A current limiting method and system for protecting applications

Abstract

The present invention discloses a current limiting method and system for protecting applications, and the method includes: when the global current limiting judgment value returns 1, access is allowed; when the global current limiting judgment value returns ‑1, access is intercepted; when the global current limiting judgment value returns 0, a method current limiter judgment step is executed; if the current limiting judgment values ​​corresponding to all method current limiters return 0, the current limiting modes corresponding to the global current limiter and all method current limiters allow access; when the current limiting judgment value of the current method current limiter returns 1, the current limiting mode allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge; when the current limiting judgment value of the current method current limiter returns ‑1, access is intercepted. The system includes a data acquisition module, a global current limiter acquisition module, a global current limiter judgment module and a method current limiter judgment module. The current limiting method and system for protecting applications solve the problem of inflexible current limiting methods based on Java web.

Description

Technical Field

[0001] The present invention relates to the field of traffic management, and in particular to a flow limiting method and system for protecting applications. Background Art

[0002] Current limiting refers to limiting the number of times a certain code is executed within a certain period of time through certain methods. At present, the industry generally sets the access frequency cap directly at the unified gateway, such as: no more than 100 accesses within 1 second. However, the existing current limiting methods based on Java web have few types of current limiting modes that can be set, and multiple current limiting modes cannot be used together, resulting in inflexible current limiting methods. Summary of the invention

[0003] In order to overcome the defects of the prior art, an object of the present invention is to provide a current limiting method for protecting applications to solve the above problems;

[0004] In order to overcome the defects of the prior art, another object of the present invention is to provide a current limiting system for protection applications to solve the above problems;

[0005] The technical solution adopted by the present invention to solve the technical problem is: a current limiting method for protecting applications, comprising:

[0006] Data acquisition step: obtain the current access data and input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return;

[0007] A global current limiter acquisition step: acquiring the global current limiter and determining whether the global current limiter is empty; when the global current limiter is not empty, executing a global current limiter determination step; when the global current limiter is empty, executing a method current limiter determination step;

[0008] Global current limiter judgment step: obtain the current limit judgment value corresponding to the global current limiter; judge the current limit judgment value corresponding to the global current limiter; when the global current limit judgment value returns 1, access is allowed; when the global current limit judgment value returns -1, access is blocked; when the global current limit judgment value returns 0, the method current limiter judgment step is executed;

[0009] Method current limiter judgment step: obtaining each method current limiter and sorting all the method current limiters; obtaining the current limit judgment value corresponding to the method current limiter in the order of sorting, and judging the current limit judgment value corresponding to the method current limiter;

[0010] When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access;

[0011] When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value;

[0012] When the current limit judgment value of the current method limiter returns -1, the access is intercepted;

[0013] It is worth noting that in the global current limiter judgment step, the current limit manager obtains the current limit judgment value corresponding to the global current limiter by calling the current limit manager's private method checkAccessible; the current limit manager judges the current limit judgment value corresponding to the global current limiter by calling the current limit manager's private method accessible(String method);

[0014] In the method current limiter judgment step, the current limit manager obtains the current limit judgment value corresponding to the method current limiter by calling the current limit manager's private method checkAccessible, and the current limit manager judges the current limit judgment value corresponding to the current limiter by calling the current limit manager's private method accessible(String method);

[0015] Optionally, before the data acquisition step, a current limiting manager initialization step is also included;

[0016] The current limiting manager initialization step: obtaining the current limiting configuration of the current limiting manager;

[0017] Create a new current limiting manager object;

[0018] Process the current limiting configuration line by line, and call the putLimitCondition(Stringmethod, String condition) method of the current limiting manager object to cut out the configuration of each current limiting actuator and assemble it into a current limiter;

[0019] When the parameter passed by method is allmethod, the current limiter is set as the global current limiter; otherwise, the parameter passed by method and the current limiter are added to the list corresponding to the method current limiter to form a method current limiter;

[0020] Preferably, between the data acquisition step and the global current limiter acquisition step, a business method pre-calling step is also included;

