User verification method, device and equipment based on content distribution network

Abstract

The embodiment of the invention provides a user verification method, device and equipment based on a content distribution network, and the method comprises the steps: receiving a verification code data request transmitted by a webpage front end through a first edge node in the content distribution network, and transmitting dynamic verification code data and a ciphertext answer of the dynamic verification code data to the webpage front end, displaying the dynamic verification code data at the front end of the webpage; receiving an answer verification request sent by the webpage front end through a second edge node in the content distribution network, performing verification code verification and robot verification on data carried by the answer verification request, and sending an effective bill to the webpage front end after the verification code verification and the robot verification are passed; the service request sent by the webpage front end is received through the third edge node in the content distribution network, and the service request is intercepted or released according to the bill condition carried by the service request, so that the service request is verified by utilizing the edge nodes in the content distribution network.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet data security, and in particular to a user authentication method, device and equipment based on a content distribution network. Background Art

[0002] With the rapid development of information technology and the widespread application of the Internet, online services such as mobile payment, online ticket grabbing, and online shopping have become an important part of people's daily lives, greatly improving the convenience of life. However, while these online services bring convenience to the majority of users, they also provide opportunities for gray and black industries (i.e., the collective term for online black industries and gray industries). Gray and black industries use automated machine programs (such as scripts, crawlers, etc.) to seize website resources on a large scale, conduct illegal purchases, swipe tickets, and even maliciously disrupt the normal operation of the website, making it difficult for legitimate users to obtain the services they deserve, and the legitimate rights and interests of website operators are seriously threatened. Summary of the invention

[0003] In view of the above problems, a method, apparatus and device for user authentication based on a content distribution network is proposed to overcome the above problems or at least partially solve the above problems, including:

[0004] A user verification method based on a content distribution network, wherein the content distribution network is provided with a plurality of edge nodes, and the method comprises:

[0005] Receiving a verification code data request sent by a web page front end through a first edge node in the content distribution network, and sending dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end;

[0006] Receiving the answer verification request sent by the webpage front end through the second edge node in the content distribution network, performing verification code verification and robot verification on the data carried by the answer verification request, and sending a valid ticket to the webpage front end after both the verification code verification and the robot verification are passed; the answer verification request carries the verification code data input by the user, the ciphertext answer and the user identification;

[0007] The service request sent by the webpage front end is received through the third edge node in the content distribution network, and the service request is intercepted or released according to the ticket situation carried by the service request.

[0008] Optionally, performing robot verification and verification code verification on the data carried in the answer verification request includes:

[0009] Decrypting the ciphertext answer carried in the answer verification request to obtain a plaintext answer, and using the plaintext answer to verify the user input verification code data carried in the answer verification request;

[0010] When the user input verification code data carried in the answer verification request matches the plain text answer, determining that the verification code verification is passed;

[0011] When the user input verification code data carried in the answer verification request and the plain text answer do not match, it is determined that the verification code verification has failed.

[0012] Optionally, performing robot verification and verification code verification on the data carried in the answer verification request includes:

[0013] According to the user identifier carried in the answer verification request, a user access behavior sequence is obtained, and a robot verification is performed according to the user access behavior sequence;

[0014] When the result of the robot verification indicates a normal human request, the robot verification is determined to be successful;

[0015] When the result of the robot verification indicates a robot request, it is determined that the robot verification has not passed.

[0016] Optionally, before obtaining the user access behavior sequence according to the user identifier carried in the answer verification request and performing robot verification according to the user access behavior sequence, the method further includes:

[0017] Obtaining historical request interaction data corresponding to the user identifier;

[0018] A user access behavior sequence is generated according to the historical request interaction data; the user access behavior sequence includes a plurality of four-tuple data, each of which includes a uniform resource locator system, timestamp information, a request type, and a verification result.

[0019] Optionally, it also includes:

[0020] When the verification code verification fails, the step of sending the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the webpage front end is returned.

[0021] Optionally, it also includes:

[0022] When the robot verification fails, the SMS verification process is executed.

[0023] Optionally, intercepting or releasing the service request according to the ticket status carried by the service request includes:

[0024] When the service request carries a ticket and the ticket is a valid ticket, the service request is released to the website server;

[0025] When the service request does not carry a ticket or the carried ticket is an invalid ticket, the service request is intercepted at the third edge node.

