An access control method and apparatus

Abstract

The application provides an access control method and device. A handshake request message based on an intermediate layer protocol sent by a terminal is received, a historical total quantity is obtained, the historical total quantity comprises a total quantity of historical handshake request messages received in a historical time period, in a case where the historical total quantity is less than a preset quantity, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal, and correspondingly, in a case where the historical total quantity is greater than or equal to the preset quantity, the handshake response message based on the intermediate layer protocol is not returned to the terminal according to the handshake request message sent by the terminal, for example, the handshake request message sent by the terminal is not processed, and relevant steps of SSL handshake are not performed, system resource consumption generated in an SSL handshake stage is eliminated, so that system resources of a server can be saved, and the load of system resources of the server can be reduced as much as possible.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an access control method and apparatus. Background Technology

[0002] With the rapid development of technology, a large number of users are using mobile phones to access the Internet and enjoy network services, which can bring great convenience to users' work and life.

[0003] While browsing the internet, users can interact with service providers' servers using their mobile phones. For example, in a shopping scenario, users can use their phones to retrieve and display shopping pages from e-commerce servers, allowing them to make purchases. Similarly, in a payment scenario, users can use their phones to retrieve and display payment pages from financial institutions' servers, enabling them to make payments. Summary of the Invention

[0004] This application discloses an access control method and apparatus.

[0005] In a first aspect, this application discloses an access control method applied to an electronic device, the method comprising:

[0006] The receiving terminal sends a handshake request message based on an intermediate layer protocol, wherein the intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model;

[0007] Obtain the total historical count, which includes the total number of historical handshake request messages received within a historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is before the current time.

[0008] If the total number of historical records is less than a preset number, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0009] In one alternative implementation, the intermediate layer protocol includes Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

[0010] In an optional implementation, the method further includes:

[0011] If the total number of historical data is greater than or equal to a preset number, determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0012] If the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0013] In an optional implementation, the method further includes:

[0014] If the handshake request message sent by the terminal triggers the flow control condition of the electronic device, the processing of the handshake request message sent by the terminal shall be stopped.

[0015] In an optional implementation, the method further includes:

[0016] If the handshake request message sent by the terminal triggers the flow control condition of the electronic device, and a communication connection at the transport layer between the electronic device and the terminal has been established, the communication connection at the transport layer between the electronic device and the terminal shall be disconnected.

[0017] In an optional implementation, the method further includes:

[0018] The total number of recorded historical records is incremented based on the handshake request message sent by the terminal.

[0019] In an optional implementation, the handshake request message sent by the terminal is used to request a handshake with one of the multiple servers in the distributed service system.

[0020] The acquisition of the total historical quantity includes:

[0021] Obtain the historical count of each server in the distributed service system. The historical count of the server includes the total number of historical handshake request messages received by the server in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol.

[0022] The total historical count is obtained by summing the historical counts of each server in the distributed service system.

[0023] In one optional implementation, obtaining the total historical count includes:

[0024] The domain name requested by the terminal is obtained based on the handshake request message sent by the terminal;

[0025] Obtain the total historical count corresponding to the domain name, which includes the total number of handshake request messages based on the intermediate layer protocol received during the historical time period that requested the domain name.

[0026] In an optional implementation, determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device includes:

[0027] The flow control ratio is obtained based on the total historical quantity and the preset quantity.

[0028] The flow control ratio determines whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0029] In an optional implementation, determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the flow control ratio includes:

[0030] Set multiple preset labels;

[0031] Based on the flow control ratio, select some preset tags from the plurality of preset tags; and randomly select a preset tag from the plurality of preset tags for the handshake request message sent by the terminal.

[0032] If the selected preset tag is located in the part of the preset tags, it is determined that the handshake request message sent by the terminal triggers the flow control condition of the electronic device;

[0033] or,

[0034] If the selected preset tag is not located in the aforementioned preset tags, it is determined that the handshake request message sent by the terminal did not trigger the flow control condition of the electronic device.

[0035] In an optional implementation, determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device includes:

[0036] The terminal's identification information is obtained based on the handshake request message sent by the terminal;

[0037] The system searches for the terminal's identification information in the whitelist. If the terminal's identification information is found in the whitelist, it determines that the handshake request message sent by the terminal did not trigger the flow control condition. Alternatively, if the terminal's identification information is not found in the whitelist, it determines that the handshake request message sent by the terminal triggered the flow control condition.

[0038] or,

[0039] The system searches for the terminal's identification information in the blacklist. If the terminal's identification information is found in the blacklist, it determines that the handshake request message sent by the terminal triggers the flow control condition. Alternatively, if the terminal's identification information is not found in the blacklist, it determines that the handshake request message sent by the terminal does not trigger the flow control condition.

[0040] Secondly, this application discloses an access control device applied to an electronic device, the device comprising:

[0041] The receiving module is used to receive a handshake request message based on an intermediate layer protocol sent by the terminal. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model.

[0042] The acquisition module is used to acquire the total historical quantity, which includes the total number of historical handshake request messages received in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is before the current time.

[0043] The return module is used to return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal when the total number of historical data is less than a preset number.

[0044] In one alternative implementation, the intermediate layer protocol includes Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

[0045] In an alternative implementation, the apparatus further includes:

[0046] The determination module is used to determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device when the total number of historical data is greater than or equal to a preset number.

[0047] The return module is further configured to: return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal if the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device.

[0048] In an alternative implementation, the apparatus further includes:

[0049] The stop module is used to stop processing the handshake request message sent by the terminal when the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0050] In an alternative implementation, the apparatus further includes:

[0051] The disconnect module is used to disconnect the communication connection between the electronic device and the terminal located at the transport layer if a communication connection at the transport layer has been established when the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0052] In an alternative implementation, the apparatus further includes:

[0053] An addition module is provided to increase the total number of recorded historical records based on the handshake request message sent by the terminal.

[0054] In an optional implementation, the handshake request message sent by the terminal is used to request a handshake with one of the multiple servers in the distributed service system.

[0055] The acquisition module includes:

[0056] The first acquisition unit is used to acquire the historical quantity of each server in the distributed service system. The historical quantity of the server includes the total number of historical handshake request messages received by the server in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol.

[0057] The calculation unit is used to calculate the sum of the historical quantities of each server in the distributed service system to obtain the total historical quantity.

