Service access control method, device, electronic device and storage medium

Abstract

Embodiments of the present invention relate to a service access control method, apparatus, electronic device, and storage medium. The method comprises: receiving a client's access request for a target service, determining a target resource on which the target service depends; obtaining current access information of the target resource from a first storage medium; determining, based on the current access information of the target resource, whether a concurrent access limit for the target resource has been reached; if so, discarding the access request to deny provision of the target service to the client; if not, accessing the target resource to provide the target service to the client. Thus, by setting a concurrent access limit for a resource, it is possible to control the number of concurrent accesses to services that depend on the resource.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing, and in particular to a service access control method, device, electronic device, and storage medium. Background Art

[0002] Currently, in order to prevent a service provided by a business system from being blocked, which would cause the CPU resources of the business system to be exhausted by the high concurrent access of the service, thereby causing the entire business system to be unavailable to the outside world, thread pool isolation technology has been proposed in the prior art.

[0003] Thread pool isolation technology means: based on the service granularity, a separate thread pool is created for each service. User access requests to the service will be submitted to the thread pool corresponding to the service for execution. In this way, when the service reaches the concurrent access limit, it will not affect the normal access of other services.

[0004] However, in the thread pool isolation technology, more threads need to be created, and the CPU of the business system will also switch between multiple threads. Frequent switching of the CPU between threads will affect the service response speed. Summary of the Invention

[0005] In view of this, in order to solve the above technical problems or part of the technical problems, embodiments of the present invention provide a service access control method, device, electronic device and storage medium.

[0006] In a first aspect, an embodiment of the present invention provides a service access control method, the method comprising:

[0007] Receive a request from a client to access a target service, and determine a target resource on which the target service depends;

[0008] Acquire current access information of the target resource from the first storage medium;

[0009] Determining whether a concurrent access limit for the target resource has been reached based on current access information of the target resource;

[0010] If so, discard the access request to deny providing the target service to the client; if not, access the target resource to provide the target service to the client.

[0011] In a possible implementation, determining whether the upper limit of concurrent access to the target resource is currently reached based on the current access information of the target resource includes:

[0012] Determining the actual remaining allowed concurrent access amount of the target resource according to the current access information of the target resource;

[0013] Determine whether the actual remaining allowed concurrent access quantity of the target resource is greater than 0;

[0014] If so, it is determined that the upper limit of concurrent access to the target resource has not been reached; if not, it is determined that the upper limit of concurrent access to the target resource has been reached.

[0015] In a possible implementation, the current access information is the remaining allowed concurrent access amount; and the method further includes:

[0016] In the case that the current access information of the target resource cannot be obtained from the first storage medium, setting a local count flag of the target resource, and adding 1 to the local access count of the target resource stored in the second storage medium, where the initial value of the local access count is 0;

[0017] The determining, based on the current access information of the target resource, the actual remaining allowed concurrent access amount of the target resource includes:

[0018] Check whether there is a local count flag for the target resource;

[0019] If not, determining the remaining allowed concurrent access amount obtained from the first storage medium as the actual remaining allowed concurrent access amount of the target resource;

[0020] If so, the local access count of the target resource is obtained from the second storage medium, and the difference between the remaining allowed concurrent access amount obtained from the first storage medium and the local access count is determined as the actual remaining allowed concurrent access amount of the target resource.

[0021] In a possible implementation, the current access information is the remaining allowed concurrent access amount;

[0022] When it is determined, based on the current access information of the target resource, that the upper limit of concurrent access to the target resource has not been reached, the method further includes:

[0023] The remaining allowed concurrent access amount of the target resource stored in the first storage medium is updated to a value obtained by subtracting 1 from the actual remaining allowed concurrent access amount.

[0024] In a possible implementation, after accessing the target resource to provide the target service to the client, the method further includes:

[0025] Check whether there is a local count flag for the target resource;

[0026] If so, decrementing the local access count of the target resource stored in the second storage medium by 1, and when determining that the local access count of the target resource is 0, deleting the local count flag of the target resource;

[0027] If not, the remaining allowed concurrent access amount of the target resource stored in the first storage medium is increased by 1.

[0028] In one possible implementation, the method further includes:

[0029] In the case that the current access information of the target resource cannot be obtained from the first storage medium, the target resource is directly accessed to provide the target service to the client.