[0026] A user verification device based on a content distribution network, wherein the content distribution network is provided with a plurality of edge nodes, and the device comprises:

[0027] A verification code data request response module, configured to receive a verification code data request sent by a web page front end through a first edge node in the content distribution network, and send dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end;

[0028] A verification code verification and robot verification module, used to receive the answer verification request sent by the web page front end through the second edge node in the content distribution network, perform verification code verification and robot verification on the data carried by the answer verification request, and send a valid ticket to the web page front end after both the verification code verification and the robot verification are passed; the answer verification request carries the verification code data input by the user, the ciphertext answer and the user identification;

[0029] The service request response module is used to receive the service request sent by the web page front end through the third edge node in the content distribution network, and intercept or release the service request according to the ticket situation carried by the service request.

[0030] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method described above when executed by the processor.

[0031] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0032] The embodiments of the present invention have the following advantages:

[0033] In an embodiment of the present invention, a verification code data request sent by a web page front end is received through a first edge node in a content distribution network, and dynamic verification code data and a ciphertext answer to the dynamic verification code data are sent to the web page front end to display the dynamic verification code data on the web page front end; an answer verification request sent by the web page front end is received through a second edge node in the content distribution network, and verification code verification and robot verification are performed on the data carried in the answer verification request, and after both the verification code verification and the robot verification are passed, a valid ticket is sent to the web page front end; the answer verification request carries the user-input verification code data, the ciphertext answer, and the user identifier; a business request sent by the web page front end is received through a third edge node in the content distribution network, and the business request is intercepted or released according to the ticket situation carried by the business request, thereby realizing verification, interception, or release of requests by utilizing edge nodes in the content distribution network, providing a strong guarantee for the secure operation of online businesses, and reducing the technical complexity and time cost of website operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0035] Figure 1 is a schematic diagram of a user authentication method based on a content distribution network provided by some embodiments of the present invention;

[0036] Figure 2 is a flowchart of a method for user authentication based on a content distribution network provided by some embodiments of the present invention;

[0037] Figure 3 is a flowchart of another method for user authentication based on a content distribution network provided by some embodiments of the present invention;

[0038] Figure 4 It is a structural block diagram of a user authentication device based on a content distribution network provided by some embodiments of the present invention. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] In related technologies, websites have adopted verification code technology as an important means to distinguish between machine programs and human behavior. Verification code, as a verification information presented in the form of images, audio, etc., which needs to be manually identified and input by users, can effectively increase the difficulty of automatic program identification, thereby effectively preventing machine programs from maliciously destroying and illegally accessing websites. The application of this technology has maintained the security and fairness of websites to a certain extent.

[0041] However, in order to reduce the development and maintenance costs of the verification code system, many websites choose to purchase third-party verification code services. Although this approach can reduce the technical burden of the website itself, in the process of connecting to the third-party verification code service, the website needs to redevelop its front-end and server-side codes to adapt to the interface and process requirements of the third-party service. This process is relatively cumbersome and increases the technical complexity and time cost of website operation.

[0042] More importantly, the use of third-party verification code services also faces potential security risks. Since such services usually require the website server to forward the received verification code request to the third-party verification code server for verification, this forms an additional communication link. In the scenario of large-volume malicious verification requests, both the client website's own server and the third-party verification code server may exhaust server resources due to processing a large number of malicious requests, resulting in service performance degradation or even paralysis. This situation not only affects the normal operation of the website, but may also cause inconvenience to legitimate users and even cause economic losses. Specifically, in the relevant technology, the verification request needs to be sent to the website server first, and then forwarded to the verification code server. The load capacity of the website's own server and the third-party verification code server is limited. When the number of dynamic verification code data requests or verification requests is too large, it may exceed the server capacity limit, resulting in the verification code service being unavailable for a short period of time.

[0043] In view of the problems that the current third-party verification code service is prone to service failure in high-traffic scenarios and the high maintenance cost of verification code access, the embodiment of the present invention proposes the use of an original three-end architecture of website client, CDN edge node, and website server, and a method of edge node responding to verification code dynamic data and intelligent verification of edge nodes. Malicious requests are intercepted directly at the edge node to protect the customer website server from malicious verification traffic attacks. At the same time, only the customer website front end needs to introduce the verification code component, and the website server does not need to do any processing, which further reduces the maintenance cost of the user website verification code.

[0044] Specifically, if Figure 1The embodiment of the present invention proposes a three-end architecture of a website front end, an edge node, and a website server. The customer's website front end needs to access the verification code component code through secondary development. After the verification code component is introduced, the customer calls the verification code display interface where the verification code needs to pop up.

[0045] When a user accesses the display interface, it will send a request to the CDN edge node to obtain the dynamic data of the verification code. The edge node will generate dynamic data such as the verification code image in real time and send it to the front end. After the front end obtains the data, it will load and render the verification code.