[0058] In one optional implementation, the acquisition module includes:

[0059] The second acquisition unit is used to acquire the domain name requested by the terminal based on the handshake request message sent by the terminal;

[0060] The third acquisition unit is used to acquire the total historical quantity corresponding to the domain name, which includes the total number of handshake request messages based on the intermediate layer protocol received during the historical time period that request the domain name.

[0061] In one optional implementation, the determining module includes:

[0062] The fourth acquisition unit is used to acquire the flow control ratio based on the total historical quantity and the preset quantity.

[0063] The first determining unit is used to determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the flow control ratio.

[0064] In one optional implementation, the first determining unit includes:

[0065] Set sub-units to set multiple preset labels;

[0066] A filtering subunit is used to filter a portion of preset tags from the plurality of preset tags according to the flow control ratio;

[0067] The selection subunit is used to randomly select a preset tag from the plurality of preset tags for the handshake request message sent by the terminal;

[0068] The first determining subunit is used to determine the flow control condition triggered by the handshake request message sent by the terminal when the selected preset tag is located in the part of the preset tags;

[0069] or,

[0070] The second determining subunit is used to determine that the handshake request message sent by the terminal has not triggered the flow control condition of the electronic device when the selected preset tag is not located in the part of the preset tags.

[0071] In one optional implementation, the determining module includes:

[0072] The fifth acquisition unit is used to acquire the identification information of the terminal based on the handshake request message sent by the terminal;

[0073] The second determining unit is used to search for the terminal's identification information in the whitelist; if the terminal's identification information is found in the whitelist, it determines that the handshake request message sent by the terminal has not triggered the flow control condition; or, if the terminal's identification information is not found in the whitelist, it determines that the handshake request message sent by the terminal has triggered the flow control condition.

[0074] or,

[0075] The third determining unit is used to search for the identification information of the terminal in the blacklist; if the identification information of the terminal is found in the blacklist, it determines that the handshake request message sent by the terminal triggers the flow control condition; or, if the identification information of the terminal is not found in the blacklist, it determines that the handshake request message sent by the terminal does not trigger the flow control condition.

[0076] Thirdly, this application discloses an electronic device comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to perform the methods shown in any of the foregoing aspects.

[0077] Fourthly, this application discloses a non-transitory computer-readable storage medium that, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the methods shown in any of the foregoing aspects.

[0078] Fifthly, this application discloses a computer program product in which, when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the methods shown in any of the foregoing aspects.

[0079] Compared with the prior art, this application has the following advantages:

[0080] In this application, a handshake request message based on an intermediate layer protocol is sent by a receiving terminal. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model. The total historical count is obtained, which includes the total number of historical handshake request messages received within a historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is before the current time. If the total historical count is less than a preset count, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0081] This application enables the following: when the total historical number is less than a preset number, a handshake response message based on an intermediate layer protocol is returned to the terminal based on the handshake request message sent by the terminal. Conversely, when the total historical number is greater than or equal to the preset number, a handshake response message based on an intermediate layer protocol is not returned to the terminal based on the handshake request message sent by the terminal. For example, the handshake request message sent by the terminal is not processed, and the relevant steps of the SSL handshake are not performed, thus eliminating the system resource consumption generated during the SSL handshake phase. This can save the server's system resources and reduce the load on the server's system resources as much as possible. Attached Figure Description

[0082] Figure 1 This is a structural block diagram of an access control system illustrated in an exemplary embodiment of this application.

[0083] Figure 2 This is a structural block diagram of an access control system illustrated in an exemplary embodiment of this application.

[0084] Figure 3 This is a structural block diagram of an access control system illustrated in an exemplary embodiment of this application.

[0085] Figure 4 This is a flowchart illustrating an access control method according to an exemplary embodiment of this application.

[0086] Figure 5 This is a flowchart illustrating an access control method according to an exemplary embodiment of this application.

[0087] Figure 6 This is a flowchart illustrating an access control method according to an exemplary embodiment of this application.

[0088] Figure 7 This is a structural block diagram of an access control device illustrated in an exemplary embodiment of this application.

[0089] Figure 8 This is a schematic diagram of the structure of an apparatus shown in an exemplary embodiment of this application. Detailed Implementation

[0090] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0091] As users increasingly interact with service providers' servers via mobile phones, and as the privacy and importance of this data grows, higher demands are being placed on the security of network interactions. Currently, HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) is being used more and more widely in scenarios where mobile phones interact with servers.

[0092] In this context, the interaction between mobile phones and servers is often based on computer network models. These computer network models can include the 7-layer ISO (Open System Interconnection) model or the 4-layer TCP (Transmission Control Protocol) / IP (Internet Protocol) model, etc.

[0093] The 7-layer ISO model, from bottom to top, includes: physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer.

[0094] The four-layer TCP / IP model, from bottom to top, includes: network interface layer, internet layer, transport layer, and application layer.

[0095] In computer network models, lower layers often need to provide support to upper layers.

[0096] HTTPS is often used in the application layer of a computer network model. Protocols at the application layer often require network connections at the transport layer to support them, such as TCP connections at the transport layer.

[0097] In this way, before data interaction occurs between the mobile phone and the server, regardless of which computer network model is used, the associations between the mobile phone and the server for each layer can be established sequentially from bottom to top.

[0098] For example, regarding the transport and application layers, in scenarios where a mobile phone needs to interact with a server, a TCP connection can first be established between the mobile phone and the server. Then, the mobile phone and the server can exchange data via the TCP connection using the application layer's HTTPS protocol.

[0099] In one possible scenario, users can interact with the server using their own mobile phones, meaning the server can concurrently provide data services to multiple mobile phones.

[0100] However, the inventors discovered that sometimes high concurrency may occur, which may overload the server's system resources and lead to server failures, such as downtime.

[0101] High concurrency scenarios can include situations where the server receives a large number of HTTPS requests in a short period of time and needs to process these requests.

[0102] The server-side system resources may include the server-side CPU (Central Processing Unit) and memory, etc.

[0103] Therefore, the need to avoid overloading the system resources on the server side was proposed.

[0104] To avoid overloading server system resources, one approach is to return a rejection response (e.g., including an HTTPS 429 status code) to some of the HTTPS requests received by the server in a short period of time. This avoids processing some of the HTTPS requests normally, thereby reducing the server load.

