Resource access method, device, equipment and storage medium based on identity rules

Abstract

The present application provides a resource access method, apparatus, device and storage medium based on identity rules. It relates to the field of data processing technology. The method includes: receiving an access request from a user, determining the access request category of the access request; when the access request category is determined to be the first access request category, determining the first access request quantity threshold corresponding to the user; determining the access request quantity of all access requests of the user at the current moment, and when the access request quantity does not reach the first access request quantity threshold, obtaining the target resource corresponding to the access request and returning the target resource to the user. The present application determines the priority of the corresponding traffic by identifying the access request category of the user, and configures different access request quantities for traffic of different priorities, so that different access requests for traffic of different priorities can be processed simultaneously at the same time, thereby effectively preventing malicious traffic from maliciously occupying the access space of ordinary users to target resources.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a resource access method, apparatus, device, and storage medium based on identity rules. Background Art

[0002] Currently, malicious traffic, often exploited through high-performance machines or technical means, severely squeezes ordinary citizens' access to public welfare and public resources. Furthermore, when large amounts of data are accessed concurrently, services or interfaces often become unavailable due to the surge in requests, even triggering chain reactions that lead to system crashes. Current limiting is the primary technical solution to this problem. It typically involves waiting, queuing, downgrading, or even denying service when requests reach a certain concurrency or rate. Existing current limiting algorithms primarily include counters, funnels, and token buckets. However, these algorithms do not differentiate between user categories and cannot meet the need for customized traffic control for service recipients. Summary of the Invention

[0003] The present application provides a resource access method, apparatus, device and storage medium based on identity rules, which are used to solve the problem that the existing technology does not distinguish between user categories and cannot meet the demand for customized flow control of service objects.

[0004] In a first aspect of the present application, a resource access method based on identity rules is provided, comprising:

[0005] receiving an access request from a user, and determining an access request category of the access request;

[0006] In the case where it is determined that the access request category is the first access request category, determining a first access request quantity threshold corresponding to the user;

[0007] Determine the access request quantity of all access requests of the user at a current moment, and if the access request quantity does not reach the first access request quantity threshold, obtain the target resource corresponding to the access request and return the target resource to the user.

[0008] Optionally, the access request includes identity information of the user, and determining the access request category of the access request includes:

[0009] determining an access request category of the access request according to a preset access request category table, where the access request category includes a first access request category and a second access request category;

[0010] The access request category table at least includes access request categories corresponding to identity information of different users.

[0011] Optionally, the method further includes:

[0012] When it is determined that the access request category is the second access request category, the user's access request is filtered according to a preset first access control frequency, so that the user's access frequency to the target resource is lower than a first access frequency threshold.

[0013] Optionally, the method further includes:

[0014] If it is determined that there are other users' access requests to the target resource at the current moment, obtaining a threshold value of the number of access requests corresponding to the other users;

[0015] When the first access request quantity threshold corresponding to the user is the same as the access request quantity thresholds corresponding to other users, obtaining the access frequency of the user to the target resource and the access frequency of other users to the target resource;

[0016] When the difference between the user's access frequency to the target resource and other users' access frequencies to the target resource is greater than an access frequency difference threshold, the user's access request is filtered at a preset second access control frequency so that the user's access frequency to the target resource is lower than the second access frequency threshold.

[0017] Optionally, the access request category table further includes:

[0018] The access request quantity threshold corresponding to different identity information;

[0019] When the access request category corresponding to the user's identity information is a first access request category, the access request quantity threshold corresponding to the user's identity information is the first access request quantity threshold; when the access request category corresponding to the user's identity information is a second access request category, the access request quantity threshold corresponding to the user's identity information is the second access request quantity threshold;

[0020] Determining a first access request quantity threshold corresponding to the user includes:

[0021] Determining a first access request quantity threshold corresponding to the user according to the access request category table;

[0022] The second access request quantity threshold is smaller than a third access request quantity threshold, and the third access request quantity threshold is smaller than the first access request quantity threshold.