[0030] In a second aspect, an embodiment of the present invention provides a service access control device, the device comprising:

[0031] Request receiving module, used to receive the client's access request to the target service;

[0032] A resource determination module, configured to determine a target resource on which the target service depends;

[0033] An information acquisition module, configured to acquire current access information of the target resource from a first storage medium;

[0034] A judgment module, configured to determine whether a concurrent access limit of the target resource has been reached based on the current access information of the target resource;

[0035] A processing module is used to discard the access request to refuse to provide the target service to the client if the concurrent access limit of the target resource is currently reached; and to access the target resource to provide the target service to the client if the concurrent access limit of the target resource is not currently reached.

[0036] In a possible implementation, the judgment module includes:

[0037] A first determining submodule, configured to determine an actual remaining allowed concurrent access amount of the target resource according to current access information of the target resource;

[0038] A comparison submodule is used to determine whether the actual remaining allowed concurrent access quantity of the target resource is greater than 0;

[0039] The second determination submodule is used to determine that the current concurrent access upper limit of the target resource has not been reached if it is determined that the actual remaining allowed concurrent access amount of the target resource is greater than 0; if it is determined that the actual remaining allowed concurrent access amount of the target resource is not greater than 0, then determine that the current concurrent access upper limit of the target resource has been reached.

[0040] In a possible implementation manner, the current access information is the remaining allowed concurrent access amount; and the apparatus further includes:

[0041] a local counting module, configured to, when the current access information of the target resource cannot be obtained from the first storage medium, set a local counting flag of the target resource and increase the local access count of the target resource stored in the second storage medium by 1, where the initial value of the local access count is 0;

[0042] The first determining submodule is specifically configured to:

[0043] Check whether there is a local counting flag for the target resource; if not, determine the remaining allowed concurrent access amount obtained from the first storage medium as the actual remaining allowed concurrent access amount of the target resource; if so, obtain the local access count of the target resource from the second storage medium, and determine the difference between the remaining allowed concurrent access amount obtained from the first storage medium and the local access count as the actual remaining allowed concurrent access amount of the target resource.

[0044] In a possible implementation, the current access information is the remaining allowed concurrent access amount;

[0045] The device further comprises:

[0046] The first update module is used to update the remaining allowed concurrent access amount of the target resource stored in the first storage medium to the value of the actual remaining allowed concurrent access amount minus 1 when it is determined based on the current access information of the target resource that the concurrent access upper limit of the target resource has not been reached.

[0047] In one possible embodiment, the device further includes:

[0048] The second update module is used to check whether there is a local counting flag of the target resource after accessing the target resource to provide the target service to the client; if so, subtract 1 from the local access count of the target resource stored in the second storage medium, and when determining that the local access count of the target resource is 0, delete the local counting flag of the target resource; if not, add 1 to the remaining allowed concurrent access to the target resource stored in the first storage medium.

[0049] In one possible embodiment, the device further includes:

[0050] The service providing module is configured to directly access the target resource to provide the target service to the client when the current access information of the target resource cannot be obtained from the first storage medium.

[0051] The technical solution provided by the embodiment of the present invention determines whether the concurrent access limit of the target resource has been reached when receiving an access request to the target service that depends on the resource. If so, the access request is discarded to refuse to provide the target service to the client. If not, the target resource is accessed to provide the target service to the client. This achieves the control of the concurrent access volume of the service that depends on the resource by setting the concurrent access limit of the resource. When the resource that a certain service depends on reaches its concurrent access limit, the business system can refuse to provide the service to the outside world, thereby preventing the CPU resources of the business system from being exhausted by high concurrent access to a certain service, thereby causing the entire business system to be unavailable to the outside world. Furthermore, compared with the prior art of controlling the concurrent access volume of services through thread pool isolation technology, this does not involve the creation of more threads, and thus does not involve the CPU switching between multiple threads. This can avoid affecting the service response speed due to excessive CPU switching.

[0052] Furthermore, in a distributed system architecture, multiple resource access control service nodes access the same first storage medium to obtain the current access information of the target resource. That is, in a distributed system architecture, different resource access control services do not maintain their own resource access information locally separately, but maintain the resource access information in a unified manner. In this way, resource access control can be coordinated between multiple resource access control services. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a business system architecture involved in an embodiment of the present invention;

[0054] Figure 2 A flow chart of an embodiment of a service access control method provided by an exemplary embodiment of the present invention;

[0055] Figure 3 A flow chart of another service access control method provided by an exemplary embodiment of the present invention;

[0056] Figure 4 A block diagram of an embodiment of a service access control device provided by an exemplary embodiment of the present invention;

[0057] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0059] See also Figure 1 , is a schematic diagram of a business system architecture involved in an embodiment of the present invention. Figure 1 As shown, the business system 100 includes a load balancing service node 101 , resource access control service nodes 102 - 104 , and a resource storage node 105 .

