Method and system for preventing attacks during private cloud object storage

Abstract

The invention provides a method for preventing attacks during private cloud object storage. The method comprises the following steps that: an intermediate server calls an access interface to access objects in a storage server according to access permission of clients, and transmits an access result to corresponding clients; and when that the calling times of a certain client specific to the access interface reach a predetermined upper limit value is detected, the intermediate server disables the access permission of the client. The invention also provides a system for preventing attacks during private cloud object storage. Through adoption of the method and system for preventing attacks during private cloud object storage, interface abuse is prevented; traffic waste caused by bucket list operations is reduced; and the phenomenon that the system rejects services is avoided.

Description

technical field [0001] The invention relates to the technical field of cloud object storage, in particular to a method and system for preventing attacks in private cloud object storage. Background technique [0002] Object storage has received widespread attention in the tide of the Internet and has developed rapidly. Object storage is different from file storage in that objects are not organized in a directory hierarchy. Each object is located at the same level of a flat space called a storage pool, and each element of each level has a unique identifier in the storage system, and users access the container or object through this identifier. The flat data organization structure discards nested folders and avoids maintaining huge directory trees. In the era of big data and the Internet, more than one million files / objects are stored, and the number of visits and concurrent visits per unit time have reached an unprecedented level. In this case, the directory tree will bring ...

AI Technical Summary

Problems solved by technology

[0004] In the private cloud application scenario, because no charging policy is adopted for internal customers, the back-end storage service often has API interface abuse. For example, in order to obtain whether an object exists, perform a list operation on the entire bucket to obtain the entire bucket. Object list, this kind of list operation usually requires the back-end storage cluster to send a lot of content to the caller, occupying the server bandwidth, usually charged according to the traffic in the public business, and this kind of list operation is very traffic-intensive

Another scenario is that if a private cloud user suffers from an external attack, he will send a large number of data upload and download requests to the storage server, causing the back-end cluster to be overwhelmed, and even unable to provide services for normal users, that is, denial of service

Images