Application flow comprehensive management method, device and electronic equipment

Abstract

The present invention discloses a method, device and electronic device for comprehensive management of application traffic, wherein the method comprises the following steps: a user terminal marks user request traffic so that the traffic request issued by the user terminal carries the mark; the user terminal initiates a request and sends the traffic to a user access layer gateway; rule management and configuration are performed, including setting traffic filtering rules, traffic parsing rules, traffic safety blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules and traffic forwarding rules; the user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, and identifies and filters the traffic through pre-configured filtering rules; according to pre-configured request processing rules, secondary processing is performed on the request traffic; according to pre-configured traffic forwarding rules, the secondary processed request traffic is forwarded to the corresponding application proxy gateway; the application proxy gateway performs inbound traffic proxy and outbound traffic proxy.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to an application flow comprehensive management method, device and electronic equipment. Background Art

[0002] The complexity of business calls under the microservice architecture increases exponentially. Although microservices provide a clear structure for development and a single developer only needs to maintain a small amount of application code, microservices bring unprecedented challenges to operation and maintenance. At the resource level, K8S is already the basis, but there is no good implementation of comprehensive solutions for application layer control related to user request traffic, including flexible traffic scheduling, fault simulation and automatic processing, and traffic mirroring.

[0003] This results in many problems in traffic management, such as: (1) User request traffic will be distributed to a large number of backend applications, making the proxy forwarding configuration at the access layer complicated, increasing maintenance and management costs, and prone to errors. (2) There is a strong demand for observable user request traffic, and it is necessary to be able to track and monitor the destination of traffic. (3) Business parties hope that traffic can be scheduled according to controllable logic, and specific traffic can be scheduled to predetermined applications. (4) When responding to emergencies, it is necessary to isolate, limit, and fuse traffic to avoid large-scale failures. (5) Traffic has many requirements for centralized control: unified security authentication, traffic replication and cleaning, traffic mirroring, and security testing. Summary of the invention

[0004] In view of the above problems, the present invention provides a method, device and electronic device for comprehensive management of application traffic, which are used to perform comprehensive operation and maintenance control of east-west traffic and north-south traffic of application traffic, and provide one-stop traffic switching, fusing, isolation, configuration, current limiting, authentication, scheduling and other functions.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0006] In a first aspect, the present invention provides a method for integrated management of application traffic, comprising the following steps:

[0007] The user end marks the user request traffic so that the traffic request sent by the user end carries the mark; the user end initiates the request and sends the traffic to the user access layer gateway;

[0008] Conduct rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules, and traffic replication rules;

[0009] The user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, identifies and filters the traffic through pre-configured filtering rules; performs secondary processing on the request traffic according to the pre-configured request processing rules; forwards the secondary processed request traffic to the corresponding application proxy gateway according to the pre-configured traffic forwarding rules;

[0010] The application proxy gateway performs inbound and outbound traffic proxy.

[0011] In a possible implementation manner, the user-side marking of user request traffic includes embedding an SDK into a browser and an application of the user-side, and adding a Trace ID header mark to all application-side requests through the SDK.

[0012] In a possible implementation, parsing the request traffic includes identifying and parsing different protocols through a parsing plug-in, and the parsed content includes Trace ID header tags and variables and attributes identifiable by other protocol layers to generate a variable list.

[0013] In a possible implementation manner, identifying and filtering traffic using preconfigured filtering rules includes applying the preconfigured filtering rules to a variable list, and determining a next processing rule for the traffic request using the traffic filtering rule calculation.

[0014] In a possible implementation manner, the secondary processing of the request traffic includes traffic security blocking, which is used to block the traffic in real time according to preconfigured security blocking rules.

[0015] In a possible implementation, the secondary processing of the request traffic includes flow limiting, which is used to support flow limiting in different dimensions according to preconfigured flow limiting rules.

[0016] In a possible implementation, the secondary processing of the request traffic includes fusing, which is used to perform fusing processing on the traffic requests that meet the conditions according to preconfigured fusing rules.