[0023] Optionally, determining the access request category of the access request further includes: if the access request does not include the identity information of the user, determining that the access request category is a second access request category; the method further includes:

[0024] When it is determined that the access request category is the second access request category, the preset access request quantity threshold is used as the second access request quantity threshold corresponding to the user, the preset access request quantity threshold is lower than the third access request quantity threshold, and the third access request quantity threshold is lower than the first access request quantity threshold.

[0025] Optionally, the method further includes:

[0026] When the number of access requests reaches the first access request number threshold, the access request is placed in a waiting queue until the number of access requests is less than the first access request number threshold, the target resource corresponding to the access request is obtained and the target resource is returned to the user.

[0027] Optionally, before determining the number of access requests of all access requests of the user at the current moment, the method further includes:

[0028] If it is determined that there are other users' access requests to the target resource at the current moment, obtaining a threshold value of the number of access requests corresponding to the other users;

[0029] In a case where the first access request quantity threshold corresponding to the user is greater than the access request quantity thresholds corresponding to other users, it is determined that the priority of the user is higher than the priorities of other users.

[0030] Optionally, obtaining a target resource corresponding to the access request includes:

[0031] Determining a resource category of a target resource corresponding to the access request;

[0032] Determine the number of occupied resources among other resources that belong to the same resource category as the target resource at a current moment, and acquire the target resource if the number of occupied resources is less than a resource occupation threshold.

[0033] A second aspect of the present application provides a resource access device based on identity rules, comprising:

[0034] an access request receiving module, configured to receive an access request from a user and determine an access request category of the access request;

[0035] an access request determination module configured to, when determining that the access request category is the first access request category, determine a first access request quantity threshold corresponding to the user; and determine the access request quantity of all access requests of the user at a current moment;

[0036] The resource acquisition module is configured to acquire the target resource corresponding to the access request and return the target resource to the user if the number of the access requests does not reach the first access request number threshold.

[0037] According to a third aspect of the present application, an electronic device is provided, comprising: a processor, and a memory communicatively connected to the processor;

[0038] The memory stores computer-executable instructions;

[0039] The processor executes the computer-executable instructions stored in the memory to implement the above method.

[0040] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to implement the above-mentioned method when executed by a processor.

[0041] In a fifth aspect of the present application, a computer program product is provided, comprising a computer program, which implements the above method when executed by a processor.

[0042] This application determines the priority of the corresponding traffic by identifying the user's access request category, and configures different numbers of access requests for traffic of different priorities, so that different access requests for traffic of different priorities can be processed simultaneously at the same time, thereby allocating corresponding traffic by identifying the user's identity, and effectively preventing malicious traffic from maliciously occupying the access space of ordinary users to target resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] Figure 1 A flowchart of a resource access method based on identity rules provided in an embodiment of the present application;

[0045] Figure 2 A logic diagram for processing access requests provided in an embodiment of the present application;

[0046] Figure 3 A schematic block diagram of an identity rule-based resource access device provided in an embodiment of the present application;

[0047] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0048] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0049] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0050] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indications will also change accordingly.

[0051] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0052] Rate limiting controls the traffic rate accessing a server's entry point, where traffic can be measured in terms of bandwidth, requests per second, or transactions per second. When facing surges in device connections or malicious traffic attacks, servers often experience service or interface unavailability due to the surge in requests, potentially triggering a chain reaction that leads to system crashes. Therefore, rate limiting plays a key role in ensuring the smooth operation of the system. When requests reach a certain concurrency or rate, access is processed through waiting, queuing, downgrading, or denial of service. Common rate limiting algorithms include counters, funnels, and token buckets, but none of these differentiate between user categories to control resource access.

[0053] At the same time, existing algorithms, such as counter algorithms, basically accumulate a counter per unit time. If a request exceeds the counter's allowed value, the request is intercepted. The counter is reset every time the time expires, resulting in dense access and an inability to differentiate traffic flows. Counter algorithms also have the following shortcomings: they cannot handle short periods of high concurrency. For example, if a large number of requests are received and processed within the first 10ms of a cycle, requests will be discarded in the second half of the cycle, a phenomenon known as "spikes." At the critical point between the old and new cycles, when instantaneous traffic exceeds the server's load capacity, counter current limiting can experience significant performance fluctuations for longer-term current limiting. Furthermore, they cannot meet the need for customized flow control for service objects, making it impossible to fine-tune access control.

