System access security risk control processing method and device

Abstract

The present application discloses a system access security risk control processing method, which belongs to the field of software development. The method mainly includes setting an interface access restriction configuration group on the management terminal configuration interface of the current system background, obtaining the interface access restriction configuration information in the background, and automatically loading the interface access restriction configuration information into the system memory; when a user or an external system accesses a specified application programming interface, the background synchronizes the interface access restriction configuration information in the system memory with the request restriction information in the database and updates it to the system cache, obtains the interface restriction information, and determines whether the specified application programming interface has an access frequency restriction through aspect-oriented programming. The present application adopts a custom group configuration to associate the current limiting interface URL, which is flexible and reliable; through the independent development of the access restriction algorithm, the aspect verification is used to effectively achieve the purpose of interface access restriction; the abnormal access records are recorded by the log processing center, and graphical monitoring can be realized on the system.

Description

Technical Field

[0001] The present application relates to the field of software development technology, and in particular to a system access security risk control processing method and device. Background Art

[0002] During actual software operation, specific APIs may be accessed frequently or may be publicly accessible. To ensure system stability and security, access frequency restrictions must be applied to these specific APIs to prevent server crashes and malicious access attacks.

[0003] In traditional software development, mainstream technologies for limiting API access times include annotation-based access control, RateLimiter, and Spring-Cloud-Alibaba-Sentinel-Gateway. Each has its own configuration syntax and standards, and suffers from the following shortcomings:

[0004] Controlling the number of accesses to the interface using aspect annotations: Although controlled by aspect annotations, it is not possible to customize the restriction level (IP, user, global);

[0005] RateLimiter: It is implemented by limiting the speed of request inflow. Its usage is similar to the aspect annotation method. It also cannot customize the configuration limit type (IP, user, global), limit level (shared, individual), limit frequency, and limit number. Spring-cloud-alibaba-sentinel-gateway current limiting: For the encapsulated microservice architecture, simple interface current limiting must be configured outside the system, which makes configuration management inconvenient. In addition, mainstream interface current limiting technologies need to be configured in code or configuration files. Summary of the Invention

[0006] In response to the problems in the existing technology that the interface restriction rules cannot be customized, the interface current limiting needs to be configured outside the system, the configuration management is not convenient, and the mainstream interface current limiting technology needs to be configured in the code or configuration file, this application mainly provides a system access security risk control processing method and device.

[0007] To achieve the above objectives, a technical solution adopted by this application is to provide a system access security risk control processing method, which includes:

[0008] On the management configuration interface of the current system background, set the interface access restriction configuration group through the interface access restriction sub-interface;

[0009] Binding the interface access restriction configuration group and the uniform resource locator address of the specified application programming interface in the associated application programming interface, obtaining the interface access restriction configuration information in the background, and automatically loading the interface access restriction configuration information into the system memory;

[0010] When a user or external system requests to access a specified application programming interface, the background will synchronize the interface access restriction configuration information in the system memory with the request restriction information in the database to the system cache, obtain the interface restriction information, and determine whether the specified application programming interface has an access frequency restriction through aspect-oriented programming.

[0011] If it does not exist, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system.

[0012] If it exists, it is determined whether the number of requested accesses to the specified application programming interface exceeds the access frequency limit, where:

[0013] If the number of requested accesses does not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system; otherwise, an error prompt information is returned to the user access interface of the current system and / or the external system; and

[0014] The access record information of users and / or external systems accessing the specified application programming interface is saved to the log center interface through the log processing center.

[0015] Another technical solution adopted by this application is to provide a system access security risk control processing device, which includes:

[0016] A module used to set the interface access restriction configuration group through the interface access restriction sub-interface on the management terminal configuration interface of the current system background;

[0017] A module for binding an interface access restriction configuration group to a uniform resource locator address of a specified application programming interface in its associated application programming interface, obtaining interface access restriction configuration information in the background, and automatically loading the interface access restriction configuration information into the system memory;

[0018] When a user or external system requests to access a specified application programming interface, the background will synchronize the interface access restriction configuration information in the system memory with the request restriction information in the database to the system cache, obtain the interface restriction information, and use aspect-oriented programming to determine whether the specified application programming interface has an access frequency restriction module.

[0019] If it does not exist, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system.

[0020] If it exists, it is determined whether the number of requested accesses to the specified application programming interface exceeds the access frequency limit, where:

[0021] If the number of requested accesses does not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system; otherwise, an error prompt information is returned to the user access interface of the current system and / or the external system; and

[0022] A module used to save access record information of users and / or external systems accessing a specified application programming interface to the log center interface through the log processing center.

