Whitelist processing method and device, and electronic equipment

Abstract

This invention discloses a whitelist processing method, apparatus, and electronic device. Relating to the field of artificial intelligence, the method includes: acquiring the whitelist used by each target application in a target unit, resulting in multiple whitelists, wherein the whitelists include information on objects allowed to access the current target application, and the target unit consists of multiple canary servers corresponding to the target applications; determining a target whitelist based on the business type of the target service and the multiple whitelists; filtering traffic accessing the target service based on the target whitelist to obtain target traffic, and routing the target traffic to the target unit. This invention solves the technical problem of low application efficiency caused by different applications using different whitelists in the same business scenario during canary releases of related technologies.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, and more specifically, to a whitelist processing method, apparatus, and electronic device. Background Technology

[0002] With the implementation of IT architecture transformation, unitized operations and maintenance (O&M) is of paramount importance for improving the O&M system. Unitized architecture is an increasingly popular enterprise application deployment architecture in the internet industry. This architecture targets a group of users, deploying their main business services cohesively within a single deployment unit. This allows customer transaction-related traffic to complete a closed loop within the unit to the greatest extent possible, significantly reducing unnecessary cross-unit and cross-campus access. It effectively controls the fault blast radius in regional failure scenarios, improves switching flexibility while reducing switching granularity, effectively overcomes network latency losses caused by data center distance, and significantly enhances the application's adaptability to the data center's location. The wider the scope of business covered by the unitized architecture, the larger the transaction volume that can be closed loop within the unit, and the more significant the benefits in fault isolation and emergency switching.

[0003] Canary releases are widely used in IT operations and maintenance to enable rapid application deployment, and application whitelists play an irreplaceable role in canary releases. In unitized environments involving long data chains across multiple applications, each application implements and manages its own whitelist, resulting in low efficiency, complex and chaotic data chains, difficulties in switching configurations and management, and a significant increase in operational complexity.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a whitelist processing method, apparatus, and electronic device to at least solve the technical problem of low application efficiency caused by different applications using different whitelists in the same business scenario during the gray-scale release of related technologies.

[0006] According to one aspect of the present invention, a whitelist processing method is provided, wherein multiple target applications corresponding to a target service adopt a unitized architecture, including: obtaining a whitelist used by each target application in a target unit to obtain multiple whitelists, wherein the whitelists include information on objects allowed to access the current target application, and the target unit is composed of grayscale servers corresponding to multiple target applications; determining a target whitelist based on the service type of the target service and the multiple whitelists; filtering traffic accessing the target service based on the target whitelist to obtain target traffic, and routing the target traffic to the target unit.

[0007] Furthermore, the whitelist processing method also includes: converting the format of the object identifier contained in each whitelist to obtain at least one object identifier to be processed, and determining the converted whitelist based on at least one object identifier to be processed; and determining the target whitelist based on the business type of the target business and the converted whitelist.

[0008] Furthermore, the whitelist processing method also includes: determining target filtering rules based on the business type of the target business; determining at least one target object identifier based on the target filtering rules and the converted whitelist; and determining the target whitelist based on at least one target object identifier.

[0009] Furthermore, the whitelist processing method also includes at least one of the following: taking the union of the object identifiers to be processed contained in multiple transformed whitelists; taking the intersection of the object identifiers to be processed contained in multiple transformed whitelists; obtaining the priority value corresponding to each object identifier to be processed, and filtering at least one object identifier to be processed based on the priority value, wherein the priority value represents the importance of the object corresponding to the object identifier to be processed to the target business.

[0010] Furthermore, the whitelist processing method also includes: determining a target threshold based on a first target data volume and a preset threshold, wherein the first target data volume is the data volume corresponding to the traffic received by the target unit within a target time range, and the maximum time length of the target time range from the current time is less than the target time length; and determining the object identifier to be processed corresponding to the priority value less than the target threshold as the target object identifier.