[0105] However, the inventors found that, judging from the results, the above method had little effect on reducing the server load, and in some cases, even if a rejection response was returned for some HTTPS requests, the server's system resources were still overloaded.

[0106] Thus, the inventors discovered that returning a rejection response to some HTTPS requests could not achieve the goal of avoiding overloading the server's system resources.

[0107] In light of this, the inventors analyzed why returning a rejection response for some HTTPS requests could not prevent the server's system resources from becoming overloaded, and found that:

[0108] In scenarios where data is exchanged between a mobile phone and a server, if HTTPS is used at the application layer, after establishing a TCP connection at the transport layer between the mobile phone and the server, before the mobile phone sends an HTTPS request to the server based on the TCP connection, due to the use of HTTPS, in order to ensure data security, the mobile phone needs to first perform an SSL (Secure Sockets Layer) handshake with the server. Only after the SSL handshake between the mobile phone and the server is completed will the mobile phone send an HTTPS request to the server based on the TCP connection.

[0109] The SSL handshake process between the mobile phone and the server includes:

[0110] 01) The terminal sends a Client hello message to the server.

[0111] The Client hello message may include the SSL version number, a random number, a session ID (Identity Document), a cipher suite, and a compression method.

[0112] The cipher suite indicates the list of algorithms that the terminal can support, including key exchange methods, signature methods, and encryption methods.

[0113] 02) The server returns a Server hello (server call) message to the terminal based on the Client hello message.

[0114] The Server hello message may include the SSL version number, the key exchange method, signature method, encryption method supported by both the server and the client, and a random number used to generate the key later.

[0115] The server can match the cipher suite in the Client hello message with the pre-loaded digital certificate and signature method. If the match is successful, the server can return a Server hello message to the terminal and indicate the cipher algorithm agreed upon by both parties.

[0116] 03) The server sends the specified certificate (certificate chain) to the terminal for authentication.

[0117] 04) After the terminal successfully verifies the server certificate, it sends a Client key exchange message to the server, which is used to encrypt the pre-master key with the server's public key and send it to the server.

[0118] 05) Both parties generate a master key for the transmission phase based on the pre-master key and a random number, thereby completing the SSL handshake negotiation process.

[0119] As can be seen, the SSL handshake between the mobile phone and the server involves multiple steps, and the server's execution of these steps consumes the server's system resources.

[0120] In one possible scenario, even if the server does not process some HTTPS requests, each terminal will still perform an SSL handshake with the server before sending its own HTTPS request to the server. The SSL handshake process consumes the server's system resources, which may result in the server returning a rejection response for some HTTPS requests, thus failing to achieve the goal of avoiding overloading the server's system resources.

[0121] Therefore, the inventors concluded that the reason why returning a rejection response for some HTTPS requests cannot avoid overloading the server's system resources may include: before the server receives some HTTPS requests, it performs an SSL handshake with the senders of each HTTP request in the HTTPS requests. The SSL handshake process consumes the server's system resources, which leads to the inability to avoid overloading the server's system resources by returning a rejection response for some HTTPS requests.

[0122] To address this, the inventors devised another approach: if the server does not need to process partial HTTPS requests to avoid overload, it can perform an SSL handshake with the sender of partial HTTPS requests before receiving partial HTTPS requests. For example, the server can skip the SSL handshake steps, thus saving server system resources and minimizing the load on server system resources.

[0123] For example, if the server does not need to process some HTTPS requests to avoid overload, it can choose not to process the Client hello message sent by the sender of these HTTPS requests during the SSL handshake phase. For example, steps 02) to 05) of the SSL handshake phase mentioned above are not executed, that is, the server does not participate in the SSL handshake, thereby saving server system resources and minimizing the load on server system resources.

[0124] Specific solutions will be described later in this application and will not be detailed here.

[0125] In order to facilitate understanding of this application, the technical terms that may be involved in this application are explained as follows:

[0126] SNI: Server Name Indication, is an extension used to improve SSL and TLS (Transport Layer Security) between servers and clients. It is mainly used to address the limitation that a server can only use one certificate (or one domain name). With the support of virtual hosting, a server can provide services for multiple domain names. The purpose of SNI is to allow the server to determine which domain to provide services for based on the request.

[0127] SSL: Widely used for authentication and encrypted data transmission between web browsers and servers. The SSL protocol sits between the TCP / IP protocol and various application layer protocols, providing security support for data communication. The SSL protocol can be divided into two layers: SSL Record Protocol: Built on top of reliable transport protocols (such as TCP), it provides support for basic functions such as data encapsulation, compression, and encryption for higher-level protocols. SSL Handshake Protocol: Built on top of the SSL Record Protocol, it is used for authentication, encryption algorithm negotiation, and key exchange between communicating parties before actual data transmission begins.

[0128] TLS: Used to provide confidentiality and data integrity between two communicating applications. The protocol consists of two layers: the TLS Record protocol and the TLS Handshake protocol. The lower layer, the TLS Record protocol, sits on top of a reliable transport protocol (such as TCP). The TLS protocol comprises two protocol groups: the TLS Record protocol and the TLS Handshake protocol. The TLS Record protocol is a layered protocol. Information in each layer may include fields such as length, description, and content. The Record protocol supports message transmission, segmenting data into processable blocks, compressing data, applying MAC, encryption, and transmitting results. Received data is decrypted, verified, decompressed, reassembled, etc., and then transmitted to the higher-level client. The TLS Handshake protocol consists of three sub-protocol groups, allowing peers to agree on security parameters at the Record layer, self-authenticate, instantiate negotiated security parameters, and report error conditions to each other. Since TLS is built on top of SSL and is a subsequent version of SSL, there are differences between the two, mainly in the encryption algorithms they support, while the overall process is basically the same. Therefore, in this embodiment, SSL is primarily used for explanation. The first phase of the SSL handshake initiates a logical connection and establishes the security capabilities of this connection.

[0129] HTTPS is an HTTP (Hypertext Transfer Protocol) channel with security as its goal. It adds SSL or its later version TLS to HTTP. SSL / TLS uses data encryption, authentication and message integrity verification mechanisms to provide security guarantees for the transmission of data over the network.