[0023] The beneficial effects that can be achieved by the technical solution of the present application are as follows: the present application designs a method and device for processing system access security risk control. The interface access restriction mechanism set by the present application through the configuration interface of the management end can prevent high-frequency access from occupying system resources and prevent malicious access attacks from invading resources, ensure the safety of system operation, and is separated from the business code, realizes visual configuration of the interface, and the maintenance process is convenient and fast, and provides a standardized configuration window; the interface current limiting mechanism adopts group configuration to associate the current limiting interface URL, and the configuration rules can be customized, which has certain flexibility; the interface access restriction mechanism is independently developed through the combination of database + Redis cache + system cache + aspect verification. The algorithm of the interface access restriction mechanism adopts aspect verification to effectively achieve the purpose of interface access restriction, which is effective; abnormal access records are recorded by the log processing center, and graphical monitoring can be realized on the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0025] Figure 1 This is a schematic diagram of a specific implementation of a system access security risk control processing method of the present application;

[0026] Figure 2 This is a flowchart of a system access security risk control processing method of the present application;

[0027] Figure 3 This is a schematic diagram of a specific implementation of a system access security risk control processing device of the present application;

[0028] Figure 4 This is a system architecture diagram of a system access security risk control processing method of this application.

[0029] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0030] The preferred embodiments of the present application are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present application can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present application.

[0031] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0032] The Java compilation and construction tools currently on the market mainly include custom annotations, RateLimiter rate control, spring-cloud-alibaba-sentinel-gateway current limiting, etc. Among them, the annotation method controls the number of accesses to the interface: current limiting is achieved through custom annotations + interceptors + Redis. Although it is controlled through aspect annotations, the level of restriction (IP, user, global) cannot be customized; RateLimiter controls the API request rate: The principle of RateLimiter is token bucket, which is mainly defined by the rate at which licenses are issued. If there is no additional configuration, licenses will be allocated at a fixed rate specified by the license per second, and the licenses will be distributed smoothly. If the request exceeds permitsPerSecond, RateLimiter releases licenses at a rate of 1 / permitsPerSecond per second. It is also impossible to customize the configuration restriction type (IP, user, global), restriction level (shared, individual), restriction frequency, and restriction number; spring-cloud-alibaba-sentinel-gateway current limiting: For the encapsulated microservice architecture, simple interface current limiting must be configured outside the system, and configuration management is not very convenient.

[0033] This application uses a unified interface request frequency limit center, allowing system administrators to easily configure access frequency limits for specific interfaces. This configuration is independent of the business level and requires only simple configuration on the "Interface Access Limit" maintenance interface, without the need for adjustments or modifications in code or configuration files. This is convenient and fast. Systems that have already implemented this feature include cross-border logistics service platforms.

[0034] This application is based on Redis cache and uses the key-value data storage characteristics of Redis. When processing a request, the key is increased by 1 through the increment method of Redis cache. If 1 is returned, it means that it is the first request, and the record is persisted to the disk. In combination with Redis, an interface access limit module is written in JAVA language in the system.

[0035] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0036] Figure 1 A specific implementation of a system access security risk control processing method of the present application is shown.

[0037] exist Figure 1 In the illustrated implementation mode, the system access security risk control processing method mainly includes: step S101, setting the interface access restriction configuration group through the interface access restriction sub-interface on the management end configuration interface of the current system background; step S102, binding the interface access restriction configuration group and the uniform resource locator address of the specified application programming interface in the application programming interface associated with it, obtaining the interface access restriction configuration information in the background, and automatically loading the interface access restriction configuration information into the system memory.

[0038] In this implementation, access restrictions to the application programming interface (API) are configured on the management-side configuration interface of the interaction layer. This method not only completely decouples the business layer, allowing for interface-based configuration of any system interface, but also transcends traditional throttling methods, which require code adjustments or system configuration file modifications to implement interface access restriction configuration. This approach facilitates quick and easy maintenance, provides a standardized configuration window, and offers a highly versatile solution. The access restriction mechanism on the management-side configuration interface prevents high-frequency access from occupying system resources and malicious access attacks from usurping resources, while also ensuring system operational security.

[0039] It should be noted that the current system is a system that has the security risk control management method of this application, and is a current application system that can be accessed by backend managers, users or external systems.

[0040] In an optional embodiment of the present application, at least one interface access restriction configuration group is set in the interface access restriction sub-interface, and each interface access restriction configuration group is associated with at least one application programming interface.