[0060] Among them, the resource storage node 105 is used to store resources in the entire business system, such as order information, product information, user information, etc. In applications, a business system can provide multiple services to the outside world, and the provision of each service depends on the corresponding resources. For example, the business system 100 can provide three services to the outside world, namely order query service, product query service, and user query service. Among them, the order query service depends on order information, the product query service depends on product information, and the user query service depends on user information. It should be noted that the above description of a service depending on a type of resource is only an example. In applications, a service can depend on multiple types of resources, and a type of resource can also be relied upon by multiple services. The present invention does not limit this.

[0061] Based on this, an embodiment of the present invention proposes: by setting a concurrent access upper limit for a resource to control the concurrent access volume of services that rely on the resource, when the resource that a service relies on reaches its concurrent access upper limit, the business system can refuse to provide the service to the outside world, thereby preventing the CPU resources of the business system from being exhausted by high concurrent access to a certain service, thereby causing the entire business system to be unavailable to the outside world. It should be noted that when a service depends on multiple types of resources, the same concurrent access upper limit can be set for the multiple types of resources, or different concurrent access upper limits can be set for the multiple types of resources. However, in application, the concurrent access volume of the service is controlled based on the lowest concurrent access upper limit among multiple concurrent access upper limits, and the present invention does not limit this.

[0062] The resource access control service nodes 102 to 104 are used to apply the service access control method provided by the embodiment of the present invention to implement access control on the resources that the service depends on when receiving an access request for a service, thereby controlling whether the business system provides the service externally.

[0063] The load balancing service node 101 is used to select a resource access control service node (hereinafter referred to as the target resource access control service node) from multiple resource access control service nodes included in the business system 100, such as resource access control service nodes 102 to 104, when receiving an access request for a certain service, and send the received access request to the target resource access control service node.

[0064] The service access control method provided by the present invention is further explained below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not limit the embodiments of the present invention.

[0065] See also Figure 2 , is a flow chart of an exemplary embodiment of a service access control method provided by an exemplary embodiment of the present invention. As an embodiment, the method can be applied to Figure 1 Any resource access control service node in the system architecture shown, such as Figure 2 As shown, the method may include the following steps:

[0066] Step 201: Receive a client's access request to a target service, and determine the target resource that the target service depends on.

[0067] In an application, when a user needs to use a service provided by a business system (hereinafter referred to as a target service), he or she can send an access request to the target service to the business system through the client. Figure 1 In the system architecture shown, the load balancing service node 101 first receives the access request. Then, the load balancing service node 101 selects a target resource access control service node from multiple resource access control service nodes according to the set load balancing strategy, and sends the received access request to the target resource access control service node. In this way, the target resource access control service node receives the client's access request to the target service.

[0068] As an example, a resource access control service node may maintain an association between a service and its dependent resources. Optionally, this association may be represented by a correspondence between a service identifier and a resource identifier. It should be noted that this correspondence may be a one-to-many correspondence, meaning that one service identifier may correspond to one or more resource identifiers.

[0069] Based on this, after receiving the client's access request to the target service, the target resource access control service node can determine the resource (hereinafter referred to as the target resource) that the target service depends on based on the above-mentioned association relationship. Specifically, the target resource access control service node first parses the service identifier of the target service (hereinafter referred to as the target service identifier) ​​from the received access request, and then searches for the correspondence between the service identifier and the resource identifier based on the target service identifier to obtain the resource identifier corresponding to the target service identifier (hereinafter referred to as the target resource identifier), and determines the resource corresponding to the target resource identifier as the target resource that the target service depends on. It should be noted that the number of target resources can be one or more categories.

[0070] Step 202: Obtain current access information of the target resource from the first storage medium.

[0071] As an embodiment, the first storage medium is a Redis database. Figure 1 In the system architecture shown, multiple resource access control service nodes can access the Redis database.

[0072] In an embodiment of the present invention, the first storage medium may store current access information of various resources. Thus, the target resource access control service node may obtain the current access information of the target resource on which the target service depends from the first storage medium.

[0073] As an embodiment, the above current access information is the remaining allowed concurrent access, that is, the current concurrent access allowed for the resource. For example, assuming that the upper limit of concurrent access for a certain type of resource is 1000, and there are currently 800 service processes concurrently accessing this type of resource, then the current remaining allowed concurrent access for this type of resource is 200.

[0074] As another embodiment, the current access information is the current concurrent access volume. In the above example, the current concurrent access volume is 800.