[0054] In order to solve the above problems, we need to control the inbound traffic, maximize the fair access to public resources, and prevent malicious users from occupying bandwidth by using malicious techniques, such as Figure 1 As shown, in a first aspect of the present application, a resource access method based on identity rules is provided, comprising:

[0055] S100, receiving an access request from a user and determining an access request category of the access request;

[0056] S200: When the access request category is determined to be the first access request category, determine a first access request quantity threshold corresponding to the user;

[0057] S300: Determine the access request quantity of all access requests of the user at the current moment, and if the access request quantity does not reach a first access request quantity threshold, obtain a target resource corresponding to the access request and return the target resource to the user.

[0058] In this way, the present application determines the priority of the corresponding traffic by identifying the user's access request category, and configures different numbers of access requests for traffic of different priorities, so that traffic of different priorities can be processed simultaneously with different access requests at the same time, thereby allocating corresponding traffic through user identity identification, and effectively preventing malicious traffic from maliciously occupying the access space of ordinary users to target resources.

[0059] Specifically, after receiving a user's access request, the system first analyzes the request to determine whether characteristic information exists. If so, the system then retrieves the characteristic information. The characteristic information includes at least the user's identity, the target resource, and the target method to be called. It is understood that a target method is a set of instructions for executing a corresponding process on the target resource. In other words, normal traffic includes at least characteristic information such as the user's identity, the target resource, and the process to be performed on the target resource.

[0060] In step S100, if the user's identity information is obtained through the access request, the access request category of the access request is determined, including: determining the access request category of the access request based on a preset access request category table, where the access request category includes a first access request category and a second access request category; the access request category table includes at least access request categories corresponding to the identity information of different users.

[0061] The user's identity information may include information such as the user's IP address and login account. In this embodiment, the user's identity information includes at least the user's login account, and the traffic characteristics of the access request are identified through the user's login account. Specifically, a mapping relationship between the user's login account and its corresponding traffic characteristics is pre-established to generate an access request category table. In the access request category table, the traffic characteristics are characterized by the access request category. In this embodiment, if the access request category corresponding to the user's login account is the first access request category, it indicates that the user has normal traffic; if it is not the second access request category, it indicates that the user has malicious traffic. It is understandable that the access request category corresponding to the user's login account can be pre-determined based on the corresponding user's access behavior, or determined based on an existing blacklist or whitelist that includes the user's login account.

[0062] By obtaining the characteristic information of the inbound traffic in the access request for users with different traffic characteristics, the corresponding traffic control rules can be executed according to the characteristic information of the current user, thereby maximizing the fairness of service provision. In this embodiment, different weights are assigned to users with different traffic characteristics, that is, users with different access request categories, to allocate corresponding computing resources. Then, the access request category table also includes: access request quantity thresholds corresponding to different identity information; wherein, when the access request category corresponding to the user's identity information is the first access request category, the access request quantity threshold corresponding to the user's identity information is the first access request quantity threshold, and when the access request category corresponding to the user's identity information is the second access request category, the access request quantity threshold corresponding to the user's identity information is the second access request quantity threshold; in step S200, determining the first access request quantity threshold corresponding to the user includes: determining the first access request quantity threshold corresponding to the user according to the access request category table; the second access request quantity threshold is less than the third access request quantity threshold, and the third access request quantity threshold is less than the first access request quantity threshold.

[0063] The access request quantity threshold, or the weight corresponding to a user, can be represented by a digital resource ID. In the access request category table, a user's login account corresponds one-to-one with the access request category and the access request quantity threshold. For example, the corresponding relationship between a user's login account, access request category, and access request quantity threshold can be expressed as follows: (login account A, first access request category, 5), (login account B, first access request category, 3), (login account C, second access request category, 1). 5, 3, and 1 represent the access request quantity thresholds, or digital resource IDs, corresponding to users A, B, and C, respectively, indicating that the system allows user A to initiate five access requests simultaneously, user B to initiate three access requests simultaneously, and user C to initiate one access request simultaneously. By assigning different weights to different users and executing different traffic matching rules, fine-grained traffic control can be achieved. For example, if user A's digital resource ID is 1, the entire system will only process one request from user A simultaneously. Once one request is completed, the next request begins. If user B's digital resource ID is 10, the system can process all 10 of user B's requests simultaneously. Under the same conditions, user B enjoys 10 times the processing power of user A. When a user's access request category falls into the second access request category, and the traffic initiated by the current user is determined to be malicious, it is assigned a weight significantly lower than normal traffic to achieve flow control over malicious traffic.

