection request. The terminal allocates a socket server, and allocates a globally unique connection identifier for the connection, and the distributor sends the connection information of the allocated socket server and the connection identifier to the plurality of browser clients, and sends Information related to the connection request and the connection identifier are cached in the buffer; a socket server, which connects the distributor, the push server and a plurality of browser clients, and is used for receiving from the plurality of browser clients The connection identifier is received and verified, and the connection with the plurality of browser clients is maintained or disconnected according to the verification result, and used for forwarding the command information from the push server to the target client.

Utilizing the system and method for preventing malicious connections of the present invention has the following advantages:

1) It can prevent a large number of occupation and shelving of storage resources, and prevent the generation of illegal connections;

2) By setting the push server, when the data content stored on the cloud storage server is updated, the command information is sent to the target client through the push server in a timely manner, thus realizing the simple and efficient connection between the cloud storage server and the browser. Real-time synchronization of client data;

3) By adding socket server, distributor and distribution information database, the connection between cloud storage server, push server and target client is successfully realized;

4) The command information pushed by the push server to the target client is a notification message. After receiving the notification message pushed by the push server, the target client downloads the updated data content from the cloud storage server, and executes the local data content according to the downloaded content. Synchronization, which can further save system resources.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 is a schematic structural diagram of a system for realizing browser data synchronization according to an embodiment of the present invention;

2 is a schematic structural diagram of a system for realizing browser data synchronization according to another embodiment of the present invention;

Fig. 3 is a schematic diagram of the process of establishing a connection between the browser client and the socket server in the system for realizing browser data synchronization shown in Fig. 2;

Fig. 4 is a schematic diagram of the process of pushing information to the target client in the first type of scenario in the system for realizing browser data synchronization shown in Fig. 2;

Fig. 5 is a schematic diagram of the process of pushing information to the target client in the second type of scenario in the system for implementing browser data synchronization shown in Fig. 2;

Fig. 6 is a schematic diagram of the process of pushing information to the target client in the third type of scenario in the system for realizing browser data synchronization shown in Fig. 2;

7 is a flowchart of a method for implementing browser data synchronization according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a browser client implementing browser data synchronization according to an embodiment of the present invention;

FIG. 9 is a structural diagram of a system for preventing malicious connections according to an embodiment of the present invention;

FIG. 10 is a flowchart of a method for preventing malicious connections according to an embodiment of the present invention;

Fig. 11 is a structural diagram of a distributor for distributing multiple socket servers according to an embodiment of the present invention;

Fig. 12 is a flowchart of a method for distributing multiple socket servers according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

In an exemplary embodiment of the present invention, a system for implementing browser data synchronization is provided. As shown in FIG. 1 , the system for synchronizing browser data includes: a cloud storage server 1 , a push server 2 and multiple browser clients 3 and 4 . Among them, the cloud storage server 1 is used to send condition information and command information to the push server when there is data update; the push server 2 is used to determine the target client among multiple browser clients according to the condition information, and send The command information is pushed to the target client 3; the target client 3 is used to realize data synchronization between the target client and the cloud storage server according to the command information.

In the embodiment shown in Figure 1, by setting up a separate push server 2, when the data content stored at the cloud storage server end is updated, the command information is sent to the target client through the push server in time, so that it is simple, Efficiently realize the real-time synchronization of server-side information and client-side information.

As shown in FIG. 1 , multiple browser clients include an initiating client 4 and a target client 3 . Wherein, the initiating client 4 is used to update the data stored in the cloud storage server 1 . The initiating client 4 and the target client 3 may belong to the same user, or may belong to different users. The main application scenario where the initiating client 4 and the target client 3 belong to the same user is: the same user uses different devices (such as a mobile phone and a PC) to log in to the browser, and one of them (such as a PC) changes favorites, then it needs Sync that update to another device (phone) of the same user. An application scenario where the initiating client 4 and the target client 3 do not belong to the same user is, for example, information communication between different browser clients.

Of course, in the present invention, the cloud storage server itself can also initiate an update of the data content. In this case, the initiating browser client 4 in FIG. 1 may not exist. The scenario of this situation is, for example: the system pushes news messages or weather forecasts to all browser clients; or the system initiates an update instruction to all browser clients of a certain version.

Since the cloud storage server 1, the target client 3 and the initiating client 4 within the dotted line box in Figure 1 are existing in the existing browser system, adding a push server on this basis can effectively utilize the original system Architecture, reducing the cost of implementing the present invention.

In order to realize the connection of cloud storage server 1, push server 2 and target client 3, as shown in Figure 2, the system for realizing data synchronization between browser client and cloud storage server can also include multiple socket servers, distribution device.

The distributor is configured to allocate a corresponding socket server and a connection identifier to the client after receiving the connection request, and store the user identification information and the connection identifier in the distribution information database. The detailed connection establishment process is shown in Figure 3, including:

Step S301, the browser client submits a connection request to the distributor. The connection request includes at least user identification information. For a logged-in user, the user identification information may include a user name; for a non-login user, the user identification Information may include the user's machine hardware identification.

For a logged-in user, the user identification information may be a character string. Wherein, in addition to the username of the logged-in user, the character string also includes information such as login time and verification characters. The username is the user unique identification number, which is a number used to represent a user. The verification character is generated according to the user name, and it can be determined whether the user identification information has been changed through the verification character.

For non-logged-in users, the user identification information may include the non-logged-in user's machine hardware ID, where the machine hardware ID is a unique machine ID, which is generated by the client through the hash of the user's machine hardware and system configuration.