[0130] Domain names, similar to house numbers on the internet, are hierarchical character identifiers used to identify and locate computers on the internet. In the international internet domain name system, top-level domains are divided into: Country Code Top Level Domains (ccTLDs) and Generic Top Level Domains (gTLDs). Country Code Top Level Domains correspond to the geographical locations of countries and regions, such as .CN for China and .US for the United States. Generic Top Level Domains correspond to different categories; common examples include .COM for commercial organizations, .NET for organizations providing internet services, and .ORG for non-profit organizations.

[0131] Reference Figure 1 The diagram shows a structural block diagram of an access control system according to this application. Figure 1 The access control system includes a server 01 and at least one terminal 02.

[0132] This single server can provide data services to various terminals, and it can also provide data services for multiple domains to each terminal. Each terminal can request to interact with this single server to enjoy the data services provided by the server for each domain.

[0133] Reference Figure 2 The diagram shows a structural block diagram of an access control system according to this application. Figure 2 The access control system includes a distributed service system and at least one terminal 02. The distributed service system includes multiple servers 01, which can communicate with each other.

[0134] Each server can provide data services to each terminal separately, and each server can provide data services for multiple domains to each terminal. For example, the same terminal can request data services for multiple domains from different servers. Each terminal can request data interaction with multiple servers to enjoy the data services provided by the servers for each domain.

[0135] Reference Figure 3 The diagram shows a structural block diagram of an access control system according to this application. Figure 3The access control system includes a distributed service system and at least one terminal 02. The distributed service system includes multiple servers 01 and a flow control node 03. The flow control node can communicate with each server. The flow control node can be invisible to the terminal, and can choose not to interact with the terminal.

[0136] This flow control node has statistical functions and formulates flow control policies based on these functions. It then distributes these policies to each server so that each server can control the traffic according to the policies. For example, the server can determine whether to return a handshake response message to the terminal based on the handshake request message sent to it, or not to process the handshake request message (e.g., not to return a handshake response message to the terminal based on the handshake request message sent to it).

[0137] In one example, in a scenario where data services are provided to various terminals, for any server, upon receiving a handshake request message from a terminal, it can report the handshake request message received by the server to the flow control node. This allows the flow control node to statistically analyze the handshake request messages received by each server and formulate flow control strategies based on these messages.

[0138] The terminals mentioned above include devices used by a wide range of users, such as mobile phones, tablets, laptops, and desktop computers.

[0139] Combination Figure 1-3 The access control system shown is described in the image. Figure 4 The diagram illustrates a flowchart of an access control method according to this application. This method can be applied to electronic devices, which include... Figure 1-3 The following embodiments, using electronic devices as servers, are illustrated but are not intended to limit the scope of this application. The method includes:

[0140] In step S101, a handshake request message based on an intermediate layer protocol is sent by the receiving terminal. The intermediate layer protocol includes the protocol applied between the application layer and the transport layer in the computer network model.

[0141] The handshake request message sent by the terminal based on the intermediate layer protocol is used to request a handshake with the server based on the intermediate layer protocol.

[0142] In scenarios where data interaction occurs between a terminal and a server, the two parties can interact based on a computer network model.

[0143] Intermediate layer protocols include those used between the transport layer and the application layer in a multi-layered computer network model, such as SSL or TLS.

[0144] In this application, the application layer and the transport layer can interact through an intermediate layer protocol.

[0145] For example, data from the application layer may not be passed directly to the transport layer, but instead to an intermediate layer, such as SSL / TLS. The SSL / TLS layer encrypts the data received from the application layer before passing it to the transport layer.

[0146] Intermediate layer protocols include SSL or TLS, etc.

[0147] SSL / TLS is a secure network transport protocol primarily designed to protect confidential information transmitted over the Internet. The protocol consists of two processes: a handshake phase and a data transmission phase.

[0148] The data transmission phase involves encrypting and decrypting the transmitted data using the agreed-upon symmetric key and performing a digest operation using the digest key, in order to ensure the privacy and integrity of the data.

[0149] The main purpose of the handshake phase is to verify the authenticity of the other party's identity and generate the key required for the data transmission phase.

[0150] In one embodiment, a handshake request message sent by the terminal based on Secure Sockets Layer (SSL) or Secure Transport Layer (TLS) can be received.

[0151] The terminal sends a Client hello message (i.e., a handshake request message) to the server and waits for the server's response.

[0152] It should be noted that in the short term, there may be multiple clients sending handshake request messages based on intermediate layer protocols. In order to improve the processing speed of handshake request messages, multiple processes can be started on the server side, each process is used to handle different handshake request messages. When it is necessary to distribute the handshake request messages sent by multiple clients based on intermediate layer protocols to each process, the handshake request messages can be distributed according to the current processing capacity of each process to achieve the purpose of load balancing.

[0153] In step S102, the total historical count is obtained. The total historical count includes the total number of historical handshake request messages received in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol. The historical time period is before the current time.

[0154] The current moment includes the moment of receipt when the handshake request message based on the intermediate layer protocol is received from the terminal in step S101.

[0155] In this application, the duration of the historical time period can be determined according to the actual situation, such as 1 second, 2 seconds, 3 seconds, or 4 seconds, etc., and this application does not limit it in this regard. The end time of the historical time period can be the current time, etc.

[0156] In step S101, the time when the handshake request message based on the intermediate layer protocol sent by the terminal is received is the current time.

[0157] Previously, during the historical time period, there were historical handshake request messages based on intermediate layer protocols that were received, and the historical number of historical handshake request messages based on intermediate layer protocols that were received during the historical time period has been recorded (e.g., recorded on the server). Thus, the historical number of historical handshake request messages based on intermediate layer protocols that were received during the historical time period can be directly obtained.

[0158] In one embodiment, in Figure 1 In the access control system scenario shown, the handshake request message sent by the terminal based on the intermediate layer protocol requests a handshake with a server. In this embodiment, only this one server is involved, so the historical number of handshake request messages based on the intermediate layer protocol received by this server in a historical time period can be determined as the total historical number.

[0159] Alternatively, in another embodiment of this application, in Figure 2 In the access control system scenario shown in Figure 3, the handshake request message sent by the terminal based on the intermediate layer protocol requests a handshake with a server. In this embodiment, a distributed service system is involved, which includes multiple servers, each of which can provide services to the outside world. The "one server" refers to one of the multiple servers in the distributed service system; that is, the handshake request message is used to request a handshake with one of the multiple servers in the distributed service system.