[0041] In this embodiment, the current limiting mechanism uses a uniform resource identifier address URL associated with the current limiting interface in group configuration, and the configuration rules can be customized; an interface access restriction configuration group can configure or maintain multiple application programming interfaces API; the group configuration makes the access frequency restriction processing of specific APIs more efficient.

[0042] In an optional embodiment of the present application, an interface access restriction configuration group is set through an interface access restriction sub-interface, and the uniform resource locator address of a specified application programming interface in the application programming interface associated with the interface access restriction configuration group is bound, and the interface access restriction configuration information is obtained in the background, including: in the interface access restriction sub-interface, the action level of the interface access restriction configuration group is selected through the access restriction type, where the action level includes user level, IP level or global; the restriction action type of the access frequency and access count of the application programming interface associated with the interface access restriction configuration group is selected according to the access restriction level, where the restriction action type includes shared restriction or individual restriction; the specific restriction rules of the application programming interface access restriction associated with the interface access restriction configuration group are selected according to the access frequency restriction and access count restriction; and the interface access restriction configuration information is obtained by binding the interface access restriction configuration group with the uniform resource locator address of the specified application programming interface.

[0043] In this embodiment, the restriction type can be customized as: global restriction, IP restriction, user restriction; the restriction level can be customized as; common restriction, individual restriction; the system can also customize the restriction frequency and number; configuration management is convenient and efficient, and highly flexible.

[0044] In one example of the present application, the access restriction type is configured: according to the configured access restriction type, the level of action of the configuration group is specified, wherein the user layer refers to the access restriction group acting on the user layer, that is, the access restriction of a certain user accessing the interface connection associated with the group; the IP layer refers to the access restriction group acting on the network IP layer, that is, the access restriction of a certain user accessing the interface connection associated with the group under a certain network IP; the global refers to the access restriction group ignoring IP and user information, that is, any user accessing the interface connection associated with the group under any network IP will be affected by the access restriction.

[0045] In this example, the access restriction level configuration is as follows: according to the configured access restriction level, it is specified whether the access frequency and access count restrictions of the APIs associated with the configuration group are common or individual.

[0046] In this example, the access restriction frequency and number of times are configured: according to the configured access restriction frequency and number of times, the specific restriction rules for the access restriction of the API associated with the configuration group are specified.

[0047] In an optional embodiment of the present application, in the log center interface, based on the queried restricted access record information, check whether there are abnormal request records for the specified application programming interface. If there are abnormal request records, set an access blacklist based on the user information or IP information in the abnormal request record.

[0048] In this embodiment, access restricted record information can be queried in the system log center interface; based on the access restriction log record information, it can be checked whether there are abnormal access records. If there are abnormal access records, an access blacklist can be set according to the specified user or IP, which can enhance system security and prevent malicious access attacks.

[0049] exist Figure 1 In the illustrated embodiment, the system access security risk control processing method also includes: step S103, when the user and / or external system requests access to the specified application programming interface, the background synchronizes the interface access restriction configuration information in the system memory and the request restriction information in the database to the system cache, obtains the interface restriction information, and determines whether the specified application programming interface has an access frequency limit through aspect-oriented programming. If not, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system. If so, it is determined whether the number of requested accesses to the specified application programming interface exceeds the access frequency limit. If the number of requested accesses does not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system. Otherwise, an error prompt message is returned to the user access interface of the current system and / or the external system.

[0050] In this implementation, based on the interface restriction information in the system cache, aspect-oriented programming technology can determine whether there is a frequency limit on the currently accessed specified application programming interface; by independently developing an interface access restriction mechanism algorithm by combining the database with Redis cache and system cache with aspect-oriented programming verification, the number of request accesses to the currently accessed specified application programming interface can be obtained, thereby determining whether the number of request accesses exceeds the frequency limit, thereby achieving the purpose of interface access, which has both a certain degree of independent development and effectiveness.

[0051] Step 104: The log processing center saves the access record information of the user and / or external system accessing the designated application programming interface to the log center interface.

[0052] In this implementation, an interface access restriction mechanism algorithm is independently developed by combining the database with Redis cache, system cache, and aspect verification to achieve the purpose of interface access restriction and ensure the effectiveness of this solution; the access record information of the specified application programming interface is recorded in the log center interface to facilitate backend management personnel to query and check for exceptions at any time.