In addition, for subsequent target client screening, the connection request may also include user feature information, such as IP address information, browser version information, or user feature information such as user classification information. Wherein, user characteristic information such as browser version number, user classification information, or IP address information can be used for subsequent client screening.

Step S302, the distributor calculates a value based on the user identification information using a preset algorithm, and assigns a socket server to the browser client that submits the connection request according to the value; the value is globally unique, that is, the connection identifier; The server sends the connection information such as the IP address and port of the socket server and the connection identifier to the browser client that submitted the request;

In this step, a preset algorithm is used to calculate the above value based on the username of the logged-in user. For a non-login user, the above-mentioned value is directly calculated using the machine hardware identifier of the non-login user, and the algorithm may be a cyclic redundancy check (CRC) 32 algorithm.

Step S303, the browser client establishes a connection with the corresponding socket server according to the received IP address and port number of the socket server, and the connection may be a Transmission Control Protocol (TCP) connection. When the browser client establishes a connection with the socket server, the socket server obtains a resource identifier identifying the connection relationship between the socket server and the browser client. The browser client transmits the received connection identifier to the socket server using the established connection.

Step S304, after the socket server receives the connection identifier, it verifies the connection identifier to the distributor, if the verification is successful, it maintains the connection established with the browser client, and if the verification is unsuccessful, it disconnects connection already established.

Step S305, the distributor stores the user identification information (the user name of the logged-in user or the machine hardware identification of the non-logged-in user), the user characteristic information (if any) and the connection identifier in the distribution information database, and the socket server The resulting resource identifier is also stored in the distribution information database.

It should be noted that, in order to prevent allocation confusion caused by server-side changes, the browser client needs to re-execute steps S301-step S304 to connect after a period of time.

In addition, for each socket server, there is a corresponding separate data table in the distribution information database, so as to reduce the size of the data table and speed up the query speed of the socket server in the subsequent information push stage.

By increasing the distributor and socket server, and setting the distribution information database in the distributor, so that user identification information, connection identifier, resource identifier and user characteristic information can be stored in the distribution information database during the connection establishment phase, Thus, the push server can push the data content of the preset target client.

In the information push phase: the push server is used to send condition information and command information to the socket server; the socket server is used to forward the information pushed by the push server to the corresponding target client. The detailed information push process is described in detail in the following three types of scenarios.

(1) When the real-time synchronization is initiated by the initiating client, and the initiating client and the receiving client belong to the same user, the condition information includes user identification information. For example, as shown in Figure 4, the information push process includes:

Step S401, initiating the client to update the data stored in the cloud storage server;

In this step, the data stored on the cloud storage server side includes one of the following: favorites information, history information, browser configuration information, note information, login manager information, message reminder information, key information, and other possible information.

Step S402, the cloud storage server sends condition information and command information to the push server, the condition information includes user identification information, such as the user name of the logged-in user or the machine hardware identifier of the user who is not logged in, and the condition information also includes the identification of the initiator the resource identifier of the client's connection to its corresponding socket server;

Step S403, the push server uses the same algorithm as in the distributor to calculate a value based on the user identification information, thereby obtaining the socket server allocated for the target client, and sends the condition information and command information to the socket server allocated for the target client. socket server, where the value is globally unique, that is, the connection identifier;

Step S404, the socket server queries the distribution information database in the distributor according to the user identification information in the condition information, and determines the resource identifier corresponding to the target client, excluding those identifying the originating client and its corresponding socket server the resource identifier for the connection;

Step S405, the socket server sends the command information to the target client (one or more) in connection with the target client according to the resource identifier.

(2) When the real-time synchronization is initiated by the initiating client, and the initiating client and the receiving client belong to different login users, that is, the condition information includes user identification information, as shown in Figure 5, the information push process includes:

Step S501, the initiating client initiates updating the data stored in the cloud storage server;

In this step, the data stored on the cloud storage server side includes one of the following: favorites information, history information, browser configuration information, note information, login manager information, message reminder information, key information, news information and/or user Generated information and more.

Step S502, the cloud storage server sends condition information and command information to the push server, where the condition information may include user identification information, such as the user name of a logged-in user or the machine hardware identifier of a non-logged-in user;

Step S503, the push server uses the same algorithm as in the distributor to calculate a value based on the user identification information, thereby obtaining the socket server allocated for the target client, and sends the condition information and command information to the socket server allocated for the target client. socket server, where the value is globally unique, that is, the connection identifier;

Step S504, the socket server queries the distribution information database in the distributor according to the user identification information in the condition information, and determines the resource identifier of the target client;

Step S505, according to the resource identifier, the corresponding socket server sends the notification message to the target client (one or more) in connection with the client, so far, the information pushing process ends.

(3) When the real-time synchronization is actively initiated by the cloud storage server, and the condition information includes the characteristic screening information of the target client, but does not include the user identification information, wherein the characteristic screening information can also be empty,

In this case, during the connection establishment phase, the connection request submitted by the browser client to the distributor also includes feature screening information, which corresponds to the user feature information stored in the distribution information database as before.

As shown in Figure 6, the information push process includes:

Step S601, the cloud storage server sends condition information and command information to the push server, the condition information includes feature screening information of the target client (such as the version number of a certain browser), and the command information is, for example, an instruction to notify the user to upgrade;

Step S602, the push server pushes the condition information and command information to all socket servers;

Step S603, each socket server submits a query request to the distribution information database of the distributor respectively, and the query request includes characteristic screening information; the distribution information database queries the user characteristic information of each browser client in the distribution information database according to the characteristic screening condition, Determine the resource identifier of the target client satisfying the characteristic filter condition, and return the resource identifier to each socket server that initiates the query;

Step S604, each socket server sends command information to the corresponding client according to the received resource identifier, so far, the information pushing process ends.

