Method and apparatus for determining last access time of access key, and electronic device

Abstract

The disclosure provides a method and device for determining the last use time of an access key and an electronic device, relates to the technical field of data processing, and particularly relates to the technical field of access keys or cloud security. The specific implementation scheme is as follows: obtaining an event log of signature verification events in a preset monitoring period, the signature verification event being an event for signature verification on an access request initiated by a user, the access request being signed by an access key of the user; and determining the last use time of the access key based on the event log. According to the scheme, the last use time of the access key can be effectively determined based on the event log, which provides a basis for assisting the user in judging whether the access key has been leaked, and helps to improve the security protection for the user.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and more particularly to the field of access key or cloud security technology. Specifically, this disclosure relates to a method, apparatus, and electronic device for determining the last time an access key was used. Background Technology

[0002] With the rapid development of cloud computing technology, more and more enterprise users are choosing Identity as a Service (IDaaS) to meet their security management needs.

[0003] The identity management service distributes access keys to users, which are used to sign user-initiated business requests. When the identity management service receives a user-initiated business request, it verifies the signature of the request to ensure the security of the request and that the requesting user has the appropriate permission to request the corresponding business.

[0004] However, access keys may be leaked if users fail to properly safeguard them. Providing users with the last known date of use for their access keys effectively helps them understand how their access keys have been used and determine if a leak has occurred. Therefore, how to provide users with the last known date of use for their access keys is a significant technical issue in the field of cloud security. Summary of the Invention

[0005] To address at least one of the aforementioned deficiencies, this disclosure provides a method, apparatus, and electronic device for determining the last used time of an access key.

[0006] According to a first aspect of this disclosure, a method for determining the last used time of an access key is provided, the method comprising:

[0007] Obtain the event log of signature verification events within the preset monitoring period. Signature verification events are used to verify the signature of access requests initiated by users. The access requests are signed by the user's access key.

[0008] The last time the access key was used was determined based on the event log.

[0009] According to a second aspect of this disclosure, an apparatus for determining the last used time of an access key is provided, the apparatus comprising:

[0010] The event log acquisition module is used to acquire event logs of signature verification events within a preset monitoring period. Signature verification events are used to verify the signature of access requests initiated by users. The access requests are signed by the user's access key.

[0011] The Last Use Time Determination module is used to determine the last use time of an access key based on the event log.

[0012] According to a third aspect of this disclosure, an electronic device is provided, the electronic device comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to at least one of the aforementioned processors; wherein,

[0015] The memory stores instructions that can be executed by at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method for determining the last use time of the access key.

[0016] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method for determining the last use time of the access key.

[0017] According to a fifth aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method for determining the last use time of the access key described above.

[0018] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0019] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0020] Figure 1 This is a flowchart illustrating a method for determining the last used time of an access key according to an embodiment of this disclosure;

[0021] Figure 2 This is a diagram illustrating the change in the number of access requests that undergo signature verification by the target server;

[0022] Figure 3 This is a schematic diagram of each stage within a preset push period provided in the embodiments of this disclosure;

[0023] Figure 4 This is a schematic diagram of the structure of an identity management server system provided in an embodiment of this disclosure;

[0024] Figure 5 This is a flowchart illustrating another method for determining the last use time of an access key provided in an embodiment of this disclosure;

[0025] Figure 6 This is a schematic diagram of a device for determining the last use time of an access key according to an embodiment of this disclosure;

[0026] Figure 7 This is a schematic diagram of another device for determining the last use time of an access key provided in an embodiment of this disclosure;

[0027] Figure 8 This is a block diagram of an electronic device used to implement the method for determining the last used time of an access key according to embodiments of the present disclosure. Detailed Implementation

[0028] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0029] Some identity management services (IDaaS) in related technologies cannot provide users with the last usage time of the access key, or cannot cover all access key call records, resulting in poor accuracy of the extracted last usage time of the access key.

[0030] Identity management services typically experience high traffic volumes. If the last access key's usage time is obtained by directly reading information from the identity management service's log files, it will consume a significant amount of time, resulting in a substantial delay in the retrieved last access key usage time. Furthermore, reading information from the identity management service's log files may contain a large amount of redundant data, which can adversely affect database read and write operations.

[0031] The method, apparatus, and electronic device for determining the last use time of an access key provided in this disclosure are intended to solve at least one of the above-mentioned technical problems in the prior art.

[0032] Figure 1 This illustration shows a flowchart of a method for determining the last usage time of an access key according to an embodiment of this disclosure, as shown below. Figure 1 As shown, the method can mainly include:

[0033] Step S110: Obtain the event log of signature verification events within the preset monitoring period. The signature verification event is used to verify the signature of the access request initiated by the user. The access request is signed by the user's access key.

[0034] Step S120: Determine the last time the access key was used based on the event log.

[0035] In this case, users can pre-assign access keys to users who use Identity as a Service (IDaaS).

[0036] Access requests can be business requests from users for a specific service. Access requests can be initiated based on the Application Programming Interface (API) provided by the identity management service.

[0037] Access keys include an Access Key ID (AK) and a Secret Key (SK), which can be used to sign access requests. The identity management service can assign a unique access key to a user during registration.

[0038] After a user initiates an access request, the identity management service verifies the signature of the access request to ensure its security and that the user has the appropriate business access permissions. Specifically, the identity management service can identify the accessing user's identity using the AK (Access Detector) and verify the signature using the SK (Signature Detector).

[0039] A signature verification event is an event in which the identity management service verifies the signature of an access request. After the signature verification event is completed, the event log of the signature verification event will be recorded in the identity management service's log.

[0040] The event log for signature verification events contains information related to signature verification, such as response fields for signature authentication. These response fields include the event time, user ID, and access key ID. The event time of the signature verification event can be extracted from the event log, reflecting the duration of access key usage.