[0021] The pre-calling step of the business method: execute the preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) method, extract the sessionId and the user's IP from the parameter request, call the getUserId() method to obtain the userId, then store the sessionId, the user's IP and the userId into the current limiting context, and extract the method name of the business method from the parameter handler, and finally call the in(String method) method of the current limiting manager, where sessionId is the session ID and userId is the user ID;

[0022] Specifically, after the method limiter judgment step, a business method post-calling step is also included;

[0023] The business method post-call step: execute the postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager;

[0024] It is worth noting that a current limiting system for protecting an application includes:

[0025] Data acquisition module: used to obtain the current access data, input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return;

[0026] Global current limiter acquisition module: used to obtain the global current limiter and determine whether the global current limiter is empty; used to execute the global current limiter judgment module when the global current limiter is not empty; used to execute the method current limiter judgment module when the global current limiter is empty;

[0027] Global current limiter judgment module: used to obtain the current limit judgment value corresponding to the global current limiter; used to judge the current limit judgment value corresponding to the global current limiter; used to allow access when the global current limit judgment value returns 1, used to intercept access when the global current limit judgment value returns -1, and used to execute the method current limiter judgment module when the global current limit judgment value returns 0;

[0028] Method current limiter judgment module: used to obtain each method current limiter and sort all method current limiters; used to obtain the current limit judgment value corresponding to the method current limiter in the sorted order, and judge the current limit judgment value corresponding to the method current limiter;

[0029] When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access.

[0030] When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value;

[0031] It is used to intercept access when the current limit judgment value of the current method limiter returns -1;

[0032] Preferably, the global current limiter judgment module is used to obtain the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method checkAccessible of the current limit manager; and is also used to judge the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method accessible(String method) of the current limit manager;

[0033] The method current limiter judgment module is used to obtain the current limit judgment value corresponding to the method current limiter by using the current limit manager by calling the private method checkAccessible of the current limit manager, and is also used to judge the current limit judgment value corresponding to the current limiter by using the current limit manager by calling the private method accessible(String method) of the current limit manager;

[0034] Specifically, it also includes a current limiting manager initialization module, which is used to obtain the current limiting configuration of the current limiting manager; to create a new current limiting manager object; to process the current limiting configuration line by line, and call the putLimitCondition(String method, String condition) method of the current limiting manager object to cut out the configuration of each current limiting executor and assemble it into a current limiter; when the parameter passed by method is allmethod, the current limiter is set to a global current limiter; otherwise, the parameter passed by method and the current limiter are added to the list corresponding to the method current limiter to form a method current limiter;

[0035] Optionally, it also includes a business method pre-call module, which is used to execute the preHandle(HttpServletRequest request, HttpServletResponse response, Objecthandler) method, extract the sessionId and the user's IP from the parameter request, and call the getUserId() method to obtain the userId, which is used to store the sessionId, the user's IP and the userId into the current limiting context, and extract the method name of the business method from the parameter handler, which is used to call the in(String method) method of the current limiting manager, where sessionId is the session ID and userId is the user ID;

[0036] It is worth noting that it also includes a business method post-call module, which is used to execute the postHandle(HttpServletRequest request, HttpServletResponse response, Objecthandler,ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager;

[0037] The beneficial effect of the present invention is that in the current limiting method for protecting the application, by obtaining a global current limiter and a method current limiter, wherein the method current limiter can include a plurality of different current limiting modes, the diversity of the current limiting modes is increased, and different usage scenarios of users can be satisfied, thereby improving flexibility. In addition, through the global current limiter judgment step and the method current limiter judgment step, multiple current limiting modes can be associated and used in conjunction, thereby completing the access current limiting of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A structural block diagram of a Java web container in one embodiment of the present invention;

[0039] Figure 2 A structural block diagram of a java web container in another embodiment of the present invention;

[0040] Figure 3 It is a structural block diagram of a current limiting interceptor in another embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the return value of the isAccessible method of the current limiting actuator in another embodiment of the present invention;

[0042] Figure 5 A flow chart of a current limiting method in another embodiment of the present invention;

[0043] Figure 6 FIG. 4 is a system block diagram of a current limiting system in another embodiment of the present invention. DETAILED DESCRIPTION