[0011] Furthermore, the whitelist processing method also includes any one of the following: determining a target threshold based on a first threshold, a first target data volume, and a second target data volume, wherein the second target data volume is the data volume corresponding to the highest traffic allowed to be received by the target unit within a preset time range, and the preset threshold includes the first threshold and the second threshold, with the second threshold being greater than the first threshold; determining a target threshold based on the second threshold and the first target data volume; or determining a target threshold based on the first threshold, the second threshold, the first target data volume, and the second target data volume.

[0012] Furthermore, the whitelist processing method also includes: setting a target label for the target traffic to obtain the processed target traffic; and routing the processed target traffic to the target unit.

[0013] According to another aspect of the present invention, a whitelist processing apparatus is also provided, comprising: an acquisition module, configured to acquire a whitelist used by each target application in a target unit to obtain multiple whitelists, wherein the whitelists include information on objects allowed to access the current target application, and the target unit consists of multiple grayscale servers corresponding to the target applications; a determination module, configured to determine a target whitelist based on the service type of the target service and the multiple whitelists; and a processing module, configured to filter traffic accessing the target service based on the target whitelist to obtain target traffic, and route the target traffic to the target unit.

[0014] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described whitelist processing method when running.

[0015] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the whitelist processing method described above when running.

[0016] In this embodiment of the invention, a unified whitelist approach is used to check traffic entering the target unit. Multiple whitelists are obtained by acquiring the whitelist used by each target application within the target unit. Then, based on the service type of the target service and the multiple whitelists, a target whitelist is determined. Traffic accessing the target service is then filtered based on the target whitelist to obtain the target traffic, which is then routed to the target unit. The whitelist includes information about objects allowed to access the current target application, and the target unit consists of multiple grayscale servers corresponding to the target applications.

[0017] In the above process, because in related technologies, different target applications within the same unit (i.e., the same data link dimension) have their own whitelists and check traffic accessing themselves using their respective whitelists, determining the target whitelist based on the business type of the target service and the whitelists corresponding to each target application achieves uniformity in the whitelists used by various applications corresponding to the target service. This means that objects recorded in the target whitelist can access all applications within the target unit. Furthermore, before traffic accessing the target service enters the target unit, it is filtered using the target whitelist, avoiding the need for each application in the target unit to perform whitelist checks. This achieves a single calculation to check the entire data link of the target unit, thereby reducing the operational steps for each application and improving the work efficiency of each application.

[0018] Therefore, the solution provided in this application achieves the goal of using a unified whitelist to check traffic entering the target unit, thereby improving the technical effect of application efficiency. It also solves the technical problem of low application efficiency caused by different whitelists used by different applications in the same business scenario during canary release of related technologies. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0020] Figure 1 This is a schematic diagram of an optional whitelist processing method according to an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of an optional whitelist processing method according to an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of an optional whitelist processing method according to an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of an optional whitelist processing apparatus according to an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0028] Unit: The deployment unit of the unitized application service product layer refers to a self-contained set that can complete all business operations. This set contains all the services required by all businesses, as well as the data allocated to this unit.

[0029] Unitized architecture: The unit is used as the basic unit of deployment. Multiple units are deployed in all data centers across the entire site. The number of units in each data center is not fixed. Each unit deploys all the applications required by the system, and the data is a part of the full data after being divided according to a certain dimension.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0031] Example 1

[0032] According to an embodiment of the present invention, an embodiment of a whitelist processing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] Figure 1 This is a schematic diagram of an optional whitelist processing method according to an embodiment of the present invention, such as... Figure 1 As shown, the method employs a unitized architecture for multiple target applications corresponding to the target business, including the following steps:

[0034] Step S101: Obtain the whitelist used by each target application in the target unit, resulting in multiple whitelists. The whitelists include information about objects that are allowed to access the current target application. The target unit consists of multiple grayscale servers corresponding to the target applications.