[0041] In this embodiment of the disclosure, event logs for signature verification events can be extracted from the log records of the identity management service. As an example, the log records of the identity management service can be managed by a cloud audit service, which can then extract event logs for signature verification events within the monitoring period from the log records of the identity management service.

[0042] Specifically, the event log of a signature verification event contains a type identifier for the signature verification event, and the event log of the signature verification event can be extracted based on the type identifier of the signature verification event.

[0043] In this embodiment of the disclosure, a monitoring period can be preset, and the last usage time of the access key can be determined by analyzing the time logs collected in each monitoring period, and the last usage time of the stored access key can be updated.

[0044] The duration of the monitoring cycle can be set according to actual needs, for example, it can be set to a monitoring cycle of 2 minutes.

[0045] The method provided in this disclosure obtains event logs of signature verification events for user-initiated access requests within a preset monitoring period, and determines the last usage time of the access key based on the event logs. Based on this scheme, the last usage time of the access key can be effectively determined according to the event logs, providing a basis for assisting users in determining whether the access key has been leaked, and helping to improve user security.

[0046] In this embodiment of the disclosure, the event log of the signature verification event extracted from the log record of the identity management service by the cloud audit service can cover the access key call record, avoid a large number of access key call records that cannot be covered, and ensure the accuracy of the last use time of the analyzed access key.

[0047] In one alternative approach disclosed herein, determining the last use time of the access key based on event logs includes:

[0048] Extract key field information from the event information parsed from the event log. The key field information includes the event time of the signature verification event.

[0049] Query the event time of the signature verification event from the key field information to obtain the event time query results;

[0050] The last time the access key was used was determined based on the event time query results.

[0051] In this embodiment of the disclosure, after obtaining the event log of the signature verification event, the event log can be parsed to obtain event information. The event information generally includes signature verification response fields, which specifically include response header fields and response body fields of the signature verification response.

[0052] To avoid memory pressure caused by redundant data, key fields can be extracted from the event information for subsequent processing. These key fields include the event time of the signature verification event. The event time of the signature verification event can be used to determine the last time the access key was used.

[0053] As an example, key field information may include information such as event time and response.

[0054] After identifying the key field information, the event time of the signature verification event can be queried from the key field information to obtain the event time query results. These results can then be used to determine the last usage time of the access key. Because the query operation is performed from the key field information, compared to querying directly from the event log, the amount of data involved in the query is significantly reduced, as is the time consumed by the data query, thus helping to lower the latency in determining the last usage time of the access key.

[0055] In this embodiment of the disclosure, the event time query result will include the event time of the signature verification event. Since the time interval between the access key signing the access request and the signature verification event generated by the access request is short, the event time of the signature verification event can be used as the usage time of the corresponding access key, and the time of the latest signature verification event in the current monitoring period can be used as the last usage time of the corresponding access key.

[0056] To reduce the time consumed by event time query operations, the query statement can be set up to query only the event time of the signature verification event, thus avoiding the introduction of other redundant data.

[0057] In this embodiment of the disclosure, by extracting key field information from the event information of the signature verification event, and then querying the event time of the signature verification event in the key field information, the time consumption of the event time query operation can be effectively reduced, and the latency of the last use time of the analyzed access key can be reduced.

[0058] In one optional method of this disclosure, the access key corresponds to at least two signature verification events. The event time of each signature verification event is queried from the key field information to obtain the event time query result, including:

[0059] Retrieve the event times of at least two signature verification events corresponding to the access key from the key field information;

[0060] The latest event time among the event times of at least two signature verification events corresponding to the access key is determined as the event time query result;

[0061] The last time the access key was used was determined based on the event time query results, including:

[0062] The latest event time among the event times of at least two signature verification events corresponding to the access key is taken as the last time the access key is used.

[0063] In this embodiment of the disclosure, multiple access requests signed by the same access key may exist within a preset monitoring period, and multiple signature verification events may also exist for these access requests. When querying key field information, the event times of multiple signature verification events may be retrieved.

[0064] If the query for the event times of signature verification events includes the event times of multiple signature verification events, the query operation will result in a long response time. Since this solution requires querying the last usage time, the event times of the retrieved signature verification events can be sorted to determine the latest event time, which will then be used as the query result. This ensures that the query result only contains the event time of the latest signature verification event.

[0065] In this embodiment of the disclosure, query efficiency can be improved by reasonably configuring the query statement so that the returned query results contain only the event time of a single signature verification event. Since the query results only contain the event time of the latest signature verification event, the event time of the signature verification event in the query results can be directly used as the last usage time of the corresponding access key.

[0066] In one alternative embodiment of this disclosure, before retrieving the event time of the signature verification event from the key field information, the method further includes:

[0067] Extract index field information from key field information;

[0068] The indexed field information is used as an index for the key field information, and stored in association with the key field information in the elastic search cluster;

[0069] Retrieve the event time of the signature verification event from the key field information, including:

[0070] Using an elastic search cluster, query the event time of the signature verification event from the index field information.

[0071] Elastic Search (ES) is an open-source, highly scalable, distributed full-text search engine that provides high-performance data storage and retrieval services. To ensure efficient querying of event-time information, the querying of key field information in this embodiment can be implemented based on Elastic Search.

[0072] In this embodiment of the disclosure, after extracting the key field information, the key field information can be packaged and cached. After a certain amount of data has been cached, the cached key field information is stored in the elastic search cluster.

[0073] When storing key field information in an elastic search cluster, index field information can be extracted from the key field information as an index for the key field information, and the index and key field information can be stored together in the elastic search cluster.

[0074] The indexed fields contain information such as event time, user ID, and access key ID. Therefore, when querying key field information stored in the Elasticsearch cluster, the query can be performed directly from the indexed fields to obtain event time query results. Querying from the indexed fields improves query efficiency compared to querying directly from the key fields.