[0044] The specific embodiments of the present invention are further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other. Figure 1 As shown, java web is a set of standard interfaces defined by java for web, and various java web container implementations need to implement these interfaces. There are three java web interfaces related to the present invention: Filter, HttpServletRequest and HttpServletResponse. Filter is a filter, and users can write their own implementation class, and then configure it in the java web container in web.xml. In the process of java web processing requests, objects of the HttpServletRequest and HttpServletResponse interface types are always passed. When the request enters the java web container, the container is responsible for creating these two objects (hereinafter referred to as the original HttpServletRequest object and the original HttpServletResponse object). The springMvc framework is in the serverlet stage of java. Before officially processing the business, it will go through a lot of pre-processing of springMvc. What is related to the present invention is the interceptor stage of springMvc. springMvc provides an interceptor interface, which can work by implementing this interface and configuring springMvc;

[0045] A current limiting method for protecting an application, comprising:

[0046] Data acquisition step: obtain the current access data and input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return;

[0047] Global current limiter acquisition step: obtain the global current limiter and determine whether the global current limiter is empty; when the global current limiter is not empty, it indicates that the global current limiter is set, and the global current limiter determination step is executed; when the global current limiter is empty, it indicates that the global current limiter is not set, and the method current limiter determination step is executed;

[0048] Global current limiter judgment step: obtain the current limit judgment value corresponding to the global current limiter; judge the current limit judgment value corresponding to the global current limiter; when the global current limit judgment value returns 1, access is allowed; when the global current limit judgment value returns -1, access is blocked; when the global current limit judgment value returns 0, the method current limiter judgment step is executed;

[0049] Method current limiter judgment step: obtaining each method current limiter and sorting all the method current limiters; obtaining the current limit judgment value corresponding to the method current limiter in the order of sorting, and judging the current limit judgment value corresponding to the method current limiter;

[0050] When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access;

[0051] When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value;

[0052] When the current limit judgment value of the current method limiter returns -1, the access is intercepted;

[0053] In the current limiting method for protecting applications, by obtaining a global current limiter and a method current limiter, wherein the method current limiter can include a variety of different current limiting modes, the diversity of current limiting modes is increased, and different usage scenarios of users can be met, thereby improving flexibility. In addition, through the global current limiter judgment step and the method current limiter judgment step, multiple current limiting modes can be associated and used in conjunction, thereby completing the access current limiting of users;

[0054] In this embodiment, the current limiting mode can be selected: current limiting by frequency count, for example: limit to y times in x seconds; current limiting by frequency userCount in units of users, for example: limit to y times in x seconds for each user; current limiting by the number of threads occupied by the method methodThreadLimit; for the hello method, for example: a single node can have at most x processing threads; set the user blacklist userBlackList, for example: users: "Zhang San" and "Li Si" are not accessible; set the ip blacklist ipBlackList; set the ip whitelist ipWhiteList. Multiple current limiting modes can be used in combination, such as the ip blacklist combined with frequency current limiting. Except for the current limiting mode based on the number of threads occupied by the method, the other current limiting modes have two current limiting ranges: global current limiting and method-specific current limiting. Global current limiting corresponds to the global current limiter, and method-specific current limiting corresponds to the method current limiter. Among them, global refers to all incoming requests, regardless of the specific method. The current limiting configuration can be modified and take effect in real time without restarting the application;

[0055] Among them, the frequency-based current limiting and the frequency-based current limiting by user are both implemented by redis distributed current limiting, which is 1 if passed, otherwise -1. For method, the frequency-based current limiting is the method name; while the frequency-based current limiting by user is the method name and userId. The userId parameter is obtained from the current limiting context. When the obtained userId is empty, the frequency-based current limiting by user returns 0. In addition, it should be noted that when the current application does not configure redis distributed current limiting, these two current limiting executors are not initialized. The current limiting executor based on the number of threads occupied by the method will set the reference of the "calling method counter" to it when it is created, so when it executes isAccessible(), it will directly compare the count of the current method in the "calling method counter" with its current limiting number. If the count of the current method is greater than its current limiting number, it returns -1, otherwise it returns 1. For the user blacklist, when judging, the userId parameter is obtained from the current limiting context. If the obtained userId is in the list, it returns -1, otherwise it returns 0. IP blacklist, when judging, the IP parameter is obtained from the current limiting context. If the obtained IP is in the list, it returns -1, otherwise it returns 0. IP whitelist, when judging, the IP parameter is obtained from the current limiting context. If the obtained IP is in the list, it returns 0, otherwise it returns -1. Regarding the current limiting context, the current limiting context maintains a ThreadLocal object provided by JDK, which can save variables in the currently executing thread;