[0035] Optionally, this invention provides intelligent algorithmic unified management of different whitelists for long-link interactions involving multiple applications within a unitized architecture. Specifically, the aforementioned unitized architecture will first be described. A unitized architecture uses units as the basic deployment unit, deploying multiple units across all data centers. Each data center can contain one or more units. In other words, all servers within a data center can be considered as one unit, or all servers within a data center can be divided into multiple units. Each unit deploys all applications required for the relevant business, and the data is a portion of the total data divided according to a certain dimension. In simpler terms, the applications deployed in each unit are identical, each unit has the capability to complete the relevant business, and during runtime, each unit only handles a portion of the overall business traffic.

[0036] In step S101, the whitelist used by each target application in the target unit can be obtained through devices such as electronic devices, servers, and application systems. In this embodiment, the whitelist used by each target application in the target unit is obtained through a whitelist processing system. Optionally, the aforementioned target service can be processed based on multiple data centers, each of which deploys multiple applications corresponding to the target service. Each data center can be considered as a unit, with each unit handling a portion of the target service's traffic, and different units handling different portions of the target service's traffic. The whitelist includes information about objects allowed to access the current target application. The object information includes at least the object's identifier, which is used to characterize the object's identity.

[0037] Optionally, in related technologies, within the same unit (i.e., the same data link dimension), different target applications each have their own whitelists, and each checks its own traffic using its own whitelist. Therefore, the whitelist processing system can obtain the whitelist used by each target application within that target unit. Here, the target unit is a gray-scale unit among multiple units corresponding to the target service. The target unit consists of gray-scale servers corresponding to multiple target applications, i.e., servers deploying gray-scale versions of multiple target applications. These servers handle traffic from gray-scale users of the target service for gray-scale testing, enabling rapid deployment of new versions of the target application. The relevant information of the gray-scale users is recorded in the aforementioned whitelist. It should be noted that a target service can correspond to multiple gray-scale units, and the target unit can be any one of these gray-scale units. Furthermore, this application can also be applied to other scenarios that require user whitelists, not just gray-scale deployment scenarios. That is, depending on the actual scenario, the aforementioned target unit can also be a non-gray-scale unit.

[0038] Step S102: Determine the target whitelist based on the business type of the target business and multiple whitelists.

[0039] In step S102, the whitelist processing system can determine the corresponding intelligent policy algorithm based on the business type of the target business to filter objects recorded in multiple whitelists, obtaining filtered objects. Based on these filtered objects, a target whitelist is determined. The target whitelist includes information about objects allowed to access multiple target applications within the target unit; that is, objects recorded in the target whitelist can access all applications within the target unit. The aforementioned intelligent policy algorithm can either take the union or intersection of objects recorded in multiple whitelists to generate a static whitelist, or it can filter objects recorded in multiple whitelists based on traffic monitoring within the unit to generate a dynamically adjusted whitelist.

[0040] It should be noted that by determining the target whitelist based on the business type of the target business and multiple whitelists, the whitelist used by various applications corresponding to the target business is unified.

[0041] Step S103: Filter traffic accessing the target service based on the target whitelist to obtain the target traffic, and route the target traffic to the target unit.

[0042] In step S103, after the target whitelist is determined, as follows: Figure 2As shown, the whitelist processing system can perform checks at the traffic entry point of the target unit based on the target whitelist to filter traffic accessing the target service, obtain the target traffic, and then route the target traffic to the target unit, realizing the canary server forwarding function in canary release. The target traffic consists of access requests initiated by objects recorded in the target whitelist.

[0043] It should be noted that since the objects recorded in the target whitelist can access all applications in the target unit, by filtering the traffic accessing the target business through the target whitelist before it enters the target unit, the operation of whitelist checking for each application in the target unit is avoided. This reduces the operation steps for each application, improves the work efficiency of each application, and realizes a one-time check of the entire data link of the target unit through a single calculation.

[0044] Based on the scheme defined in steps S101 to S103 above, it can be understood that in this embodiment of the invention, a unified whitelist is used to check traffic entering the target unit. Multiple whitelists are obtained by acquiring the whitelist used by each target application in the target unit. Then, based on the service type of the target service and the multiple whitelists, a target whitelist is determined. Traffic accessing the target service is then filtered based on the target whitelist to obtain the target traffic, which is then routed to the target unit. The whitelist includes information about objects allowed to access the current target application, and the target unit consists of multiple grayscale servers corresponding to the target applications.