[0046] After the user is verified, the verification result will be sent to the edge node. The edge node will be judged by the algorithm and classified into normal user verification and machine program verification after security detection. The verification request identified as a normal user will be responded to with a ticket after successful verification. The request that fails the normal user verification will be responded to for re-verification. The front-end verification code component will initiate the acquisition of the verification code dynamic data to the CDN edge node again and request a dynamic verification code. The verification request identified as a machine program will be directly intercepted at the edge node and responded with an error code, and the front-end verification code component will no longer perform verification.

[0047] After a normal user successfully verifies and obtains a ticket, the business request that needs verification code protection carries the ticket. After accessing the edge, the ticket is verified. If the verification is successful, it will be released back to the customer website server source station. If the verification fails, it will be directly intercepted.

[0048] The embodiments of the present invention have the following advantages:

[0049] 1. In the prior art, third-party verification code services require both the website client and the server to undergo secondary development to introduce verification code components. The present invention only requires the website client to introduce verification code components, and the server does not need to perform any operations, thereby reducing the website user verification code maintenance costs.

[0050] 2. In the third-party verification code technology in the related technology, the verification code dynamic data directly requests the verification code server. The verification request needs to be sent to the website server first, and then forwarded to the verification code server. The website's own server and the third-party verification code server have limited load capacity. When the dynamic verification code data request or verification request volume is too large, it may exceed the server capacity limit, resulting in the verification code service being unavailable for a short period of time. The present invention reuses the CDN edge node as the verification code server. When a single server or a node is overloaded, it can be routed to other nodes through the CDN's own scheduling capability. At the same time, this solution can provide user historical access behavior analysis when facing abnormal traffic, and intercept it directly at the edge node without returning to the website server. Therefore, the verification code service of this solution has extremely high disaster recovery capabilities.

[0051] 3. In the embodiment of the present invention, the verification code data is generated at the edge node and responded to the website front end. The edge node is physically closer to the website front end, the verification code dynamic data request has a lower delay and response speed, and the verification code experience will be smoother.

[0052] In an embodiment of the present invention, it is proposed to use the edge nodes in the content distribution network as verification code servers. When a single server or a node is overloaded, the content distribution network can be used to select other nodes through its own scheduling capabilities. At the same time, when facing abnormal traffic, it can provide user historical access behavior analysis and intercept directly at the edge node without returning to the website server, so that the user verification method of the present invention has extremely high disaster recovery capabilities. Secondly, the verification code data of the present invention is generated at the edge node and responded to the web page front end. The edge node is physically closer to the web page front end, and the verification code dynamic data request has a lower delay and response speed, and the verification code experience will be smoother.

[0053] The present invention will be further described below in conjunction with the accompanying drawings:

[0054] Reference Figure 2 , shows a step flow chart of a user verification method based on a content distribution network provided by some embodiments of the present invention, wherein the content distribution network is provided with multiple edge nodes.

[0055] Among them, the Content Delivery Network (CDN) is a system that deploys multiple copies (i.e., cache servers) at different geographical locations on the Internet, which store copies of content (such as web pages, videos, application data, etc.). For example, a content delivery network can be a network of servers distributed in various regions, which intelligently schedules data request routing based on which servers are closest to the user and have the lowest server load, providing fast and stable services that are not easily affected by high traffic. The main goal of a CDN is to increase the speed and reliability of user access to these contents, reduce latency by shortening the distance between users and content, and reduce the load on the source server.

[0056] Edge nodes are a key component of CDN architecture. Edge nodes refer to servers or cache nodes deployed at the edge of the CDN network (i.e., closer to the end user). These nodes are responsible for storing and distributing content to users. Because they are located at the "edge" of the network, they can respond to user requests faster, which can significantly reduce latency compared to obtaining content from source servers in central locations.

[0057] As some examples, since each request from the web page front end may be sent to different edge nodes due to load balancing or dynamic scheduling, in order to ensure that the dynamically generated verification code can be successfully verified when the verification request is sent to different nodes, the present invention proposes to encrypt the verification code result answer and put it in the data seed and transmit it to the web page front end. The front end will bring the ciphertext answer to the edge node along with the verification request for verification.

[0058] As some examples, a content distribution network is provided with multiple edge nodes, and the multiple edge nodes can communicate with each other.

[0059] Specifically, the following steps may be included:

[0060] Step 201, receiving a verification code data request sent by a web page front end through a first edge node in the content distribution network, and sending dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end.

[0061] The first edge node refers to the edge node to which the verification code data request is dispatched; this node may be selected based on factors such as geographical location, network topology, and load conditions to ensure that the request can be processed efficiently.