[0053] In an optional embodiment of the present application, the background synchronizes the interface access restriction configuration information in the system memory with the request restriction information in the database and updates them to the system cache to obtain the interface restriction information, including: processing the request restriction information in the database and recording the request restriction information in the system memory, wherein when the synchronization time in the database is equal to the initial value, the request restriction information in the database is synchronized to the system memory; when the synchronization time in the database is greater than the preset synchronization time in the system cache, and there is a request restriction key in the remote dictionary service cache, and the synchronization time in the remote dictionary service cache is greater than the synchronization time in the system memory, the request restriction information in the database is synchronized to the system memory, and the request restriction key and the corresponding synchronization timestamp are recorded in the system memory; and a synchronization interface request restriction caching method is executed on the interface access restriction configuration information and the request restriction information in the system memory to obtain the interface restriction information in the system cache.

[0054] In this specific embodiment, when the system starts, the system automatically loads the interface access restriction configuration information configured by the management background into the system memory, and synchronizes the interface access restriction configuration information in the system memory and the request restriction information in the database into the system cache. It is necessary to first synchronize the data in the database to the system memory, and then use the synchronous interface request restriction cache method to synchronize the request restriction information and the interface access restriction configuration information in the database to the system cache. The maintained interface restriction information serves as the basis for indirectly obtaining the number of request accesses to the interface.

[0055] Preferably, the initial value can be reasonably determined based on experience, wherein the initial value can be 0.

[0056] It should be noted that the request limit synchronization method processes the request limit information in the database and records it in the system memory. When entering the request limit synchronization method, the method first determines whether the synchronization time in the database is equal to 0. If the synchronization time is equal to 0, the request limit data is synchronized from the database by default. Otherwise, the method determines whether the current time is greater than the preset synchronization time of 5 minutes in the system cache record. If so, it determines whether the request limit key exists in the remote dictionary service cache Redis. If so, it then determines whether the synchronization time in the remote dictionary service cache Redis is greater than the synchronization time in the memory. If so, the request limit information in the database is synchronized to the memory. Finally, the last synchronization time is recorded.

[0057] In an optional embodiment of the present application, after obtaining the interface restriction information, it also includes obtaining the current restriction cache key of the current execution of the synchronous interface request restriction cache method and the storage key of the last execution of the synchronous interface request restriction cache method based on the interface restriction information in the system cache; and obtaining the number of request accesses to the specified application programming interface based on the current restriction cache key and the storage key.

[0058] In this embodiment, based on the interface restriction information, user information and IP information, the current restriction cache key for the current execution of the synchronous interface request restriction cache method and the storage key for the last execution of the synchronous interface request restriction cache method can be obtained, paving the way for calculating the number of request accesses.

[0059] In an optional embodiment of the present application, based on the interface restriction information in the system cache, the restriction cache key for the current execution of the synchronous interface request restriction cache method and the storage key for the last execution of the synchronous interface request restriction cache method are obtained, including: judging the restriction effect type in the restriction level information according to the access restriction level information preset in the interface restriction information, splicing the initial definition symbol of the restriction ID corresponding to the current restriction cache key with the common restriction or separate restriction in the restriction effect type to obtain a first splicing key; judging the effect level in the access restriction type information according to the access restriction type information preset in the interface restriction information, splicing the first splicing key with one of the IP address, user ID and global identifier in the effect level to obtain a second splicing key; obtaining the time value in the restriction frequency information according to the access frequency restriction information preset in the interface restriction information, splicing the second splicing key with the time value to obtain the current restriction cache key for the current execution of the synchronous interface request restriction cache method.

[0060] In this embodiment, the obtained limit cache key is used to store a count in the remote dictionary service Redis cache.

[0061] In an example of the present application, if the restriction ID of the key key is a123, its initial definition can be: KEYa123; if its restriction level is single restriction, the first spliced ​​key after splicing is: KEYa123:SINGLE; if its restriction type is IP restriction and the IP is 127.0.0.1, the second spliced ​​key after splicing is: KEYa123:SINGLE:127.0.0.1; if its frequency limit is minutes and the current time minute number is 31, the final current restriction cache key is: KEYa123:SINGLE:127.0.0.1:31.

[0062] In an optional embodiment of the present application, based on the interface restriction information in the system cache, the restriction cache key of the current execution of the synchronous interface request restriction cache method and the storage key of the last execution of the synchronous interface request restriction cache method are obtained, and it also includes: based on the access restriction level information preset in the interface restriction information, judging the restriction effect type in the access restriction level information, splicing the initial definition symbol of the restriction ID corresponding to the storage key with the common restriction or separate restriction in the restriction effect type to obtain a third splicing key; based on the restriction type information preset in the interface restriction information, obtaining the effect level in the restriction type information, splicing the third splicing key with one of the IP address, user ID and global identifier in the effect level, and finally obtaining the storage key of the last execution of the synchronous interface request restriction cache method.