[0075] Step 203 : Determine whether the upper limit of concurrent access to the target resource has been reached based on the current access information of the target resource; if so, execute step 204 ; if not, execute step 205 .

[0076] As an embodiment, the actual remaining allowed concurrent access to the target resource can be determined based on the current access information of the target resource, and then it is determined whether the actual remaining allowed concurrent access to the target resource is greater than 0. If so, it means that the current upper limit of concurrent access to the target resource has been reached, and step 204 is executed; if not, it means that the current upper limit of concurrent access to the target resource has not been reached, and step 205 is executed.

[0077] In this embodiment, if the first storage medium stores the remaining allowed concurrent access quantity of the target resource, the remaining allowed concurrent access quantity of the target resource obtained from the first storage medium can be directly determined as the actual remaining allowed concurrent access quantity of the target resource. If the first storage medium stores the current concurrent access quantity of the target resource, the difference between the preset concurrent access upper limit of the target resource and the current concurrent access quantity of the target resource obtained from the first storage medium can be determined as the actual remaining allowed concurrent access quantity of the target resource.

[0078] As another embodiment, the current concurrent access volume of the target resource can be determined based on the current access information of the target resource, and then it is determined whether the current concurrent access volume of the target resource reaches the preset concurrent access upper limit. If so, step 204 is executed; if not, step 205 is executed.

[0079] Step 204: discard the access request to deny providing the target service to the client.

[0080] Step 205: Access the target resource to provide the target service to the client.

[0081] In addition, when the current access information stored in the first storage medium is the remaining allowed concurrent access amount, when it is determined based on the current access information of the target resource that the concurrent access upper limit of the target resource has not been reached, the remaining allowed concurrent access amount of the target resource stored in the first storage medium can also be updated to the value of the actual remaining allowed concurrent access amount determined above minus 1. In this way, the current access information stored in the first storage medium can reflect the current access status of the target resource in real time. Therefore, under normal circumstances, the current access information stored in the first storage medium can reflect the actual remaining allowed concurrent access amount of the resource in real time and truthfully.

[0082] To facilitate understanding of the technical solutions provided by the embodiments of the present invention, the following specific examples are provided:

[0083] Assuming that the upper limit of concurrent access to the target resource is 2, then, in the initial case, the remaining allowed concurrent access to the target resource stored in the above-mentioned first storage medium is 2. Assuming that the first client first initiates an access request to the target service that depends on the target resource, according to the above description, the target resource access control service node obtains the remaining allowed concurrent access to the target resource (which is 2) from the first storage medium, and determines the obtained remaining allowed concurrent access as the actual remaining allowed concurrent access to the target resource (which is 2). At this time, it can be seen that the actual remaining allowed concurrent access is greater than 0, then the target resource access control service node accesses the target resource to provide the target service to the first client, and at the same time, updates the remaining allowed concurrent access to the target resource stored in the first storage medium to 1.

[0084] Assume that while the first client is accessing the target service, the second client also initiates an access request to the target service. According to the above description, the target resource access control service node obtains the remaining allowed concurrent access quantity of the target resource from the first storage medium as 1, and determines the obtained remaining allowed concurrent access quantity as the actual remaining allowed concurrent access quantity of the target resource (which is 1). At this point, it can be seen that the actual remaining allowed concurrent access quantity is greater than 0, so the target resource access control service node accesses the target resource to provide the target service to the second client, and at the same time, updates the remaining allowed concurrent access quantity of the target resource stored in the first storage medium to 0.

[0085] Assume that during the process of the first and second clients accessing the target service, a third client also initiates an access request to the target service. According to the above description, the target resource access control service node obtains the remaining allowed concurrent access quantity of the target resource from the first storage medium as 0, and determines the obtained remaining allowed concurrent access quantity as the actual remaining allowed concurrent access quantity of the target resource (which is 0). At this point, it can be seen that the actual remaining allowed concurrent access quantity is equal to 0, so the target resource access control service node can discard the received access request and refuse to provide the target service to the third client.

[0086] The technical solution provided by the embodiment of the present invention determines whether the concurrent access limit of the target resource has been reached when receiving an access request to the target service that depends on the resource. If so, the access request is discarded to refuse to provide the target service to the client. If not, the target resource is accessed to provide the target service to the client. This achieves the control of the concurrent access volume of the service that depends on the resource by setting the concurrent access limit of the resource. When the resource that a certain service depends on reaches its concurrent access limit, the business system can refuse to provide the service to the outside world, thereby preventing the CPU resources of the business system from being exhausted by high concurrent access to a certain service, thereby causing the entire business system to be unavailable to the outside world. Furthermore, compared with the prior art of controlling the concurrent access volume of services through thread pool isolation technology, this does not involve the creation of more threads, and thus does not involve the CPU switching between multiple threads. This can avoid affecting the service response speed due to excessive CPU switching.