[0017] In a possible implementation, the secondary processing of the request traffic includes a replication simulation for replicating the request according to a preconfigured replication rule and forwarding the replicated request to the application proxy gateway under test.

[0018] In one possible implementation, the application proxy gateway performs inbound traffic proxying by performing protocol parsing on the traffic forwarded from the user access gateway or the traffic from remote calls of other applications, and then limiting, degrading, or fusing the traffic before forwarding the traffic to the application.

[0019] In one possible implementation, the application proxy gateway performs outbound traffic proxying, including performing protocol parsing on the application's calls to other applications or the application's external calls, and then limiting, downgrading, or fusing the traffic, and forwarding the traffic to other internal proxy gateways, databases, caches, or external calls.

[0020] In a second aspect, an embodiment of the present invention provides an application traffic integrated management device, including a user request traffic marking module, a rule management and configuration module, a user access layer gateway module, and a plurality of application gateway proxy modules.

[0021] The marking user request traffic module is used for the user terminal to mark the user request traffic, so that the traffic request sent by the user terminal carries the mark; the user terminal initiates the request and sends the traffic to the user access layer gateway;

[0022] The rule management and configuration module is used to perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules and traffic replication rules;

[0023] The user access layer gateway module is used to accept user requests, parse the request traffic according to the traffic parsing rules, identify and filter the traffic through pre-configured filtering rules; perform secondary processing on the request traffic according to the pre-configured request processing rules; forward the secondary processed request traffic to the corresponding application proxy gateway module according to the pre-configured traffic forwarding rules;

[0024] The application proxy gateway module is used to perform inbound traffic proxy and outbound traffic proxy.

[0025] In a third aspect, the present invention provides an electronic device, comprising a processor and a memory storing computer executable instructions, wherein the executable instructions, when executed, cause the processor to execute the method for integrated application traffic management as described in any one of the above items.

[0026] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by a processor, they implement the application traffic comprehensive management method as described in any one of the above items.

[0027] The present invention has the following beneficial effects:

[0028] (1) The marking of request traffic and the subsequent traffic analysis and processing combined with the marking realize the tracking of the detailed call link of the entire request traffic. Business anomalies or failures can be efficiently checked through the data of the call link.

[0029] (2) Dynamic flow control based on configurable rules can better cope with sudden traffic, eliminate or smooth traffic peaks, and ensure the stability of the backend business system.

[0030] (3) The dynamically pluggable parsing plug-in enables the present invention to not only parse common application protocols such as HTTP and GRPC, but also support any application protocol by supporting the running of plug-ins written in multiple other programming languages ​​(Rust / Python / Golang / JavaScript / C++, etc.).

[0031] (4) The rule analysis and execution uses a rule engine, which can configure various complex rules more powerfully and flexibly. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of the steps of the application traffic integrated management method according to an embodiment of the present invention;

[0033] Figure 2 It is a principle block diagram of the application traffic integrated management device according to an embodiment of the present invention;

[0034] Figure 3 The figure is a principle block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Reference Figure 1 , which is a flowchart of a method for integrated application traffic management according to an embodiment of the present invention, comprising the following steps:

[0037] S10, the user terminal marks the user request traffic so that the traffic request sent by the user terminal carries the mark; the user terminal initiates the request and sends the traffic to the user access layer gateway;

[0038] S20, perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules, and traffic replication rules;

[0039] S30, the user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, identifies and filters the traffic through pre-configured filtering rules; performs secondary processing on the request traffic according to the pre-configured request processing rules; forwards the secondary processed request traffic to the corresponding application proxy gateway according to the pre-configured traffic forwarding rules; the user access layer gateway is responsible for user access traffic, i.e., north-south traffic management.

[0040] S40, the application proxy gateway performs inbound traffic proxy and outbound traffic proxy. The application proxy gateway is responsible for the inter-application call traffic, i.e., east-west traffic management.

[0041] Through the above-mentioned comprehensive application traffic management method, comprehensive operation and maintenance control of east-west traffic and north-south traffic can be carried out on application traffic, providing one-stop traffic switching, fusing, isolation, configuration, current limiting, authentication, scheduling and other functions.

