CN104735086A - A method and device for securely downloading files - Google Patents

Abstract

The invention provides a method and a device for safely downloading a file, wherein the method comprises the following steps: sending an analysis request to a domain name analysis server, and receiving a data file sent by a data server; carrying out verification calculation on the data file to obtain a verification value of the data file; and comparing the calculated check value with a preset data file check value, and switching to an HTTPS channel to download the data file again if the calculated check value is different from the preset check value. The invention can effectively avoid downloading unsafe files to influence the normal operation of the terminal, and can effectively download correct data files through the HTTPS channel in time when abnormal.

Description

A method and device for securely downloading files

technical field

The invention belongs to the field of the Internet, in particular to a method and device for safely downloading files.

Background technique

With the development of Internet technology, users can use terminals such as mobile phones, computers, or PADs to obtain required data, such as browsing web pages, downloading pictures, or applications, through wired or wireless networks.

When a terminal browses the network or downloads an application program through the network, the terminal usually submits an access request. After receiving the access request, the domain name server analyzes the domain name address in the access request, and searches for To the address corresponding to the accessed domain name address, the domain name server sends the analysis result back to the terminal, and the terminal accesses the server according to the received address, so as to obtain the data sent by the server.

When other illegal users intercept the domain name resolution request sent to the domain name resolution server, the user's request is resolved to the address of other servers, allowing the user to access data in other servers, and may cause the user to download files containing viruses, affecting the normal operation of the terminal run.

Contents of the invention

The purpose of the present invention is to provide a method for securely downloading files to solve the problem that when domain name hijacking occurs in the prior art, the user's request is resolved to the address of other servers, so that the user can access the data in other servers, and may make the user download files containing Virus files affect the normal operation of the terminal.

In a first aspect, an embodiment of the present invention provides a method for securely downloading a file, the method comprising:

Send a resolution request to the domain name resolution server, and receive the data server address returned by the resolution server;

According to the address of the data server, send a data download request to the data server, and receive the data file sent by the data server;

Perform verification calculation on the data file to obtain the verification value of the data file;

Compare the calculated check value with the preset check value of the data file. If the calculated check value is different from the preset check value, switch to the HTTPS channel to re-download the data file.

In combination with the first aspect, in the first possible implementation manner of the first aspect, the step of performing verification calculation on the data file to obtain the verification value of the data file is specifically:

Perform verification calculation on the data at the predetermined position and the predetermined size of the received data file, and obtain the verification value of the data at the predetermined position and the predetermined size.

With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the predetermined location is a downloaded first part of the data file.

With reference to the first aspect, in the third possible implementation manner of the first aspect, in the comparison of the calculated check value with the preset check value of the data file, if the calculated check value is compared with the preset check value If the check values are different, after switching to the HTTPS channel to re-download the data file step, the method also includes:

Send a prompt message of domain name hijacking to the user.

With reference to the first aspect, in a second possible implementation manner of the first aspect, the step of performing verification calculation on the data file specifically includes: calculating the MD5 value of the data file as the verification value of the data file.

In a second aspect, an embodiment of the present invention provides a device for securely downloading files, the device comprising:

A resolution request unit, configured to send a resolution request to the domain name resolution server, and receive the data server address returned by the resolution server;

A data receiving unit, configured to send a data download request to the data server according to the address of the data server, and receive a data file sent by the data server;

A data verification unit, configured to perform verification calculation on the data file to obtain a verification value of the data file;

Check value comparison unit, used to compare the calculated check value with the preset check value of the data file, if the calculated check value is different from the preset check value, switch to the HTTPS channel to re-download the data document.

With reference to the second aspect, in the first possible implementation manner of the second aspect, the data verification unit is specifically configured to:

Perform verification calculation on the data at the predetermined position and the predetermined size of the received data file, and obtain the verification value of the data at the predetermined position and the predetermined size.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the predetermined location is a downloaded first part of the data file.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the device further includes:

The switching unit is used to send a prompt message of domain name hijacking to the user.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the data verification unit is specifically configured to: calculate the MD5 value of the data file as a verification value of the data file.

