Method and electronic equipment for realizing dynamic IP black and white lists in real time

Abstract

The invention discloses a method for realizing dynamic IP black and white lists in real time and electronic equipment, and belongs to the technical field of Internet. The method comprises the following steps: realizing three interface functions related to an IP black list and an IP white list in a dynamic library of a C language; determining and issuing an IP black and white list; the method comprises the following steps: starting nginx, reading an IP black list and an IP white list, combining an ipv4 and an ipv6 included in the IP black list and the IP white list into an array, storing the array through a cardinal number tree, starting a first timer at the same time, and repeating the process of reading the IP black list and the IP white list if the modification attribute of the IP black list and the IP white list is changed; in a user access process, the nginx queries IP black and white list attributes of the user through the cardinal number tree; and if the IP black and white list attribute of the user is the IP black list user, refusing the access of the user. According to the method, the dynamic real-time effectiveness of the IP black and white list files is realized, and the execution efficiency is improved.

Description

Technical Field

[0001] This application belongs to the field of Internet technologies, and particularly relates to a method for dynamically implementing IP black and white lists in real time and an electronic device. Background Art

[0002] Currently, in the method of implementing IP black and white lists in the nginx configuration, the ngx_http_access_module module is usually used to implement IP-based access control, including IP blacklists and IP whitelists; each update of such methods requires reloading the nginx server again, and it is impossible to achieve dynamic real-time effectiveness after modification; moreover, using the lua language is restricted by data structures and can only perform string comparisons, and the execution efficiency of adding, deleting, modifying, and querying is very low.

[0003] In view of the above problems, the method for dynamically implementing IP black and white lists in real time and the electronic device in this application are proposed. Summary of the Invention

[0004] To solve the deficiencies of the existing technologies described above, this application provides a method for dynamically implementing IP black and white lists in real time and an electronic device, and solves the technical problems that it is impossible to achieve dynamic real-time effectiveness after modifying the IP black and white lists and the execution efficiency of adding, deleting, modifying, and querying is very low in the existing technologies.

[0005] The technical effects to be achieved by this application are realized through the following solutions: In a first aspect, this application provides a method for dynamically implementing IP black and white lists in real time, and the method includes: Implement three interface functions related to IP black and white lists in a dynamic library of the C language; Determine and distribute the IP black and white list, where the IP black and white list includes an IP blacklist and / or an IP whitelist; Start nginx, read the IP black and white list, combine the ipv4 and ipv6 included in the IP black and white list into an array, store the array through a radix tree, and store the update operations corresponding to the IP black and white list. At the same time, start a first timer to check the modification attribute of the IP black and white list. If the modification attribute of the IP black and white list changes, repeat the process of reading the IP black and white list. If the modification attribute of the IP black and white list does not change, enter the next cycle; During the user access process, nginx queries the IP black and white list attribute of the user through the radix tree, where the IP black and white list attribute includes an IP blacklist user or an IP whitelist user; If the IP black and white list attribute of the user is an IP blacklist user, the access of the user is rejected; if the IP black and white list attribute of the user is an IP whitelist user, the access of the user is allowed.

[0006] In some embodiments, the IP blacklist is divided into a global blacklist and a user blacklist, and the IP whitelist is divided into a global whitelist and a user whitelist. The nginx queries the IP black and white list attribute of the user through the radix tree, including: The nginx performs a first query through the radix tree, and the first query is to query the global blacklist and the global whitelist; The nginx performs a second query through the radix tree, and the second query is to query the user blacklist and the user whitelist; In the case that at least one of the first query and the second query determines that the IP black and white list attribute of the user is an IP blacklist user, it is determined that the IP black and white list attribute of the user is an IP blacklist user.

[0007] In some embodiments, the three interface functions related to the IP black and white list are respectively: The add and modify interface function, expressed as ngx_ip_array_update(key,value); The query function, expressed as Wiengx_ip_array_lookup(host,key); The delete function, expressed as ngx_ip_array_destory(key).