In order to further save system resources, the command information pushed by the push server 2 to the browser client 3 is a notification message. In this case, the browser client is also used to establish a connection with the cloud storage server after receiving the notification message pushed by the push server, and download the updated data content from the cloud storage server. Synchronize local data content. By transmitting notification messages, the amount of transmitted data can be reduced, and the occupation of system resources can be reduced.

Of course, the command information pushed by the push server to the target client can also be a content message, that is, the content message contains updated data content. In this case, after the target client receives the content message pushed by the push server, The updated data content is extracted from the content message, and the local data content is synchronized according to the extracted data content. The content message can be directly pushed to the client by transmitting the content message, and the information transmission is fast and the steps are simple.

In order to support multiple languages and call texts conveniently, an HTTP interface is used between the push server and the cloud storage server.

Based on the system for realizing browser data synchronization shown in FIG. 1 and FIG. 2 , the present invention further provides a method for realizing browser data synchronization. As shown in Figure 7, the method for implementing browser data synchronization includes:

Step S710, the cloud storage server sends condition information and command information to the push server when there is data update;

Step S720, the push server determines the target client among multiple browser clients according to the condition information, and sends the command information to the target client;

In step S730, the target client implements data synchronization with the cloud storage server according to the command information.

Further, before step S710, a socket connection is established between the browser client and the socket server, and the establishment process of the connection is shown in FIG. 3 , which will not be repeated here.

Further, in step S710, in the step where the cloud storage server sends condition information and command information to the push server when there is data update, if the condition information includes the user name of the logged-in user of the target client or the machine hardware identifier of the user who is not logged in, including The following two situations:

Situation 1: The originating client and the receiving client belong to the same user, and the user uses different devices (such as a mobile phone and a PC) to log in to the browser, and one of them (such as a PC) changes favorites, then the update needs to be synchronized to the same user's another device (mobile phone);

In this case, the initiating client first initiates modification of information about configurations, functions, or favorites or other information stored in the cloud storage server. Then the cloud storage server sends conditional information and command information to the push server, the command information includes content messages and notification messages, and the push server sends the command information to the target client through the socket server according to the condition information, wherein the target client side excludes the originating client. The information pushing process in this case is shown in FIG. 4 , which will not be repeated here.

Case 2: The initiating client and the receiving client do not belong to the same user, so that information exchange between different users through the client is realized.

Specifically, a user's client sends condition information and content messages to the cloud storage server, and the cloud storage server sends the condition information and related notification messages to the pusher, and the pusher sends the notification message to the destination according to the condition information. The client, and then the target client can access the cloud storage server to obtain content. The information pushing process in this case is shown in FIG. 5 , and will not be repeated here.

In addition, if the conditional information does not include the user identification information of the target client, but may include characteristic screening information, the following situations are also included:

Situation 3: The cloud storage server itself has data updates, and the browser client needs to synchronize data with the cloud storage server. The cloud storage server actively sends condition information and command information to the push server, for example:

1. The cloud storage server sends an update instruction to all browser clients of a certain version, so that all browser clients of this version can be upgraded to a new version, where the command information is a notification message for upgrading to a new version, and the condition is a certain The client version of the browser, that is, the feature filtering information is the version number of the browser client. Then, the push server sending the command information to the target client among the plurality of browser clients according to the condition information includes: the push server sends a notification message of upgrading to a new version to all browser clients of a certain version.

2. The cloud storage server pushes news messages to all browser clients, where the condition is all browser clients, that is, the feature screening information is empty, and the command information is content messages containing news messages; then the push server will send The sending of the command information to the target client among the plurality of browser clients includes: the push server sends the content message including the news message to all the browser clients. It should be understood that what is sent may also be a notification message.

3. The cloud storage server pushes the weather forecast to the browser clients in different regions, where the condition is the browser client in a certain region, that is, the feature screening information is the IP segment corresponding to the certain region, and the command information contains the weather forecast The push server sends the command information to the target client among the plurality of browser clients according to the condition information, including: the push server sends the content message containing the weather forecast to the browser client in a certain area. It should be understood that what is sent may also be a notification message.

The information pushing process in this case is shown in FIG. 6 , which will not be repeated here.

Based on the system for realizing browser data synchronization shown in FIG. 1 and FIG. 2 , the present invention further provides a browser client for realizing browser data synchronization. As shown in Figure 8, the browser client includes: a connection module, used to establish a connection relationship with the socket server through the distributor, and receive command information from the corresponding socket server; Information, execute its corresponding application operation. Wherein, the command information is a notification message or a content message.

As shown in Figure 8, the connection module further includes: a distributor connection submodule, which is used to submit a connection request to the distributor, the connection request at least includes user identification information, and receives the allocated socket returned by the distributor The connection information of the word server and the connection identifier; the socket connection submodule is used to establish a socket connection with the corresponding socket server according to the received connection information of the socket server and the connection identifier, and Receive command information from the corresponding socket server through the socket connection. Wherein, the user identification information is a user name of a login user or a machine hardware identification of a non-login user.

As shown in FIG. 8 , the browser client may further include: a cloud storage communication module, configured to communicate with the cloud storage server in response to an application operation of the application module.