In the present invention, after the terminal sends a data download request, the domain name resolution server will analyze the request of the terminal to obtain the address of the data server corresponding to the data file, and the terminal will download the data file according to the address of the data server, and perform Check, if not the same, switch to the HTTPS channel to re-download the data file, so as to effectively avoid downloading unsafe files, which will affect the normal operation of the terminal, and can be downloaded effectively through the HTTPS channel in time when there is an exception correct data file.

Description of drawings

FIG. 1 is a schematic diagram of a file downloading method in the prior art.

Fig. 2 is the implementation flowchart of the safe download method of the file provided by the first embodiment of the present invention;

Fig. 3 is the implementation flowchart of the safe downloading method of the file provided by the second embodiment of the present invention;

Fig. 4 is a schematic structural diagram of an apparatus for securely downloading files provided by a third embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The purpose of the embodiments of the present invention is to provide a safe file download method to solve the problem that virus files may be downloaded due to domain name hijacking in the prior art, resulting in user terminals, such as computers or mobile phones, not operating normally, or even stealing The user's private information poses a threat to the user's property. As shown in Figure 1, it is a schematic diagram of data file downloading in the prior art. After the user sends a data file download request, it is resolved by DNS (domain name resolution server A), and returns the server address of the file to be downloaded, so as to go to the data server A Download the data file; when the domain name server A is hijacked, the false domain name resolution server B returns a wrong address, and when the user downloads the file to the data server B according to the wrong address, it may be downloaded to an illegal user setting. If the user runs the file without knowing it, the terminal will be infected with the virus, causing the terminal to malfunction, or the privacy of the terminal to be stolen.

In order to overcome the above problems, the present invention provides a method for safely downloading files, said method comprising: sending a resolution request to a domain name resolution server, and receiving the data server address returned by the resolution server; The data server sends a data download request, receives the data file sent by the data server; performs check calculation on the data file to obtain the check value of the data file; checks the calculated check value with the preset data file If the calculated verification value is different from the preset verification value, switch to the HTTPS (English full name is Hyper Text Transfer Protocol over Secure Socket Layer, Chinese full name is Secure Socket Layer Hypertext Transfer Protocol) channel Download the data file again.

After the terminal of the present invention sends a data download request, the domain name resolution server will analyze the request of the terminal to obtain the address of the data server corresponding to the data file, and the terminal will download the data file according to the address of the data server, and verify the downloaded file. If not, switch to the HTTPS channel to re-download the data file, so as to avoid downloading unsafe files and affect the normal operation of the terminal, and can effectively download the correct data file in time through the HTTPS channel in case of abnormality. It will be described in detail below in conjunction with the accompanying drawings.

Embodiment one:

Fig. 2 shows the implementation process of the secure download method for files provided by the first embodiment of the present invention, which is described in detail as follows:

In step S201, send a resolution request to the domain name resolution server, and receive the data server address returned by the resolution server.

Specifically, the embodiment of the present invention sends a resolution request to the domain name resolution server, generally a download request is sent through an HTTP channel.

Described HTTP (English full name is Hyper Text Transfer Protocol, Chinese full name is Hypertext Transfer Protocol) channel, is used for transferring hypertext from WWW server to the transmission protocol of local browser. It can make browsers more efficient and reduce network transfers. It not only ensures that the computer transmits hypertext documents correctly and quickly, but also determines which part of the document to transmit, and which part of the content is displayed first (such as text before graphics), etc. That is, when the HTTP channel is used for file download, efficient file download can be realized.

The terminal sends a resolution request, that is, a resolution request for the address of the data server. According to the characteristics of domain name hijacking in the prior art, if the DNS of the domain name server is hijacked, a wrong download address may be returned. That is, the downloaded file corresponding to the returned download address is inconsistent with the downloaded file corresponding to the download address expected by the user.