[0008] In some embodiments, the method further includes: Calling the three interface functions related to the IP black and white list to perform real-time dynamic update operations on the IP black and white list corresponding to the user, where the update operations include addition, modification, query, and deletion.

[0009] In some embodiments, the IP black and white list is issued in json format, and multiple jsons are distinguished by line breaks.

[0010] In some embodiments, in the case of rejecting the access of the user, a 403 status code is returned, and the user is not allowed to access the corresponding resource.

[0011] In some embodiments, the first timer includes 10 seconds or 20 seconds.

[0012] In some embodiments, the dynamic library is a SO library.

[0013] In a second aspect, the present application provides an electronic device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the method described in any one of the foregoing is implemented.

[0014] In a third aspect, the present application provides a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the method described in any one of the foregoing.

[0015] Through the method and electronic device for real-time implementation of a dynamic IP black and white list provided by the present application, the method reads a specified IP black and white list file through a radix tree and realizes dynamic real-time effect. The real-time update of the IP black and white list is realized by combining the radix tree data structure with the SO library of the C language, which improves the execution efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments recorded in the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0017] Figure 1 It is a flowchart of the method for real-time implementation of a dynamic IP black and white list in an embodiment of the present application; Figure 2 It is a schematic block diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] To make the objectives, technical solutions, and advantages of the present application clearer, the following will clearly and completely describe the technical solutions of the present application in conjunction with specific embodiments and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present application.

[0019] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of this application should have the ordinary meanings understood by those with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in one or more embodiments of this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Words such as "including" or "comprising" mean that the elements or objects appearing before this word cover the elements or objects listed after this word and their equivalents, without excluding other elements or objects. Words such as "connected" or "linked" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right", etc. are only used to indicate relative position relationships. When the absolute position of the object being described changes, the relative position relationship may also change accordingly.

[0020] The following explains some professional terms involved in this application: IP black and white list: A function for whether an IP is allowed to access the server. An IP added to the blacklist is refused access to the server, while an IP added to the white list is only allowed to access by the IPs in the white list.

[0021] Dynamic IP black and white list: An IP black and white list that uses a certain interface or specifies a specific file, and takes effect immediately without modifying the nginx configuration and without reloading the nginx service.

[0022] Data structure of lua: The lua language has only one data structure, table, which can implement arrays, linked lists, etc. Radix tree: A binary search tree that has all the advantages of a binary search tree, with fast speeds for retrieving, inserting, and deleting nodes, supports range search, and supports traversal, etc.

[0023] Interaction between lua and C: lua is an embedded language and cannot run independently, but is a library that can be linked to other applications. lua is developed using the C language. There are two ways of interaction between lua and the C language. One is with C as the main language and lua as a library called by C. The C code in this way is called application code. The other is with lua as the main language and C as a library called by lua. The C code in this way is called library code. These two ways are implemented using the same set of APIs, called CAPI.

[0024] SO dynamic library: lua calls the dynamic library of the C language through ffi.load IPV4: The IP address is represented by a 32-bit positive integer. The 32-bit IP address is divided into 4 groups, each group being 8 bits. Each group is separated by a ".", and then each group of numbers is converted into the corresponding decimal number. For example: 192.168.0.231 IPV6: In the marking of IPV6, generally the 128-bit IP address is grouped by every 16 bits, and each group is marked with a colon. When there are consecutive 0s, they can be omitted and separated by two colons. Only one occurrence of two consecutive colons is allowed in an IP address. For example: FE80:: / 10 The following will, in conjunction with the accompanying drawings, elaborate on various non-limiting embodiments of the present application in detail.

[0025] First, with reference to Figure 1 , a detailed description will be given of the method for dynamically implementing an IP black and white list in real time in the present application.

