Access restriction method, device, non-volatile storage medium and processor

Abstract

The present invention discloses an access restriction method, device, non-volatile storage medium and processor. The method comprises: receiving an access request sent by a target client; obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client; obtaining an access record corresponding to the target client, and rejecting the access request when it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold. The present invention solves the technical problem of low intelligence of the interface in intercepting overclocking access.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an access restriction method, device, non-volatile storage medium and processor. Background Art

[0002] With the rapid development of the Internet, user traffic is increasing, but the system processing capacity for providing services to the outside world is limited, and it is necessary to limit user traffic, which introduces the concept of interface frequency limiting. In the process of network production, many factors need to be considered when the server is open to the outside world to provide services, such as the processing capacity of the server, the security of the server system, and the request rate of the client. This requires the introduction of a frequency limiting mechanism for interface access. However, the existing interface frequency limiting solutions directly limit the access volume of the interface. If the limit is exceeded, it is judged as overclocking. This method is too single and rigid, and does not take into account the dynamic changes in client access volume.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide an access restriction method, device, non-volatile storage medium and processor to at least solve the technical problem of low intelligence level of interface interception of overclocking access.

[0005] According to one aspect of an embodiment of the present invention, there is provided an access restriction method, comprising: receiving an access request sent by a target client; obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client; obtaining the access record corresponding to the target client, and rejecting the access request if it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold.

[0006] Optionally, the method further includes: releasing the access request if it is determined based on the access record that the access request exceeds the fixed interception threshold, but the access request does not exceed the dynamic interception threshold.

[0007] Optionally, determining that the access request exceeds the fixed interception threshold based on the access record includes: obtaining a first time period corresponding to the fixed interception threshold; based on the access record, counting a first frequency of access requests by the target client in the first time period, and when the first frequency exceeds the fixed interception threshold, determining that the current access request of the target client exceeds the fixed interception threshold.

[0008] Optionally, before obtaining the dynamic interception threshold corresponding to the target client, the method further includes: analyzing the abnormality level of the target client based on a predetermined rule and an access record corresponding to the target client; and allocating the dynamic interception threshold corresponding to the abnormality level to the target client.

[0009] Optionally, analyzing the abnormality level of the target client based on the predetermined rules and the access records corresponding to the target client includes: obtaining a second time period corresponding to the dynamic interception threshold; determining, based on the access records and the fixed interception threshold, the proportion of time periods in which the target client exceeds the fixed interception threshold within the second time period; and determining the abnormality level of the target client based on the time period proportion.

[0010] Optionally, determining the dynamic interception threshold based on the access record includes: based on the access record, counting a second frequency of the target client requesting access within the second time period, and when the second frequency exceeds the dynamic interception threshold, determining that the current access request of the target client exceeds the dynamic interception threshold.

[0011] Optionally, after rejecting the access request, the method further includes: lowering the fixed interception threshold and the dynamic interception threshold corresponding to the target client.

[0012] According to another aspect of an embodiment of the present invention, an access restriction device is also provided, including: a receiving module, used to receive an access request sent by a target client; an acquisition module, used to obtain a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client; and a rejection module, used to obtain an access record corresponding to the target client, and reject the access request when it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold.

[0013] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any one of the access restriction methods described above.

[0014] According to yet another aspect of the embodiments of the present invention, a processor is provided, wherein the processor is used to run a program, wherein the program executes any one of the access restriction methods described above when the program is run.