[0075] In one optional method of this disclosure, key field information is extracted from the event information parsed from the event log, including:

[0076] Extract initial key field information from the event information parsed from the event log;

[0077] The initial key field information is filtered to obtain key field information, so that the key field information is extracted from the event log of one of the signature verification events corresponding to the access key within the first preset time period.

[0078] In this embodiment of the disclosure, the field information of a preset field can be extracted from the event information parsed from the event log as the initial key field information.

[0079] As an example, preset fields may include event time and response.

[0080] Within the first preset time period, there may be multiple access requests signed by the same access key, and there may also be multiple signature verification events corresponding to these access requests. Initial key field information can be extracted from the event logs of multiple signature verification events, which will result in a large total amount of initial key field information, leading to a large amount of data being queried when performing subsequent data queries.

[0081] The first preset time period is configured to be a relatively short period, such as 10 minutes. Since the time span of the first preset time period is small, the time difference between the event times of multiple signature verification events corresponding to the same access key within the first preset time period is also small. Therefore, one of the event times of multiple signature verification events corresponding to the same access key within the first preset time period can be selected to represent the usage time of the access key within the first preset time period.

[0082] As an example, a Bloom filter can be used to filter the initial key field information corresponding to the first preset time period. This allows the filtered key field information to be extracted from the event log of any one of the signature verification events corresponding to the access key within the first preset time period. In other words, only one key field information for one access key within the first preset time period is extracted, thereby reducing the amount of key field information and facilitating subsequent query operations based on event time.

[0083] In one alternative embodiment of this disclosure, after determining the last use time of the access key based on the event log, the method further includes:

[0084] Based on the changes in the processing pressure of the target server, the push time for pushing the corresponding data to be pushed is determined.

[0085] For any given push time, the data to be pushed corresponding to the data to be pushed is sent to the target server so that the target server stores the data to be pushed in the database. The data to be pushed is the last time of use of the access key determined within the time period between the push time and the adjacent previous push time.

[0086] The target server can be the backend server of the identity management service. After determining the last usage time of the access key, it is sent to the target server, which then stores it in its database for later provision to the user.

[0087] The target server performs multiple services, such as signature verification of access requests. The processing load on the target server varies at different times. If the last usage time of the access key is sent to the target server when its processing load is high, it may impact the performance of other services.

[0088] In this embodiment of the disclosure, by monitoring the changes in the processing pressure of the target server, the push time for pushing the corresponding data to be pushed can be determined. The changes in the processing pressure of the target server at the push time can reflect that the target server has better processing capabilities at the push time, and can receive the last usage time of the access key and store it in the database while ensuring the performance of other servers.

[0089] In this embodiment of the disclosure, after determining the last time the access key was used, it can be cached, and the cached data can be sent to the target server at each push time.

[0090] In this embodiment of the disclosure, for any push time, the data to be pushed is the last usage time of the access key cached during the time period between the push time and the adjacent previous push time. At the push time, the data to be pushed can be sent to the target server, and then the cached data to be pushed can be cleared, and the next batch of data to be pushed can be cached.

[0091] As an example, if the push time is at the 10th second and the preceding push time is at the 5th second, the last usage time of the access key cached between the 5th and 10th seconds can be used as the data to be pushed and sent to the target server at the 10th second.

[0092] In one optional embodiment of this disclosure, the push time for pushing the corresponding data to be pushed is determined based on the changes in the processing pressure of the target server, including:

[0093] For any given preset push period, obtain the changes in the processing pressure of the target server within the previous preset push period adjacent to that preset push period;

[0094] Determine the target time within the previous preset push cycle, and ensure that the processing pressure change at the target time meets the preset conditions.

[0095] The time corresponding to the target time within the preset push period is determined as the push time.

[0096] In this embodiment of the disclosure, the preset push period can be a small value, such as 30s, that is, the pressure change is analyzed and processed with a small granular time period, and the push time is determined.

[0097] As an example, the signature verification service for access requests is a major service provided by the target server, which consumes a lot of the target server's processing power. Therefore, the processing pressure on the target server can be reflected by the number of access requests that are signed and verified at any given time.

[0098] Figure 2 The diagram below illustrates the change in the number of access requests that undergo signature verification through the target server. For example... Figure 2 As shown, 14:00:00, 16:00:00, 18:00:00, and 20:00:00 are all time coordinates. Figure 2 The curve in the graph represents the change in the number of access requests undergoing signature verification through the target server over time. Since the number of access requests undergoing signature verification reflects the processing load on the target server, therefore... Figure 2 The curve shown can be used as a curve illustrating the change in processing pressure on the target server. (By...) Figure 2As shown in the curve, the pressure change curve also shows significant changes within a relatively short time period (e.g., 5 minutes). Therefore, it is necessary to analyze the pressure change using a smaller granular time period.

[0099] In this embodiment of the disclosure, since the time length of the preset push period is a small value, for any preset push period, the processing pressure change of the target server in the previous preset push period adjacent to the preset push period can be obtained and regarded as the processing pressure change in the preset push period, which is used to analyze and determine the push time.

[0100] In this embodiment of the disclosure, preset conditions can be configured. When the processing pressure change meets the preset conditions, it means that the processing capability of the target server is better at this moment, and it can receive the last use time of the access key and store it in the database. The time corresponding to the processing pressure change meeting the preset conditions is the target time within the previous preset push period. The time corresponding to the target time within the preset push period can be determined as the push time.

[0101] As an example, the preset push cycle is 30 seconds. The previous preset push cycle adjacent to this preset push cycle is from 1 minute 30 seconds to the 2nd minute. The preset push cycle is from 2 minutes 00 seconds to 2 minutes 30 seconds. If the target time in the aforementioned previous preset push cycle is determined to be 1 minute 40 seconds, then the time corresponding to the target time in the preset push cycle can be determined as the push time, that is, 2 minutes 10 seconds is determined as the push time. Both the target time and the push time correspond to the 10th second in the preset push cycle.