[0026] The present application provides a method for dynamically implementing an IP black and white list in real time. The method includes: S1: Implement three interface functions related to the IP black and white list in the dynamic library of C language; S2: Determine and distribute the IP black and white list, where the IP black and white list includes an IP black list and / or an IP white list; S3: Start nginx, read the IP black and white list, combine the ipv4 and ipv6 included in the IP black and white list into an array, store the array through a radix tree, and store the update operation corresponding to the IP black and white list. At the same time, start a first timer to check the modification attribute of the IP black and white list. If the modification attribute of the IP black and white list changes, repeat the process of reading the IP black and white list. If the modification attribute of the IP black and white list does not change, enter the next cycle; S4: During the user access process, nginx queries the IP black and white list attribute of the user through the radix tree, where the IP black and white list attribute includes an IP black list user or an IP white list user; S5: If the IP black and white list attribute of the user is an IP black list user, reject the user's access. If the IP black and white list attribute of the user is an IP white list user, allow the user's access.

[0027] The above method realizes reading the specified IP black and white list file through a radix tree, achieving dynamic real-time effectiveness, and realizes the real-time update of the IP black and white list through the dynamic library of C language combined with the radix tree data structure, improving the execution efficiency.

[0028] In some embodiments, the IP blacklist is divided into a global blacklist and a user blacklist, and the IP whitelist is divided into a global whitelist and a user whitelist. The nginx queries the IP black and white list attributes of the user through the radix tree, including: The nginx performs a first query through the radix tree, and the first query is to query the global blacklist and the global whitelist; The nginx performs a second query through the radix tree, and the second query is to query the user blacklist and the user whitelist; In the case where at least one of the first query and the second query determines that the IP black and white list attribute of the user is an IP blacklist user, it is determined that the IP black and white list attribute of the user is an IP blacklist user.

[0029] Specifically, during the access process of a user (such as an actual Internet user), in the access phase of nginx, access_by_lua is executed for two-step queries: 1) The first query, querying the global blacklist and the global whitelist: Find the client IP ($remote_addr) of the current Internet user, ngx_ip_array_lookup(global,$remote_addr), and query in the global list. If it is a blacklist user, return true to reject; if it is a whitelist user, return true to allow access.

[0030] 2) The second query, querying the user blacklist and the user whitelist of its own host: According to the accelerated domain name, find the client IP ($remote_addr) corresponding to the current user, ngx_ip_array_lookup(host,$remote_addr). If it is a blacklist user, return true to reject; if it is a whitelist user, return true to allow access.

[0031] If one of the first query and the second query needs to reject, the access of the current user should be rejected, and a 403 status code is returned, and the user is not allowed to access the corresponding resource.

[0032] Specifically, a directory can be determined, assumed to be / usr / local / nginx / conf / ip_access.conf ip_access.conf is issued by the configuration distribution component. The configuration distribution component determines the IP blacklist or IP whitelist to be issued and issues it in JSON format.

[0033] The specific format is exemplified as follows: When "host" is equal to "global", it means this entry is global.

[0034] {"host":"www.baidu.com","deny":{"ipv4":["1.2.3.4","2.3.4.5 / 24"],"ipv6":["fe80::1"]}}; This entry represents the user blacklist for users of www.baidu.com.

[0035] {"host":"www.qq.com","allow":{"ipv4":["1.2.3.4","2.3.4.5"],"ipv6":["fe80::1"]}}; This entry represents the user whitelist for users of www.qq.com.

[0036] {"host":"global","deny":{"ipv4":["1.2.3.4","2.3.4.5"],"ipv6":["fe80::1"]}}; This entry represents the global blacklist.

[0037] {"host":"global","allow":{"ipv4":["1.2.3.4","2.3.4.5"],"ipv6":["fe80::1"]}} This entry represents the global whitelist.