[0063] In this embodiment, the storage key is a key used to find the execution record in the remote dictionary service cache.

[0064] In one example of this application, the frequency limit and splicing frequency values ​​are not determined; only the splicing restriction level and restriction type values ​​are determined. For example, if the restriction ID is a123, the initial definition can be: KEYa123; if its restriction level is single restriction, the third splicing key after splicing is: KEYa123:SINGLE; if its restriction type is IP restriction and the IP address is 127.0.0.1, the storage key is: KEYa123:SINGLE:127.0.0.1.

[0065] In an optional embodiment of the present application, the number of request accesses to the specified application programming interface is obtained based on the current restriction cache key and the storage key, including: using the storage key of the last execution of the synchronous interface request restriction cache method to obtain the previous restriction cache key; judging whether the current restriction cache key is equal to the previous restriction cache key, if not equal, deleting the previous restriction cache key from the remote dictionary service cache to release resources; if equal, using the storage key as the key in the remote dictionary service cache, using the current restriction cache key as the value in the remote dictionary service cache, and storing it in the remote dictionary service cache as an execution record storage; through the increment method of the remote dictionary service cache, using the current restriction cache key, counting the number of request accesses to the specified application programming interface, and returning the count value of the number of request accesses per unit time under the interface restriction rules.

[0066] In this embodiment, based on the storage key of the last execution of the synchronous interface request restriction cache method, the execution record in the remote dictionary service cache of the last execution of the synchronous interface request restriction cache method is found. The execution record records the last restriction cache key of the last execution of the synchronous interface request restriction cache method. The current restriction cache key is compared with the previous restriction cache key. If the current restriction cache key is not equal to the previous restriction cache key, the execution record in the remote dictionary service cache is deleted to release resources. Otherwise, the request access count is counted. When the aspect processing determines that the request access count is limited and returns an error prompt message, the log processing center saves the access record information to the system memory so that the abnormal request information can be viewed.

[0067] In an example of the present application, the restriction cache key key and the storage key key of the last execution of the restriction cache are obtained respectively through the above-mentioned splicing method. The process of obtaining the number of request accesses includes: first, obtaining the restriction cache key key of the last execution according to the storage key key of the last execution of the restriction cache; second, judging whether the restriction cache key key of the current request is equal to the restriction cache key key of the last request. If they are not equal, deleting the restriction cache key key of the last request from the remote dictionary service Redis cache to release resources; then, using the obtained storage key key of the last execution of the restriction cache as the key key of the remote dictionary service redis cache, and storing the restriction cache key key obtained this time as the value of the remote dictionary service redis cache in the remote dictionary service Redis cache as an execution record; finally, using the current restriction cache key key and the increment() increment method in the remote dictionary service Redis cache to implement the counter function and return the number of requests per unit time for the request under the interface restriction rule. Judge whether the request meets the interface restriction requirements. If the returned number is greater than the interface restriction requirement number, directly return an error message through the section. Here, since the current limit cache key will accumulate and increase with the increase in the number of requests and the different requests per unit time, the limit cache key of the last request needs to be deleted from the remote dictionary service Redis cache to release resources.

[0068] For example, if the application programming interface a123 is executed at IP: 127.0.0.1 twice at 31 minutes and once at 32 minutes, the execution steps are as follows: First time: limit the cache key to: KEYa123:SINGLE:127.0.0.1:31, limit the cache storage key of the last execution to: KEYa123:SINGLE:127.0.0.1, and the execution record is {"KEYa123:SINGLE:127.0.0.1":"KEYa123:SINGLE:127.0.0.1:31"}, after the execution is completed, the execution count of KEYa123:SINGLE:127.0.0.1:31 in the remote dictionary service redis is 1; Second time: limit the cache key to: KEYa123:SINGLE:127.0.0.1:31, limit the cache storage key of the last execution to ey is: KEYa123:SINGLE:127.0.0.1 and is in redis, and the execution record is {"KEYa123:SINGLE:127.0.0.1":"KEYa123:SINGLE:127.0.0.1:31"}. After the execution is completed, the number of executions of KEYa123:SINGLE:127.0.0.1:31 in the remote dictionary service redis is 2; the third time: the cache key is limited to: KEYa123:SINGLE:127.0.0.1:32, and the storage key of the last execution of the cache is limited to: KEYa123:SINGLE:127.0.0.1 and is in redis, and the execution record is {"KEYa123:SINGLE:127.0.0.1":"KEYa123:SINGLE:127.0.0.1:32"}. The second and third execution records have the same key, but the corresponding value is different. Therefore, the restricted execution key recorded in the remote dictionary service Redis for the second execution is deleted. After the execution is completed, the execution count for KEYa123:SINGLE:127.0.0.1:32 in the remote dictionary service Redis is 1.