[0160] In this way, the historical counts of each server in the distributed service system can be obtained. The historical counts of each server include the total number of historical handshake request messages received by the server in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol. The historical time period is before the current time. The sum of the historical counts of each server in the distributed service system is calculated to obtain the total historical count.

[0161] In another embodiment, the process of obtaining the total historical count includes:

[0162] 1021. Obtain the domain name requested by the terminal based on the handshake request message sent by the terminal.

[0163] In one embodiment of this application, the server provides services to the outside world based on a domain name, and the server can provide services to the outside world based on different domain names. Thus, in this application, it is necessary to process the handshake request message based on the domain name dimension, and then it is necessary to obtain the domain name requested by the terminal based on the handshake request message.

[0164] In one embodiment of this application, when the intermediate layer protocol is the SSL protocol, the handshake request message can be a data packet of "Client hello".

[0165] The SNI field, which includes the domain name requested by the terminal (e.g., the domain name of the requested server), can be extracted from the SNI field of the "Client hello" data packet.

[0166] For example, the SNI field contains a Server Name field, which records the domain name of the server requested by the terminal. Thus, the Server Name field can be indexed from the SNI field, the domain name in the Server Name field can be retrieved, and this domain name can be used as the domain name requested by the terminal.

[0167] In one specific example, the SNI field, defined in RFC 4366, is a technique used to improve SSL / TLS, enabled in SSL 3.0 / TLS 1.0. It allows the requesting party to submit the requested domain name via the SNI extension field when initiating the SSL handshake request (including the Client hello phase in the SSL request), enabling the server to switch to the correct domain name and provide services based on it. Therefore, in this application, the requested domain name can be extracted based on the Server Name field within the SNI field.

[0168] In the case where the intermediate layer protocol is TLS, similar to SSL, it will not be described in detail here.

[0169] 1022. Obtain the total historical count corresponding to the domain name. The total historical count corresponding to the domain name includes the total number of handshake request messages based on the intermediate layer protocol received during the historical time period.

[0170] In step S103, it is determined whether the total historical quantity is less than the preset quantity.

[0171] In this application, the preset quantity can be set in advance according to the actual situation, such as the load that the server itself can bear, for example, it can include 10000, 11000 or 12000, etc., and this application does not limit it.

[0172] Understandably, the preset quantity can be adjusted in real time according to the actual situation.

[0173] If the total number of historical records is less than the preset number, in step S104, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0174] The handshake request message sent by the terminal includes the handshake request message received in step S101.

[0175] For example, returning a Server hello message to the terminal based on a Client hello message.

[0176] If the total number of historical messages is less than the preset number, it usually indicates that the server load was not very high during the historical period, and the server can usually continue to bear more load. The number of handshake request messages received by the server is often continuous. Thus, it can be inferred that the server load may not be very high after the current moment, and the server can usually continue to bear more load. Therefore, in order to provide normal service to the outside world as much as possible, flow control can be disabled on the server after the current moment. For example, the received handshake request messages based on the intermediate layer protocol can be processed normally. In this way, a handshake response message based on the intermediate layer protocol can be returned to the terminal based on the handshake request message.

[0177] If the total historical number is greater than or equal to the preset number, in step S105, it is determined whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0178] If the total number of historical messages is greater than or equal to the preset number, it often indicates that the server load was very high during the historical period, and the server was often unable to handle more load. The number of handshake request messages received by the server often has continuity. Thus, it can be inferred that the server load may be very high after the current moment, and the server may often be unable to handle more load. Therefore, it is necessary to further determine whether to control the flow of the server after the current moment. For example, determine whether the handshake request messages trigger the flow control conditions of the electronic device. If the flow control conditions of the electronic device are triggered, then flow control of the server can be implemented. Alternatively, if the flow control conditions of the electronic device are not triggered, flow control of the server can be omitted.

[0179] If the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device, step S105 is executed: return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal.

[0180] For details of this step, please refer to the embodiments shown later, which will not be described in detail here.

[0181] If the handshake request message sent by the terminal triggers the flow control condition of the electronic device, in step S106, the processing of the handshake request message sent by the terminal is stopped.

[0182] For example, instead of returning a handshake response message based on the intermediate layer protocol to the terminal based on the handshake request message, such as not returning a Server hello message to the terminal based on the Client hello message, steps 02) to 05) of the above SSL handshake phase are not executed, and the handshake request message can be directly discarded, thereby saving server system resources and minimizing the load on server system resources.

[0183] In this application, a handshake request message based on an intermediate layer protocol is sent by a receiving terminal. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model. The total historical count is obtained, which includes the total number of historical handshake request messages received within a historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is before the current time. If the total historical count is less than a preset count, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0184] This application enables the following: when the total historical number is less than a preset number, a handshake response message based on an intermediate layer protocol is returned to the terminal based on the handshake request message sent by the terminal. Conversely, when the total historical number is greater than or equal to the preset number, a handshake response message based on an intermediate layer protocol is not returned to the terminal based on the handshake request message sent by the terminal. For example, the handshake request message sent by the terminal is not processed, and the relevant steps of the SSL handshake are not performed, thus eliminating the system resource consumption generated during the SSL handshake phase. This can save the server's system resources and reduce the load on the server's system resources as much as possible.

[0185] In this application, before receiving the handshake request message based on an intermediate layer protocol sent by the terminal in step S101, in one possible embodiment, a communication connection at the transport layer has been established with the terminal, for example, a server connection has been established ( Figure 1-3The communication connection between a server in the access control system and a terminal is located at the transport layer. The communication connection at the transport layer can include TCP connection or UDP (User Datagram Protocol) connection, etc.

[0186] If a handshake request message triggers the flow control condition of an electronic device, and a communication connection at the transport layer between the device and the terminal has already been established, the communication connection at the transport layer between the device and the terminal can be disconnected.

[0187] Since the handshake request message triggers the flow control condition of the electronic device, it is clear that this is to block the subsequent terminal request to obtain services from the server. Because it is necessary to block the subsequent terminal request to obtain services from the server, the communication connection at the transport layer between the terminal and the server (e.g., the communication connection at the transport layer between the server and the terminal) is useless at least in the short term. Therefore, in order to save the network resources involved in the communication connection at the transport layer between the terminal and the server, as well as the system resources consumed by the server to maintain the communication connection at the transport layer between the terminal and the server, the communication connection at the transport layer between the terminal and the server can be disconnected.