[0045] It is noteworthy that in the above process, because in related technologies, different target applications within the same unit (i.e., the same data link dimension) have their own whitelists and check traffic accessing themselves using their respective whitelists, determining the target whitelist based on the business type of the target service and the whitelists corresponding to each target application achieves uniformity in the whitelists used by various applications corresponding to the target service. This means that objects recorded in the target whitelist can access all applications within the target unit. Furthermore, before traffic accessing the target service enters the target unit, it is filtered using the target whitelist, avoiding the need for each application in the target unit to perform whitelist checks. This achieves a single calculation to check the entire data link of the target unit, thereby reducing the operational steps for each application and improving the efficiency of each application.

[0046] Therefore, the solution provided in this application achieves the goal of using a unified whitelist to check traffic entering the target unit, thereby improving the technical effect of application efficiency. It also solves the technical problem of low application efficiency caused by different whitelists used by different applications in the same business scenario during canary release of related technologies.

[0047] In one optional embodiment, during the process of determining the target whitelist based on the business type of the target business and multiple whitelists, the whitelist processing system can perform format conversion on the object identifier contained in each whitelist to obtain at least one object identifier to be processed, and determine the converted whitelist based on at least one object identifier to be processed, and then determine the target whitelist based on the business type of the target business and the converted whitelist.

[0048] Optionally, since different applications originally have different whitelist formats, that is, the types of object identifiers included in the whitelists are different (e.g., customer ID and IP address, application account, etc.), therefore, if... Figure 2 As shown, after obtaining the whitelist used by each target application in the target unit, the first step is to unify the different forms of whitelists. Specifically, since the routing and forwarding function in the unitized scenario is mainly based on the form of customer codes, all whitelists from different applications are converted to customer codes. For example, if a whitelist is for a certain application account, a fast matching calculation can be performed using a HashMap (hash mapping) based on the relevant application (e.g., unified authentication number application and personal customer information application) to obtain the customer code (i.e., the aforementioned object identifier to be processed). Based on the queried customer code, a new whitelist (i.e., the aforementioned converted whitelist) is determined, and the converted whitelist is placed into the relevant cache application of the whitelist processing system (e.g., Redis (Remote Dictionary Server)). The aforementioned relevant application is at least used to determine the correspondence between customer codes and other forms of customer identifiers.

[0049] Furthermore, the target whitelist can be determined based on the business type of the target business and the converted whitelist.

[0050] It should be noted that since different applications use different whitelist formats, by first converting the format of the data in the whitelist and then determining the target whitelist based on the unified format whitelist, data redundancy caused by different identifiers of the same user appearing in the target whitelist at the same time is avoided. At the same time, it facilitates the subsequent use of the target whitelist, thereby further improving work efficiency.

[0051] In an optional embodiment, during the process of determining the target whitelist based on the business type of the target business and the converted whitelist, the whitelist processing system can determine the target filtering rules based on the business type of the target business, and then determine at least one target object identifier based on the target filtering rules and the converted whitelist, thereby determining the target whitelist based on at least one target object identifier.

[0052] Optional, such as Figure 2 As shown, the whitelist processing system can have multiple pre-set filtering rules (i.e., the aforementioned intelligent strategy algorithm), and different filtering rules correspond to different business types. Based on the business type of the target business, the whitelist processing system can determine the target filtering rule corresponding to the target business from among the multiple filtering rules. Then, based on the target filtering rule, it can determine at least one target object identifier from the pending object identifiers included in the converted whitelist, and finally, based on at least one target object identifier, determine the target whitelist. Multiple filtering rules can be managed using the Strategy Manager within the whitelist processing system.

[0053] It should be noted that by determining the target screening rules based on the business type of the target business, and then determining the target whitelist, the whitelists for different business applications can be processed in a targeted manner, thereby improving the accuracy of the target whitelist determination in this application.