[0087] Further, in Figure 1 In the distributed system architecture illustrated, multiple resource access control service nodes access the same first storage medium to obtain the current access information of the target resource. That is, in the distributed system architecture, different resource access control services do not maintain their own resource access information locally separately, but maintain the resource access information in a unified manner. In this way, resource access control can be coordinated between multiple resource access control services.

[0088] See also Figure 3 , is a flow chart of another service access control method provided by an exemplary embodiment of the present invention. Figure 3 The process shown in Figure 2 Based on the process shown, the following steps may be included:

[0089] Step 301: Receive a client's access request to a target service, and determine the target resource that the target service depends on.

[0090] The detailed description of this step can be found in the description of step 201 above, which will not be repeated here.

[0091] Step 302: Access the first storage medium. If the access fails, execute step 303; if the access succeeds, execute step 305.

[0092] Step 303 : Set a local count flag, and increase the local access count of the target resource stored in the second storage medium of the node by 1; and execute step 309 .

[0093] The second storage medium may be a local memory of the resource access control service node.

[0094] Step 304 : Check whether a local counting flag exists. If so, execute step 305 ; if not, execute step 306 .

[0095] Step 305 : Obtain the local access count of the target resource from the second storage medium of the node, and determine the difference between the remaining allowed concurrent accesses obtained from the first storage medium and the local access count as the actual remaining allowed concurrent accesses of the target resource; and execute step 307 .

[0096] Step 306: Determine the remaining allowed concurrent access amount obtained from the first storage medium as the actual remaining allowed concurrent access amount of the target resource.

[0097] Step 307 : Determine whether the actual remaining allowed concurrent access amount of the target resource is greater than 0. If so, execute step 308 ; if not, execute step 313 .

[0098] Step 308: Update the remaining allowed concurrent access amount of the target resource stored in the first storage medium to the value obtained by subtracting 1 from the actual remaining allowed concurrent access amount determined above.

[0099] Step 309: Access the target resource to provide the target service to the client.

[0100] Step 310 : Check whether a local counting flag exists. If so, execute step 311 ; if not, execute step 312 .

[0101] Step 311: Subtract 1 from the local access count of the target resource stored in the second storage medium of the node, and when it is determined that the local access count is 0, delete the local count flag.

[0102] Step 312: Increase the remaining allowed concurrent access quantity of the target resource stored in the first storage medium by 1.

[0103] Step 313: discard the access request to deny providing the target service to the client.

[0104] The following is a unified description of steps 301 to 313:

[0105] In actual applications, the first storage medium may be abnormal, resulting in the resource access control service node being unable to access the first storage medium. In this case, the normal execution Figure 2 Based on the process shown in FIG. Figure 3 The process shown.

[0106] Figure 3 The process shown in Figure 2 Based on the process shown, when the resource access control service node fails to access the first storage medium, it can directly access the target resource to provide the target service to the client. This can avoid the user being unable to use the target service due to the abnormality of the first storage medium, affecting the user experience.

[0107] At the same time, in order to ensure that after the first storage medium returns to normal, it is still possible to accurately judge whether the current concurrent access limit of the target resource has been reached based on the current access information of the target resource stored in the first storage medium, an embodiment of the present invention proposes: when access to the first storage medium fails, the resource access control service node adds 1 to the local access count of the target resource stored in the second storage medium of this node to count the concurrent access to the target resource locally, and sets a local counting flag to indicate that local counting is turned on.

[0108] Based on this, if access to the first storage medium is successful, the first step is to check whether there is a local count flag. If so, it means that the actual remaining concurrent access amount is not stored in the first storage medium. According to the description in step 305, the local access count of the target resource is obtained from the second storage medium of this node, and the difference between the remaining allowed concurrent access amount obtained from the first storage medium and the local access count is determined as the actual remaining allowed concurrent access amount of the target resource. Conversely, if there is no local count flag, it means that the actual remaining concurrent access amount is stored in the first storage medium. According to the description in step 306, the remaining allowed concurrent access amount obtained from the first storage medium is determined as the actual remaining allowed concurrent access amount of the target resource. Then, it is determined whether the current concurrent access limit of the target resource has been reached based on the actual remaining allowed concurrent access amount.