In step S202, according to the address of the data server, a data download request is sent to the data server, and a data file sent by the data server is received.

After the domain name resolution server parses the download request, the address of the data server is obtained, and the terminal downloads the file according to the received address of the data server.

In this step, if DNS hijacking occurs, the downloaded file may be a virus file or other illegal files; if DNS hijacking does not occur, the user can quickly and effectively download the desired file through the HTTP channel.

In step S203, check calculation is performed on the data file to obtain a check value of the data file.

In order to detect whether domain name hijacking occurs, the present invention verifies downloaded data files, and obtains a verification value through verification calculation.

The verification calculation can be verified by calculating the MD5 value.

Among them, the MD5 value, the English full name is Message Digest Algorithm MD5, and the Chinese name is the fifth edition of the message digest algorithm. The MD5 algorithm has the following characteristics:

1. Compressibility: For any length of data, the length of the calculated MD5 value is fixed.

2. Easy to calculate: It is easy to calculate the MD5 value from the original data.

3. Anti-modification: Any modification to the original data, even if only one byte is modified, will result in a very different MD5 value.

4. Weak anti-collision: Knowing the original data and its MD5 value, it is very difficult to find a data with the same MD5 value (that is, forged data).

5. Strong anti-collision: It is very difficult to find two different data so that they have the same MD5 value.

Due to the above characteristics of the MD5 value, the accuracy of the verification result is very high.

In step S204, the calculated check value is compared with the preset check value of the data file, and if the calculated check value is different from the preset check value, switch to the HTTPS channel to re-download the data file.

The preset check value can be the MD5 value provided by the server, displayed on the server page, or sent to the terminal or the user in other ways, so that the user can compare the calculated check value with the preset check value. value for comparison.

When the calculated check value is different from the preset check value, it means that the currently downloaded data is abnormal data, and an error file download caused by illegal analysis may be requested.

When the file is wrongly downloaded, the file is re-downloaded through the HTTPS channel. Wherein, the HTTPS channel is based on the addition of SSL (English full name is SecureSockets Layer, Chinese full name is Secure Sockets Layer) protocol on the basis of HTTP. SSL relies on certificates to verify the identity of the server, and is used for communication between the browser and the server. Communication encryption.

Of course, the embodiment of the present invention can also send an alarm prompt message to the user, prompting that there is anomaly in the current network, such as some common phishing hotspots, etc., reminding the user to pay attention to the confidentiality of data privacy.

The invention re-downloads the data file through the HTTPS channel, which can avoid damage to the terminal under special circumstances, and is beneficial to the data security of the terminal.

Embodiment two:

Fig. 2 shows the implementation flow of the secure download method for files provided by the second embodiment of the present invention, which is described in detail as follows:

In step S301, send a resolution request to the domain name resolution server, and receive the data server address returned by the resolution server.

In step S302, according to the address of the data server, a data download request is sent to the data server, and a data file sent by the data server is received.

Steps S301-302 are basically the same as steps S201-202 in Embodiment 1, and will not be repeated here.

In step S303, a verification calculation is performed on the data at the predetermined position and the predetermined size of the received data file, and a verification value of the data at the predetermined position and the predetermined size is obtained.

Specifically, in the embodiment of the present invention, by setting the data of the specified size at the specified location of the downloaded data file to be verified, such as verifying the first 8K data downloaded, it is possible to avoid performing verification calculations on the entire data file , which can improve the efficiency of verification.

In a preferred implementation manner, the predetermined location is the downloaded first part of the data file. The advantage of this is that the validity of the file can be verified by downloading a small number of data files. Compared with the method of downloading the entire file for verification, it can greatly improve the verification efficiency and greatly save the download time. traffic, and can detect abnormal download conditions in a more timely manner.

In step S304, the calculated check value is compared with the preset check value of the data file, and if the calculated check value is different from the preset check value, switch to the HTTPS channel to re-download the data file.