[0054] In one optional embodiment, the target filtering rule includes at least one of the following: taking the union of the object identifiers to be processed contained in multiple converted whitelists; taking the intersection of the object identifiers to be processed contained in multiple converted whitelists; obtaining the priority value corresponding to each object identifier to be processed, and filtering at least one object identifier to be processed based on the priority value, wherein the priority value characterizes the importance of the object corresponding to the object identifier to the target business.

[0055] Optionally, depending on the business scenario, the target filtering rules may include only one type of rule mentioned above, or they may include multiple types of rules mentioned above. When the target filtering rules include multiple types of rules mentioned above, the usage time of each type of rule will also vary depending on the business scenario.

[0056] Optionally, the target whitelist can be divided into two types: static whitelist and dynamic whitelist. A static whitelist (type 1) is obtained by taking the union of the object identifiers to be processed contained in multiple transformed whitelists. A static whitelist (type 2) is obtained by taking the union of the object identifiers to be processed contained in multiple transformed whitelists. A third type of static whitelist or dynamic whitelist is obtained by obtaining the priority value corresponding to each object identifier to be processed and filtering at least one object identifier based on the priority value.

[0057] Specifically, the process of obtaining the priority value corresponding to each object identifier to be processed and filtering at least one object identifier to be processed based on the priority value is described in detail. Optionally, the whitelist processing system can pre-set the correspondence between each user identifier (i.e., the aforementioned object identifier) ​​and the priority value. For example, for financial institutions, VIP customers are set with low priority values, ordinary customers are set with relatively high priority values, and customers who do not belong to any application whitelist are directly set with priority values ​​greater than the relevant threshold. Further, after obtaining the priority value corresponding to each object identifier to be processed, the whitelist processing system can compare the priority value corresponding to each object identifier to be processed with the relevant threshold and filter at least one object identifier to be processed based on the comparison result. For example, object identifiers with priority values ​​lower than the relevant threshold are determined as target object identifiers, and object identifiers with priority values ​​greater than or equal to the relevant threshold are determined as non-target object identifiers. The aforementioned relevant threshold can be fixed or dynamically adjusted. Optionally, the relevant threshold can be dynamically adjusted according to traffic monitoring within the target unit.

[0058] It should be noted that by setting multiple rules, the methods for determining the target whitelist are enriched, thereby improving the applicability of this application.

[0059] In one alternative embodiment, during the process of filtering at least one object identifier to be processed based on a priority value, such as Figure 3 As shown, it includes the following steps:

[0060] Step S301: Determine the target threshold based on the first target data volume and the preset threshold. The first target data volume is the amount of data received by the target unit within the target time range, and the maximum time length between the target time range and the current time is less than the target time length.

[0061] Optionally, in step S301, as follows Figure 2As shown, the whitelist processing system can monitor traffic entering the target unit in real time and determine the amount of data received by the target unit in each time period, where the time lengths of different time periods are the same. Within the current time period, the whitelist processing system can use a relevant mathematical model to determine the target threshold based on the traffic in the previous time period and a preset threshold, thereby achieving dynamic threshold determination. The traffic in the previous time period is the aforementioned first target data volume, and the target threshold and the first target data volume are inversely correlated; that is, the higher the first target data volume, the lower the target threshold. It should be noted that by calculating the target threshold and the first target data volume using an inverse correlation algorithm, when the traffic in the previous time period is higher, the number of pending object identifiers that meet the threshold in the current time period is less. Therefore, the traffic added to the whitelist is smaller, thus avoiding the unmanageable phenomenon of forwarding a large amount of traffic to the target unit before it has finished processing the traffic in the previous time period, thereby achieving effective rate limiting.

[0062] Step S302: Determine the object identifier to be processed corresponding to the priority value that is less than the target threshold as the target object identifier.