[0064] It is understandable that users can have different weights in different business scenarios, so a login account can belong to multiple groups or its own unique group with the same name. In this case, the access request and access request category table also include the group information corresponding to the login account. When obtaining the user's digital resource id through the access request category table, it can be searched in the order of the groups. This is not limited here. For example, the access request includes: business scenario A, sub-business scenario A1, login account A and other information; the access request category table includes the correspondence between different business scenarios, sub-business scenarios, login accounts and digital resource ids. After receiving the access request, the corresponding digital resource id is searched from the access request category table in the order of business scenario A, sub-business scenario A1, and login account A, thereby achieving different traffic control for different business scenarios of the same user.

[0065] It is understandable that the correspondence between the user's login account and the access request quantity threshold can be stored in the access request category table or in a separate table, for example, in the access request quantity threshold table, which is not limited here.

[0066] The method of this embodiment further includes placing the access request in a waiting queue when the number of access requests reaches a first access request threshold, and then obtaining the target resource corresponding to the access request and returning the target resource to the user until the number of access requests falls below the first access request threshold. For example, if user A's digital resource ID is 5 and the number of all access requests from user A has reached 5 at the current moment or within the current access cycle, user A's next access request will be placed in a waiting queue and sorted by request time until an access request is processed. Only then will the next access request be processed.

[0067] Since some malicious traffic usually does not have identity information or deliberately hides identity information, it is difficult to determine the user's identity information through the access request. In this embodiment, determining the access request category of the access request also includes: when the access request does not include the user's identity information, determining the access request category to be a second access request category; the method also includes: when the access request category is determined to be the second access request category, using a preset access request quantity threshold as the second access request quantity threshold corresponding to the user, the preset access request quantity threshold is lower than the third access request quantity threshold, and the third access request quantity threshold is lower than the first access request quantity threshold.

[0068] If a user's access request does not contain the user's identity information, the traffic corresponding to the user is determined to be malicious traffic and the user is directly assigned the lowest weight. For example, the threshold number of access requests for the user, i.e., the digital resource ID, is assigned to 1. It is understood that if the traffic corresponding to the user is determined to be malicious traffic, a blacklist mechanism can also be used to directly filter out the user's access requests and not process them. In this embodiment, when a user accesses public resources, only malicious traffic is restricted to prevent it from occupying excessive bandwidth. Therefore, in this embodiment, the preset threshold number of access requests is set to 1.

[0069] In order to further control the flow of malicious traffic, the method of this embodiment also includes: when it is determined that the access request category is the second access request category, filtering the user's access request with a preset first access control frequency so that the user's access frequency to the target resource is lower than the first access frequency threshold.

[0070] Specifically, if the current user's access request is determined to be malicious traffic, the current user's access request is filtered using a preset frequency switch to implement frequency flow control of the resource. For example, the frequency switch is periodically set to 1 according to the resource frequency control table. For example, if there are 100 1 / 0 switches per second, this means that an average of 50 requests are allowed in 1 second and 50 requests are filtered out. In other words, 50 of the multiple operations by the same user will be correctly processed. Setting the frequency switch to 1 opens the processing entry, allowing access requests to be received, while setting the frequency switch to 0 closes the processing entry, preventing access requests from being received. Alternatively, the frequency switch can be set to 1 based on business needs, which is not limited here. In this way, by controlling the frequency switch to 1 periodically according to the resource frequency control table, it can ensure that each request is allowed to enter at a uniform rate. In this way, if malicious traffic initiates high-frequency malicious access, the frequency switch can be used to control the access frequency of the malicious traffic, effectively limiting the malicious bandwidth occupation by the malicious traffic. For normal traffic, frequency control is not enabled to control the flow of normal traffic.