[0188] Furthermore, in another embodiment of this application, a total historical count has been recorded (e.g., recorded on the server). In addition, a handshake request message based on an intermediate layer protocol sent by the terminal is received in step S101. Thus, the total historical count that has been recorded can be increased according to the handshake request message based on an intermediate layer protocol sent by the terminal received in step S101. For example, a specific value can be added to the total historical count that has been recorded. The characteristic value may include positive integers such as 1, 2, or 3, which is not limited in this application.

[0189] In one embodiment of this application, see [link to embodiment]. Figure 5 Step S106 includes:

[0190] In step S201, the flow control ratio is obtained based on the historical total number and the preset number.

[0191] In one embodiment, if the total historical quantity is greater than or equal to a preset quantity, the difference between the total historical quantity and the preset quantity can be calculated, and then the ratio between the difference and the preset quantity can be calculated and used as the flow control ratio.

[0192] Alternatively, in another embodiment, if the total historical quantity is greater than or equal to a preset quantity, the difference between the total historical quantity and the preset quantity can be calculated, and then the ratio between the difference and the total historical quantity can be calculated and used as the flow control ratio.

[0193] In step S202, it is determined whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the flow control ratio.

[0194] In one embodiment of this application, this step can be implemented through the following process, including:

[0195] 2021, Set multiple preset labels.

[0196] Multiple preset labels are different from each other.

[0197] In one example, multiple preset labels can be multiple different numbers. For example, it could include 100 numbers, from 1 to 100, etc.

[0198] 2022. Based on the flow control ratio, select some preset tags from multiple preset tags.

[0199] In this application, the flow control ratio is a value greater than 0 and less than 1. The product between the number of multiple preset tags and the flow control ratio can be calculated to obtain a value. The integer part of this value can be taken to obtain an integer.

[0200] Then, based on this integer, preset tags are filtered from multiple preset tags (for example, the number of preset tags to be filtered from multiple preset tags is this integer), which is a partial set of preset tags. Among them, preset tags can be randomly filtered from multiple preset tags based on this integer (for example, as long as the number of preset tags to be filtered is this integer, it is not necessary to select any preset tags).

[0201] For example, assuming the integer is 20, 20 numbers can be filtered from the numbers 0 to 100 in step 2021. For example, the 20 numbers filtered are numbers 1 to 20, and are used as some preset labels.

[0202] 2023. Randomly select a preset tag from multiple preset tags for the handshake request message sent by the terminal.

[0203] Among them, a preset tag can be randomly selected from multiple preset tags and used as the preset tag randomly selected for the handshake request message sent to the terminal.

[0204] For example, in the example of step 2021, a number is randomly selected from the numbers 0 to 100 for the handshake request message.

[0205] 2024. When the selected preset tag is located in part of the preset tags, determine the flow control conditions that trigger the electronic device when the handshake request message sent by the terminal is sent.

[0206] For example, suppose that the number randomly selected from the numbers 0 to 100 in step 2023 for the handshake request message is 11, which is located in the 20 numbers 1 to 20 filtered in step 2022. In this way, the flow control conditions that trigger the handshake request message for the electronic device can be determined.

[0207] 2025. If the selected preset tag is not located in the partial preset tags, determine that the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device.

[0208] For example, suppose that the number randomly selected from the numbers 0 to 100 in step 2023 for the handshake request message is 37, which is not among the 20 numbers 1 to 20 selected in step 2022. In this way, it can be determined that the handshake request message has not triggered the flow control conditions of the electronic device.

[0209] Alternatively, see one embodiment of this application, Figure 6 Step S106 includes:

[0210] In step S301, the terminal's identification information is obtained based on the handshake request message sent by the terminal.

[0211] In one embodiment of this application, when the intermediate layer protocol is the SSL protocol, the handshake request message can be a data packet of "Client hello".

[0212] The "Client hello" data packet includes an identification field, which contains the terminal's identification information, including its IP address or MAC (Media Access Control) address. Therefore, the terminal's identification information can be extracted from the identification field of the "Client hello" data packet.

[0213] In the case where the intermediate layer protocol is TLS, similar to SSL, it will not be described in detail here.

[0214] In step S302, it is determined whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the terminal's identification information.

[0215] For example, in one embodiment, the terminal's identification information is searched in a whitelist. If the terminal's identification information is found in the whitelist, it is determined that the handshake request message did not trigger the electronic device's flow control conditions. Alternatively, if the terminal's identification information is not found in the whitelist, it is determined that the handshake request message triggered the electronic device's flow control conditions.

[0216] In this embodiment, a whitelist can be pre-set, including identification information for at least one terminal. Handshake request messages sent by terminals whose identification information is in the whitelist to the server can be processed normally without being subject to flow control, thus achieving precise flow control at the terminal level. Furthermore, the identification information in the whitelist can be updated as needed to meet real-time requirements.

[0217] Alternatively, in one embodiment, the terminal's identification information is searched in a blacklist. If the terminal's identification information is found in the blacklist, it is determined that the handshake request message triggers the flow control condition of the electronic device. Alternatively, if the terminal's identification information is not found in the blacklist, it is determined that the handshake request message did not trigger the flow control condition of the electronic device.

[0218] In this embodiment, a blacklist can be pre-set, including identification information for at least one terminal. Handshake request messages sent to the server by terminals whose identification information is on the blacklist can be flow-controlled and not processed normally, thus achieving precise flow control at the terminal level. Furthermore, the identification information in the blacklist can be updated as needed to meet real-time requirements.

[0219] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by this application.

[0220] Reference Figure 7 This diagram illustrates a structural block diagram of an access control device according to this application, applied to an electronic device, the device comprising:

[0221] The receiving module 11 is used to receive a handshake request message based on an intermediate layer protocol sent by the terminal. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model.

[0222] The acquisition module 12 is used to acquire the total historical quantity, which includes the total number of historical handshake request messages received in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is located before the current time.

[0223] The return module 13 is used to return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal when the total number of historical data is less than a preset number.

[0224] In one alternative implementation, the intermediate layer protocol includes Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

[0225] In an alternative implementation, the apparatus further includes:

[0226] The determination module is used to determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device when the total number of historical data is greater than or equal to a preset number.