[0015] In an embodiment of the present invention, an access request sent by a target client is received; a fixed interception threshold and a dynamic interception threshold corresponding to the target client are obtained, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client; and an access record corresponding to the target client is obtained, and when it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold, the access request is rejected, thereby achieving the purpose of intelligently intercepting clients whose access requests are too frequent, thereby realizing the technical effect of improving the intelligence level of the interface in intercepting overclocked access, and further solving the technical problem of the low intelligence level of the interface in intercepting overclocked access. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 A hardware structure block diagram of a computer terminal for implementing an access restriction method is shown;

[0018] Figure 2 is a flowchart of an access restriction method provided according to an embodiment of the present invention;

[0019] Figure 3 is a flow chart of dynamic interception on the server side provided according to an optional implementation manner of the present invention;

[0020] Figure 4 4 is a structural block diagram of an access restriction device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] According to an embodiment of the present invention, an access restriction method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing an access restriction method. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0025] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the access restriction method in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the access restriction method of the above-mentioned application program is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0027] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0028] Figure 2 is a flow chart of an access restriction method provided according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0029] Step S202, receiving an access request sent by a target client. Optionally, while receiving the access request sent by the target client, the IP address of the target client and the timestamp of the access request may also be recorded.

[0030] Step S204, obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to the access record corresponding to the target client.

[0031] In this step, the fixed interception threshold may be determined in advance based on the client type. For example, based on the access request of the target client, the client type of the target client may be first obtained, and then the fixed interception threshold corresponding to the client type may be determined. The dynamic interception threshold may be generated based on the specific access record of the target client, and the characteristics of the target client may be obtained by analyzing the access record of the target client within a certain period of time, and then a dynamic interception threshold that meets the characteristics of the target client may be generated.

[0032] Step S206, obtaining the access record corresponding to the target client, and rejecting the access request if it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold. In this step, when the target client's access to the interface or the access to the server exceeds both the fixed interception threshold and the dynamic interception threshold, the target client may have an attack behavior, or the target client occupies too many resources, so the access request is rejected and the frequency is limited.

[0033] Through the above steps, by receiving an access request sent by a target client; obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client; obtaining an access record corresponding to the target client, and in the case where it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold, rejecting the access request, the purpose of intelligently intercepting clients whose access requests are too frequent is achieved, thereby realizing the technical effect of improving the intelligence level of the interface in intercepting overclocked access, and further solving the technical problem of the low intelligence level of the interface in intercepting overclocked access.

[0034] As an optional embodiment, when it is determined based on the access record that the access request exceeds the fixed interception threshold, but the access request does not exceed the dynamic interception threshold, the access request is released. In this embodiment, the target client that exceeds the fixed interception threshold but does not exceed the dynamic interception threshold can be allowed to call the interface or access the server. By analyzing the target client in this embodiment, the dynamic interception threshold is determined and the dynamic interception threshold is greater than the fixed interception threshold, which means that the target client is more trusted by the server, or the target client is eligible to obtain more interface call resources. Therefore, when the target client's access record is analyzed and a dynamic interception threshold greater than the fixed interception threshold is assigned to it, and the target client's access frequency falls between the two thresholds, the target client can be allowed to call the server's service, thereby improving the flexibility of the frequency and flow limiting behavior.

[0035] As an optional embodiment, whether an access request exceeds a fixed interception threshold can be determined based on the following steps: obtaining a first time period corresponding to the fixed interception threshold; based on the access record, counting a first frequency of access requests by the target client within the first time period, and when the first frequency exceeds the fixed interception threshold, determining that the current access request of the target client exceeds the fixed interception threshold.

[0036] Optionally, the first time period may be pre-selected and determined based on the client type corresponding to the fixed interception threshold, for example, for a client of the personal client type, the first time period is set to be the twenty-four hours before the current time. The access records of the target client in the twenty-four hours are obtained and the first frequency of the access request sent by the target client in the twenty-four hours is counted. If the first frequency exceeds the fixed interception threshold, it is considered that the current access request of the target client exceeds the fixed interception threshold.

[0037] As an optional embodiment, before obtaining the dynamic interception threshold corresponding to the target client, the abnormality level of the target client can be analyzed based on predetermined rules and access records corresponding to the target client; and a dynamic interception threshold corresponding to the abnormality level is allocated to the target client.