[0109] Furthermore, from the above description, it can be seen that when there is a local counting flag, the remaining allowed concurrent access in the first storage medium is not modified, but the local access count is updated. Therefore, after completing this resource access, check whether there is a local counting flag. If so, execute step 311 to reduce the number of local accesses to the target resource stored in the second storage medium of this node by 1; if not, execute step 312 to increase the remaining allowed concurrent access to the target resource stored in the first storage medium by 1.

[0110] To facilitate understanding of the technical solutions provided by the embodiments of the present invention, the following specific examples are provided:

[0111] Assuming that the upper limit of concurrent access to the target resource is 2, then, initially, the remaining allowed concurrent access to the target resource stored in the first storage medium is 2. Assuming that the first client first initiates an access request to the target service that depends on the target resource, according to the above description, if the target resource access control service node fails to access the first storage medium, it directly accesses the target resource to provide the target service to the first client, sets the local count flag, and updates the local access count of the target resource in the second storage medium from 0 to 1.

[0112] Assume that during the process of the first client accessing the target service, the second client also initiates an access request to the target service. If the target resource access control service node obtains the remaining allowed concurrent access quantity of the target resource from the first storage medium (which is 2), according to the above description, the target resource access control service node determines the difference between the obtained remaining allowed concurrent access quantity and the local access count, 1 (2-1), as the actual remaining allowed concurrent access quantity of the target resource. At this time, it can be seen that the actual remaining allowed concurrent access quantity is greater than 0, so the target resource access control service node accesses the target resource to provide the target service to the second client, and at the same time, updates the remaining allowed concurrent access quantity of the target resource stored in the first storage medium to 0.

[0113] Assume that during the process of the first and second clients accessing the target service, a third client also initiates an access request to the target service. According to the above description, the target resource access control service node obtains the remaining allowed concurrent access quantity of the target resource from the first storage medium as 0, and determines the obtained remaining allowed concurrent access quantity as the actual remaining allowed concurrent access quantity of the target resource (which is 0). At this point, it can be seen that the actual remaining allowed concurrent access quantity is equal to 0, so the target resource access control service node can discard the received access request and refuse to provide the target service to the third client.

[0114] Furthermore, assuming that the second client initiates an access request to the target service only after the first client has accessed the target service, then according to the above description, after the first client has accessed the target service, the local count of the target resource in the second storage medium is reduced from 1 to 0, and the local count flag is deleted. Based on this, during the second client's request to access the target service, the target resource access control service node will obtain the remaining allowed concurrent access quantity of the target resource (which is 2) from the first storage medium. According to the above description, the target resource access control service node will directly determine the obtained remaining allowed concurrent access quantity as the actual remaining allowed concurrent access quantity of the target resource.

[0115] exist Figure 3 In the process shown, by combining the first storage medium and the second storage medium to jointly record the current access status of the target resource, it is possible to avoid being unable to perform service access control when the first storage medium is abnormal, thereby improving the stability of service access control.

[0116] See also Figure 4 , is a block diagram of an embodiment of a service access control device provided by an exemplary embodiment of the present invention. Figure 4 As shown, the device includes:

[0117] The request receiving module 41 is used to receive a request from a client to access a target service;

[0118] A resource determination module 42 is configured to determine a target resource on which the target service depends;

[0119] The information acquisition module 43 is used to obtain the current access information of the target resource from the first storage medium;

[0120] A judgment module 44 is configured to determine whether the upper limit of concurrent access to the target resource has been reached based on the current access information of the target resource;

[0121] The processing module 45 is used to discard the access request to refuse to provide the target service to the client if the concurrent access limit of the target resource is currently reached; and access the target resource to provide the target service to the client if the concurrent access limit of the target resource is not currently reached.

[0122] In a possible implementation, the judgment module 44 includes (not shown):

[0123] A first determining submodule, configured to determine an actual remaining allowed concurrent access amount of the target resource according to current access information of the target resource;

[0124] A comparison submodule is used to determine whether the actual remaining allowed concurrent access quantity of the target resource is greater than 0;

[0125] The second determination submodule is used to determine that the current concurrent access upper limit of the target resource has not been reached if it is determined that the actual remaining allowed concurrent access amount of the target resource is greater than 0; if it is determined that the actual remaining allowed concurrent access amount of the target resource is not greater than 0, then determine that the current concurrent access upper limit of the target resource has been reached.