To sum up, the system, method and browser client provided by the present invention for realizing browser data synchronization, by setting up a separate push server, when the browser-related content stored on the cloud storage server is updated, The command information can be sent to the target client among the multiple browser clients in a timely manner through the push server, which solves the problem that the browser client cannot be synchronized with the cloud storage server data in real time simply and effectively, thus simple and efficient Realized data synchronization between browser client and cloud storage server. Therefore, on the basis of the original architecture, the browser client can efficiently, proactively, and resource-savingly synchronize information with the cloud storage server in real time. The system and method can also be implemented on the basis of the original system architecture, effectively utilize the original architecture, and realize cost effectiveness.

In the method for realizing browser data synchronization of the present invention described above in conjunction with the accompanying drawings, during the connection establishment stage, if there are some browser clients maliciously sending requests to the distributor continuously, the distributor will correspondingly stop Allocate socket servers and corresponding connection identifiers to these users continuously, and store the allocation information in the distribution information repository continuously. However, these browser clients do not actually establish a connection, thus occupying a large amount of storage resources, resulting in a large waste of storage resources. Or there are some browser clients that do not make a request to the dispatcher, but try to connect to the socket server with an invalid connection identifier.

In order to prevent a large number of storage resources from being occupied and suspended and to prevent illegal connections, according to another embodiment of the present invention, a system for preventing malicious connections is proposed, and FIG. 9 shows a structural diagram of the system.

Referring to FIG. 9, the system for preventing malicious connections includes a browser client, a distributor and a socket server.

The browser client is used to send a connection request to the distributor, so as to request to establish a connection with the socket server, and establish a connection with the corresponding socket server according to the allocation of the distributor.

The distributor is used to receive the connection request sent by the browser client, and allocate a socket server for the browser client according to the connection request, and assign a globally unique connection identifier to the connection, and the distributor will allocate the socket The connection information of the word server and the connection identifier are sent to the browser client, and the information related to the connection request and the connection identifier are cached in the buffer. The information related to the connection request may include user identification information and user characteristic information included in the connection request.

The socket server is configured to receive the connection identifier from the browser client via the established connection with the browser client, and perform an operation on the received connection identifier according to the connection identifier cached in the buffer. Authenticate, and maintain or disconnect the connection according to the authentication result.

If the verification result of the connection identifier by the socket server is passed, the established connection is maintained, and if not passed, the connection is disconnected. The verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the buffer, if there is, the verification result is legal, otherwise it is illegal.

Establishing a connection between the browser client and the corresponding socket server according to the allocation of the distributor includes: establishing a connection between the browser client and the socket server according to the connection information and the connection identifier received from the distributor, and the connection is a TCP connection.

The buffer saves the information buffered in it for a predetermined period of time and then releases it. The predetermined period of time is preset to the buffer, and the size of the period of time can be set according to actual needs, for example, it can be 30 seconds, and the buffer automatically discards the stored content exceeding the duration to release the storage space, which can be set according to It is actually necessary to set the length of the time period.

The cache can be implemented using any suitable caching technology, for example, redis can be used. Redis can maintain an information list with the connection identifier as the key, which can include connection identifier, user identification information, machine hardware identification, version number and other information. Redis is a key-value storage system and a high-performance key-value database. It supports relatively more types of stored values, including string (string), list (linked list), set (set) and zset (ordered set) ).

If the browser client does not send a connection identifier to the socket server within another predetermined period of time after the browser client establishes a connection with the socket server, the socket server disconnects the established connection . The predetermined time period is preset, for example, may be 10 seconds, and the length of the time period may be set according to actual needs. By setting the predetermined time period, system resources can be saved and generation of malicious connections can be prevented.

The dispatcher assigns the socket server to the browser client according to the connection request, including: the dispatcher calculates a value based on the user identification information contained in the connection request received from the browser client using a preset algorithm, according to which the value is A browser client that submits a connection request allocates a socket server. This value is globally unique and is the connection identifier.

The user identification information includes: a user name of a login user, and a machine hardware identification of a non-login user. For a logged-in user, the user identification information may include a user name, and for a non-login user, the user identification information may include the user's machine hardware ID. For a logged-in user, the user identification information may be a character string. Wherein, in addition to the username of the logged-in user, the character string also includes information such as login time and verification characters. The username is the user unique identification number, which is a number used to represent a user. The verification character is generated according to the user name, and it can be determined whether the user identification information has been changed through the verification character. For non-logged-in users, the user identification information may include the non-logged-in user's machine hardware ID, where the machine hardware ID is a unique machine ID, which is generated by the client through the hash of the user's machine hardware and system configuration.

In addition, for subsequent target client screening, the connection request may also include user feature information, such as IP address information, browser version information, or user feature information such as user classification information. Wherein, user feature information such as browser version number, user classification information, or IP address information can be used for subsequent browser client screening.

When the browser client establishes a connection with the socket server, the socket server obtains a resource identifier identifying the connection relationship between the socket server and the browser client.

After the socket server successfully verifies the connection identifier, it extracts the information related to the connection request and the connection identifier from the buffer, and stores the extracted information together with the obtained resource identifier into the distributor database.

The database can be implemented using any suitable database, for example, a document type database can be selected, and the present invention preferably selects a database with no limitation on the number of data columns, so that the data items are flexible and changeable, which is beneficial to the lack and expansion of data items compatible. The database can be implemented, for example, using a MongoDB cluster, but it can also be implemented using a CouchDB or similar database. Specifically, the use of clusters can achieve the following advantages: 1. Distributed storage to improve write update speed; 2. Distributed query computing to improve query efficiency; 3. Redundant backup within the cluster to improve data reliability.