[0062] Receiving the verification code data request sent by the web page front end through the first edge node in the content distribution network; refers to an edge node in the content distribution network, which is responsible for processing requests from a specific area or user, such as processing the verification code data request sent by the web page front end.

[0063] Verification code data request refers to the request sent by the web front end (such as the user's browser) to the server when the user attempts to perform certain sensitive operations (such as logging in, registering, resetting passwords, etc.). The purpose of this request is to obtain a dynamically generated verification code, and the user needs to enter the correct answer to this verification code to complete the subsequent operation.

[0064] Dynamic verification code data refers to a set of data generated by the first edge node, and each request may have a different verification code. It can be a combination of numbers, letters, symbols, or a verification code in the form of a picture.

[0065] The ciphertext answer refers to the answer corresponding to the dynamic verification code data, which can be stored or transmitted to the front end of the web page in an encrypted form. The ciphertext answer is used to verify whether the verification code entered by the user is correct on the back end without exposing the answer itself on the front end.

[0066] After the web front end receives the dynamic verification code data, it will display the verification code on the user interface, which can be a verification code image or a number / letter combination displayed next to an input box. Users need to enter the verification code they see to complete subsequent operations.

[0067] In some examples, a verification code component can be embedded in the front end of the web page to dynamically request verification code data. The verification code data is dynamically generated at the edge node, which can effectively reduce the verification code data request delay, and the web front end will display the verification code more quickly and smoothly. At the same time, the first edge node generates verification code data with inherent high concurrency compatibility, which can effectively avoid overloading the verification code server. Since each request from the web front end may be load balanced or dynamically scheduled to different edge nodes, in order to ensure that the dynamically generated verification code can be successfully verified when the verification request is sent to different nodes, the verification code result answer can be encrypted and placed in the data and transmitted to the web front end. The web front end takes the ciphertext answer along with the answer verification request to the second edge node for verification.

[0068] Step 202, through the second edge node in the content distribution network, receive the answer verification request sent by the web page front end, perform verification code verification and robot verification on the data carried by the answer verification request, and after the verification code verification and robot verification are passed, send a valid ticket to the web page front end; the answer verification request carries the user input verification code data, the ciphertext answer and the user ID.

[0069] The second edge node refers to the edge node to which the answer verification request is dispatched; this node can be selected based on factors such as geographical location, network topology, load conditions, etc. to ensure that the request can be processed efficiently.

[0070] The answer verification request is a request sent by the front end to the server after the user enters the verification code data (answer) on the web front end (such as a browser). The purpose of this request is to verify whether the verification code data (answer) entered by the user is correct and whether the user is a human (not a robot or automated script).

[0071] Verification code verification refers to the process of checking whether the verification code entered by the user matches the verification code stored or generated by the backend. If they match, it is considered that the user has entered the verification code correctly.

[0072] Robot validation refers to the process of checking whether user behavior conforms to the characteristics of human behavior to distinguish between human users and automated scripts or robots. It can include checking the speed, pattern, frequency, etc. of user input.

[0073] A valid ticket means that after both the verification code and the robot verification are passed, the second edge node will send a valid ticket to the web front end. This ticket can be a token, session ID, or encrypted string, which is used to prove the user's identity and verification status in subsequent requests.

[0074] The answer verification request carries the user input verification code data, the ciphertext answer and the user ID; wherein the user input verification code data refers to the dynamic verification code that the user sees on the front end of the web page and tries to enter (i.e. the answer that the user tries to enter).

[0075] As some examples, the user identification refers to unique information for identifying a user, such as a user name, a session ID, a token, etc. A client identification of a client used by the user may be used as the user identification.

[0076] Since the web front end has received the ciphertext answer to the dynamic verification code data sent by the first edge node, it can generate an answer verification request based on the ciphertext answer to the dynamic verification code, the verification code data input by the user for the dynamic verification code, and the user ID corresponding to the user, and send it to the second edge node for verification. After the second edge node passes the verification code verification and robot verification, it will send a valid ticket to the web front end.

[0077] As some examples, after the client requests the dynamic verification code data and displays it on the front end of the web page, the user can perform the verification code verification. The answer verification request is sent directly from the front end of the web page to the second edge node for verification. The second edge node first verifies based on the result of this verification, and outputs the user ID to the log. When the access behavior analysis result determines that it is a machine request, the web front end directly responds to the SMS verification code strong verification status code, and the web front end will pop up the SMS verification code. When the access behavior analysis result determines that it is a normal human request, based on the verification result of this verification code answer, if the answer is correct, the verification is successful and a valid ticket is issued. If the answer is wrong, the verification fails and the web front end responds to the re-calibration status code. The web front end will initiate a dynamic request again to obtain a new verification code and ask the user to verify again until the verification passes.