[0126] In a possible implementation, the current access information is the remaining allowed concurrent access amount; the apparatus further includes (not shown in the figure):

[0127] a local counting module, configured to, when the current access information of the target resource cannot be obtained from the first storage medium, set a local counting flag of the target resource and increase the local access count of the target resource stored in the second storage medium by 1, where the initial value of the local access count is 0;

[0128] The first determining submodule is specifically configured to:

[0129] Check whether there is a local counting flag for the target resource; if not, determine the remaining allowed concurrent access amount obtained from the first storage medium as the actual remaining allowed concurrent access amount of the target resource; if so, obtain the local access count of the target resource from the second storage medium, and determine the difference between the remaining allowed concurrent access amount obtained from the first storage medium and the local access count as the actual remaining allowed concurrent access amount of the target resource.

[0130] In a possible implementation, the current access information is the remaining allowed concurrent access amount;

[0131] The device also includes (not shown in the figure):

[0132] The first update module is used to update the remaining allowed concurrent access amount of the target resource stored in the first storage medium to the value of the actual remaining allowed concurrent access amount minus 1 when it is determined based on the current access information of the target resource that the concurrent access upper limit of the target resource has not been reached.

[0133] In one possible embodiment, the device further includes (not shown in the figure):

[0134] The second update module is used to check whether there is a local counting flag of the target resource after accessing the target resource to provide the target service to the client; if so, subtract 1 from the local access count of the target resource stored in the second storage medium, and when determining that the local access count of the target resource is 0, delete the local counting flag of the target resource; if not, add 1 to the remaining allowed concurrent access to the target resource stored in the first storage medium.

[0135] In one possible embodiment, the device further includes (not shown in the figure):

[0136] The service providing module is configured to directly access the target resource to provide the target service to the client when the current access information of the target resource cannot be obtained from the first storage medium.

[0137] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. Figure 5The electronic device 500 shown includes: at least one processor 501, a memory 502, at least one network interface 504 and another user interface 503. The various components in the electronic device 500 are coupled together via a bus system 505. It is understood that the bus system 505 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 505 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 505 is not shown in FIG. Figure 5 Various buses are labeled as bus system 505.

[0138] The user interface 503 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touchpad, or a touch screen).

[0139] It is understood that the memory 502 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 502 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0140] In some embodiments, the memory 502 stores the following elements, executable units, or data structures, or a subset thereof, or an extended set thereof: an operating system 5021 and application programs 5022 .

[0141] The operating system 5021 includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and handling hardware-based tasks. Application programs 5022 include various application programs, such as a media player (MediaPlayer) and a browser (Browser), for implementing various application services. Programs implementing the methods of the embodiments of the present invention may be included in application programs 5022.

[0142] In an embodiment of the present invention, by calling a program or instruction stored in the memory 502, specifically, a program or instruction stored in the application 5022, the processor 501 is configured to execute the method steps provided in each method embodiment, for example, including:

[0143] Receive a request from a client to access a target service, and determine a target resource on which the target service depends;

[0144] Acquire current access information of the target resource from the first storage medium;

[0145] Determining whether a concurrent access limit for the target resource has been reached based on current access information of the target resource;

[0146] If so, discard the access request to deny providing the target service to the client; if not, access the target resource to provide the target service to the client.

[0147] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 501. Processor 501 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in processor 501 or by software instructions. The above processor 501 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software units in the decoding processor. The software units can be located in storage media well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 502 , and the processor 501 reads the information in the memory 502 and completes the steps of the above method in combination with its hardware.

[0148] It is understood that the embodiments described herein may be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP devices, DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or a combination thereof.

[0149] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0150] The electronic device provided in this embodiment may be Figure 5The electronic device shown in FIG. 1 can perform the following operations: Figure 2-3 All steps of the service access control method in the implementation Figure 2-3 For details on the technical effects of the service access control method shown, please refer to Figure 2-3 For the sake of brevity, the relevant description will not be repeated here.

[0151] An embodiment of the present invention further provides a storage medium (computer-readable storage medium). The storage medium stores one or more programs. The storage medium may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk, or solid-state drive; and the memory may also include a combination of the aforementioned types of memory.

[0152] When one or more programs in the storage medium can be executed by one or more processors, the service access control method executed on the electronic device side can be implemented.

[0153] The processor is configured to execute the service access control program stored in the memory to implement the following steps of the service access control method executed on the electronic equipment side:

[0154] Receive a request from a client to access a target service, and determine a target resource on which the target service depends;

[0155] Acquire current access information of the target resource from the first storage medium;

[0156] Determining whether a concurrent access limit for the target resource has been reached based on current access information of the target resource;

[0157] If so, discard the access request to deny providing the target service to the client; if not, access the target resource to provide the target service to the client.