[0071] In step S300, before determining the number of access requests for all access requests of the user at the current moment, the method further includes: if it is determined that other users have access requests to the target resource at the current moment, obtaining the access request number threshold corresponding to the other users; if the first access request number threshold corresponding to the user is greater than the access request number threshold corresponding to the other users, determining that the user's priority is higher than the priority of other users. At the same time or in the same access cycle, there may be multiple users accessing the target resource, and the system's processing capacity at the same time or in the same access cycle is generally limited. Therefore, when there are multiple users, the user's priority is determined based on the size of the user's digital resource ID. That is, the larger the user's digital resource ID, the higher the user's priority is determined. Therefore, at the same time or in the same access cycle, the request of the user with the higher priority is processed first. For example, the system's access request processing limit is 20. At the current moment, there are multiple requests from user A, user B, user C, and user D to access the target resource. The digital resource IDs of user A, user B, user C, and user D are 10, 5, 4, and 3 respectively. Then, the priority of user A, user B, user C, and user D is user A greater than user B, user B greater than user C, and user C greater than user D. When processing user requests, the system gives priority to user A's 10 requests, user B's 5 requests, user C's 4 requests, and user D's 1 request. At this time, the remaining 3 requests from user D will wait.

[0072] At the same time, when processing user access requests, there may be a situation where multiple users have the same weight. The method of this embodiment also includes: if it is determined that there are other users' access requests to the target resource at the current moment, obtaining the access request quantity threshold corresponding to other users; when the first access request quantity threshold corresponding to the user is the same as the access request quantity threshold corresponding to other users, obtaining the user's access frequency to the target resource and the access frequency of other users to the target resource; when the difference between the user's access frequency to the target resource and the access frequency of other users to the target resource is greater than the access frequency difference threshold, filtering the user's access request with a preset second access control frequency so that the user's access frequency to the target resource is lower than the second access frequency threshold.

[0073] Specifically, if multiple users, such as User A, User B, User C, and User D, simultaneously initiate access requests to the target resource at the same time or within the same access cycle, and the digital resource IDs of User A, User B, User C, and User D are 1, 1, 4, and 3, respectively, then User A and User B have the same weight. The access frequencies of User A and User B are then further obtained. If User A maliciously makes multiple batch requests, while User B manually initiates requests, User A will indirectly affect User B's access experience, as User B manually initiates significantly fewer requests than User A. To maximize fairness in user access to the target resource, User A's successful bid frequency can be reduced to mitigate this issue. For example, if User A's frequency is set to 6 I / O switches per second, even if User A makes batch requests, it will only have a maximum of 6 successful requests per second. This ensures that both vulnerable and advantaged groups are protected and that service requirements are met. It is understood that when controlling user frequency, the user's access frequency can be calculated based on the number of user requests obtained within a preset time period, or the access frequency of the target resource or method can be directly set. For example, for target resource A, the upper limit of its access frequency can be set to N times / second, or for target method A, the upper limit of its access frequency can be set to M times / second. Then, no matter how user A initiates batch access, as long as the access object in its access request is target resource A, or the target method to be called is target method A, the access frequency of user A will be limited by means of a frequency switch so that its access frequency does not exceed N times / second or M times / second.

[0074] In order to further optimize the frequency and flow control of resources, in this embodiment, obtaining the target resource corresponding to the access request includes: determining the resource category of the target resource corresponding to the access request; determining the number of occupied resources among other resources that belong to the same resource category as the target resource at the current moment, and obtaining the target resource when the number of occupied resources is less than the resource occupation threshold.

[0075] For the same type of resources, set the resource occupation threshold that is allowed to be occupied at the same time. For example, if it is set to 10, it means that the maximum number of resources allowed to be occupied at the same time is 10. Among them, the same type of resources can be different resources under the same category of resources, such as different resources in the same business scenario, or the same target resource, which is not limited here. When acquiring target resources, the system first obtains the resource occupation threshold and current resource id corresponding to the target resource from the resource frequency control table. For example, if the current resource id is 3, it means that the current target resources that can be occupied are 3, that is, the number of similar target resources currently occupied is 7, which is less than 10. At this time, the resource id is -1, and the resource id is updated to 2. The target resource is acquired and returned to the user. Before the access request processing is completed and the result is returned, the resource id is released, and the frequency flow control service is called, corresponding to resource id+1; if the current resource id is 0, it means that the current target resource that can be occupied is 0, that is, the number of similar target resources currently occupied is 10, then there are no resources that can be occupied at this time. At this time, the system will no longer accept new matching rule requests until there is a resource released, resource id+1 and the value is >0.