[0063] Optionally, in step S302, the whitelist processing system can determine the object identifier to be processed corresponding to the priority value less than the target threshold as the target object identifier, and can determine the target whitelist based on the target object identifier, and then put the target whitelist into the cache application Redis, so as to facilitate rapid updates according to traffic changes, and provide subsequent inspection services.

[0064] It should be noted that by combining the traffic situation within the target unit, different whitelists for multiple applications can be managed uniformly through relevant rules, and a unified whitelist can be dynamically generated. This enables intelligent rate limiting, which can quickly achieve emergency control and is conducive to intelligent operation and maintenance management.

[0065] In one optional embodiment, the method for determining a target threshold based on a first target data volume and a preset threshold includes any one of the following: determining a target threshold based on a first threshold, a first target data volume, and a second target data volume, wherein the second target data volume is the data volume corresponding to the highest traffic allowed to be received by the target unit within a preset time range, and the preset threshold includes a first threshold and a second threshold, wherein the second threshold is greater than the first threshold; determining a target threshold based on the second threshold and the first target data volume; and determining a target threshold based on the first threshold, the second threshold, the first target data volume, and the second target data volume.

[0066] Optionally, different methods can be used to calculate the dynamic target threshold, such as the lower limit valuation method, the upper limit valuation method, the upper and lower limit ratio valuation method, and the average value valuation method. Specifically, the whitelist processing system can determine different methods for determining the target threshold based on different business types.

[0067] Specifically, the lower bound valuation method can be implemented based on the following formula:

[0068] A(t)=a*Lowest*trafficMonitor(highest) / trafficMonitor(t-1)

[0069] Where A(t) represents the target threshold corresponding to the current time period, a represents the preset first coefficient, Lowest represents the minimum threshold of the whitelist (i.e., the aforementioned first threshold), trafficMonitor(highest) represents the highest traffic that the system load test target unit can meet for external services (i.e., the aforementioned second target data volume), and trafficMonitor(t-1) represents the first target data volume. The first threshold can be determined based on the priority value corresponding to the object with the highest importance to the target business.

[0070] The upper limit valuation method can be implemented based on the following formula:

[0071] B(t)=Highest-b*trafficMonitor(t-1)

[0072] Where B(t) represents the target threshold corresponding to the current time period, b represents the preset second coefficient, and Highest represents the highest threshold of the whitelist (i.e., the aforementioned second threshold).

[0073] The upper and lower limit valuation method can be implemented based on the following formula:

[0074] C(t)=c*Highest*trafficMonitor(t-1)+d*Lowest*trafficMonitor(highest) / trafficMonitor(t-1)

[0075] Where C(t) represents the target threshold corresponding to the current time period, c represents the preset third coefficient, and represents the preset fourth coefficient.

[0076] It should be noted that by setting different methods for determining the target threshold, the methods for determining the target whitelist are further enriched, thereby further improving the applicability of this application.

[0077] In one alternative embodiment, during the process of routing target traffic to the target unit, the whitelist processing system can set a target label on the target traffic to obtain the processed target traffic, thereby routing the processed target traffic to the target unit.

[0078] Optionally, once the whitelist processing system identifies the target traffic, it can tag the target traffic with a target label and forward the processed target traffic to the target unit. The grayscale server in the target unit can identify the target traffic based on the target label on the target traffic, thereby skipping the check on the target traffic and improving the processing efficiency of the application. The aforementioned target label can be a grayscale label, a traffic allowance label, or other labels.

[0079] It should be noted that the present invention can also be applied to other non-unitized scenarios, and unitized scenarios are only preferred embodiments of the present invention.

[0080] Therefore, the solution provided in this application achieves the goal of using a unified whitelist to check traffic entering the target unit, thereby improving the technical effect of application efficiency. It also solves the technical problem of low application efficiency caused by different whitelists used by different applications in the same business scenario during canary release of related technologies.