[0102] As an example, Figure 3 The diagram shows a schematic representation of each stage within a preset push period provided by an embodiment of this disclosure.

[0103] like Figure 3 As shown, the preset push period is the t-th preset push period, the preceding preset period is the (t-1)-th preset push period, and the following preset period is the (t+1)-th preset push period.

[0104] The preset push cycle can include a monitoring and collection phase, a valley point confirmation phase, and a push execution phase. During the monitoring and collection phase, the processing load changes of the target server within the previous preset push cycle are collected. The valley point is the push time. The valley point confirmation phase determines whether a push time exists within the current preset push cycle. The push execution phase sends the data to be pushed to the target server.

[0105] In practical use, the duration of the monitoring and collection phase, the valley value confirmation phase, and the push execution phase is not limited. If the push time cannot be determined during the valley value confirmation phase, the push execution phase will not exist. The monitoring and collection phase, the valley value confirmation phase, and the push execution phase may overlap. For example, if the push execution phase within the current preset push cycle has not yet ended, the data collection operations within the monitoring and collection phase of the next preset push cycle can be executed asynchronously. That is, before the end of the current preset push cycle, the next preset push cycle can begin, ensuring effective acquisition of the changes in the processing pressure of the target server within the previous preset push cycle. Alternatively, the operation to determine the push time within the valley value confirmation phase can be executed asynchronously before the monitoring and collection phase ends.

[0106] In one optional embodiment of this disclosure, determining the target time within the previous preset push cycle, wherein the processing pressure change corresponding to the target time satisfies preset conditions, including:

[0107] Determine the processing pressure change curve based on the changes in processing pressure;

[0108] The target time within the previous preset push cycle is determined, and the processing pressure change curve corresponding to the target time satisfies preset conditions, wherein the preset conditions include at least one of the following:

[0109] The slope of the pressure change curve at the target time is zero.

[0110] The slope of the pressure change curve is greater than zero within a preset push cycle of the first number of consecutive targets before the position corresponding to the target time.

[0111] The slope of the pressure change curve is less than zero within a preset push cycle of the number of consecutive second targets before the position corresponding to the target time.

[0112] In this embodiment, the changes in processing pressure within each preset push cycle are converted into a processing pressure change curve. Specifically, the pressure changes within each preset push cycle are summarized, and the processing pressure change curve is plotted. Figure 2 It can also serve as a schematic diagram for handling pressure change curves, i.e. Figure 2 The curve in the figure represents the pressure change curve.

[0113] In this embodiment of the disclosure, the preset condition can be that the slope of the processing pressure change curve at the target time is zero, which means that the processing pressure of the target server has not increased at the target time. It can be considered that the processing capacity of the target server is better at this time, and it is suitable for receiving the data to be pushed.

[0114] The preset condition can be that the slope of the processing pressure change curve is greater than zero within a preset push period of the first number of consecutive targets before the target time. That is, within the preset push period of the first number of targets before the target time, the processing pressure is always increasing. In order to avoid the processing pressure from increasing to a higher level, the data to be pushed can be received as soon as possible.

[0115] The preset condition can be that the slope of the processing pressure change curve is less than zero within a preset push period of the second number of consecutive targets before the target time. That is, within the preset push period of the second number of targets before the target time, the processing pressure is always decreasing. At this time, it can be considered that the processing pressure has dropped low enough to be suitable for receiving the data to be pushed.

[0116] The number of first and second objectives can be set according to actual needs. For example, the number of first objectives can be 5 and the number of second objectives can be 10.

[0117] In one alternative embodiment of this disclosure, before sending the data to be pushed to the target server, the method further includes:

[0118] In response to the failure to determine the push time within the second preset time period, the last usage time of the access key determined within the second preset time period is determined as the data to be pushed.

[0119] In this embodiment of the disclosure, if the target server cannot be determined at a suitable time to receive the data to be pushed within a long period of time, the amount of cached data is already quite large. In order to avoid further data backlog, the data accumulated within the second preset time period can be used as the data to be pushed and sent to the target server in a timely manner, and then the cached data can be cleared.

[0120] The duration of the second preset time period can be set according to actual needs. For example, the duration of the second preset time period can be set to 20 minutes.

[0121] In one alternative embodiment of this disclosure, after the target server stores the data to be pushed into the database, the last usage time of the access key stored in the database is output in any of the following ways:

[0122] When a target user accesses the access key information display page, the last time the target user's access key was used is displayed on the access key information display page;

[0123] In response to receiving a query request from the target user, return the last time the target user's access key was used.

[0124] In this embodiment of the disclosure, the last usage time of the access key can be stored and updated in real time through a database, and provided to the user when the user has a need for the last usage time of the access key.

[0125] As an example, an access key information display page can be provided, which includes the last usage time of the target user's access key, so that the target user can see the last usage time of the target user's access key when viewing the access key information display page.

[0126] For example, the access key information display page can use a table to show the relevant information of the access key, including the last time the access key was used. A table showing the relevant information of the access key can be shown in Table 1.

[0127] Table 1

[0128] Access key identification Status Creation time Last use time AK1 Enabled Time1 Time2

[0129] Wherein, AK1 is the access key identifier of the target user, the status of the target user's access key is enabled, Time1 is the creation time of the target user's access key, and Time2 is the last time the target user's access key was used.

[0130] As an example, when a target user needs to view the last usage time of an access key, the target user sends a query request to the identity management service. The identity management service retrieves the last usage time of the target user's access key from the database based on the target user's user ID and access key identifier, and returns it to the target user.

[0131] When a target user needs to view the last usage time of an access key, the target user can send a query request to the identity management service. The identity management service will then retrieve the last usage time of the target user's access key from the database based on the target user's user ID and access key identifier, and return it to the target user.

