Method and apparatus for cross-domain communication using designated response processing page

Abstract

cross-domain communication between a sender domain and a receiver domain includes: receiving, in the receiver domain, a data request from the sender domain, the data request being directed to a designated request processing page in the receiver domain; processing the data request to generate a response; and sending the response to the sender domain, the response being directed to a designated response processing page in the sender domain. Alternatively, cross-domain communication includes receiving, in the receiver domain, a data request from the sender domain, the data request being directed to a designated request processing page in the receiver domain; processing the data request to generate a response; and sending the response to the sender domain, the response being directed to a designated response processing page in the sender domain.

Description

This application claims priority to People's Republic of China Patent Application No. 200810147259.3 entitled METHOD, SYSTEM AND DEVICE FOR CROSS-DOMAIN COMMUNICATION filed Aug. 25, 2008 which is incorporated herein by reference for all purposes.

FIELD OF THE PRESENT INVENTION

The present invention relates generally to the field of network technology and more particularly to method, system and device for cross-domain communication.

BACKGROUND OF THE PRESENT INVENTION

Existing browser software such as Internet Explorer or Firefox provides a security isolation mechanism based on network domains to prevent programs from different websites from accessing each other's data and causing visitor's private data to be misappropriated from one website to another. Some large web platforms, however, can include many different domain names or different websites that are in trust relationships with each other and often need to exchange data and service among different websites.

Several techniques for cross-domain communication exist. Current techniques, however, usually have certain disadvantages.

One existing technique for cross-domain communication involves exploiting certain security holes in the browser. This is not secure since malicious websites can also use security vulnerabilities to launch attacks. Also, the technique becomes obsolete as soon as the security holes are patched.

Another technique for cross-domain communication involves decreasing the client browser security setting to allow for cross-domain visits. Decreasing the security standard, however, makes the client more vulnerable to exploits by malicious web sites.

Another technique involves URL jumping between different websites, where one website requests a page in another domain and sends information in the form of URL parameters and the other domain returns information by redirecting the browser to the web page in the requester's domain and sending information in the form of URL parameters. When URL jumping is used to communicate between different websites, the servers must deal with greatly increased load and efficiency is decreased. The technique also leads to security problems since the data information transferred via the URL is in plain view in the address bar of requesta necessary current hardware platform. Based on this understanding, the technical program of the present invention can be embodied by a form of software products which can be stored in a nonvolatile storage medium (such as CD-ROM, U disk, mobile hard disk, etc.), including a number of instructions for making a computer device (such as personal computers, servers, or network equipments equipment, etc.) implement the methods described in the embodiments of the present invention.

The descriptions above are just preferred implementation ways of the present invention. It should be pointed that, for general technical personnel in this field, some improvement and decorating can be done, which should be under the protection scope of the present invention.

Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.

Claims

1. A sender system for cross-domain communication between a sender domain and a receiver domain that is different from the sender domain, comprising:

a hardware processor configured to:

send a data request from an originating webpage deployed in the sender domain to the receiver domain, the data request being directed to a designated request processing page in the receiver domain, wherein sending the data request from the sender domain to the receiver domain includes opening a hidden page and using the hidden page to open the designated response request processing page and to send a request command and associated request data via the hidden page, wherein opening the hidden page includes opening an invisible new window or an invisible iframe;

receive a response from the receiver domain, the response including requested data and being directed to a designated response processing page in the sender domain, wherein the designated response processing page deployed in the sender domain is a different webpage from the originating webpage deployed in the sender domain; and

process the response; and

a memory coupled to the hardware processor, configured to provide the hardware processor with instructions.

2. The system of claim 1, wherein the data request is sent in response to a client action from a browser to an the originating webpage in the sender domain.

3. The system of claim 1, wherein the designated request processing page is deployed in the receiver domain and the designated response processing page is deployed in the sender domain prior to the cross-domain communication.

4. The system of claim 1, wherein the data request includes a request command and associated request data that are sent via a Hypertext Transfer Protocol (HTTP) GET command.

5. The system of claim 1, wherein:

the data request includes a request command and associated request data;

the request command is sent as a fragment identifier attached to a uniform resource locator (URL); and

the associated data are is transferred as a name property of a window object.

6. The system of claim 1, wherein:

the data request includes a request command and associated request data; and

the request command and the associated request data are sent as a fragment identifier attached to a URL.

7. The system of claim 1, wherein request data is transferred as a string in JSON format.

8. The system of claim 1, wherein processing the response includes transferring response data from the designated response processing page to the originating webpage.

9. A method for cross-domain communication between a sender domain and a receiver domain that is different from the sender domain, comprising:

sending a data request from an originating webpage deployed in the sender domain to the receiver domain, the data request being directed to a designated request processing page in the receiver domain, wherein sending the data request from the sender domain to the receiver domain includes opening a hidden page and using the hidden page to open the designated response request processing page and to send a request command and associated request data via the hidden page, wherein opening the hidden page includes opening an invisible new window or an invisible iframe;

receiving a response from the receiver domain, the response including requested data and being directed to a designated response processing page in the sender domain, wherein the designated response processing page deployed in the sender domain is a different webpage from the originating webpage deployed in the sender domain; and

processing, by one or more hardware processors, the response.

10. The method of claim 9, wherein the data request is sent in response to a client action from a browser to an the originating webpage in the sender domain.

11. The method of claim 9, wherein the designated request processing page is deployed in the receiver domain and the designated response processing page is deployed in the sender domain prior to the cross-domain communication.

12. The method of claim 9, wherein the data request includes a request command and associated request data that are sent via a Hypertext Transfer Protocol (HTTP) GET command.

13. The method of claim 9, wherein:

the data request includes a request command and associated request data;

the request command is sent as a fragment identifier attached to a uniform resource locator (URL); and

the associated data are is transferred as a name property of a window object.

14. The method of claim 9, wherein:

the data request includes a request command and associated request data; and

the request command and the associated request data are sent as a fragment identifier attached to a URL.

15. The method of claim 9, wherein request data is transferred as a string in JSON format.

16. A receiver system for cross-domain communication between a sender domain and a receiver domain that is different from the sender domain, comprising:

a processor configured to:

receive, in the receiver domain, a data request from an originating webpage deployed in the sender domain, the data request being directed to a designated request processing page in the receiver domain, wherein sending the data request from the sender domain to the receiver domain includes opening a hidden page and using the hidden page to open the designated response request processing page and to send a request command and associated request data via the hidden page, wherein opening the hidden page includes opening an invisible new window or an invisible iframe;

process the data request to generate a response; and

send the response to the sender domain, the response being directed to a designated response processing page in the sender domain, wherein the designated response processing page deployed in the sender domain is a different webpage from the originating webpage deployed in the sender domain; and

a memory coupled to the processor, configured to provide the processor with instructions.

17. A method for cross-domain communication between a sender domain and a receiver domain that is different from the sender domain, comprising:

receiving, in the receiver domain, a data request from an originating webpage deployed in the sender domain, the data request being directed to a designated request processing page in the receiver domain, wherein sending the data request from the sender domain to the receiver domain includes opening a hidden page and using the hidden page to open the designated response request processing page and to send a request command and associated request data via the hidden page, wherein opening the hidden page includes opening an invisible new window or an invisible iframe;

processing, by one or more hardware processors, the data request to generate a response; and

sending the response to the sender domain, the response being directed to a designated response processing page in the sender domain, wherein the designated response processing page deployed in the sender domain is a different webpage from the originating webpage deployed in the sender domain.