[0081] Example 2

[0082] According to an embodiment of the present invention, a whitelist processing apparatus is provided, wherein multiple target applications corresponding to a target service adopt a unitized architecture. Figure 4 This is a schematic diagram of an optional whitelist processing apparatus according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0083] The acquisition module 401 is used to acquire the whitelist used by each target application in the target unit, and obtain multiple whitelists. The whitelists include information on objects that are allowed to access the current target application. The target unit consists of multiple grayscale servers corresponding to the target applications.

[0084] Module 402 is used to determine the target whitelist based on the business type of the target business and multiple whitelists.

[0085] Processing module 403 is used to filter traffic accessing the target service based on the target whitelist, obtain the target traffic, and route the target traffic to the target unit.

[0086] It should be noted that the above-mentioned acquisition module 401, determination module 402 and processing module 403 correspond to steps S401 to S403 in the above embodiments. The three modules are the same as the examples and application scenarios implemented by the corresponding steps S101 to S103, but are not limited to the content disclosed in the above embodiment 1.

[0087] Optionally, the determining module further includes: a conversion submodule, used to convert the format of the object identifier contained in each whitelist to obtain at least one object identifier to be processed, and to determine the converted whitelist based on at least one object identifier to be processed; and a determining submodule, used to determine the target whitelist based on the business type of the target business and the converted whitelist.

[0088] Optionally, the determination submodule further includes: a first determination unit, used to determine target filtering rules based on the business type of the target business; a second determination unit, used to determine at least one target object identifier based on the target filtering rules and the converted whitelist; and a third determination unit, used to determine the target whitelist based on at least one target object identifier.

[0089] Optionally, the target filtering rules include at least one of the following: taking the union of the object identifiers to be processed contained in multiple transformed whitelists; taking the intersection of the object identifiers to be processed contained in multiple transformed whitelists; obtaining the priority value corresponding to each object identifier to be processed, and filtering at least one object identifier to be processed based on the priority value, wherein the priority value represents the importance of the object corresponding to the object identifier to the target business.

[0090] Optionally, filtering at least one object identifier to be processed based on a priority value includes: determining a target threshold based on a first target data volume and a preset threshold, wherein the first target data volume is the data volume corresponding to the traffic received by the target unit within a target time range, and the maximum time length of the target time range from the current time is less than the target time length; and determining the object identifier to be processed corresponding to a priority value less than the target threshold as the target object identifier.

[0091] Optionally, the method for determining the target threshold based on the first target data volume and the preset threshold includes any one of the following: determining the target threshold based on the first threshold, the first target data volume, and the second target data volume, wherein the second target data volume is the data volume corresponding to the highest traffic allowed to be received by the target unit within a preset time range, and the preset threshold includes the first threshold and the second threshold, wherein the second threshold is greater than the first threshold; determining the target threshold based on the second threshold and the first target data volume; or determining the target threshold based on the first threshold, the second threshold, the first target data volume, and the second target data volume.

[0092] Optionally, the processing module further includes: a setting submodule for setting target labels on target traffic to obtain processed target traffic; and a processing submodule for routing the processed target traffic to the target unit.

[0093] Example 3

[0094] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described whitelist processing method at runtime.

[0095] Example 4

[0096] According to another aspect of the present invention, an electronic device is also provided, wherein, Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as... Figure 5 As shown, the electronic device includes one or more processors; and a memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement a method for running the programs, wherein the programs are configured to execute the whitelist processing method described above during runtime.