The system further includes a cloud storage server end and a push server, wherein: the cloud storage server end is used to send condition information and command information to the push server when there is data update; the push server is used to determine according to the condition information target client, and send command information to the target client through the socket server; and the target client is used to realize data synchronization between it and the cloud storage server according to the command information, and the target client is a plurality of browser clients client in the terminal.

The system for preventing malicious connections of the present invention constructs the distribution information repository of the distributor to include a buffer and a database, wherein a predetermined period of time is preset for the buffer, and the cache saves the information cached therein for the predetermined time. release; on the other hand, within another predetermined period of time after the browser client establishes a connection with the socket server, if the connection identifier is not sent to the socket server, the socket server disconnects the established connection, so as to eliminate a large number of storage resources occupied and shelved and prevent the generation of illegal connections.

According to yet another embodiment of the present invention, a method for preventing malicious connections is also proposed, and FIG. 10 shows a flow chart of the method.

Referring to FIG. 10 , the method for preventing malicious connection includes steps: Step S1001 , the browser client sends a connection request to the distributor to request to establish a connection with the socket server.

Step S1002, the distributor receives the connection request sent by the browser client, and allocates a socket server for the browser client according to the connection request, and allocates a globally unique connection identifier for the connection, and the distributor distributes the allocated The connection information of the socket server and the connection identifier are sent to the browser client, and the information related to the connection request and the connection identifier are cached in the buffer.

In this step, the distributor calculates a value based on the user identification information contained in the connection request received from the browser client using a preset algorithm, and assigns a socket server to the browser client submitting the connection request according to the value . This value is globally unique and is the connection identifier. By setting the predetermined time period, system resources can be saved and generation of malicious connections can be prevented.

The user identification information includes: a user name of a login user, and a machine hardware identification of a non-login user. For a logged-in user, the user identification information may include a user name, and for a non-login user, the user identification information may include the user's machine hardware ID. For a logged-in user, the user identification information may be a character string. Wherein, in addition to the username of the logged-in user, the character string also includes information such as login time and verification characters. The username is the user unique identification number, which is a number used to represent a user. The verification character is generated according to the user name, and it can be determined whether the user identification information has been changed through the verification character. For non-logged-in users, the user identification information may include the non-logged-in user's machine hardware identification, where the machine hardware identification is a unique identification of the machine, which is generated by the browser client through the hash of the user's machine hardware and system configuration.

In addition, for subsequent target client screening, the connection request may also include user feature information, such as IP address information, browser version information, or user feature information such as user classification information. Wherein, user characteristic information such as browser version number, user classification information, or IP address information can be used for subsequent client screening.

The buffer saves the information buffered therein for a predetermined period of time and then releases it. The predetermined time period is preset for the buffer, and the size of the time period can be set according to actual needs, for example, it can be 30 seconds, and the buffer automatically discards the stored content exceeding the time length to release the storage space.

The cache can be implemented using any suitable caching technology, for example, it can be implemented using Redis. Redis can maintain an information list with resource identifiers as keywords, which can include user identification information, machine hardware identification, version number and other information.

In step S1003, the browser client establishes a connection with the corresponding socket server according to the allocation of the distributor.

When the browser client establishes a connection with the socket server, the socket server obtains a resource identifier identifying the connection relationship between the socket server and the browser client.

Step S1004, the socket server receives the connection identifier from the browser client via the established connection with the browser client, and assigns the received connection identifier to the received connection identifier according to the connection identifier cached in the buffer. Authentication is performed, and the connection is maintained or disconnected according to the authentication result.

If the browser client does not send a connection identifier to the socket server within another predetermined period of time after the browser client establishes a connection with the socket server, the socket server disconnects the established connection . The predetermined time period is preset, for example, may be 10 seconds, and the length of the time period may be set according to actual needs.

In this step, if the verification result of the connection identifier by the socket server is passed, the established connection is maintained, and if not passed, the connection is disconnected. The verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the buffer, if there is, the verification result is legal, otherwise it is illegal.

After the socket server successfully verifies the connection identifier, it extracts the information related to the connection request and the connection identifier from the buffer, and stores the extracted information together with the obtained resource identifier into the distributor database.

The database can be implemented using any suitable database, for example, a document type database can be selected, and the present invention preferably selects a database with no limitation on the number of data columns, so that the data items are flexible and changeable, which is beneficial to the lack and expansion of data items compatible. The database can be implemented, for example, using a MongoDB cluster, but it can also be implemented using a CouchDB or similar database. The method further includes step S1005, the cloud storage server sends condition information and command information to the push server when there is data update.

Step S1006, the push server determines the target client according to the condition information, and sends the command information to the target client through the socket server.

Step S1007, the target client implements data synchronization with the cloud storage server according to the command information, and the target client is a client among multiple browser clients.

According to yet another embodiment of the present invention, a system for preventing malicious connections is also provided. The system includes: cloud storage server side, push server and multiple browser clients, distributor and socket server.

The cloud storage server is used to send condition information and command information to the push server when there is data update.

The push server is used to determine the target client among the plurality of browser clients according to the condition information, and send the command information to the target client through the socket server.

The target client is used to realize data synchronization with the cloud storage server according to the command information.