[0038] In this optional embodiment, by analyzing the target client's access record, it is possible to determine whether the target client is suspicious and the degree of suspicion. The predetermined rule may be a rule customized by the server, and the server formulates different abnormal levels corresponding to different client access request behaviors according to the type of service it provides and the client's regular behavior.

[0039] As an optional embodiment, based on the predetermined rules and the access records corresponding to the target client, the abnormal level of the target client is analyzed, and the following method can be adopted: obtain the second time period corresponding to the dynamic interception threshold; determine the time period ratio of the target client exceeding the fixed interception threshold in the second time period based on the access records and the fixed interception threshold; determine the abnormal level of the target client based on the time period ratio. Among them, the second time period can be a pre-set fixed value or a floating value. The server can read the access record of the target client in the second time period, and then determine whether the access frequency of the target client in the second time period often exceeds the fixed interception threshold. Since the fixed interception threshold corresponds to the conventional threshold of the client type of the target client, if the access frequency of the target client often exceeds that of other clients of the same type, it can be considered that the target client may be a risky IP, may be performing attacks or other abnormal behaviors, and needs special attention, so its abnormal level is set higher, that is, it is considered that it is more likely to be abnormal.

[0040] As an optional embodiment, determining a dynamic interception threshold based on access records may include: based on the access records, counting a second frequency of access requests by the target client within a second time period, and when the second frequency exceeds the dynamic interception threshold, determining that the current access request of the target client exceeds the dynamic interception threshold.

[0041] As an optional embodiment, after rejecting the access request, the following step may be further included: reducing the fixed interception threshold and dynamic interception threshold corresponding to the target client. Rejecting the access request means that the risk level of the target client is high. The server may further reduce the fixed interception threshold and dynamic interception threshold of the target client to achieve dynamic current limiting of the client's access request.

[0042] Figure 3 1 is a flow chart of dynamic interception by the server provided according to an optional implementation mode of the present invention. Figure 3 As shown, the interception method may include the following steps:

[0043] Step 1: Allocate a fixed interception threshold: Report the target client that requests to call the interface, and set a fixed interception threshold based on the type of the target client;

[0044] Step 2: Collect and store records: collect access records of target clients in real time and store them in cache;

[0045] Step 3: Analyze the target client access records: Analyze the target client access records stored in the cache. Optionally, the client's interface access increment or decrement per second, minute, hour, or day can be analyzed at a time granularity.

[0046] Step 4: Dynamically adjust the dynamic interception threshold: After assigning the dynamic interception threshold to the target client, you can also analyze the target client's access records in the recent time period, and then dynamically adjust the dynamic interception threshold based on the analysis results;

[0047] Step 5: Overclocking interception: intercept access requests that exceed the fixed interception threshold and dynamic interception threshold in real time;

[0048] Step 6: Analysis of intercepted requests: Analyze the access records of the target client to determine whether the client has made a large number of requests in a short period of time. If so, it is likely to be an attack, and the corresponding fixed interception threshold and dynamic interception threshold are lowered.

[0049] According to an embodiment of the present invention, an access restriction device for implementing the above access restriction method is also provided. Figure 4 is a structural block diagram of an access restriction device provided according to an embodiment of the present invention. Figure 4As shown, the access restriction device includes: a receiving module 42, an obtaining module 44 and a rejecting module 46. The access restriction device is described below.

[0050] The receiving module 42 is used to receive an access request sent by a target client;

[0051] An acquisition module 44, configured to acquire a fixed interception threshold and a dynamic interception threshold corresponding to a target client, wherein the dynamic interception threshold is generated according to an access record corresponding to the target client;

[0052] The rejection module 46 is used to obtain the access record corresponding to the target client, and reject the access request when it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold.

[0053] It should be noted that the receiving module 42, the obtaining module 44 and the rejecting module 46 correspond to steps S202 to S206 in the embodiment, and the examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment. It should be noted that the above modules as part of the device can be run in the computer terminal 10 provided in the embodiment.