[0132] As an example, Figure 4 The diagram shows a structural schematic of an identity management server system provided in an embodiment of this disclosure.

[0133] like Figure 4 As shown, the system includes an event acquisition model, an event push model, and a record display model.

[0134] The event acquisition model is used to extract key field information from event logs. The extracted key field information is cached, and then the key field information corresponding to different scenarios is sent to the event push model respectively.

[0135] The cloud audit event information source is used to obtain event logs of signature verification events through the cloud audit service.

[0136] Access key event preprocessor is used to process the event log of signature verification events and extract key field information from the event log.

[0137] The audit log event parser is used to parse the event log of signature verification events to obtain event information.

[0138] The signature authentication record wrapper is used to extract key field information from event information and then wrap the key field information.

[0139] An authentication key information cache is used to cache the packaged key field information.

[0140] Cloud testing, identity recognition and access management services, and remote dictionary servers for identity recognition and access management services represent different scenarios within the identity management service.

[0141] Cloud testing to Elastic Search involves sending key field information cached in cloud testing scenarios to the Elastic Search log cluster.

[0142] The Identity and Access Management (IAM) service is sent to Elastic Search, which means sending key field information cached in the IAM service to the Elastic Search log cluster.

[0143] The Identity and Access Management (IAM) service sends key field information cached in the Identity and Access Management (IAM) scenario based on the Remote Dictionary Server (Redis) to the Elastic Search log cluster.

[0144] The event push model is used to receive key field information sent by the event acquisition model, retrieve the last usage time of the access key from the key field information through ElasticSearch, and store the last usage time of the access key in the database.

[0145] Elastic Search log clusters are used to store packaged key field information.

[0146] The scheduled pusher is used to retrieve the last usage time of the access key from key field information through Elastic Search and push the last usage time of the access key to the database for storage on a scheduled basis.

[0147] Information extraction refers to searching for the last time the access key was used from key field information.

[0148] The update is performed using the user ID and AK. Specifically, the database is queried for the corresponding last access time using the user identifier (ID) and access key identifier (AK), and the original last access time in the database is updated using the latest obtained last access time.

[0149] The record display model is used to show the user the last access time of the access key.

[0150] DB stands for database, which is used to store the last time an access key was used.

[0151] The front-end page display shows the access key information to the target user, including the last time the target user's access key was used.

[0152] OpenAPI calls, or Open Application Programming Interface (API) calls, allow target users to initiate query requests through the open API. The identity management service then retrieves the last usage time of the target user's access key from the database based on the target user's user ID and access key identifier, and returns it to the target user.

[0153] Figure 5 A flowchart illustrating another method for determining the last use time of an access key provided in an embodiment of this disclosure is shown, such as... Figure 5 As shown, the method can mainly include:

[0154] Step S510: Obtain the event log of signature verification events within the preset monitoring period. The signature verification event is used to verify the signature of the access request initiated by the user. The access request is signed by the user's access key.

[0155] Step S520: Determine the last time the access key was used based on the event log.

[0156] Step S530: Based on the changes in the processing pressure of the target server, determine the push time for pushing the data to be pushed.

[0157] Step S540: For any push time, send the data to be pushed corresponding to that push time to the target server, so that the target server stores the data to be pushed in the database. The data to be pushed is the last usage time of the access key determined within the time period between that push time and the adjacent previous push time.

[0158] In this case, users can pre-assign access keys to users who use Identity as a Service (IDaaS).

[0159] Access requests can be business requests from users for a specific service. Access requests can be initiated based on the Application Programming Interface (API) provided by the identity management service.

[0160] Access keys include an Access Key ID (AK) and a Secret Key (SK), which can be used to sign access requests. The identity management service can assign a unique access key to a user during registration.

[0161] After a user initiates an access request, the identity management service verifies the signature of the access request to ensure its security and that the user has the appropriate business access permissions. Specifically, the identity management service can identify the accessing user's identity using the AK (Access Detector) and verify the signature using the SK (Signature Detector).

[0162] A signature verification event is an event in which the identity management service verifies the signature of an access request. After the signature verification event is completed, the event log of the signature verification event will be recorded in the identity management service's log.

[0163] The event log for signature verification events contains information related to signature verification, such as response fields for signature authentication. These response fields include the event time, user ID, and access key ID. The event time of the signature verification event can be extracted from the event log, reflecting the duration of access key usage.

[0164] In this embodiment of the disclosure, event logs for signature verification events can be extracted from the log records of the identity management service. As an example, the log records of the identity management service can be managed by a cloud audit service, which can then extract event logs for signature verification events within the monitoring period from the log records of the identity management service.

[0165] Specifically, the event log of a signature verification event contains a type identifier for the signature verification event, and the event log of the signature verification event can be extracted based on the type identifier of the signature verification event.

[0166] In this embodiment of the disclosure, a monitoring period can be preset, and the last usage time of the access key can be determined by analyzing the time logs collected in each monitoring period, and the last usage time of the stored access key can be updated.

[0167] The duration of the monitoring cycle can be set according to actual needs, for example, it can be set to a monitoring cycle of 2 minutes.

[0168] The method provided in this disclosure obtains event logs of signature verification events for user-initiated access requests within a preset monitoring period, and determines the last usage time of the access key based on the event logs. Based on this scheme, the last usage time of the access key can be effectively determined according to the event logs, providing a basis for assisting users in determining whether the access key has been leaked, and helping to improve user security.

[0169] In this embodiment of the disclosure, the event log of the signature verification event extracted from the log record of the identity management service by the cloud audit service can cover the access key call record, avoid a large number of access key call records that cannot be covered, and ensure the accuracy of the last use time of the analyzed access key.

[0170] The target server can be the backend server of the identity management service. After determining the last usage time of the access key, it is sent to the target server, which then stores it in its database for later provision to the user.