Compared with Embodiment 1, the embodiment of the present invention differs in that the embodiment of the present invention specifically limits the verification of the downloaded data of a specified size at a specified location, especially the verification of the previous part of the downloaded data, which can While improving the verification efficiency, it can also greatly save the download traffic, avoid the waste of traffic, and make it possible to find abnormal downloads in a more timely manner.

Embodiment three:

FIG. 4 shows a schematic structural diagram of a device for securely downloading files provided by the third embodiment of the present invention, which is described in detail as follows:

The safe download device of the file described in the embodiment of the present invention comprises:

A resolution request unit 401, configured to send a resolution request to the domain name resolution server, and receive the data server address returned by the resolution server;

A data receiving unit 402, configured to send a data download request to the data server according to the address of the data server, and receive a data file sent by the data server;

A data verification unit 403, configured to perform verification calculation on the data file to obtain a verification value of the data file;

The verification value comparison unit 404 is used to compare the calculated verification value with the preset data file verification value, and if the calculated verification value is different from the preset verification value, then switch to the HTTPS channel to re-download data file.

Preferably, the data verification unit is specifically used for:

Perform verification calculation on the data at the predetermined position and the predetermined size of the received data file, and obtain the verification value of the data at the predetermined position and the predetermined size.

Preferably, the predetermined location is the downloaded first part of the data file.

Preferably, the device also includes:

The switching unit is used to send a prompt message of domain name hijacking to the user.

Preferably, the data verification unit is specifically configured to: calculate the MD5 value of the data file as the verification value of the data file.

The device for securely downloading files described in the embodiments of the present invention corresponds to the method for securely downloading files described in Embodiments 1 and 2, and will not be repeated here.

In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (10)

1. a method for safely downloading for file, is characterized in that, described method comprises:

Analysis request is sent to domain name resolution server, and according to receiving the data server address returned by resolution server;

According to described data server address, send data download request to data server, receive the data file sent by data server;

Verify calculation is carried out to described data file, obtains the check value of described data file;

The check value of calculating and the data file check value preset are compared, if the check value calculated is different from the check value preset, then switches to HTTPS passage download data files again.

2. method according to claim 1, is characterized in that, describedly carries out verify calculation to described data file, and the check value step obtaining described data file is specially:

Carry out verify calculation to the precalculated position of the data file received, the data of pre-sizing, what obtain the data of described precalculated position, in advance sizing comparatively tests value.

3. method according to claim 2, is characterized in that, described precalculated position is the forward part data file downloaded.

4. method according to claim 1, it is characterized in that, described, the check value of calculating and the data file check value preset are compared, if the check value calculated is different from the check value preset, then switch to HTTPS passage again after download data files step, described method also comprises:

The information of Domain Hijacking is sent to user.

5. method according to claim 1, is characterized in that, describedly carries out verify calculation step to described data file and is specially: comparatively test value by the MD5 value of calculated data file as described data file.

6. a secure download device for file, is characterized in that, described device comprises:

Analysis request unit, for sending analysis request to domain name resolution server, and according to receiving the data server address returned by resolution server;

Data receipt unit, for according to described data server address, sends data download request to data server, receives the data file sent by data server;

Data check unit, for carrying out verify calculation to described data file, obtains the check value of described data file;

Check value comparing unit, for the check value of calculating and the data file check value preset being compared, if the check value calculated is different from the check value preset, then switches to HTTPS passage download data files again.

7. device according to claim 6, is characterized in that, described data check unit specifically for:

Carry out verify calculation to the precalculated position of the data file received, the data of pre-sizing, what obtain the data of described precalculated position, in advance sizing comparatively tests value.

8. device according to claim 7, is characterized in that, described precalculated position is the forward part data file downloaded.

9. device according to claim 6, it is characterized in that, described device also comprises:

By switch unit, for sending the information of Domain Hijacking to user.

10. device according to claim 6, is characterized in that, described data check unit specifically for: comparatively test value by the MD5 value of calculated data file as described data file.