[0076] like Figure 2 As shown, the access request processing process of this embodiment is as follows: the system's request entry receives a user's access request and preprocesses the corresponding traffic. This preprocessing process includes parsing the access request, obtaining the user's identity information, and then, based on the user's identity information, obtaining the weight (i.e., the digital resource ID) corresponding to the user's access to the corresponding resource category using the traffic matching rule group table. The group resource allocation table is then used to determine whether the user's traffic characteristics are normal or malicious. The traffic matching rule group table and the group resource allocation table can be the same table, such as integrated into an access request category table, or they can be separate tables. Furthermore, the traffic preprocessing process also switches the request entry on and off at a preset frequency based on the resource frequency control table, thereby controlling malicious and high-frequency traffic. After the traffic preprocessing step, if the user request meets the conditions, the system assigns the user the corresponding group resources, that is, obtains the target resources, and the resource frequency and flow control module records and updates the resource occupancy, that is, updates the resource id. The business module calls the target method corresponding to the user request to process the target resources and return them to the user. After completing the processing of the target resources, the resource frequency and flow control module releases the corresponding group resources, updates the resource id, and controls the user's matching request based on whether the current resource id is greater than 0, thereby realizing the control of user access frequency and traffic.

[0077] like Figure 3 As shown, the second aspect of the present application provides a resource access device based on identity rules, comprising:

[0078] an access request receiving module, configured to receive an access request from a user and determine an access request category of the access request;

[0079] an access request determination module configured to, when determining that the access request category is the first access request category, determine a first access request quantity threshold corresponding to the user; and determine the access request quantity of all access requests of the user at a current moment;

[0080] The resource acquisition module is configured to acquire the target resource corresponding to the access request and return the target resource to the user when the number of access requests does not reach a first access request number threshold.

[0081] In some specific instances, the access request includes the user's identity information, and determining the access request category of the access request includes: determining the access request category of the access request based on a preset access request category table, where the access request category includes a first access request category and a second access request category; the access request category table at least includes access request categories corresponding to the identity information of different users.

[0082] In some specific instances, the access request determination module is further configured to: when determining that the access request category is the second access request category, filter the user's access request with a preset first access control frequency so that the user's access frequency to the target resource is lower than the first access frequency threshold.

[0083] In some specific instances, the access request determination module is further configured to: if it is determined that there are other users' access requests to the target resource at the current moment, obtain the access request quantity threshold corresponding to other users; when the first access request quantity threshold corresponding to the user is the same as the access request quantity threshold corresponding to other users, obtain the user's access frequency to the target resource and the access frequency of other users to the target resource; when the difference between the user's access frequency to the target resource and the access frequency of other users to the target resource is greater than the access frequency difference threshold, filter the user's access request with a preset second access control frequency so that the user's access frequency to the target resource is lower than the second access frequency threshold.

[0084] In some specific instances, the access request category table also includes: access request quantity thresholds corresponding to different identity information; wherein, when the access request category corresponding to the user's identity information is the first access request category, the access request quantity threshold corresponding to the user's identity information is the first access request quantity threshold, and when the access request category corresponding to the user's identity information is the second access request category, the access request quantity threshold corresponding to the user's identity information is the second access request quantity threshold; determining the first access request quantity threshold corresponding to the user includes: determining the first access request quantity threshold corresponding to the user based on the access request category table; the second access request quantity threshold is less than the third access request quantity threshold, and the third access request quantity threshold is less than the first access request quantity threshold.

[0085] In some specific instances, determining the access request category of an access request further includes: when the access request does not include the user's identity information, determining that the access request category is a second access request category; the access request determination module is further configured to: when the access request category is determined to be the second access request category, use a preset access request quantity threshold as the second access request quantity threshold corresponding to the user, the preset access request quantity threshold is lower than a third access request quantity threshold, and the third access request quantity threshold is lower than the first access request quantity threshold.