[0078] In some embodiments of the present invention, the robot verification and verification code verification of the data carried by the answer verification request include: decrypting the ciphertext answer carried by the answer verification request to obtain a plaintext answer, and using the plaintext answer to verify the user input verification code data carried by the answer verification request; when the user input verification code data carried by the answer verification request matches the plaintext answer, determining that the verification code verification has passed; when the user input verification code data carried by the answer verification request does not match the plaintext answer, determining that the verification code verification has failed.

[0079] In actual applications, the second edge node receives the answer verification request and needs to decrypt the ciphertext answer in the answer verification request. Decryption refers to the reverse process of using a certain encryption algorithm, the purpose of which is to convert the encrypted ciphertext back to the original plaintext form.

[0080] The plaintext answer refers to the correct answer to the verification code generated by the system. The second edge node obtains the plaintext answer through decryption, and uses it to judge whether the verification code data entered by the user matches the plaintext answer to determine whether the verification code verification is passed.

[0081] If the verification code data entered by the user completely matches the plain text answer, the second edge node determines that the verification code verification is passed, which means that the verification code entered by the user is correct, and the user can therefore be allowed to proceed to the next step (such as logging in, submitting a form, etc.).

[0082] If the verification code data entered by the user does not match the plain text answer, the second edge node determines that the verification code verification has failed, which means that the verification code entered by the user is wrong. The second edge node can send an error prompt and prompt the user to re-enter the verification code data of the dynamic verification code.

[0083] In some embodiments of the present invention, it also includes: when the verification code verification fails, returning to execute the sending of the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the web page front end.

[0084] In actual applications, when the verification code verification fails, the second edge node will not continue the current verification process, but return to the step of sending the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the web front end.

[0085] As some examples, when the verification code fails, the second edge node can regenerate a new verification code (i.e., dynamic verification code data) and send it to the web front end. This new verification code will replace the old verification code that has failed. Dynamic verification code data is usually designed to prevent verification codes from being reused or brute-force cracked, and a new verification code will be generated after each verification failure. In addition to sending the new dynamic verification code data to the web front end, the ciphertext answer to this new verification code will also be sent to the web front end.

[0086] In some embodiments of the present invention, the robot verification and verification code verification are performed on the data carried by the answer verification request, including: obtaining a user access behavior sequence based on the user identifier carried by the answer verification request, and performing robot verification based on the user access behavior sequence; when the result of the robot verification indicates a normal human request, determining that the robot verification has passed; when the result of the robot verification indicates a robot request, determining that the robot verification has failed.

[0087] After receiving the answer verification request sent by the webpage front end, the second edge node can extract the user identifier from the answer verification request, and use the extracted user identifier to obtain the user's access behavior sequence.

[0088] The user access behavior sequence may include the user's previous login attempts, page browsing records, click behaviors, dwell time, etc. The second edge node may record these behaviors and construct the user access behavior sequence after the logs are finally aggregated.

[0089] The second edge node verifies the user ID carried in the answer request, searches for the user access behavior sequence corresponding to the user ID, and then analyzes the user behavior to determine whether the person initiating the verification request is a normal human user or a robot (automated script or program). For example, behavioral analysis, pattern recognition, machine learning, etc., can be used to identify abnormal access patterns that do not conform to human behavior characteristics.

[0090] Based on the results of the robot verification, the second edge node will make two decisions:

[0091] If the verification result indicates a normal human request, that is, the user's access behavior conforms to human behavior characteristics and shows no signs of a robot, then the second edge node determines that the robot verification has passed. This means that the user can continue with the subsequent verification steps or operations.

[0092] If the verification result indicates a robot request, that is, the user's access behavior shows an abnormal pattern or does not conform to human behavior characteristics, then the second edge node determines that the robot verification has failed. This means that the request was initiated by an automated script or program, not by a real user. In this case, the second edge node can reject the request, require the user to take additional verification steps, or take other security measures to protect the system from potential threats.

[0093] In some embodiments of the present invention, it also includes: when the robot verification fails, executing the SMS verification process.

[0094] Among them, robot verification failed This means that the user (or possibly an automated script, robot, etc.) failed to pass the initial robot verification test when trying to perform an operation (such as logging in, registering, submitting a form, etc.). Robot verification is usually used to distinguish between human users and automated scripts or robots to prevent malicious behavior, such as spam sending, account brute force cracking, etc.