[0158] Professionals should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0159] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0160] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A service access control method, characterized in that: The method comprises: Receive a request from a client to access a target service, and determine a target resource on which the target service depends; Acquire current access information of the target resource from the first storage medium; Determining whether a concurrent access limit for the target resource has been reached based on current access information of the target resource; If yes, discard the access request to deny providing the target service to the client; if no, access the target resource to provide the target service to the client; The determining, based on the current access information of the target resource, whether the upper limit of concurrent access to the target resource is currently reached comprises: determining, based on the current access information of the target resource, an actual remaining allowed concurrent access amount to the target resource; determining whether the actual remaining allowed concurrent access amount to the target resource is greater than 0; if so, determining that the upper limit of concurrent access to the target resource is currently not reached; if not, determining that the upper limit of concurrent access to the target resource is currently reached; The current access information is the remaining allowed concurrent access amount; the method further includes: if the current access information of the target resource cannot be obtained from the first storage medium, setting a local count flag of the target resource, and adding 1 to the local access count of the target resource stored in the second storage medium, where the initial value of the local access count is 0; The method of determining the actual remaining allowed concurrent access to the target resource based on the current access information of the target resource includes: checking whether there is a local counting flag for the target resource, the local counting flag being used to identify whether counting of concurrent access to the target resource is enabled locally; if not, determining the remaining allowed concurrent access obtained from the first storage medium as the actual remaining allowed concurrent access to the target resource; if so, obtaining the local access count of the target resource from the second storage medium, and determining the difference between the remaining allowed concurrent access obtained from the first storage medium and the local access count as the actual remaining allowed concurrent access to the target resource.

2. The method according to claim 1, characterized in that The current access information is the remaining allowed concurrent access amount; When it is determined, based on the current access information of the target resource, that the upper limit of concurrent access to the target resource has not been reached, the method further includes: The remaining allowed concurrent access amount of the target resource stored in the first storage medium is updated to a value obtained by subtracting 1 from the actual remaining allowed concurrent access amount.

3. The method according to claim 1, characterized in that After accessing the target resource to provide the target service to the client, the method further includes: Check whether there is a local count flag for the target resource; If so, decrementing the local access count of the target resource stored in the second storage medium by 1, and when determining that the local access count of the target resource is 0, deleting the local count flag of the target resource; If not, the remaining allowed concurrent access amount of the target resource stored in the first storage medium is increased by 1.

4. The method according to claim 1, wherein The method further comprises: In the case that the current access information of the target resource cannot be obtained from the first storage medium, the target resource is directly accessed to provide the target service to the client.

5. A service access control device, characterized in that: The device comprises: Request receiving module, used to receive the client's access request to the target service; A resource determination module, configured to determine a target resource on which the target service depends; An information acquisition module, configured to acquire current access information of the target resource from a first storage medium; A judgment module, configured to determine whether a concurrent access limit of the target resource has been reached based on the current access information of the target resource; a processing module configured to discard the access request to deny providing the target service to the client if the upper limit of concurrent access to the target resource is currently reached; and to access the target resource to provide the target service to the client if the upper limit of concurrent access to the target resource is currently not reached; Wherein, the judgment module includes: A first determining submodule, configured to determine an actual remaining allowed concurrent access amount of the target resource according to current access information of the target resource; A comparison submodule is used to determine whether the actual remaining allowed concurrent access quantity of the target resource is greater than 0; A second determining submodule is configured to determine that the upper limit of concurrent access to the target resource has not been reached if it is determined that the actual remaining allowed concurrent access to the target resource is greater than 0; and to determine that the upper limit of concurrent access to the target resource has been reached if it is determined that the actual remaining allowed concurrent access to the target resource is not greater than 0; The current access information is the remaining allowed concurrent access amount; the device further comprises: a local counting module, configured to set a local counting flag of the target resource and increase the local access count of the target resource stored in the second storage medium by 1 when the current access information of the target resource cannot be obtained from the first storage medium, wherein the initial value of the local access count is 0; The method of determining the actual remaining allowed concurrent access to the target resource based on the current access information of the target resource includes: checking whether there is a local counting flag for the target resource, the local counting flag being used to identify whether counting of concurrent access to the target resource is enabled locally; if not, determining the remaining allowed concurrent access obtained from the first storage medium as the actual remaining allowed concurrent access to the target resource; if so, obtaining the local access count of the target resource from the second storage medium, and determining the difference between the remaining allowed concurrent access obtained from the first storage medium and the local access count as the actual remaining allowed concurrent access to the target resource.

6. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is configured to execute a service access control program stored in the memory to implement the service access control method according to any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the service access control method according to any one of claims 1 to 4.

Images