[0086] In some specific instances, the access request determination module is further configured to: when the number of access requests reaches a first access request number threshold, place the access request in a waiting queue until the number of access requests is less than the first access request number threshold, obtain the target resource corresponding to the access request and return the target resource to the user.

[0087] In some specific instances, before determining the access request number of all access requests of the user at the current moment, the access request determination module is further configured to: if it is determined that there are other users' access requests to the target resource at the current moment, obtain the access request number threshold corresponding to other users; and when the first access request number threshold corresponding to the user is greater than the access request number threshold corresponding to other users, determine that the user's priority is higher than the priority of other users.

[0088] In some specific instances, obtaining the target resource corresponding to the access request includes: determining the resource category of the target resource corresponding to the access request; determining the number of occupied resources among other resources that belong to the same resource category as the target resource at the current moment, and obtaining the target resource when the number of occupied resources is less than a resource occupation threshold.

[0089] The identity rule-based resource access device provided in the embodiment of the present application can be used to execute the technical solution of the identity rule-based resource access method in the above embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0090] It should be noted that it should be understood that the division of the various modules of the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into a physical entity, or they can be physically separated. Moreover, these modules can all be implemented in the form of software called by a processing element; or they can all be implemented in the form of hardware; or some modules can be implemented in the form of software called by a processing element, and some modules can be implemented in the form of hardware. For example, the data acquisition module can be a separately established processing element, or it can be integrated into a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called by a processing element of the above device to perform the functions of the above data acquisition module. The implementation of other modules is similar. In addition, these modules can all or partly be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed by hardware integrated logic circuits in the processor element or instructions in the form of software.

[0091] In a third aspect of the present application, an electronic device is provided, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; and the processor executes the computer-executable instructions stored in the memory to implement the above method.

[0092] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 4 As shown, the electronic device may include: a transceiver 121 , a processor 122 , and a memory 123 .

[0093] The processor 122 executes the computer-executable instructions stored in the memory, so that the processor 122 implements the solutions in the above embodiments. The processor 122 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0094] The memory 123 is connected to the processor 122 via a system bus and communicates with the processor 122. The memory 123 is used to store computer program instructions.

[0095] The transceiver 121 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.

[0096] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. System buses can be divided into address buses, data buses, and control buses. For ease of illustration, the diagram uses a single thick line, but this does not imply a single bus or type of bus. Transceivers facilitate communication between the database access device and other computers (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) or non-volatile memory.

[0097] The electronic device provided in the embodiment of the present application may be the terminal device of the above embodiment.

[0098] An embodiment of the present application also provides a chip for executing instructions, which is used to execute the technical solution of the task scheduling method in the above embodiment.

[0099] In a fourth aspect of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned method.

[0100] In a fifth aspect of the present application, a computer program product is provided, comprising a computer program, which implements the above method when executed by a processor.

[0101] In summary, the present application classifies and controls traffic by identifying user requests. For each access request, the corresponding release and discard rules are executed by monitoring the resource ID in the pre-processing stage. The control rules of the present application are based on traffic feature identification. According to the identity information corresponding to the traffic, the corresponding processing is performed on the request and how to release the request is determined. The request entrance can close a certain type of traffic at any time and no longer accept new requests, but only accept traffic that meets the rules. At the same time, by setting up a resource control table, the available digital resource ID of the corresponding traffic is configured to determine the traffic weight, that is, the number of requests allowed to be processed in the system at the same time. Access is controlled based on the digital resource ID. Each time a resource is released, an access request is released. If there are excess access requests, they are queued and waited, thereby protecting the stable operation of the system. The flow control of the present application is smooth and simple, with fine granularity, and the traffic acceptance weight is configurable. It can effectively ensure the fairness of resource access. The processing frequency can be set for unidentified malicious traffic and traffic without identity to reduce the success rate of malicious traffic. At the same time, traffic control can be performed for specific objects.