[0054] An embodiment of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one network device among multiple network devices of a computer network. The computer device includes a memory and a processor.

[0055] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the access restriction method and device in the embodiments of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the above-mentioned access restriction method is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory may further include a memory remotely arranged relative to the processor, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0056] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: receive an access request sent by the target client; obtain a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to the access record corresponding to the target client; obtain the access record corresponding to the target client, and when it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold, reject the access request.

[0057] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a non-volatile storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0058] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the access restriction method provided in the embodiment 1 above.

[0059] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0060] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: receiving an access request sent by a target client; obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated based on an access record corresponding to the target client; obtaining an access record corresponding to the target client, and rejecting the access request if it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold.

[0061] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0062] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0063] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0064] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0065] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0066] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0067] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An access restriction method, characterized in that: include: Receive access requests sent by target clients; Obtaining a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to the access record corresponding to the target client, the dynamic interception threshold is greater than the fixed interception threshold, and the fixed interception threshold is pre-determined according to the client type; Obtaining an access record corresponding to the target client, and if it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold, rejecting the access request; Before obtaining the dynamic interception threshold corresponding to the target client, the method further includes: Analyzing the abnormality level of the target client based on a predetermined rule and the access record corresponding to the target client; Allocating the dynamic interception threshold corresponding to the abnormal level to the target client; The step of analyzing the abnormality level of the target client based on a predetermined rule and an access record corresponding to the target client includes: Obtaining a second time period corresponding to the dynamic interception threshold; Based on the access record and the fixed interception threshold, determining a time period ratio of the target client exceeding the fixed interception threshold within the second time period; Based on the time period ratio, an abnormality level of the target client is determined.

2. The method according to claim 1, characterized in that Also includes: If it is determined based on the access record that the access request exceeds the fixed interception threshold, but the access request does not exceed the dynamic interception threshold, the access request is released.

3. The method according to claim 1, characterized in that The determining, based on the access record, that the access request exceeds the fixed interception threshold comprises: Obtaining a first time period corresponding to the fixed interception threshold; Based on the access record, a first frequency of access requests by the target client in the first time period is counted, and when the first frequency exceeds the fixed interception threshold, it is determined that the current access request of the target client exceeds the fixed interception threshold.

4. The method according to claim 1, characterized in that: The determining the dynamic interception threshold based on the access record comprises: Based on the access record, a second frequency of the target client's access requests in the second time period is counted, and when the second frequency exceeds the dynamic interception threshold, it is determined that the current access request of the target client exceeds the dynamic interception threshold.

5. The method according to claim 1, characterized in that After rejecting the access request, the method further includes: lowering the fixed interception threshold and the dynamic interception threshold corresponding to the target client.

6. An access restriction device, characterized in that: include: A receiving module, used for receiving an access request sent by a target client; an acquisition module, configured to acquire a fixed interception threshold and a dynamic interception threshold corresponding to the target client, wherein the dynamic interception threshold is generated according to the access record corresponding to the target client, the dynamic interception threshold is greater than the fixed interception threshold, and the fixed interception threshold is pre-determined according to the client type; a rejection module, configured to obtain an access record corresponding to the target client, and reject the access request if it is determined based on the access record that the access request exceeds the fixed interception threshold and the dynamic interception threshold; Before obtaining the dynamic interception threshold corresponding to the target client, the method further includes: Analyzing the abnormality level of the target client based on a predetermined rule and the access record corresponding to the target client; Allocating the dynamic interception threshold corresponding to the abnormal level to the target client; The step of analyzing the abnormality level of the target client based on a predetermined rule and an access record corresponding to the target client includes: Obtaining a second time period corresponding to the dynamic interception threshold; Based on the access record and the fixed interception threshold, determining a time period ratio of the target client exceeding the fixed interception threshold within the second time period; Based on the time period ratio, an abnormality level of the target client is determined.

7. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the access restriction method according to any one of claims 1 to 5.

Images