[0171] The target server performs multiple services, such as signature verification of access requests. The processing load on the target server varies at different times. If the last usage time of the access key is sent to the target server when its processing load is high, it may impact the performance of other services.

[0172] In this embodiment of the disclosure, by monitoring the changes in the processing pressure of the target server, the push time for pushing the corresponding data to be pushed can be determined. The changes in the processing pressure of the target server at the push time can reflect that the target server has better processing capabilities at the push time, and can receive the last usage time of the access key and store it in the database while ensuring the performance of other servers.

[0173] In this embodiment of the disclosure, after determining the last time the access key was used, it can be cached, and the cached data can be sent to the target server at each push time.

[0174] In this embodiment of the disclosure, for any push time, the data to be pushed is the last usage time of the access key cached during the time period between the push time and the adjacent previous push time. At the push time, the data to be pushed can be sent to the target server, and then the cached data to be pushed can be cleared, and the next batch of data to be pushed can be cached.

[0175] Based on and Figure 1 The method shown follows the same principle. Figure 6 A schematic diagram of a device for determining the last use time of an access key according to an embodiment of this disclosure is shown, as follows: Figure 5 As shown, the device 60 for determining the last time the access key was used may include:

[0176] The event log acquisition module 610 is used to acquire the event log of signature verification events within a preset monitoring period. The signature verification event is used to verify the signature of the access request initiated by the user. The access request is signed by the user's access key.

[0177] The last-use time determination module 620 is used to determine the last-use time of the access key based on the event log.

[0178] The apparatus provided in this disclosure determines the last usage time of an access key by acquiring event logs of signature verification events performed on signatures of user-initiated access requests within a preset monitoring period. Based on these event logs, the last usage time of the access key can be effectively determined from the event logs, providing a basis for assisting users in determining whether their access keys have been leaked and contributing to improved user security.

[0179] Optionally, the module for determining the last used time is specifically used for:

[0180] Extract key field information from the event information parsed from the event log. The key field information includes the event time of the signature verification event.

[0181] Query the event time of the signature verification event from the key field information to obtain the event time query results;

[0182] The last time the access key was used was determined based on the event time query results.

[0183] Optionally, the access key corresponds to at least two signature verification events. When the last-use time determination module queries the event time of the signature verification event from the key field information to obtain the event time query result, it is specifically used for:

[0184] Retrieve the event times of at least two signature verification events corresponding to the access key from the key field information;

[0185] The latest event time among the event times of at least two signature verification events corresponding to the access key is determined as the event time query result;

[0186] The module for determining the last usage time is specifically used to: determine the last usage time of an access key based on the event time query results.

[0187] The latest event time among the event times of at least two signature verification events corresponding to the access key is taken as the last time the access key is used.

[0188] Optionally, the above-mentioned device further includes:

[0189] The key field information storage module is used to extract index field information from the key field information, use the index field information as an index for the key field information, and store it in association with the key field information in the elastic search cluster;

[0190] The final time determination module is used specifically for retrieving the event time of the signature verification event from the key field information, specifically for:

[0191] Using an elastic search cluster, query the event time of the signature verification event from the index field information.

[0192] Optionally, the module for determining the last used time is specifically used to extract key field information from the event information parsed from the event log, specifically for:

[0193] Extract initial key field information from the event information parsed from the event log;

[0194] The initial key field information is filtered to obtain key field information, so that the key field information is extracted from the event log of one of the signature verification events corresponding to the access key within the first preset time period.

[0195] Optionally, the above-mentioned device further includes a data push module, which is used for:

[0196] After determining the last time the access key was used based on the event log, the push time for pushing the corresponding data to be pushed was determined based on the changes in the processing pressure of the target server.

[0197] For any given push time, the data to be pushed corresponding to that push time is sent to the target server so that the target server stores the data to be pushed in the database. The data to be pushed is the last usage time of the access key determined within the time period between that push time and the adjacent previous push time.

[0198] Optionally, when the data push module determines the push time for the corresponding data to be pushed based on changes in the processing pressure of the target server, it is specifically used for:

[0199] For any given preset push period, obtain the changes in the processing pressure of the target server within the previous preset push period adjacent to that preset push period;

[0200] Determine the target time within the previous preset push cycle, and ensure that the processing pressure change at the target time meets the preset conditions.

[0201] The time corresponding to the target time within the preset push period is determined as the push time.

[0202] Optionally, a target time within the previous preset push cycle is determined, and the processing pressure change corresponding to the target time meets preset conditions, including:

[0203] Determine the processing pressure change curve based on the changes in processing pressure;

[0204] The target time within the previous preset push cycle is determined, and the processing pressure change curve corresponding to the target time satisfies preset conditions, wherein the preset conditions include at least one of the following:

[0205] The slope of the pressure change curve at the target time is zero.

[0206] The slope of the pressure change curve is greater than zero within a preset push cycle of the first number of consecutive targets before the position corresponding to the target time.

[0207] The slope of the pressure change curve is less than zero within a preset push cycle of the number of consecutive second targets before the position corresponding to the target time.

[0208] Optionally, the above-mentioned device further includes:

[0209] The data to be pushed module is used to determine the last usage time of the access key determined within the second preset time period as the data to be pushed before sending the data to be pushed to the target server, in response to the fact that the push time has not been determined within the second preset time period.

[0210] Optionally, after the target server stores the data to be pushed into the database, the last usage time of the access key stored in the database is output in any of the following ways:

[0211] When a target user accesses the access key information display page, the last time the target user's access key was used is displayed on the access key information display page;

[0212] In response to receiving a query request from the target user, return the last time the target user's access key was used.