[0102] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0103] It should be understood that the present application is not limited to the exact structure described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A resource access method based on identity rules, characterized in that: include: receiving an access request from a user, and if the access request includes the user's identity information, determining an access request category of the access request according to a preset access request category table, wherein the access request category table includes at least access request categories corresponding to the identity information of different users, the access request categories including a first access request category and a second access request category; if the access request does not include the user's identity information, determining the access request category to be the second access request category; In the case where it is determined that the access request category is the first access request category, determining a first access request quantity threshold corresponding to the user; determining the number of access requests of all access requests of the user at a current moment, and if the number of access requests does not reach the first access request number threshold, obtaining a target resource corresponding to the access request and returning the target resource to the user; When it is determined that the access request category is the second access request category, the user's access request is filtered according to a preset first access control frequency, so that the user's access frequency to the target resource is lower than a first access frequency threshold.

2. The resource access method based on identity rules according to claim 1, characterized in that: The method further comprises: If it is determined that there are other users' access requests to the target resource at the current moment, obtaining a threshold value of the number of access requests corresponding to the other users; When the first access request quantity threshold corresponding to the user is the same as the access request quantity thresholds corresponding to other users, obtaining the access frequency of the user to the target resource and the access frequency of other users to the target resource; When the difference between the user's access frequency to the target resource and other users' access frequencies to the target resource is greater than an access frequency difference threshold, the user's access request is filtered at a preset second access control frequency so that the user's access frequency to the target resource is lower than the second access frequency threshold.

3. The resource access method based on identity rules according to claim 1, characterized in that: The access request category table also includes: The access request quantity threshold corresponding to different identity information; When the access request category corresponding to the user's identity information is a first access request category, the access request quantity threshold corresponding to the user's identity information is the first access request quantity threshold; when the access request category corresponding to the user's identity information is a second access request category, the access request quantity threshold corresponding to the user's identity information is the second access request quantity threshold; Determining a first access request quantity threshold corresponding to the user includes: Determining a first access request quantity threshold corresponding to the user according to the access request category table; The second access request quantity threshold is smaller than a third access request quantity threshold, and the third access request quantity threshold is smaller than the first access request quantity threshold.

4. The resource access method based on identity rules according to claim 1, characterized in that: The method further comprises: When it is determined that the access request category is the second access request category, the preset access request quantity threshold is used as the second access request quantity threshold corresponding to the user, the preset access request quantity threshold is lower than the third access request quantity threshold, and the third access request quantity threshold is lower than the first access request quantity threshold.

5. The resource access method based on identity rules according to claim 1, characterized in that: The method further comprises: When the number of access requests reaches the first access request number threshold, the access request is placed in a waiting queue until the number of access requests is less than the first access request number threshold, the target resource corresponding to the access request is obtained and the target resource is returned to the user.

6. The resource access method based on identity rules according to claim 1, characterized in that: Before determining the number of access requests of all access requests of the user at the current moment, the method further includes: If it is determined that there are other users' access requests to the target resource at the current moment, obtaining a threshold value of the number of access requests corresponding to the other users; In a case where the first access request quantity threshold corresponding to the user is greater than the access request quantity thresholds corresponding to other users, it is determined that the priority of the user is higher than the priorities of other users.

7. The resource access method based on identity rules according to claim 1, characterized in that: Obtaining the target resource corresponding to the access request includes: Determining a resource category of a target resource corresponding to the access request; Determine the number of occupied resources among other resources that belong to the same resource category as the target resource at a current moment, and acquire the target resource if the number of occupied resources is less than a resource occupation threshold.

8. A resource access device based on identity rules, characterized in that: include: an access request receiving module configured to receive an access request from a user, and if the access request includes the user's identity information, determine an access request category of the access request based on a preset access request category table, wherein the access request category table includes at least access request categories corresponding to the identity information of different users, the access request categories including a first access request category and a second access request category; and if the access request does not include the user's identity information, determine the access request category to be the second access request category; an access request determination module configured to, when determining that the access request category is the first access request category, determine a first access request quantity threshold corresponding to the user; and determining the access request count of all access requests of the user at the current moment; a resource acquisition module configured to, if the number of access requests does not reach the first access request number threshold, acquire a target resource corresponding to the access request and return the target resource to the user; The access request determination module is further configured to, when determining that the access request category is the second access request category, filter the user's access request with a preset first access control frequency so that the user's access frequency to the target resource is lower than a first access frequency threshold.

9. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images