The distributor connects multiple browser clients and the socket server, is used to receive the connection requests sent by the multiple browser clients to connect with the socket server, and provides the browser client with the connection request according to the connection request. assigning a socket server, and assigning a globally unique connection identifier for the connection, the distributor sends the connection information of the assigned socket server and the connection identifier to the plurality of browser clients, and Information related to the connection request and the connection identifier are cached in the cache.

The distributor calculates a value based on the user identification information contained in the connection request received from the browser client using a preset algorithm, and assigns a socket server to the browser client that submits the connection request according to the value, wherein the The value is globally unique, the connection identifier. The user identification information includes: a user name of a login user, and a machine hardware identification of a non-login user.

The socket server connects the distributor, the push server and a plurality of browser clients, and is used to receive and verify the connection identifier from the plurality of browser clients, and maintain or disconnect the connection identifier according to the verification result. The connections between the multiple browser clients are used to forward the command information from the push server to the target client. The verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the buffer, if there is, the verification result is legal, otherwise it is illegal.

Wherein the connection is a TCP connection, if the verification result of the connection identifier by the socket server is passed, the established connection is maintained, and if not passed, the connection is disconnected.

The above buffer stores the information cached therein for a first predetermined period of time and then releases it. If the browser client does not send the connection identifier to the socket server within a second predetermined period of time after the browser client establishes a connection with the socket server, the The socket server disconnects said established connection.

When the browser client establishes a connection with the socket server, the socket server obtains a resource identifier identifying the connection relationship between the socket server and the browser client.

After the socket server successfully verifies the connection identifier, it extracts the information related to the connection request and the connection identifier from the buffer, and stores the extracted information together with the obtained resource identifier into the distributor database.

The above-mentioned target client is a client in multiple browser clients.

According to yet another embodiment of the present invention, a distributor for distributing multiple socket servers is also provided, and FIG. 11 is a structural block diagram of the distributor. Referring to Fig. 11, the distributor includes: a receiver 1101 for receiving a connection request sent by a browser client; a distributor 1102 for assigning a socket server to the browser client according to the connection request, and for the browser client The connection allocates a globally unique connection identifier; the sender 1103 is used to send the connection information of the allocated socket server and the connection identifier to the browser client; the buffer 1104 is used to cache the connection information associated with the connection Request-related information and the connection identifier; and 1105 database, used to store the information related to the connection request, the connection identifier, and the socket server obtained by the socket server after the connection identifier is verified successfully The resource identifier associated with the browser client connection. The buffer 1104 saves the information buffered therein for a first predetermined period of time and then releases it.

According to yet another embodiment of the present invention, a method for distributing multiple socket servers is also provided, and FIG. 12 is a flowchart of the method. Referring to Fig. 12, the method includes steps: step 1201, receiving a connection request sent by the browser client; step 1202, assigning a socket server to the browser client according to the connection request, and assigning a globally unique connection to the connection Identifier; step 1203, send the connection information of the allocated socket server and the connection identifier to the browser client; step 1204, cache the information related to the connection request and the connection identifier in the buffer character; and step 1205, after the successful verification of the connection identifier, store the information related to the connection request, the connection identifier, and the socket server obtained by the socket server to identify the connection relationship between the socket server and the browser client The resource identifier for .

Wherein, the buffer saves the information buffered therein for a first predetermined period of time and then releases it.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in related devices according to the embodiments of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

This paper discloses A1, a system for preventing malicious connections, the system includes: a browser client, used to send a connection request to the distributor to request to establish a connection with the socket server, and according to the distribution and The corresponding socket server establishes a connection; the distributor is used to receive the connection request sent by the browser client, and allocate a socket server to the browser client according to the connection request, and assign a globally unique connection to the connection identifier, the distributor sends the allocated socket server connection information and the connection identifier to the browser client, and caches the information related to the connection request and the connection identifier in the buffer; The socket server is configured to receive the connection identifier from the browser client via the established connection with the browser client, and to assign the received connection identifier to the received connection identifier according to the connection identifier cached in the buffer. Authentication is performed, and the connection is maintained or disconnected according to the authentication result. A2. The system according to A1, wherein the browser client establishes a connection with the corresponding socket server according to the distribution of the distributor, including: the browser client receives the connection from the distributor information and a connection identifier to establish a connection with the socket server. A3. The system according to A2, wherein the connection is a Transmission Control Protocol TCP connection, and if the verification result of the connection identifier by the socket server is passed, then the established connection is maintained, if If not passed, the connection is disconnected. A4. The system according to any one of A1-A3, wherein the buffer saves the information buffered therein for a first predetermined period of time and then releases it. A5. The system according to A4, wherein if the browser client does not connect to the socket server within a second predetermined period of time after the browser client establishes a connection with the socket server If the server sends the connection identifier, the socket server disconnects the established connection. A6. The system according to A1, wherein the distributor allocates a socket server for the browser client according to the connection request, and assigning a globally unique connection identifier for the connection comprises: The user identification information included in the connection request received by the browser client is calculated using a preset algorithm to obtain a connection identifier, and a socket server is assigned to the browser client that submits the connection request according to the connection identifier. A7. The system according to A1, wherein, when the browser client establishes a connection with the socket server, the socket server obtains an identification of the connection relationship between the socket server and the browser client The resource identifier for . A8. The system according to A1, wherein, after the socket server successfully verifies the connection identifier, it extracts the information related to the connection request and the connection identifier from the cache, and the extracted information Together with the obtained resource identifier, it is stored in the distributor's database. A9. The system according to A8, wherein the user identification information includes: a user name of a logged-in user, and a machine hardware ID of a non-logged-in user. A10. The system according to A4, wherein the verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the cache, if there is , the verification result is legal, otherwise it is illegal. A11. The system according to any one of A1-A10, wherein the system further includes a cloud storage server end and a push server, wherein: the cloud storage server end is used to download to the push server when there is data update sending condition information and command information; the push server is configured to determine a target client according to the condition information, and send the command information to the target client through the socket server; and the target client , used to implement data synchronization with the cloud storage server according to the command information, and the target client is a client among the plurality of browser clients.