[0069] Figure 2 This is a flowchart of a system access security risk control processing method of this application. Figure 2In the flowchart shown, the system backend administrator sets API restriction rules and maintains the API interface access restriction configuration group and interface configuration; when a user or external system accesses a specified application programming interface that has been bound to the interface restriction rules, that is, accesses the system API, the system backend synchronously obtains the specified application programming interface API restriction rules, that is, the interface restriction information, and determines whether the specified application programming interface has an access frequency restriction through aspect verification; if the access interface does not have an access frequency restriction, the request result information is directly returned; if the access interface has an interface frequency restriction, then the "load interface request restriction cache", "synchronize interface request restriction cache", "get restriction cache key", "get restriction cache last execution storage key" and "get access count" in the system logic layer will be used to determine whether the number of accesses to the access interface exceeds the request frequency limit. If the number of accesses of the current request does not exceed the frequency limit, the request result information is returned normally. Otherwise, the system directly returns the access restriction information and records the access information through the log processing center; the system backend administrator can view the abnormal request records in the system log processing center to set up an access blacklist.

[0070] Access restriction configuration for the access interface is completely separated from the business layer and can be completed through the system's management configuration interface. There is no need to adjust code or modify system configuration files to implement interface access restriction configuration as with traditional current limiting methods. Interface access restrictions can be customized, with restriction types including global restriction, IP restriction, and user restriction; restriction levels including joint restriction and individual restriction; and customizable restriction frequency and count. Interface access restriction configuration uses group-based restriction rules, with access restriction configuration groups associated with specified API URLs. A proprietary interface access restriction mechanism algorithm is developed through a combination of database, Redis cache, system cache, and aspect validation to achieve interface restriction.

[0071] Figure 3 A specific implementation of a system access security risk control processing device of the present application is shown.

[0072] exist Figure 3In the specific implementation manner shown, the system access security risk control processing device mainly includes: module 301, which is used to set the interface access restriction configuration group through the interface access restriction sub-interface on the management terminal configuration interface of the current system background; module 302, which is used to bind the interface access restriction configuration group to the uniform resource locator address of the specified application programming interface in the associated application programming interface, obtain the interface access restriction configuration information in the background, and automatically load the interface access restriction configuration information into the system memory; module 303, which is used to synchronize the interface access restriction configuration information in the system memory with the request restriction information in the database to the system cache when the user and / or external system requests to access the specified application programming interface, so as to obtain the interface restriction information. And through aspect-oriented programming, it is determined whether there is a module with access frequency limit for the specified application programming interface, wherein, if not, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system; if it exists, it is determined whether the number of request accesses to the specified application programming interface exceeds the access frequency limit, wherein if the number of request accesses does not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system, otherwise an error prompt information is returned to the user access interface of the current system and / or the external system; and module 304 is a module for saving the access record information of the user and / or external system accessing the specified application programming interface to the log center interface through the log processing center.

[0073] Figure 4 This is a system architecture diagram of a system access security risk control processing device of the present application. Figure 4 The architecture diagram shown includes the system interaction layer, which includes a user interface. Users access an application programming interface (API) with access restrictions configured in the backend. If the API meets the access restriction requirements, the system displays an error message on the user interface, notifying the user that the access rate is too high. This ensures efficient use of system resources and protects public APIs from malicious external attacks. The system interaction layer also includes a management configuration interface, where system administrators can customize restriction rules for specific API interfaces, grouping them independently from the business code. This allows for visual configuration, facilitates maintenance, and provides a standardized configuration window. The system interaction layer also includes system access log querying. When the aspect processing determines that an access request has been restricted and returns an error message, the log processing center stores the access log information in the system for review of abnormal request information. The system interaction layer also includes access blacklist settings (user, IP). Based on the access restriction log information, it is possible to check for abnormal access records. If abnormal access records exist, access blacklists can be set based on specific users or IP addresses.