[0042] In one embodiment of the present invention, marking user request traffic on the user side includes embedding SDK into the browser and application of the user side, and adding Trace ID header mark to all application side requests through the SDK. For example, the browser of the user side, mobile phone APP, DingTalk or WeChat applet, use HTTP protocol to pass Trace ID header mark.

[0043] In an application traffic integrated management method of an embodiment of the present invention, parsing request traffic includes identifying and parsing different protocols through a parsing plug-in, and the parsed content includes Trace ID header tags and variables and attributes identifiable by other protocol layers to generate a variable list. For example, HTTP cookies, other HTTP headers, request URL parameters, request message content, etc. The parsing plug-in supports development in multiple programming languages ​​by using the WebAssembly specification. By running the parsing plug-in, you can perform customized parsing on any application protocol.

[0044] In the specific implementation, the plug-in system is implemented based on the WebAssembly specification, and the process is as follows:

[0045] Abstract the functions of the plug-in and define interface specifications. The core interfaces mainly include data receiving interface, data conversion interface, data encryption and decryption interface, data decompression interface, and data encoding and decoding interface;

[0046] Develop plug-in runtime modules based on the WebAssembly specification, which can be developed in Rust language;

[0047] Develop plugins using other WebAssembly-supported languages ​​(such as Rust, Python, Golang, etc.) according to the interface specifications;

[0048] Upload the plug-in to the file server, obtain the accessible address of the plug-in file, and configure the access address of the plug-in file into the platform;

[0049] When the plug-in is running, the module reads the configuration, dynamically downloads and loads the plug-in by configuring the access address of each plug-in;

[0050] The plug-in runtime module follows the previously defined interface specifications. When traffic data arrives, it processes the data by calling the corresponding interface and returns the processed output results to the platform.

[0051] The plug-in system implemented above makes the plug-in system dynamically pluggable and has good scalability.

[0052] In an application traffic integrated management method according to an embodiment of the present invention, identifying and filtering traffic by preconfigured filtering rules includes applying the preconfigured filtering rules to a variable list, and determining the next processing rule of the traffic request by calculating the traffic filtering rules. For example, this method can be used to perform simple application layer cleaning on traffic, such as filtering requests with too large HTTP headers.

[0053] In an embodiment of the present invention, a method for comprehensive management of application traffic includes secondary processing of request traffic, including traffic security blocking, which is used to block traffic in real time according to pre-configured security blocking rules. For example, traffic is blocked according to the blacklist and whitelist of the requesting IP, or forwarded to a security honeypot. Security risk judgment can also be made according to the content of the request through the application security scoring rules, and if the security score is too low, it is blocked.

[0054] In an embodiment of the present invention, a comprehensive application traffic management method performs secondary processing on request traffic including flow limiting, which is used to support flow limiting in different dimensions according to preconfigured flow limiting rules. The flow limiting can utilize the distributed bucket flow limiting algorithm implemented by Redis, which can quickly and efficiently determine whether the traffic is overspeeding, and can greatly increase the buffer space of the traffic after overspeeding. It can also protect the backend business well for burst traffic, and ensure that the actual request traffic is smoothly forwarded to the backend business. For example, the number of requests per second for a single, a group, or a specific request IP can be limited; the number of requests per second for a single, a group, or a specific user ID can also be limited; the number of requests per second for a specific region can also be limited; the number of requests per second for a single, a group, or a specific URL can also be limited.

[0055] In an embodiment of the present invention, a comprehensive application traffic management method performs secondary processing on request traffic, including fusing, which is used to perform fusing processing on traffic requests that meet the conditions according to pre-configured fusing rules. When the traffic reaches a certain amount, the fusing rules are used to fuse specific requests or backend services, thereby playing a role in protecting important user requests and core backend services, which can greatly improve the robustness of the system and ensure that the system can be basically available under unexpected pressure. For example, a URL whose response time for three consecutive requests exceeds 10 seconds can be fused for 60 seconds.