[0097] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0098] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0099] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0100] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0101] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0102] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0103] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for processing a whitelist, characterized in that, The multiple target applications corresponding to the target business adopt a unitized architecture, including: Obtain the whitelist used by each target application in the target unit to obtain multiple whitelists, wherein the whitelists include information on objects that are allowed to access the current target application, and the target unit is composed of grayscale servers corresponding to the multiple target applications; Based on the business type of the target business and multiple whitelists, a target whitelist is determined, including: converting the format of the object identifier contained in each whitelist to obtain at least one object identifier to be processed, and determining the converted whitelist based on the at least one object identifier to be processed; and determining the target whitelist based on the business type of the target business and the converted whitelist. The process of determining the target whitelist based on the business type of the target business and the converted whitelist includes: determining target filtering rules based on the business type of the target business; determining at least one target object identifier based on the target filtering rules and the converted whitelist; and determining the target whitelist based on the at least one target object identifier. The target filtering rule includes: obtaining the priority value corresponding to each object identifier to be processed, and filtering the at least one object identifier to be processed based on the priority value, wherein the priority value represents the importance of the object corresponding to the object identifier to the target business; The filtering of the at least one object identifier to be processed based on the priority value includes: determining a target threshold based on a first target data volume and a preset threshold, wherein the first target data volume is the traffic in the previous time period, and the higher the first target data volume, the lower the target threshold; and determining the object identifier to be processed corresponding to a priority value less than the target threshold as the target object identifier. Traffic accessing the target service is filtered based on the target whitelist to obtain the target traffic, and the target traffic is routed to the target unit.

2. The method according to claim 1, characterized in that, The target selection rules also include: Take the union of the identifiers of the objects to be processed contained in multiple transformed whitelists; Take the intersection of the object identifiers to be processed contained in the multiple converted whitelists.

3. The method according to claim 1, characterized in that, Filtering the at least one object identifier to be processed based on the priority value includes: The first target data volume is the data volume corresponding to the traffic received by the target unit within the target time range, and the maximum time length of the target time range from the current time is less than the target time length.

4. The method according to claim 3, characterized in that, The method for determining the target threshold based on the first target data volume and a preset threshold includes any one of the following: Based on the first threshold, the first target data volume, and the second target data volume, a target threshold is determined, wherein the second target data volume is the data volume corresponding to the highest traffic allowed to be received by the target unit within a preset time range, and the preset threshold includes the first threshold and the second threshold, wherein the second threshold is greater than the first threshold; The target threshold is determined based on the second threshold and the first target data volume; The target threshold is determined based on the first threshold, the second threshold, the first target data volume, and the second target data volume.

5. The method according to claim 1, characterized in that, Routing the target traffic to the target unit includes: A target label is set for the target traffic to obtain the processed target traffic; The processed target traffic is routed to the target unit.

6. A whitelist processing device, characterized in that, The multiple target applications corresponding to the target business adopt a unitized architecture, including: The acquisition module is used to acquire the whitelist used by each target application in the target unit, and obtain multiple whitelists. The whitelists include information on objects that are allowed to access the current target application. The target unit is composed of grayscale servers corresponding to the multiple target applications. The determination module is used to determine the target whitelist based on the service type of the target service and multiple whitelists; The determining module includes: a conversion submodule, used to convert the format of the object identifier contained in each whitelist to obtain at least one object identifier to be processed, and to determine the converted whitelist based on the at least one object identifier to be processed; and a determining submodule, used to determine the target whitelist based on the business type of the target business and the converted whitelist. The determining submodule includes: a first determining unit, configured to determine target filtering rules based on the business type of the target business; a second determining unit, configured to determine at least one target object identifier based on the target filtering rules and the converted whitelist; and a third determining unit, configured to determine the target whitelist based on the at least one target object identifier. The processing device is further configured to: the target filtering rule includes obtaining a priority value corresponding to each object identifier to be processed, and filtering the at least one object identifier to be processed based on the priority value, wherein the priority value characterizes the importance of the object corresponding to the object identifier to the target business; wherein filtering the at least one object identifier to be processed based on the priority value includes: determining a target threshold based on a first target data volume and a preset threshold, wherein the first target data volume is the traffic in the previous time period, and the higher the first target data volume, the lower the target threshold; and determining the object identifier to be processed corresponding to a priority value less than the target threshold as the target object identifier; The processing module is used to filter traffic accessing the target service based on the target whitelist, obtain the target traffic, and route the target traffic to the target unit.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the whitelist processing method according to any one of claims 1 to 5 when it is run.

8. An electronic device, characterized in that, The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to be configured to run the programs, wherein the programs are configured to execute the whitelist processing method as described in any one of claims 1 to 5.

Images