[0074] Figure 4 The architecture diagram shown includes a system logic layer, which includes loading the interface request limit cache, synchronizing the interface request limit cache, obtaining the limit cache key, obtaining the storage key of the last execution of the limit cache, obtaining the number of accesses, determining whether the request limit exists or exceeds the limit, and saving the system access records to the log center. The logic layer is mainly used to determine whether there are restrictions on the application programming interface for external access.

[0075] Figure 4 The architecture diagram shown includes a basic configuration layer, which includes database configuration, Redis cache configuration, log processing center, and system cache configuration. The basic configuration layer is mainly used for the underlying call of logic code, including database connection configuration, Redis tool class, system cache loading class, log processing center, etc.

[0076] The system access security risk control processing device provided in this application can be used to execute the system access security risk control processing method described in any of the above embodiments. Its implementation principles and technical effects are similar and will not be repeated here.

[0077] In a specific embodiment of the present application, each functional module in a system access security risk control process of the present application can be directly in hardware, in a software module executed by a processor, or in a combination of the two.

[0078] The software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from and write information to the storage medium.

[0079] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In the alternative, the storage medium may be integral to the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0080] In another specific embodiment of the present application, a computer-readable storage medium stores computer instructions, and the computer instructions are operated to execute the system access security risk control processing method in any embodiment.

[0081] In another specific embodiment of the present application, a computer device includes a processor and a memory, wherein the memory stores computer instructions, and the computer instructions are operated to execute the system access security risk control processing method in any embodiment.

[0082] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0083] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0084] The above description is merely an embodiment of the present application and does not limit the patent scope of the present application. Any equivalent structural transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A system access security risk control processing method, characterized in that: include: On the management terminal configuration interface of the current system backend, an interface access restriction configuration group is set through the interface access restriction sub-interface, wherein, in the interface access restriction sub-interface, an action level of the interface access restriction configuration group is selected according to the access restriction type, wherein the action level includes user level, IP level or global level; and a restriction action type of access frequency and access count of the application programming interface associated with the interface access restriction configuration group is selected according to the access restriction level, wherein the restriction action type includes shared restriction or individual restriction; Binding the interface access restriction configuration group with a uniform resource locator address of a specified application programming interface in its associated application programming interface, the background acquiring interface access restriction configuration information, and automatically loading the interface access restriction configuration information into a system memory; When a user and / or external system requests to access the specified application programming interface, the backend will synchronize the interface access restriction configuration information in the system memory with the request restriction information in the database to the system cache, obtain the interface restriction information, and determine whether the specified application programming interface has an access frequency restriction through aspect-oriented programming, wherein If it does not exist, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system. If so, it is determined whether the number of requested accesses to the specified application programming interface exceeds the access frequency limit, wherein: If the requested access times do not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system; otherwise, an error prompt message is returned to the user access interface of the current system and / or the external system; and The access record information of the user and / or the external system accessing the designated application programming interface is saved to the log center interface through the log processing center.

2. The system access security risk control processing method according to claim 1, characterized in that: The step of setting an interface access restriction configuration group through the interface access restriction sub-interface, binding a uniform resource locator address of a specified application programming interface in the application programming interface associated with the interface access restriction configuration group, and obtaining interface access restriction configuration information in the background includes: Selecting a specific restriction rule for the application programming interface access restriction associated with the interface access restriction configuration group according to the access frequency restriction and the access count restriction; and The interface access restriction configuration information is obtained by binding the interface access restriction configuration group with the uniform resource locator address of the designated application programming interface.

3. The system access security risk control processing method according to claim 1, characterized in that: At least one interface access restriction configuration group is set in the interface access restriction sub-interface, and each interface access restriction configuration group is associated with at least one application programming interface.

4. The system access security risk control processing method according to claim 1, characterized in that: The backend synchronizes the interface access restriction configuration information in the system memory with the request restriction information in the database and updates the information to the system cache to obtain the interface restriction information, including: Processing the request restriction information in the database and recording the request restriction information in the system memory, wherein When the synchronization time in the database is equal to the initial value, synchronizing the request restriction information in the database to the system memory; When the synchronization time in the database is greater than the preset synchronization time in the system cache, and the request restriction key exists in the remote dictionary service cache, and the synchronization time in the remote dictionary service cache is greater than the synchronization time in the system memory, synchronizing the request restriction information in the database to the system memory, and recording the request restriction key and the corresponding synchronization timestamp in the system memory; and A synchronous interface request restriction caching method is performed on the interface access restriction configuration information and the request restriction information in the system memory to obtain the interface restriction information in the system cache.