[0038] During the startup phase of nginx, it can read each line of / usr / local / nginx / conf / ip_access.conf. After reading each line, convert the JSON format to a Lua table, combine the ipv4 and ipv6 combinations under "deny" or "allow" into an array X, where the key is "host" and the value is X, representing the content under this host, and call the ngx_ip_array_update function of the SO library to store it through a radix tree. At the same time, store the modification of this file (i.e., the most recent modification time, which will change automatically if rewritten). Also start a first timer (for example, every 10 seconds) to check the modification property of ip_access.conf. If the file has not changed, skip to the next cycle; if it has changed, repeat the above reading process. The built-in data structure of nginx uses a radix tree, which improves the query efficiency and can be updated in real time.

[0039] In some embodiments, the three interface functions related to the IP black and white lists are respectively: Add and modify the interface function, denoted as ngx_ip_array_update(key, value); if the key exists, it is modified, and if the key does not exist, it is added.

[0040] The query function, denoted as Wiengx_ip_array_lookup(host, key); the return value of the query function is true or false. If the content is found, it returns true, and if not, it returns false.

[0041] The deletion function, denoted as ngx_ip_array_destory(key). The deletion function means deleting this access restriction rule.

[0042] In some embodiments, the method further includes: Call three interface functions related to the IP black and white list to perform real-time dynamic update operations on the IP black and white list corresponding to the user, where the update operations include addition, modification, query, and deletion.

[0043] For example, if it is necessary to delete the entire access restriction, call the ngx_ip_array_des tory(host) interface for the corresponding host to delete the IP black and white list corresponding to this host.

[0044] In some embodiments, the IP black and white list is issued in json format, and multiple jsons are distinguished by line breaks.

[0045] In some embodiments, in the case of rejecting the user's access, return a 403 status code and do not allow the user to access the corresponding resources.

[0046] In some embodiments, the first timer includes 10 seconds or 20 seconds.

[0047] In some embodiments, the dynamic library is a SO library. The SO library defines three interface functions to implement the capabilities of addition, modification, deletion, and query, and configures the modification attribute.

[0048] The SO library supports both IPv4 and IPv6 formats. It uses the built-in data structure of nginx, the radix tree, as the storage data structure. The radix tree in nginx is represented by the ngx_radix_tree_t structure. Each node stored in ngx_radix_tree_t must use a 32-bit integer as the unique identifier to distinguish two nodes. The ngx_radix_tree_t radix tree is responsible for allocating the memory occupied by each node. The value that can be stored in each node of the radix tree is a pointer, and this pointer points to the actual data. The ngx_radix_tree_t radix tree, like the ngx_rbtree_t red-black tree, is a binary search tree. The ngx_radix_tree_t radix tree has the same advantages as the ngx_rbtree_t red-black tree, but the application scope of the ngx_radix_tree_t radix tree is smaller than that of the ngx_rbtree_t red-black tree because the ngx_radix_tree_t requires elements to use integer data as the keyword, so its application scenarios are greatly reduced. However, since the ngx_radix_tree_t radix tree does not need to perform rotation operations when inserting and deleting elements, its insertion and deletion efficiency is generally higher than that of the ngx_rbtree_t red-black tree. And IP is just suitable for the scenario of the radix tree, so the radix tree is selected for the highest execution efficiency.

[0049] Compared with the prior art, the method for real-time implementation of dynamic IP black and white lists in this application has the following improvements: 1. Optimize the performance of the C language to solve the inefficiency problems of the lua virtual machine in processing strings and memory. Compared with the open-source lua virtual machine mechanism, this innovation implements the functions in the article based on the dynamic link library of the C language, mainly taking advantage of the high efficiency of the C language. Especially when dealing with a large number of IP addresses and range matching, the string processing mechanism of lua will cause a high time complexity in frequent operations, and the optimized performance of the C language is obvious.

[0050] 2. Optimize the data structure In the initial lua implementation, the storage and lookup of the IP black and white list rely on the hash table (HashTable) built into lua. Although the hash table performs excellently in the scenario of exact matching, there are a large number of fuzzy lookups in this business. The design of the radix tree not only optimizes the lookup efficiency, but also further reduces the depth and memory occupancy of the tree through path compression and node merging techniques. It can dynamically adjust the structure of the tree according to the distribution of IP addresses to ensure high performance under different data distributions. Support CIDR notation: The radix tree naturally supports the storage and lookup of IP segments in CIDR notation and can directly handle IP ranges such as "192.168.1.0 / 24".