[0056] In an embodiment of the present invention, a comprehensive application traffic management method includes secondary processing of request traffic including replication simulation, which is used to replicate the request according to preconfigured replication rules, and forward the replicated request to a bypassed proxy gateway. For example: by replicating the request traffic to the application proxy gateway under test. It can be used to simulate the real request traffic of the production environment to the maximum extent, so that the test environment can accept traffic that is almost consistent with the production environment, and can avoid as much as possible the problems of low test coverage or low BUG detection rate caused by the difference between the test environment and the production environment. The request traffic can also be replicated to the content security scanning gateway, so as to achieve real-time security scanning of the request content without affecting the performance of the production environment.

[0057] In an application traffic integrated management method of an embodiment of the present invention, the application proxy gateway performs inbound traffic proxying, including performing protocol parsing on the traffic forwarded from the user access gateway or the traffic from other application remote calls, and then forwarding the traffic to the application after limiting, degrading or fusing the traffic. The inbound traffic proxy can identify and convert protocols, and can deploy applications with different remote call protocols in the same application cluster at the same time, realizing heterogeneous hybrid deployment in a true sense.

[0058] In an application traffic comprehensive management method of an embodiment of the present invention, the application proxy gateway performs outbound traffic proxying, including performing protocol parsing on the application's calls to other applications or the application's external calls, and then limiting, downgrading or fusing the traffic, and forwarding the traffic to other internal proxy gateways, databases, caches or external calls. Limiting can limit the number of calls per second for a single, a group or a specific user ID; it can also limit the number of calls per second for a single, a group or a specific function. Degradation starts from the edge and gradually shuts down the application's functions according to the application's status (pressure, performance, response time) and pre-configured degradation rules until the application status is restored to the level required by the pre-configured rules.

[0059] Corresponding to the embodiment of the method of the present invention, the embodiment of the present invention provides an application traffic comprehensive management device, including a user request traffic marking module, a rule management and configuration module, a user access layer gateway module and several application gateway proxy modules, wherein the user request traffic marking module is used for the user end to mark the user request traffic, so that the traffic request issued by the user end carries the mark; the user end initiates a request and sends the traffic to the user access layer gateway; the rule management and configuration module is used to perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fuse rules, traffic degradation rules, traffic forwarding rules and traffic replication rules; the user access layer gateway module is used to accept user requests, parse the request traffic according to the traffic parsing rules, and identify and filter the traffic through pre-configured filtering rules; according to the pre-configured request processing rules, the request traffic is secondary processed; according to the pre-configured traffic forwarding rules, the request traffic after secondary processing is forwarded to the corresponding application proxy gateway module; the application proxy gateway module is used to perform inbound traffic proxy and outbound traffic proxy.

[0060] Through the above-mentioned application traffic comprehensive management device, comprehensive operation and maintenance control of east-west traffic and north-south traffic can be carried out on application traffic, providing one-stop traffic switching, fusing, isolation, configuration, current limiting, authentication, scheduling and other functions.

[0061] In an application traffic integrated management device according to an embodiment of the present invention, marking user request traffic at the user end includes embedding SDK in the browser and application at the user end, and adding Trace ID header mark to all application end requests through the SDK. For example, the browser at the user end, mobile phone APP, DingTalk or WeChat applet, use HTTP protocol to pass Trace ID header mark.

[0062] In an application traffic integrated management device of an embodiment of the present invention, parsing request traffic includes identifying and parsing different protocols through a parsing plug-in, and the parsed content includes Trace ID header tags and variables and attributes identifiable by other protocol layers to generate a variable list. For example, HTTP cookies, other HTTP headers, request URL parameters, request message content, etc. The parsing plug-in supports development in multiple programming languages ​​by using the WebAssembly specification. By running the parsing plug-in, you can perform customized parsing on any application protocol.