[0095] Among them, robot verification methods include verification code verification (such as image verification code, SMS verification code, etc.), behavior analysis (such as mouse movement trajectory, click speed, etc.), etc.

[0096] When the robot fails the verification, the second edge node will not allow the user to continue the requested operation, but will switch to the SMS verification process. SMS verification means that the second edge node requires the user to enter the verification code sent to his mobile phone in the SMS to prove his identity or confirm the legitimacy of his operation.

[0097] As some examples, in the SMS verification process, the second edge node can perform the following steps:

[0098] [1] Generate a random verification code (usually a combination of numbers or letters).

[0099] [2] This verification code is sent to the user’s mobile phone via SMS.

[0100] [3] Prompt the user to enter the received verification code on the web page or application.

[0101] [4] After the user enters the verification code, the system verifies its correctness. If the verification code is correct, the user is allowed to continue the requested operation; if the verification code is incorrect, the operation is rejected or the user is required to re-verify.

[0102] In some embodiments of the present invention, before obtaining the user access behavior sequence according to the user identifier carried in the answer verification request, and performing robot verification according to the user access behavior sequence, it also includes: obtaining historical request interaction data corresponding to the user identifier; generating a user access behavior sequence according to the historical request interaction data; the user access behavior sequence includes multiple four-tuple data, each four-tuple data includes a uniform resource locator system, timestamp information, request type, and verification result.

[0103] As some examples, the second edge node can obtain historical request interaction data associated with the user identifier from a data source (such as a local / cloud database, a local / cloud log file, etc.). The historical request interaction data records all request information that the user interacted with the edge node in the past period of time. The second edge node can process these historical request interaction data to generate a user access behavior sequence; wherein, this sequence can be an ordered data set that records each access behavior of the user in chronological order.

[0104] Among them, the user access behavior sequence is composed of multiple four-tuple data. Each four-tuple data contains the following four key information:

[0105] Uniform Resource Locator (URL) refers to the address of a web page or resource that a user is accessing. It tells the system which page or resource the user is trying to access.

[0106] Timestamp information refers to the specific time when the user initiates the request. It is used to record the chronological order of user access behavior, thereby helping the system understand the user's behavior pattern.

[0107] Request type refers to the type of request initiated by the user, such as GET request is used to obtain data, POST request is used to submit data. It reflects the way users interact with the system.

[0108] Verification result refers to the result after the system verifies the user request, such as success, failure, redirection, etc. It provides feedback information on whether the user request is accepted or processed by the system.

[0109] In the embodiment of the present invention, by generating a user access behavior sequence, the system can have a deeper understanding of the user's access habits, behavior patterns, and possible abnormal behaviors, which is of great significance for improving the security of the system, optimizing the user experience, and conducting data analysis.

[0110] Step 203: receiving the service request sent by the webpage front end through the third edge node in the content distribution network, and intercepting or releasing the service request according to the ticket status carried by the service request.

[0111] The third edge node refers to the edge node to which the service request is dispatched; this node can be selected based on factors such as geographical location, network topology, and load conditions to ensure that the request can be processed efficiently.

[0112] As some examples, after both the verification code verification and the robot verification are passed, the web front end will receive a valid ticket and store it on the user's client. When the user needs to perform a certain business, such as obtaining and viewing certain data, the web front end will send a business request to the third edge node, in which the business request can carry the ticket. If both the verification code verification and the robot verification fail, the business request may not carry the ticket.

[0113] After receiving the service request sent by the web front end, the third edge node can verify the identity or authority of the requester according to the ticket in the service request. By checking the status (validity) of the ticket, it can be determined whether the requester has the right to access the requested content or service.

[0114] Based on the verification result of the ticket, the third edge node will decide whether to intercept or release the service request. If the ticket is valid and the requester has the right to access the requested content or service, the request will be released and continue to be transmitted in the network, eventually reaching the target server or resource. If the ticket is invalid or the requester does not have the appropriate permissions, the request will be intercepted and will not be transmitted further. This helps protect the security of network resources and content and prevent unauthorized access.

[0115] In some embodiments of the present invention, the business request is intercepted or released according to the ticket carried by the business request, including: when the business request carries a ticket and the carried ticket is a valid ticket, the business request is released to the website server; when the business request does not carry a ticket or the carried ticket is an invalid ticket, the business request is intercepted at the third edge node.

[0116] When a user initiates a business request (such as accessing a page, submitting form data, etc.), the request can contain a ticket; if the ticket is valid (that is, it can be recognized by the system as legal and not expired), the third edge node will allow the business request to continue to pass forward and eventually reach the website's server for processing. This means that the user's request is successfully released and the operation requested by the user can be performed.