This paper discloses B12, a method for preventing malicious connections, the method comprising: the browser client sends a connection request to the distributor to request to establish a connection with the socket server; the distributor receives the connection request sent by the browser client, And assign a socket server to the browser client according to the connection request, and assign a globally unique connection identifier to the connection, and the distributor sends the connection information of the assigned socket server and the connection identifier to all The browser client, and the information related to the connection request and the connection identifier are cached in the buffer; the browser client establishes a connection with the corresponding socket server according to the allocation of the distributor; The socket server receives the connection identifier from the browser client via the established connection with the browser client, and verifies the received connection identifier according to the connection identifier cached in the cache, according to The verification result maintains or disconnects the connection. B13. The method according to B12, wherein the browser client establishes a connection with the corresponding socket server according to the distribution of the distributor, including: the browser client receives the connection from the distributor information and a connection identifier to establish a connection with the socket server. B14. The method according to B13, wherein the connection is a Transmission Control Protocol TCP connection, and the method further includes the step of: if the verification result of the connection identifier by the socket server is passed, then keep the If the established connection is not passed, the connection is disconnected. B15. The method according to any one of B12-B14, wherein the method further includes a step: the buffer saves the information cached therein for a first predetermined period of time and then releases it. B16. The method according to B15, wherein the method further includes the step: if the browser client does not sending the connection identifier to the socket server, and the socket server disconnects the established connection. B17. The method according to B12, wherein the distributor allocates a socket server for the browser client according to the connection request, and assigning a globally unique connection identifier for the connection comprises: The user identification information included in the connection request received by the browser client is calculated using a preset algorithm to obtain a connection identifier, and a socket server is assigned to the browser client that submits the connection request according to the connection identifier. B18. The method according to B12, wherein the method further includes the step: when the browser client establishes a connection with the socket server, the socket server obtains the identification of the socket server and The resource identifier of the browser client connection relationship. B19. The method according to B12, wherein the method further includes the step: after the socket server successfully verifies the connection identifier, extracts the information related to the connection request and the connection identifier from the cache , and store the extracted information together with the obtained resource identifier into the database of the distributor. B20. The method according to B19, wherein the user identification information includes: a user name of a logged-in user, and a machine hardware identifier of a non-logged-in user. B21. The method according to B15, wherein the verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the cache, if there is If saved, the verification result is legal, otherwise it is illegal. B22. The method according to any one of B12-B21, wherein the method further includes the step: the cloud storage server sends condition information and command information to the push server when there is data update; the push server Determine the target client according to the condition information, and send the command information to the target client through the socket server; and the target client realizes data synchronization with the cloud storage server according to the command information , the target client is a client in multiple browser clients.

This paper discloses C23, a system for preventing malicious connections in real-time browser synchronization, the system includes a cloud storage server, a push server, multiple browser clients, a distributor, and a socket server, wherein: the cloud storage The server end is used to send condition information and command information to the push server when there is data update; the push server is used to determine the target client among the plurality of browser clients according to the condition information, and Send the command information to the target client through the socket server; and the target client is used to synchronize data with the cloud storage server according to the command information; the distributor connects the multiple A browser client and a socket server, configured to receive connection requests sent by the plurality of browser clients to connect to the socket server, and allocate sockets to the browser clients according to the connection requests server, and allocate a globally unique connection identifier for the connection, the distributor sends the connection information of the allocated socket server and the connection identifier to the multiple browser clients, and sends the connection request-related information to the multiple browser clients. The information and the connection identifier are cached in the cache; the socket server is connected to the distributor, the push server and a plurality of browser clients, and is used to receive the connection identifier from the plurality of browser clients and perform verification, maintain or disconnect the connections with the plurality of browser clients according to the verification results, and forward the command information from the push server to the target client.

Claims (23)