[0051] 3. Performance Comparison and Improvement By migrating the core logic to C language and optimizing the data structure, the overall performance of the system has been significantly improved: 1) Query efficiency: The introduction of the radix tree has increased the range search efficiency of IP addresses by more than 80%. Especially when dealing with large-scale IP segments, the performance advantage is more obvious.

[0052] 2) Memory occupancy: The memory occupancy of the radix tree is reduced by more than 50% compared to the hash table, effectively reducing the resource consumption of the system.

[0053] 3) Concurrent processing ability: The efficient execution of C language and the fast search ability of the radix tree enable the system to easily handle high-concurrency scenarios, and the single-machine QPS (queries per second) has increased by more than 3 times.

[0054] The method for dynamically implementing the IP black and white list in real time in this application has the following advantages: 1) Innovation in technology selection: By migrating the Lua script to the C language dynamic link library and combining with the radix tree data structure, a qualitative leap in performance has been achieved.

[0055] 2) Dynamic real-time effectiveness: Supports the dynamic update of the IP black and white list without restarting the service, meeting the high availability requirements of the business.

[0056] 3) Efficient range search: The introduction of the radix tree solves the performance bottleneck of IP address range search and provides stronger support for the business.

[0057] 4) Resource optimization: Through path compression and node merging technologies, the memory occupancy and query efficiency are further optimized.

[0058] It should be noted that the method of one or more embodiments of this application can be executed by a single device, such as a computer or a server, etc. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In this distributed scenario, one of the multiple devices can only execute one or more steps of the method of one or more embodiments of this application, and these multiple devices will interact with each other to complete the described method.

[0059] It should be noted that the specific embodiments of this application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be executed in a different order than in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown to achieve the desired result. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0060] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also discloses an electronic device; Specifically, Figure 2 FIG. shows a schematic hardware structure diagram of an electronic device for implementing a method for dynamically implementing a dynamic IP black and white list in real time according to the present embodiment. The device may include: a processor 410, a memory 420, an input / output interface 430, a communication interface 440, and a bus 450. Among them, the processor 410, the memory 420, the input / output interface 430, and the communication interface 440 are communicatively connected to each other inside the device through the bus 450.

[0061] The processor 410 may be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present application.

[0062] The memory 420 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 420 may store an operating system and other application programs. When implementing the technical solutions provided by the embodiments of the present application through software or firmware, the relevant program codes are stored in the memory 420 and are called and executed by the processor 410.

[0063] The input / output interface 430 is used to connect to an input / output module to implement information input and output. The input / output module may be configured as a component in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Among them, the input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0064] The communication interface 440 is used to connect to a communication module (not shown in the figure) to implement communication interaction between the present device and other devices. Among them, the communication module may implement communication in a wired manner (for example, USB, network cable, etc.) or in a wireless manner (for example, mobile network, WIFI, Bluetooth, etc.).

[0065] The bus 450 includes a path for transmitting information between various components of the device (for example, the processor 410, the memory 420, the input / output interface 430, and the communication interface 440).

[0066] It should be noted that although the above device only shows the processor 410, the memory 420, the input / output interface 430, the communication interface 440, and the bus 450, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device may also only include the components necessary for implementing the solution of the embodiment of the present application, and does not necessarily include all the components shown in the figure.

[0067] The electronic device of the above embodiment is used to implement the method for real-time implementation of dynamic IP black and white lists corresponding to any one of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0068] Based on the same inventive concept, corresponding to the method of any of the above embodiments, one or more embodiments of the present application also provide a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the method for real-time implementation of dynamic IP black and white lists as described in any of the above embodiments.

[0069] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0070] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to execute the method for real-time implementation of dynamic IP black and white lists as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be elaborated here.