[0117] If the service request initiated by the user does not contain a ticket, or contains a ticket but the ticket is invalid (for example, the ticket is expired, tampered with, or does not exist in the records of the edge node), the third edge node will not allow the request to continue forwarding. In this case, the service request will be intercepted at the third edge node.

[0118] In an embodiment of the present invention, a verification code data request sent by a web page front end is received through a first edge node in a content distribution network, and dynamic verification code data and a ciphertext answer to the dynamic verification code data are sent to the web page front end to display the dynamic verification code data on the web page front end; an answer verification request sent by the web page front end is received through a second edge node in the content distribution network, and verification code verification and robot verification are performed on the data carried in the answer verification request, and after both the verification code verification and the robot verification are passed, a valid ticket is sent to the web page front end; the answer verification request carries the user-input verification code data, the ciphertext answer, and the user identifier; a business request sent by the web page front end is received through a third edge node in the content distribution network, and the business request is intercepted or released according to the ticket situation carried by the business request, thereby realizing verification of the business request by using the edge node in the content distribution network to intercept or release the business request, providing a strong guarantee for the safe operation of online business and reducing the technical complexity and time cost of website operation.

[0119] Reference Figure 3 , shows a step flow chart of another user verification method based on a content distribution network provided in some embodiments of the present invention, wherein the content distribution network is provided with multiple edge nodes.

[0120] Specifically, the following steps may be included:

[0121] Step 301, receiving a verification code data request sent by a web page front end through a first edge node in the content distribution network, and sending dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end.

[0122] Step 302, through the second edge node in the content distribution network, receive the answer verification request sent by the web page front end, perform verification code verification and robot verification on the data carried by the answer verification request, and after the verification code verification and robot verification are passed, send a valid ticket to the web page front end; the answer verification request carries the user input verification code data, the ciphertext answer and the user ID.

[0123] Step 303: Receive the service request sent by the webpage front end through the third edge node in the content distribution network, and intercept or release the service request according to the ticket status carried by the service request.

[0124] Step 304: When the service request carries a ticket and the ticket is a valid ticket, the service request is released to the website server.

[0125] Step 305: When the service request does not carry a ticket or the carried ticket is an invalid ticket, the service request is intercepted at the third edge node.

[0126] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0127] Reference Figure 4 , showing a schematic diagram of the structure of a user verification device based on a content distribution network provided in some embodiments of the present invention, wherein the content distribution network is provided with a plurality of edge nodes.

[0128] Specifically, the following modules may be included:

[0129] The verification code data request response module 401 is used to receive the verification code data request sent by the web page front end through the first edge node in the content distribution network, and send the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end;

[0130] The verification code verification and robot verification module 402 is used to receive the answer verification request sent by the web page front end through the second edge node in the content distribution network, perform verification code verification and robot verification on the data carried by the answer verification request, and send a valid ticket to the web page front end after both the verification code verification and the robot verification are passed; the answer verification request carries the verification code data input by the user, the ciphertext answer and the user identification;

[0131] The service request response module 403 is used to receive the service request sent by the web page front end through the third edge node in the content distribution network, and intercept or release the service request according to the ticket situation carried by the service request.

[0132] In some embodiments of the present invention, the verification code verification and robot verification module 402 includes:

[0133] The verification code verification submodule is used to decrypt the ciphertext answer carried in the answer verification request to obtain a plaintext answer, and use the plaintext answer to verify the user input verification code data carried in the answer verification request;

[0134] A first verification submodule, configured to determine that the verification code verification is passed when the user input verification code data carried in the answer verification request matches the plain text answer;

[0135] The first verification submodule is used to determine that the verification code verification fails when the user input verification code data carried in the answer verification request and the plain text answer do not match.

[0136] In some embodiments of the present invention, the performing robot verification and verification code verification on the data carried in the answer verification request includes:

[0137] A robot verification submodule, used to obtain a user access behavior sequence according to a user identifier carried in the answer verification request, and perform robot verification according to the user access behavior sequence;

[0138] A second verification submodule, configured to determine that the robot verification has passed when the result of the robot verification indicates a normal human request;

[0139] The second verification submodule is used to determine that the robot verification has failed when the result of the robot verification indicates that it is a robot request.

[0140] In some embodiments of the present invention, the device further comprises:

[0141] A historical request interaction data acquisition module, used to acquire the historical request interaction data corresponding to the user identifier;

[0142] The user access behavior sequence generation module is used to generate a user access behavior sequence according to the historical request interaction data; the user access behavior sequence includes multiple four-tuple data, each of which includes a uniform resource locator system, timestamp information, request type, and verification result.