[0227] The return module is further configured to: return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal if the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device.

[0228] In an alternative implementation, the apparatus further includes:

[0229] The stop module is used to stop processing the handshake request message sent by the terminal when the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0230] In an alternative implementation, the apparatus further includes:

[0231] The disconnect module is used to disconnect the communication connection between the electronic device and the terminal located at the transport layer if a communication connection at the transport layer has been established when the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

[0232] In an alternative implementation, the apparatus further includes:

[0233] An addition module is provided to increase the total number of recorded historical records based on the handshake request message sent by the terminal.

[0234] In an optional implementation, the handshake request message sent by the terminal is used to request a handshake with one of the multiple servers in the distributed service system.

[0235] The acquisition module includes:

[0236] The first acquisition unit is used to acquire the historical quantity of each server in the distributed service system. The historical quantity of the server includes the total number of historical handshake request messages received by the server in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol.

[0237] The calculation unit is used to calculate the sum of the historical quantities of each server in the distributed service system to obtain the total historical quantity.

[0238] In one optional implementation, the acquisition module includes:

[0239] The second acquisition unit is used to acquire the domain name requested by the terminal based on the handshake request message sent by the terminal;

[0240] The third acquisition unit is used to acquire the total historical quantity corresponding to the domain name, which includes the total number of handshake request messages based on the intermediate layer protocol received during the historical time period that request the domain name.

[0241] In one optional implementation, the determining module includes:

[0242] The fourth acquisition unit is used to acquire the flow control ratio based on the total historical quantity and the preset quantity.

[0243] The first determining unit is used to determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the flow control ratio.

[0244] In one optional implementation, the first determining unit includes:

[0245] Set sub-units to set multiple preset labels;

[0246] A filtering subunit is used to filter a portion of preset tags from the plurality of preset tags according to the flow control ratio;

[0247] The selection subunit is used to randomly select a preset tag from the plurality of preset tags for the handshake request message sent by the terminal;

[0248] The first determining subunit is used to determine the flow control condition triggered by the handshake request message sent by the terminal when the selected preset tag is located in the part of the preset tags;

[0249] or,

[0250] The second determining subunit is used to determine that the handshake request message sent by the terminal has not triggered the flow control condition of the electronic device when the selected preset tag is not located in the part of the preset tags.

[0251] In one optional implementation, the determining module includes:

[0252] The fifth acquisition unit is used to acquire the identification information of the terminal based on the handshake request message sent by the terminal;

[0253] The second determining unit is used to search for the terminal's identification information in the whitelist; if the terminal's identification information is found in the whitelist, it determines that the handshake request message sent by the terminal has not triggered the flow control condition; or, if the terminal's identification information is not found in the whitelist, it determines that the handshake request message sent by the terminal has triggered the flow control condition.

[0254] or,

[0255] The third determining unit is used to search for the identification information of the terminal in the blacklist; if the identification information of the terminal is found in the blacklist, it determines that the handshake request message sent by the terminal triggers the flow control condition; or, if the identification information of the terminal is not found in the blacklist, it determines that the handshake request message sent by the terminal does not trigger the flow control condition.

[0256] In this application, a handshake request message based on an intermediate layer protocol is sent by a receiving terminal. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model. The total historical count is obtained, which includes the total number of historical handshake request messages received within a historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol, and the historical time period is before the current time. If the total historical count is less than a preset count, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal.

[0257] This application enables the following: when the total historical number is less than a preset number, a handshake response message based on an intermediate layer protocol is returned to the terminal based on the handshake request message sent by the terminal. Conversely, when the total historical number is greater than or equal to the preset number, a handshake response message based on an intermediate layer protocol is not returned to the terminal based on the handshake request message sent by the terminal. For example, the handshake request message sent by the terminal is not processed, and the relevant steps of the SSL handshake are not performed, thus eliminating the system resource consumption generated during the SSL handshake phase. This can save the server's system resources and reduce the load on the server's system resources as much as possible.

[0258] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0259] This application provides one or more machine-readable media storing instructions that, when executed by one or more processors, cause an electronic device to perform one or more methods as described in the above embodiments. In this application, the electronic device includes a server, a gateway, sub-devices, etc., and the sub-devices are devices such as Internet of Things (IoT) devices.

[0260] Embodiments of this disclosure can be implemented as an apparatus with any suitable hardware, firmware, software, or any combination thereof, configured as desired. This apparatus may include electronic devices such as servers (clusters) and terminal devices such as IoT devices.

[0261] Figure 8 An exemplary apparatus 1300 is schematically shown that can be used to implement the various embodiments of this application.

[0262] In one embodiment, Figure 8 An exemplary device 1300 is shown, which includes one or more processors 1302, a control module (chipset) 1304 coupled to at least one of the processors 1302, a memory 1306 coupled to the control module 1304, a non-volatile memory (NVM) / storage device 1308 coupled to the control module 1304, one or more input / output devices 1310 coupled to the control module 1304, and a network interface 1312 coupled to the control module 1304.

[0263] Processor 1302 may include one or more single-core or multi-core processors, and processor 1302 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 1300 can function as a server device such as a gateway in the embodiments of this application.

[0264] In some embodiments, apparatus 1300 may include one or more computer-readable media (e.g., memory 1306 or NVM / storage device 1308) having instructions 1314 and one or more processors 1302 that are combined with the one or more computer-readable media and configured to execute the instructions 1314 to implement the module and thus perform the actions in this disclosure.

[0265] In one embodiment, the control module 1304 may include any suitable interface controller to provide any suitable interface to at least one of the processors 1302 and / or any suitable device or component communicating with the control module 1304.

[0266] The control module 1304 may include a memory controller module to provide an interface to the memory 1306. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0267] Memory 1306 may be used, for example, to load and store data and / or instructions 1314 for device 1300. In one embodiment, memory 1306 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 1306 may include double data rate quad synchronous dynamic random access memory (DDR4 SDRAM).

[0268] In one embodiment, the control module 1304 may include one or more input / output controllers to provide interfaces to the NVM / storage device 1308 and (one or more) input / output devices 1310.