[0213] It is understood that the above-described modules of the access key last used time determination device in the embodiments of this disclosure have the ability to implement... Figure 1 The illustrated embodiment demonstrates the functionality of the corresponding steps in the method for determining the last use time of the access key. This functionality can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functionality. These modules can be software and / or hardware, and each module can be implemented individually or multiple modules can be integrated. For a detailed description of the functions of each module in the aforementioned device for determining the last use time of the access key, please refer to [link to relevant documentation]. Figure 1 The corresponding description of the method for determining the last used time of the access key in the illustrated embodiment will not be repeated here.

[0214] Based on and Figure 5 The method shown follows the same principle. Figure 7 A schematic diagram of another device for determining the last use time of an access key provided in an embodiment of this disclosure is shown, as follows: Figure 7 As shown, the device 70 for determining the last time the access key was used may include:

[0215] The event log acquisition module 710 is used to acquire the event log of signature verification events within a preset monitoring period. The signature verification event is used to verify the signature of the access request initiated by the user. The access request is signed by the user's access key.

[0216] The last-use time determination module 720 is used to determine the last-use time of the access key based on the event log.

[0217] The data push module 730 is used to determine the push time for the corresponding data to be pushed based on the processing pressure changes of the target server after determining the last use time of the access key based on the event log. For any push time, the data to be pushed corresponding to the push time is sent to the target server so that the target server stores the data to be pushed in the database. The data to be pushed is the last use time of the access key determined within the time period between the push time and the adjacent previous push time.

[0218] The apparatus provided in this disclosure determines the last usage time of an access key by acquiring event logs of signature verification events performed on signatures of user-initiated access requests within a preset monitoring period. Based on these event logs, the last usage time of the access key can be effectively determined from the event logs, providing a basis for assisting users in determining whether their access keys have been leaked and contributing to improved user security.

[0219] It is understood that the above-described modules of the access key last used time determination device in the embodiments of this disclosure have the ability to implement... Figure 5 The illustrated embodiment demonstrates the functionality of the corresponding steps in the method for determining the last use time of the access key. This functionality can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described functionality. These modules can be software and / or hardware, and each module can be implemented individually or multiple modules can be integrated. For a detailed description of the functions of each module in the aforementioned device for determining the last use time of the access key, please refer to [link to relevant documentation]. Figure 5 The corresponding description of the method for determining the last used time of the access key in the illustrated embodiment will not be repeated here.

[0220] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0221] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0222] The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a method for determining the last use time of an access key as provided in embodiments of this disclosure.

[0223] Compared to existing technologies, this electronic device obtains event logs of signature verification events from user-initiated access requests within a preset monitoring period, and determines the last usage time of the access key based on these event logs. This solution effectively determines the last usage time of the access key based on the event logs, providing a basis for assisting users in determining whether their access keys have been compromised, and thus enhancing user security.

[0224] The readable storage medium is a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute a method for determining the last use time of an access key as provided in embodiments of this disclosure.

[0225] Compared to existing technologies, this readable storage medium obtains event logs of signature verification events from user-initiated access requests within a preset monitoring period, and determines the last usage time of the access key based on these event logs. This solution effectively determines the last usage time of the access key based on the event logs, providing a basis for assisting users in determining whether their access keys have been compromised, and thus enhancing user security.

[0226] The computer program product includes a computer program that, when executed by a processor, implements a method for determining the last use time of an access key as provided in embodiments of this disclosure.

[0227] Compared to existing technologies, this computer program product obtains event logs of signature verification events from user-initiated access requests within a preset monitoring period, and determines the last usage time of the access key based on these event logs. This solution effectively determines the last usage time of the access key based on the event logs, providing a basis for assisting users in determining whether their access keys have been compromised, and thus contributing to improved user security.

[0228] Figure 8 A schematic block diagram of an example electronic device 80 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0229] like Figure 8 As shown, the electronic device 80 includes a computing unit 810, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 820 or a computer program loaded from a storage unit 880 into a random access memory (RAM) 830. The RAM 830 may also store various programs and data required for the operation of the device 80. The computing unit 810, ROM 820, and RAM 830 are interconnected via a bus 840. An input / output (I / O) interface 850 is also connected to the bus 840.

[0230] Multiple components in device 80 are connected to I / O interface 850, including: input unit 860, such as keyboard, mouse, etc.; output unit 870, such as various types of monitors, speakers, etc.; storage unit 880, such as disk, optical disk, etc.; and communication unit 890, such as network card, modem, wireless transceiver, etc. Communication unit 890 allows device 80 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0231] The computing unit 810 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 810 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 810 executes the method for determining the last use time of the access key provided in the embodiments of this disclosure. For example, in some embodiments, executing the method for determining the last use time of the access key provided in the embodiments of this disclosure can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 880. In some embodiments, part or all of the computer program can be loaded and / or installed on device 80 via ROM 820 and / or communication unit 890. When the computer program is loaded into RAM 830 and executed by computing unit 810, one or more steps of the method for determining the last use time of the access key provided in the embodiments of this disclosure can be performed. Alternatively, in other embodiments, the computing unit 810 may be configured by any other suitable means (e.g., by means of firmware) to perform the method for determining the last use time of the access key provided in the embodiments of this disclosure.

[0232] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0233] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0234] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0235] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0236] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0237] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0238] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0239] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for determining the last used time of an access key, comprising: Obtain the event log of signature verification events within a preset monitoring period. The signature verification events are events used to verify the signature of access requests initiated by users. The access requests are signed by the user's access key. The last time the access key was used was determined based on the event log; Based on the changes in the processing pressure of the target server, the push time for pushing the corresponding data to be pushed is determined. The data to be pushed is the last time of use of the access key determined within the time period between the push time and the adjacent previous push time. The step of determining the push time for the corresponding data to be pushed based on the changes in the processing pressure of the target server includes: For any given preset push period, obtain the changes in the processing pressure of the target server within the previous preset push period adjacent to that preset push period; Based on the changes in processing pressure, a processing pressure change curve is determined, and a target time within the previous preset push cycle is determined. The processing pressure change curve corresponding to the target time satisfies a preset condition. The time corresponding to the target time within the preset push period is determined as the push time.