[0063] In the specific implementation method, the plug-in system is implemented based on the WebAssembly specification, and the process is as follows: abstract the functions of the plug-in and define the interface specifications. The core interfaces mainly include data receiving interface, data conversion interface, data encryption and decryption interface, data decompression interface, and data encoding and decoding interface; develop the plug-in runtime module based on the WebAssembly specification, which can be developed using the Rust language; use other languages ​​that support WebAssembly (such as Rust, Python, Golang...) to develop plug-ins according to the interface specifications; upload the plug-in to the file server, obtain the accessible address of the plug-in file, and configure the access address of the plug-in file to the platform; the plug-in runtime module reads the configuration, and dynamically downloads and loads the plug-in by configuring the access addresses of each plug-in in it; the plug-in runtime module processes the data according to the previously defined interface when traffic data arrives, and returns the processed output results to the platform.

[0064] The plug-in system implemented above makes the plug-in system dynamically pluggable and has good scalability.

[0065] In an application traffic integrated management device according to an embodiment of the present invention, identifying and filtering traffic by preconfigured filtering rules includes applying the preconfigured filtering rules to a variable list, and determining the next processing rule of the traffic request by calculating the traffic filtering rules. For example, this method can be used to perform simple application layer cleaning on traffic, such as filtering requests with too large HTTP headers.

[0066] In an application traffic integrated management device according to an embodiment of the present invention, secondary processing of request traffic includes traffic security blocking, which is used to block traffic in real time according to pre-configured security blocking rules. For example, traffic is blocked according to the blacklist and whitelist of the requesting IP, or forwarded to a security honeypot. Security risk judgment can also be made according to the content of the request through the application security scoring rules, and if the security score is too low, it is blocked.

[0067] In an application traffic comprehensive management device of an embodiment of the present invention, secondary processing of request traffic includes flow limiting, which is used to support flow limiting in different dimensions according to preconfigured flow limiting rules. The flow limiting can utilize the distributed bucket flow limiting algorithm implemented by Redis, which can quickly and efficiently determine whether the traffic is overspeeding, and can greatly increase the buffer space of the traffic after overspeeding. It can also protect the backend business well for burst traffic, and ensure that the actual request traffic is smoothly forwarded to the backend business. For example, the number of requests per second for a single, a group, or a specific request IP can be limited; the number of requests per second for a single, a group, or a specific user ID can also be limited; the number of requests per second for a specific region can also be limited; the number of requests per second for a single, a group, or a specific URL can also be limited.

[0068] In an application traffic integrated management device of an embodiment of the present invention, secondary processing of request traffic includes fusing, which is used to perform fusing processing on traffic requests that meet the conditions according to pre-configured fusing rules. When the traffic reaches a certain amount, the fusing rules are used to fuse specific requests or backend services, thereby playing a role in protecting important user requests and core backend services, which can greatly improve the robustness of the system and ensure that the system can be basically available under unexpected pressure. For example, a URL whose response time for three consecutive requests exceeds 10 seconds can be fused for 60 seconds.

[0069] In an application traffic integrated management device according to an embodiment of the present invention, secondary processing of request traffic includes replication simulation, which is used to replicate requests according to preconfigured replication rules, and forward the replicated requests to a bypassed proxy gateway. For example: by replicating the request traffic to the application proxy gateway under test. It can be used to simulate the real request traffic of the production environment to the maximum extent, so that the test environment can accept traffic that is almost consistent with the production environment, and can avoid as much as possible the problems of low test coverage or low BUG detection rate caused by the difference between the test environment and the production environment. The request traffic can also be replicated to the content security scanning gateway, so as to achieve real-time security scanning of the request content without affecting the performance of the production environment.

[0070] In an application traffic integrated management device according to an embodiment of the present invention, the application proxy gateway performs inbound traffic proxying, including performing protocol parsing on the traffic forwarded from the user access gateway or the traffic from other application remote calls, and then forwarding the traffic to the application after limiting, degrading or fusing the traffic. The inbound traffic proxy can identify and convert protocols, and can deploy applications with different remote call protocols in the same application cluster at the same time, realizing heterogeneous hybrid deployment in a true sense.