[0143] In some embodiments of the present invention, the device further comprises:

[0144] The feedback module is used to return and execute the sending of the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the web page front end when the verification code verification fails.

[0145] In some embodiments of the present invention, the device further comprises:

[0146] The SMS verification module is used to execute the SMS verification process when the robot verification fails.

[0147] In some embodiments of the present invention, the service request response module 403 includes:

[0148] A business request release submodule, used for releasing the business request to the website server when the business request carries a ticket and the ticket carried is a valid ticket;

[0149] The service request interception submodule is used to intercept the service request at the third edge node when the service request does not carry a ticket or the carried ticket is an invalid ticket.

[0150] Some embodiments of the present invention further provide an electronic device, comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the above method is implemented when the computer program is executed by the processor.

[0151] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above method when executed by a processor.

[0152] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above method when executed by a processor.

[0153] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0154] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0155] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0156] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0157] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0158] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0159] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0160] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0161] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0162] The above is a detailed introduction to the provided user verification method, device and equipment based on the content distribution network. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A user authentication method based on a content distribution network, characterized in that: The content distribution network is provided with a plurality of edge nodes, and the method comprises: Receiving a verification code data request sent by a web page front end through a first edge node in the content distribution network, and sending dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end; Receiving the answer verification request sent by the webpage front end through the second edge node in the content distribution network, performing verification code verification and robot verification on the data carried by the answer verification request, and sending a valid ticket to the webpage front end after both the verification code verification and the robot verification are passed; the answer verification request carries the verification code data input by the user, the ciphertext answer and the user identification; The service request sent by the webpage front end is received through the third edge node in the content distribution network, and the service request is intercepted or released according to the ticket situation carried by the service request.

2. The method according to claim 1, characterized in that The performing robot verification and verification code verification on the data carried in the answer verification request includes: Decrypting the ciphertext answer carried in the answer verification request to obtain a plaintext answer, and using the plaintext answer to verify the user input verification code data carried in the answer verification request; When the user input verification code data carried in the answer verification request matches the plain text answer, determining that the verification code verification is passed; When the user input verification code data carried in the answer verification request and the plain text answer do not match, it is determined that the verification code verification has failed.

3. The method according to claim 1, characterized in that The performing robot verification and verification code verification on the data carried in the answer verification request includes: According to the user identifier carried in the answer verification request, a user access behavior sequence is obtained, and a robot verification is performed according to the user access behavior sequence; When the result of the robot verification indicates a normal human request, the robot verification is determined to be successful; When the result of the robot verification indicates a robot request, it is determined that the robot verification has not passed.

4. The method according to claim 3, characterized in that Before obtaining the user access behavior sequence according to the user identifier carried in the answer verification request and performing robot verification according to the user access behavior sequence, the method further includes: Obtaining historical request interaction data corresponding to the user identifier; A user access behavior sequence is generated according to the historical request interaction data; the user access behavior sequence includes a plurality of four-tuple data, each of which includes a uniform resource locator system, timestamp information, a request type, and a verification result.

5. The method according to any one of claims 1 to 4, characterized in that: Also includes: When the verification code verification fails, the step of sending the dynamic verification code data and the ciphertext answer of the dynamic verification code data to the webpage front end is returned.

6. The method according to any one of claims 1 to 4, characterized in that: Also includes: When the robot verification fails, the SMS verification process is executed.

7. The method according to claim 1, characterized in that The intercepting or releasing the service request according to the ticket status carried by the service request includes: When the service request carries a ticket and the ticket is a valid ticket, the service request is released to the website server; When the service request does not carry a ticket or the carried ticket is an invalid ticket, the service request is intercepted at the third edge node.

8. A user authentication device based on a content distribution network, characterized in that: The content distribution network is provided with a plurality of edge nodes, and the device comprises: A verification code data request response module, configured to receive a verification code data request sent by a web page front end through a first edge node in the content distribution network, and send dynamic verification code data and a ciphertext answer to the dynamic verification code data to the web page front end, so as to display the dynamic verification code data on the web page front end; A verification code verification and robot verification module, used to receive the answer verification request sent by the web page front end through the second edge node in the content distribution network, perform verification code verification and robot verification on the data carried by the answer verification request, and send a valid ticket to the web page front end after both the verification code verification and the robot verification are passed; the answer verification request carries the verification code data input by the user, the ciphertext answer and the user identification; The service request response module is used to receive the service request sent by the web page front end through the third edge node in the content distribution network, and intercept or release the service request according to the ticket situation carried by the service request.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images