2. The method according to claim 1, wherein, Determining the last usage time of the access key based on the event log includes: Extract key field information from the event information parsed from the event log, including the event time of the signature verification event; The event time of the signature verification event is retrieved from the key field information to obtain the event time query result; The last time the access key was used is determined based on the event time query results.

3. The method according to claim 2, wherein, The access key corresponds to at least two signature verification events. The step of querying the event time of each signature verification event from the key field information to obtain the event time query result includes: Retrieve the event times of at least two signature verification events corresponding to the access key from the key field information; The latest event time among the event times of at least two signature verification events corresponding to the access key is determined as the event time query result; Determining the last usage time of the access key based on the event time query result includes: The latest event time among the event times of at least two signature verification events corresponding to the access key shall be taken as the last time the access key was used.

4. The method according to claim 2 or 3, wherein, Before retrieving the event time of the signature verification event from the key field information, the method further includes: Extract index field information from the key field information; The index field information is used as an index for the key field information and stored in association with the key field information in the elastic search cluster; The step of querying the event time of the signature verification event from the key field information includes: Using the elastic search cluster, query the event time of the signature verification event from the index field information.

5. The method according to any one of claims 2-4, wherein, The extraction of key field information from the event information parsed from the event log includes: Extract initial key field information from the event information parsed from the event log; The initial key field information is filtered to obtain key field information, so that the key field information is extracted from the event log of a signature verification event corresponding to the access key within a first preset time period.

6. The method according to any one of claims 1-5, wherein, After determining the last usage time of the access key based on the event log, the method further includes: For any given push time, the data to be pushed corresponding to that push time is sent to the target server, so that the target server stores the data to be pushed in the database.

7. The method according to claim 1, wherein, The preset conditions include at least one of the following: The slope of the pressure change curve at the target time is zero. The slope of the processing pressure change curve is greater than zero within a preset push cycle of the first number of consecutive targets before the position corresponding to the target time. The slope of the processing pressure change curve is less than zero within a preset push cycle of a second number of consecutive targets before the position corresponding to the target time.

8. The method according to claim 6 or 7, wherein before sending the data to be pushed to the target server, the method further comprises: If the push time is not determined within the second preset time period, the last usage time of the access key determined within the second preset time period is determined as the data to be pushed.

9. The method according to any one of claims 6-8, wherein after the target server stores the data to be pushed into the database, the last usage time of the access key stored in the database is output in any of the following ways: When a target user accesses the access key information display page, the last time the target user's access key was used is displayed on the access key information display page; In response to receiving a query request from the target user, the system returns the last time the target user's access key was used.

10. A device for determining the last used time of an access key, comprising: The event log acquisition module is used to acquire event logs of signature verification events within a preset monitoring period. The signature verification events are events used to verify the signature of access requests initiated by users. The access requests are signed by the user's access key. The last use time determination module is used to determine the last use time of the access key based on the event log; The data push module is used to determine the push time for pushing the corresponding data based on the changes in the processing pressure of the target server. The data to be pushed is the last usage time of the access key determined within the time period between the push time and the adjacent previous push time. The step of determining the push time for the corresponding data to be pushed based on the changes in the processing pressure of the target server includes: For any given preset push period, obtain the changes in the processing pressure of the target server within the previous preset push period adjacent to that preset push period; Based on the changes in processing pressure, a processing pressure change curve is determined, and a target time within the previous preset push cycle is determined. The processing pressure change curve corresponding to the target time satisfies a preset condition. The time corresponding to the target time within the preset push period is determined as the push time.

11. The apparatus according to claim 10, wherein, The module for determining the last usage time is specifically used for: Extract key field information from the event information parsed from the event log, including the event time of the signature verification event; The event time of the signature verification event is retrieved from the key field information to obtain the event time query result; The last time the access key was used is determined based on the event time query results.

12. The apparatus according to claim 11, wherein, The access key corresponds to at least two signature verification events. When the module determining the last used time queries the event time of the signature verification event from the key field information to obtain the event time query result, it is specifically used for: Retrieve the event times of at least two signature verification events corresponding to the access key from the key field information; The latest event time among the event times of at least two signature verification events corresponding to the access key is determined as the event time query result; When determining the last usage time based on the event time query result, the module for determining the last usage time of the access key is specifically used for: The latest event time among the event times of at least two signature verification events corresponding to the access key shall be taken as the last time the access key was used.

13. The apparatus according to claim 11 or 12, further comprising: The key field information storage module is used to extract index field information from the key field information, use the index field information as an index of the key field information, and store it in association with the key field information in the elastic search cluster; When the module for determining the last used time queries the event time of the signature verification event from the key field information, it is specifically used for: Using the elastic search cluster, query the event time of the signature verification event from the index field information.

14. The apparatus according to claim 12 or 13, wherein, The module for determining the last used time, when extracting key field information from the event information parsed from the event log, is specifically used for: Extract initial key field information from the event information parsed from the event log; The initial key field information is filtered to obtain key field information, so that the key field information is extracted from the event log of a signature verification event corresponding to the access key within a first preset time period.

15. The apparatus according to any one of claims 10-14, wherein the data push module is further configured to: For any given push time, the data to be pushed corresponding to that push time is sent to the target server, so that the target server stores the data to be pushed in the database.

16. The apparatus according to claim 10, wherein, The preset conditions include at least one of the following: The slope of the pressure change curve at the target time is zero. The slope of the processing pressure change curve is greater than zero within a preset push cycle of the first number of consecutive targets before the position corresponding to the target time. The slope of the processing pressure change curve is less than zero within a preset push cycle of a second number of consecutive targets before the position corresponding to the target time.

17. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-9.

18. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-9.

19. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-9.

Images