5. The system access security risk control processing method according to claim 1, characterized in that: After obtaining the interface restriction information, the method further includes: According to the interface restriction information in the system cache, obtaining the current restriction cache key for this execution of the synchronous interface request restriction cache method and the storage key for the last execution of the synchronous interface request restriction cache method; The requested access count of the specified application programming interface is obtained according to the current restricted cache key and the storage key.

6. The system access security risk control processing method according to claim 5, characterized in that: The obtaining, according to the interface restriction information in the system cache, a restriction cache key for the current execution of the synchronous interface request restriction cache method and a storage key for the last execution of the synchronous interface request restriction cache method, includes: Determining the restriction effect type in the restriction level information based on the access restriction level information preset in the interface restriction information, and concatenating the initial definition symbol of the restriction ID corresponding to the current restriction cache key with the shared restriction or individual restriction in the restriction effect type to obtain a first concatenated key; According to the access restriction type information preset in the interface restriction information, determining the role level in the access restriction type information, and splicing the first splicing key with one of the IP address, user ID, and global identifier in the role level to obtain a second splicing key; According to the access frequency restriction information preset in the interface restriction information, the time value in the access frequency restriction information is obtained, the second splicing key is spliced ​​with the time value to obtain the current restriction cache key for executing the synchronous interface request restriction cache method this time.

7. The system access security risk control processing method according to claim 5, characterized in that: The obtaining, according to the interface restriction information in the system cache, a restriction cache key for the current execution of the synchronous interface request restriction cache method and a storage key for the last execution of the synchronous interface request restriction cache method, further includes: Determining the restriction type in the access restriction level information based on the access restriction level information preset in the interface restriction information, and concatenating the initial definition symbol of the restriction ID corresponding to the storage key with the shared restriction or individual restriction in the restriction type to obtain a third concatenated key; According to the preset restriction type information in the interface restriction information, the action level in the restriction type information is obtained, and the third splicing key is spliced ​​with one of the IP address, user ID and global identifier in the action level, and finally the storage key of the last execution of the synchronous interface request restriction caching method is obtained.

8. The system access security risk control processing method according to claim 5, characterized in that: The obtaining, according to the current restricted cache key and the storage key, the number of requested accesses to the specified application programming interface includes: Obtain the last restricted cache key using the stored key from the last execution of the synchronous interface request restricted cache method; Determine whether the current limit cache key is equal to the previous limit cache key, If they are not equal, the last restricted cache key is deleted from the remote dictionary service cache to release resources; If they are equal, using the stored key as the key in the remote dictionary service cache, using the current limit cache key as the value in the remote dictionary service cache, and storing them in the remote dictionary service cache as an execution record; The remote dictionary service cache increment method uses the current restriction cache key to count the number of requested accesses to the specified application programming interface, and returns the count value of the number of requested accesses per unit time under the interface restriction rule.

9. The system access security risk control processing method according to claim 1, characterized in that: In the log center interface, based on the queried restricted access record information, check whether there is any abnormal request record for the specified application programming interface. If there is any abnormal request record, set an access blacklist based on the user information or IP information in the abnormal request record.

10. A system access security risk control processing device, characterized in that: include: A module for setting an interface access restriction configuration group through an interface access restriction sub-interface on the management terminal configuration interface of the current system backend, wherein, in the interface access restriction sub-interface, the action level of the interface access restriction configuration group is selected according to the access restriction type, wherein the action level includes user level, IP level or global level; and the restriction action type of the access frequency and access count of the application programming interface associated with the interface access restriction configuration group is selected according to the access restriction level, wherein the restriction action type includes shared restriction or individual restriction; A module for binding the interface access restriction configuration group to a uniform resource locator address of a specified application programming interface in its associated application programming interface, obtaining interface access restriction configuration information in the background, and automatically loading the interface access restriction configuration information into the system memory; When a user and / or external system requests access to the specified application programming interface, the backend synchronizes the interface access restriction configuration information in the system memory with the request restriction information in the database to the system cache, obtains the interface restriction information, and determines whether the specified application programming interface has an access frequency restriction module through aspect-oriented programming, wherein If it does not exist, the current request result information of the current access is directly returned to the user access interface of the current system and / or the external system. If so, it is determined whether the number of requested accesses to the specified application programming interface exceeds the access frequency limit, wherein: If the requested access times do not exceed the access frequency limit, the current result information of the current access is returned to the user access interface of the current system and / or the external system; otherwise, an error prompt message is returned to the user access interface of the current system and / or the external system; and A module for saving access record information of the user and / or the external system accessing the specified application programming interface to a log center interface through a log processing center.

Images