[0071] Those of ordinary skill in the art should understand that: The discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the present application (including the claims) is limited to these examples; Under the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations in different aspects of one or more embodiments of the present application as described above, and they are not provided in detail for the sake of brevity.

[0072] In addition, for simplicity of explanation and discussion, and in order not to make one or more embodiments of the present application difficult to understand, well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the devices may be shown in block diagram form to avoid making one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present application are to be implemented (i.e., these details should be fully within the understanding of those skilled in the art). In cases where specific details (such as circuits) are set forth to describe exemplary embodiments of the present application, it will be apparent to those skilled in the art that one or more embodiments of the present application can be implemented without these specific details or with variations of these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0073] Although the present application has been described in connection with specific embodiments of the present application, many alternatives, modifications, and variations of these embodiments will be apparent to those of ordinary skill in the art based on the foregoing description. For example, other memory architectures (such as dynamic RAM (DRAM)) can be used with the embodiments discussed.

[0074] One or more embodiments of the present application are intended to cover all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application shall be included within the protection scope of the present application.

Claims

1. A method for dynamically implementing a dynamic IP black and white list in real time, characterized in that, The method includes: Implement three interface functions related to the IP black and white list in the dynamic library of C language; Determine and distribute the IP black and white list, where the IP black and white list includes an IP black list and / or an IP white list; Start nginx, read the IP black and white list, combine the ipv4 and ipv6 included in the IP black and white list into an array, store the array through a radix tree, and store the update operation corresponding to the IP black and white list. At the same time, start the first timer to check the modification attribute of the IP black and white list. If the modification attribute of the IP black and white list changes, repeat the process of reading the IP black and white list. If the modification attribute of the IP black and white list does not change, enter the next cycle; During the user access process, nginx queries the IP black and white list attribute of the user through the radix tree, where the IP black and white list attribute includes an IP black list user or an IP white list user; If the IP black and white list attribute of the user is an IP black list user, reject the user's access. If the IP black and white list attribute of the user is an IP white list user, allow the user's access.

2. The method for dynamically implementing a dynamic IP black and white list in real time according to claim 1, wherein The IP black list is divided into a global black list and a user black list, and the IP white list is divided into a global white list and a user white list. Nginx queries the IP black and white list attribute of the user through the radix tree, including: Nginx performs a first query through the radix tree, and the first query is to query the global black list and the global white list; Nginx performs a second query through the radix tree, and the second query is to query the user black list and the user white list; In the case that at least one of the first query and the second query determines that the IP black and white list attribute of the user is an IP black list user, it is determined that the IP black and white list attribute of the user is an IP black list user.

3. The method for dynamically implementing a dynamic IP black and white list in real time according to claim 1 or 2, characterized in that, The three interface functions related to the IP black and white list are respectively: The add and modify interface function, expressed as ngx_ip_array_update(key,value); The query function, expressed as Wiengx_ip_array_lookup(host,key); The delete function, expressed as ngx_ip_array_destory(key).

4. The method for dynamically implementing a dynamic IP black and white list in real time according to claim 3, wherein The method further includes: Call three interface functions related to the IP black and white list to perform real-time dynamic update operations on the IP black and white list corresponding to the user, where the update operations include addition, modification, query, and deletion.

5. The method for real-time implementation of dynamic IP black and white lists according to claim 1, wherein The IP black and white list is distributed in json format, and multiple jsons are distinguished by line breaks.

6. The method for dynamically implementing a dynamic IP black and white list in real time according to claim 1, characterized in that In the case of rejecting the user's access, return a 403 status code and do not allow the user to access the corresponding resource.

7. The method for dynamically implementing a dynamic IP black and white list in real time according to claim 1, wherein The first timer includes 10 seconds or 20 seconds.

8. The method for real-time implementation of a dynamic IP black and white list according to claim 7, wherein The dynamic library is a SO library.

9. An electronic device, the electronic device comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 8.

Images