[0071] In an application traffic integrated management device according to an embodiment of the present invention, the application proxy gateway performs traffic proxying, including performing protocol parsing on the application's calls to other applications or the application's external calls, and then limiting, downgrading or fusing the traffic, and forwarding the traffic to other internal proxy gateways, databases, caches or external calls. Limiting can limit the number of calls per second for a single, a group or a specific user ID; it can also limit the number of calls per second for a single, a group or a specific function. Degradation starts from the edge and gradually shuts down the application's functions according to the application's status (pressure, performance, response time) and pre-configured degradation rules until the application status is restored to the level required by the pre-configured rules.

[0072] Reference Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The electronic device 300 is presented in the form of a general-purpose computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, a bus connecting different device components (including a storage unit 320 and a processing unit 310), an I / O interface 330, a display unit 340, etc. Among them, the storage unit stores a program code, and the program code can be executed by the processing unit 310, so that the processing unit 310 performs the steps of various exemplary embodiments of the present invention described in the above-mentioned application traffic comprehensive management method section. For example, the processing unit 310 can perform the following steps:

[0073] S10, the user terminal marks the user request traffic so that the traffic request sent by the user terminal carries the mark; the user terminal initiates the request and sends the traffic to the user access layer gateway;

[0074] S20, perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules, and traffic replication rules;

[0075] S30, the user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, identifies and filters the traffic through pre-configured filtering rules; performs secondary processing on the request traffic according to the pre-configured request processing rules; forwards the secondary processed request traffic to the corresponding application proxy gateway according to the pre-configured traffic forwarding rules; the user access layer gateway is responsible for user access traffic, i.e., north-south traffic management.

[0076] S40, the application proxy gateway performs inbound traffic proxy and outbound traffic proxy. The application proxy gateway is responsible for the inter-application call traffic, i.e., east-west traffic management.

[0077] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 3201 and / or a cache storage unit 3202, and may further include a read-only storage unit (ROM) 3203. The storage unit 320 may also include a program / utility having a set (at least one) of program modules, the program modules including but not limited to: an operating device, one or more application programs, other program modules, and program data, each of which or some combination may include the implementation of a network environment.

[0078] The bus may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0079] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network (Internet)) through a network adapter 350. The network adapter 350 may communicate with other modules of the electronic device 300 through a bus. The electronic device 300 displays the information to be displayed through the display unit 340. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices.

[0080] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the application traffic integrated management method according to the present invention. When the computer program is executed by a data processing device, the computer-readable storage medium can implement the above method of the present invention, that is, it includes the following steps:

[0081] S10, the user terminal marks the user request traffic so that the traffic request sent by the user terminal carries the mark; the user terminal initiates the request and sends the traffic to the user access layer gateway;

[0082] S20, perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules, and traffic replication rules;

[0083] S30, the user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, identifies and filters the traffic through pre-configured filtering rules; performs secondary processing on the request traffic according to the pre-configured request processing rules; forwards the secondary processed request traffic to the corresponding application proxy gateway according to the pre-configured traffic forwarding rules; the user access layer gateway is responsible for user access traffic, i.e., north-south traffic management.

[0084] S40, the application proxy gateway performs inbound traffic proxy and outbound traffic proxy. The application proxy gateway is responsible for the inter-application call traffic, i.e., east-west traffic management.

[0085] The computer program may be stored on one or more computer readable media. The computer readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, device or component, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0086] Computer readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution device, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0087] The program code for performing the operation of the embodiments of the present invention may be written in any combination of one or more programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0088] In summary, the present invention can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that general data processing devices such as microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0089] It should be understood that the exemplary embodiments described herein are illustrative rather than restrictive. Although one or more embodiments of the present invention have been described in conjunction with the accompanying drawings, it should be understood by those skilled in the art that various changes in form and detail may be made without departing from the spirit and scope of the present invention as defined by the appended claims.