1. A system for preventing malicious connections, the system comprising: The browser client is used to send a connection request to the distributor to request to establish a connection with the socket server, and to establish a connection with the corresponding socket server according to the distribution of the distributor; The distributor is used to receive the connection request sent by the browser client, and assign a socket server to the browser client according to the connection request, and assign a globally unique connection identifier to the connection. The socket server connection information and the connection identifier are sent to the browser client, and the information related to the connection request and the connection identifier are cached in the buffer; The socket server is configured to receive the connection identifier from the browser client via the established connection with the browser client, and to assign the received connection identifier to the received connection identifier according to the connection identifier cached in the buffer. Authentication is performed, and the connection is maintained or disconnected according to the authentication result. 2. The system according to claim 1, wherein said browser client establishes a connection with a corresponding socket server according to the assignment of said distributor, comprising: said browser client receives said browser client from said distributor according to said Establish a connection with the socket server according to the connection information and the connection identifier. 3. The system according to claim 2, wherein the connection is a Transmission Control Protocol (TCP) connection, and if the verification result of the connection identifier by the socket server is passed, the established connection is maintained , and if not passed, disconnect said connection. 4. The system according to claim 1, wherein the cache stores the information cached therein for a first predetermined period of time before releasing it. 5. The system according to claim 4, wherein if the browser client does not send a message to the socket server within a second predetermined period of time after the browser client establishes a connection with the socket server. If the socket server sends the connection identifier, the socket server disconnects the established connection. 6. The system according to claim 1, wherein the distributor allocates a socket server for the browser client according to the connection request, and assigning a globally unique connection identifier for the connection comprises: the distributor According to the user identification information contained in the connection request received from the browser client, the connection identifier is calculated by using a preset algorithm, and the socket server is allocated to the browser client submitting the connection request according to the connection identifier. 7. The system according to claim 1, wherein, when the browser client establishes a connection with the socket server, the socket server obtains the identification of the socket server and the browser client The resource identifier for the connection relationship. 8. The system according to claim 1, wherein, after the socket server verifies the connection identifier successfully, it extracts information related to the connection request and the connection identifier from the buffer, and extracts the The information is stored in the distributor's database together with the obtained resource identifier. 9. The system according to claim 6, wherein the user identification information includes: a user name of a logged-in user, and a machine hardware ID of a non-logged-in user. 10. The system according to claim 4, wherein the verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the buffer, if there is , the verification result is legal, otherwise it is illegal. 11. The system according to any one of claims 1-10, wherein the system further comprises a cloud storage server and a push server, wherein: The cloud storage server end is used to send condition information and command information to the push server when there is data update; The push server is configured to determine a target client according to the condition information, and send the command information to the target client through the socket server; And the target client is used to realize data synchronization with the cloud storage server according to the command information, the target client is a client among the plurality of browser clients. 12. A method of preventing malicious connections, the method comprising: The browser client sends a connection request to the distributor to request to establish a connection with the socket server; The distributor receives the connection request sent by the browser client, and allocates a socket server for the browser client according to the connection request, and allocates a globally unique connection identifier for the connection, and the distributor distributes the allocated socket sending the connection information of the server and the connection identifier to the browser client, and caching the information related to the connection request and the connection identifier in the cache; The browser client establishes a connection with the corresponding socket server according to the distribution of the distributor; the socket server receives the connection identifier from the browser client via the established connection with the browser client, and verifies the received connection identifier according to the connection identifier cached in the cache, The connection is maintained or disconnected according to the verification result. 13. The method according to claim 12, wherein said browser client establishes a connection with a corresponding socket server according to the distribution of said distributor comprises: said browser client according to said distribution device received from the distributor Establish a connection with the socket server according to the connection information and the connection identifier. 14. The method according to claim 13, wherein the connection is a Transmission Control Protocol (TCP) connection, and the method further comprises the step of: if the verification result of the connection identifier by the socket server is passed, then The established connection is maintained, and if not passed, the connection is disconnected. 15. The method according to claim 12, wherein the method further comprises the step of: the buffer saves the information buffered therein for a first predetermined period of time and then releases it. 16. The method according to claim 15, wherein the method further comprises the step of: if the browser client establishes a connection with the socket server within a second predetermined period of time, the browser client If the client does not send the connection identifier to the socket server, the socket server disconnects the established connection. 17. The method according to claim 12, wherein the distributor allocates a socket server for the browser client according to the connection request, and assigning a globally unique connection identifier for the connection comprises: The distributor calculates the connection identifier according to the user identification information contained in the connection request received from the browser client using a preset algorithm, and allocates a socket to the browser client submitting the connection request according to the connection identifier server. 18. The method according to claim 12, wherein the method further comprises the step of: when the browser client establishes a connection with the socket server, the socket server obtains an The resource identifier of the server and browser client connection relationship. 19. The method of claim 12, wherein the method further comprises the steps of: After the socket server successfully verifies the connection identifier, it extracts the information related to the connection request and the connection identifier from the buffer, and stores the extracted information together with the obtained resource identifier in the Distributor's database. 20. The method according to claim 17, wherein the user identification information includes: a user name of a logged-in user, and a machine hardware ID of a non-logged-in user. 21. The method according to claim 15, wherein the verification refers to verifying whether the connection identifier received by the socket server from the browser client submitting the request is stored in the buffer, if there is If saved, the verification result is legal, otherwise it is illegal. 22. The method according to any one of claims 12-21, wherein the method further comprises the steps of: The cloud storage server sends condition information and command information to the push server when there is data update; The push server determines the target client according to the condition information, and sends the command information to the target client through the socket server; And the target client implements data synchronization with the cloud storage server according to the command information, and the target client is a client among the plurality of browser clients. 23. A system for preventing malicious connections in browser real-time synchronization, the system includes cloud storage server, push server and multiple browser clients, distributor and socket server, wherein: The cloud storage server end is used to send condition information and command information to the push server when there is data update; The push server is configured to determine a target client among the plurality of browser clients according to the condition information, and send the command information to the target client through a socket server; And the target client is used to realize data synchronization with the cloud storage server according to the command information; A distributor, which connects the multiple browser clients and the socket server, is used to receive the connection requests sent by the multiple browser clients to connect to the socket server, and provide the socket server according to the connection request The browser client allocates a socket server, and allocates a globally unique connection identifier for the connection, and the distributor sends the connection information of the allocated socket server and the connection identifier to the plurality of browser clients , and cache the information related to the connection request and the connection identifier in the cache; A socket server, which is connected to the distributor, the push server and a plurality of browser clients, is used to receive and verify the connection identifiers from the plurality of browser clients, and maintain or disconnect the connection identifiers according to the verification results. Opening connections with the plurality of browser clients, and for forwarding the command information from the push server to the target client.