[0269] For example, NVM / storage device 1308 may be used to store data and / or instructions 1314. NVM / storage device 1308 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0270] NVM / storage device 1308 may include storage resources that are physically part of a device on which device 1300 is mounted, or that can be accessed by the device without needing to be part of the device. For example, NVM / storage device 1308 may be accessed via a network via one or more input / output devices 1310.

[0271] One or more input / output devices 1310 may provide an interface for device 1300 to communicate with any other suitable device. Input / output devices 1310 may include communication components, pinyin components, sensor components, etc. Network interface 1312 may provide an interface for device 1300 to communicate via one or more networks. Device 1300 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, etc., or combinations thereof.

[0272] In one embodiment, at least one of the processors 1302 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 1304. In one embodiment, at least one of the processors 1302 may be logically packaged with one or more controllers of the control module 1304 to form a system-in-package (SiP). In one embodiment, at least one of the processors 1302 may be integrated with the logic of one or more controllers of the control module 1304 on the same die. In one embodiment, at least one of the processors 1302 may be integrated with the logic of one or more controllers of the control module 1304 on the same die to form a system-on-a-chip (SoC).

[0273] In various embodiments, device 1300 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, device 1300 may have more or fewer components and / or different architectures. For example, in some embodiments, device 1300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0274] This application provides an electronic device, including: one or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, cause the electronic device to perform one or more methods as described in this application.

[0275] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0276] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0277] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable information processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable information processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0278] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable information processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0279] These computer program instructions can also be loaded onto a computer or other programmable information processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0280] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0281] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the element.

[0282] The above provides a detailed description of the access control method and apparatus provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An access control method, characterized in that, Applied to electronic devices, the method includes: The terminal receives a handshake request message based on an intermediate layer protocol, the intermediate layer protocol including a protocol applied between the application layer and the transport layer in a computer network model; the handshake request message is used to request a handshake with the server based on the intermediate layer protocol, and after the handshake, the terminal sends a request to the server. The domain name requested by the terminal is obtained based on the handshake request message sent by the terminal, and the total historical number corresponding to the domain name is obtained. The total historical number corresponding to the domain name includes the total number of handshake request messages based on the intermediate layer protocol received in the historical time period that requested the domain name. The historical time period is before the current time. If the total number of historical records is less than a preset number, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal. If the total number of historical data is greater than or equal to a preset number, determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device; If the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device, a handshake response message based on the intermediate layer protocol is returned to the terminal according to the handshake request message sent by the terminal. If the handshake request message sent by the terminal triggers the flow control condition of the electronic device, and a communication connection at the transport layer between the electronic device and the terminal has been established, the communication connection at the transport layer between the electronic device and the terminal shall be disconnected.

2. The method according to claim 1, characterized in that, The intermediate layer protocol includes Secure Sockets Layer (SSL) or Transport Security Layer (TLS).

3. The method according to claim 1, characterized in that, The method further includes: If the handshake request message sent by the terminal triggers the flow control condition of the electronic device, the processing of the handshake request message sent by the terminal shall be stopped.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: The total number of recorded historical records is incremented based on the handshake request message sent by the terminal.

5. The method according to any one of claims 1-3, characterized in that, The handshake request message sent by the terminal is used to request a handshake with one of the multiple servers in the distributed service system. The determination of the total number of historical records includes: Obtain the historical count of each server in the distributed service system. The historical count of the server includes the total number of historical handshake request messages received by the server in the historical time period. The historical handshake request messages include handshake request messages based on the intermediate layer protocol. The total historical count is obtained by summing the historical counts of each server in the distributed service system.

6. The method according to claim 1, characterized in that, The step of determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device includes: The flow control ratio is obtained based on the total historical quantity and the preset quantity; The flow control ratio determines whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device.

7. The method according to claim 6, characterized in that, The step of determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device based on the flow control ratio includes: Set multiple preset labels; According to the flow control ratio, some preset tags are filtered from the plurality of preset tags, and a preset tag is randomly selected from the plurality of preset tags for the handshake request message sent by the terminal; If the selected preset tag is located in the part of the preset tags, it is determined that the handshake request message sent by the terminal triggers the flow control condition of the electronic device; or, If the selected preset tag is not located in the aforementioned preset tags, it is determined that the handshake request message sent by the terminal did not trigger the flow control condition of the electronic device.

8. The method according to claim 1, characterized in that, The step of determining whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device includes: The terminal's identification information is obtained based on the handshake request message sent by the terminal; Search for the terminal's identification information in the whitelist; if the terminal's identification information is found in the whitelist, determine that the handshake request message sent by the terminal did not trigger the flow control condition; or, if the terminal's identification information is not found in the whitelist, determine that the handshake request message sent by the terminal triggered the flow control condition. or, The system searches for the terminal's identification information in the blacklist. If the terminal's identification information is found in the blacklist, it determines that the handshake request message sent by the terminal triggers the flow control condition. Alternatively, if the terminal's identification information is not found in the blacklist, it determines that the handshake request message sent by the terminal does not trigger the flow control condition.

9. An access control device, characterized in that, Applied to electronic devices, the device includes: The receiving module is used to receive a handshake request message sent by the terminal based on an intermediate layer protocol. The intermediate layer protocol includes a protocol applied between the application layer and the transport layer in a computer network model. The handshake request message is used to request a handshake with the server based on the intermediate layer protocol. After the handshake, the terminal sends a request to the server. The acquisition module is used to acquire the domain name requested by the terminal based on the handshake request message sent by the terminal, and to acquire the total historical number corresponding to the domain name. The total historical number corresponding to the domain name includes the total number of handshake request messages based on the intermediate layer protocol received in the historical time period that request the domain name. The historical time period is located before the current time. The return module is configured to: when the total historical count is less than a preset count, return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal; when the total historical count is greater than or equal to the preset count, determine whether the handshake request message sent by the terminal triggers the flow control condition of the electronic device; when the handshake request message sent by the terminal does not trigger the flow control condition of the electronic device, return a handshake response message based on the intermediate layer protocol to the terminal according to the handshake request message sent by the terminal; when the handshake request message sent by the terminal triggers the flow control condition of the electronic device, if a communication connection at the transport layer between the terminal and the terminal has been established, disconnect the communication connection at the transport layer between the terminal and the terminal.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the steps of the method as described in any one of claims 1-8 when executing the program.

11. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as claimed in any one of claims 1-8.

Images