Claims

1. A method for comprehensive management of application traffic, characterized in that: The following steps are involved: The user end marks the user request traffic so that the traffic request sent by the user end carries the mark; the user end initiates the request and sends the traffic to the user access layer gateway; Conduct rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules, and traffic replication rules; The user access layer gateway accepts user requests, parses the request traffic according to the traffic parsing rules, identifies and filters the traffic through the pre-configured traffic filtering rules; performs secondary processing on the request traffic according to the request processing rules; and forwards the secondary processed request traffic to the corresponding application proxy gateway according to the pre-configured traffic forwarding rules; Apply proxy gateway to perform inbound and outbound traffic proxy; The application proxy gateway performs inbound traffic proxying, including: parsing the protocol of the traffic forwarded by the user access layer gateway or the traffic from other applications’ remote calls, and then forwarding the traffic to the application after limiting, degrading or fusing the traffic; The outbound traffic proxying performed by the application proxy gateway includes: performing protocol parsing on the traffic of the application's calls to other applications or the application's external calls, and then limiting, degrading or fusing the traffic, and forwarding the traffic to other internal proxy gateways, databases, caches or external calls.

2. The method for comprehensive application traffic management according to claim 1, characterized in that: The user-side marking of user request traffic includes embedding SDK into the browser and application of the user-side, and adding Trace ID header mark to all application-side requests through the SDK.

3. The method for comprehensive application traffic management according to claim 1, characterized in that: Parsing the request traffic includes identifying and parsing different protocols through parsing plug-ins. The parsed content includes Trace ID header tags and variables and attributes identifiable by other protocol layers to generate a variable list.

4. The method for comprehensive application traffic management according to claim 3, characterized in that: The identifying and filtering of traffic by using pre-configured traffic filtering rules includes applying the pre-configured traffic filtering rules to the variable list, and determining the next processing rule of the traffic request by using the traffic filtering rules calculation.

5. The method for comprehensive application traffic management according to claim 1, characterized in that: The secondary processing of the request traffic includes traffic security blocking, which is used to block the traffic in real time according to preconfigured traffic security blocking rules.

6. The method for comprehensive application traffic management according to claim 1, characterized in that: The secondary processing of the request traffic includes flow limiting, which is used to support flow limiting in different dimensions according to preconfigured flow limiting rules.

7. The method for comprehensive application traffic management according to claim 1, characterized in that: The secondary processing of the request traffic includes fusing, which is used to perform fusing processing on the traffic requests that meet the conditions according to the preconfigured traffic fusing rules.

8. The method for integrated application traffic management according to claim 1, characterized in that: The secondary processing of the request traffic includes replication simulation, which is used to replicate the request according to the preconfigured traffic replication rules and forward the replicated request to the application proxy gateway for the test.

9. An application traffic integrated management device, characterized in that: It includes a module for marking user request traffic, a rule management and configuration module, a user access layer gateway module, and several application gateway proxy modules. The marking user request traffic module is used for the user terminal to mark the user request traffic, so that the traffic request sent by the user terminal carries the mark; the user terminal initiates the request and sends the traffic to the user access layer gateway; The rule management and configuration module is used to perform rule management and configuration, including setting traffic filtering rules, traffic parsing rules, traffic security blocking rules, traffic limiting rules, traffic fusing rules, traffic degradation rules, traffic forwarding rules and traffic replication rules; The user access layer gateway module is used to accept user requests, parse the request traffic according to the traffic parsing rules, identify and filter the traffic through pre-configured traffic filtering rules; perform secondary processing on the request traffic according to the request processing rules; and forward the secondary processed request traffic to the corresponding application proxy gateway module according to the pre-configured traffic forwarding rules; The application proxy gateway module is used to perform inbound traffic proxy and outbound traffic proxy; The application proxy gateway performs inbound traffic proxying, including: performing protocol parsing on the traffic forwarded from the user access layer gateway or the traffic from remote calls of other applications, and then limiting, downgrading or fusing the traffic, and then forwarding the traffic to the application; the application proxy gateway performs outbound traffic proxying, including: performing protocol parsing on the traffic from the application's calls to other applications or the application's external calls, and then limiting, downgrading or fusing the traffic, and then forwarding the traffic to other internal proxy gateways, databases, caches or external calls.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory storing computer executable instructions, and the executable instructions, when executed, enable the processor to execute the application traffic integrated management method according to any one of claims 1-8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and when the one or more programs are executed by the processor, the application traffic integrated management method described in any one of claims 1-8 is implemented.

Images