[0056] Finally, the current limit interceptor provides a method to update the current limit configuration: updateLimitItem(Stringconfig). Users can set their own remote communication method. Finally, call this method to pass in the parameter config to update the current limit configuration of a method in real time. The format is: xx.yy.hello=userCount:1 20;count:1 100;

[0057] The subject of the present invention is Figure 2 As shown, RateLimitInterceptor is a rate limiting interceptor, which is located in the interception layer of the springMvc framework. This class is an abstract class, and users need to inherit it and implement the only abstract method getUserId(HttpServletRequest request). An abstract method is a method that has no specific implementation in a class. This class is also called an abstract class and cannot be used directly. It requires a subclass to inherit this abstract class, and then the subclass specifically implements the abstract method of the parent class;

[0058] It is worth noting that in the global current limiter judgment step, the current limit manager obtains the current limit judgment value corresponding to the global current limiter by calling the current limit manager's private method checkAccessible; the current limit manager judges the current limit judgment value corresponding to the global current limiter by calling the current limit manager's private method accessible(String method);

[0059] In the method current limiter judgment step, the current limit manager obtains the current limit judgment value corresponding to the method current limiter by calling the current limit manager's private method checkAccessible, and the current limit manager judges the current limit judgment value corresponding to the current limiter by calling the current limit manager's private method accessible(String method);

[0060] The current limiting manager obtains the current limiting judgment value by calling the current limiting manager's private method checkAccessible (note that this step is not to determine whether the current limiting is to be applied). The private method checkAccessible will call the isAccessible method of the current limiting executor in the current limiter one by one. If the previous current limiting executor returns 0, the next current limiting executor will be called for judgment, otherwise the isAccessible result of the current current limiting executor will be directly returned. If the last current limiting executor still returns 0, check whether the current current limiter is a global current limiter. If so, it returns 0, otherwise it returns 1. The current limiting manager determines whether the current limiting is to be applied by calling the current limiting manager's private method accessible(String method). The internal process of this method is as follows: Figure 5As shown;

[0061] Optionally, before the data acquisition step, a current limiting manager initialization step is also included;

[0062] The current limiting manager initialization step: obtaining the current limiting configuration of the current limiting manager;

[0063] Create a new current limiting manager object;

[0064] Process the current limiting configuration line by line. In each line of current limiting configuration, the left side of the equal sign is the method parameter and the right side is the condition parameter. The putLimitCondition(String method, Stringcondition) method of the current limiting manager object is called to cut out the configuration of each current limiting actuator and assemble it into a current limiter.

[0065] When the parameter passed by method is allmethod, the current limiter is set as the global current limiter; otherwise, the parameter passed by method and the current limiter are added to the list corresponding to the method current limiter to form a method current limiter;

[0066] When the current limiting interceptor is started, it will first read the current limiting configuration. The content of the current limiting configuration is as follows:

[0067] xx.yy.hello=userCount:1 20;count:1 100;

[0068] xx.yy.world=ipBlackList:172.18.20.112,172.18.20.144;count:1 30;

[0069] allmethod=userBlackList:3443243,22343453;

[0070] Then, initialize the current limit manager. In the above current limit configuration, xx.yy.hello=userCount:1 20;count:1 100 and xx.yy.world=ipBlackList:172.18.20.112,172.18.20.144;count:1 30 will initialize the method current limiter, and allmethod=userBlackList:3443243,22343453 will initialize the global current limiter. In xx.yy.hello=userCount:1 20;count:1 100, xx.yy.hello is the method name, and userCount:1 20;count:1 100 are the two current limit modes to be configured for this method, which is to limit the call of this method to 20 times per second for each user, and the call of this method cannot exceed 100 times per second. When the method name is allmethod, it means configuring global current limiting. allmethod=userBlackList:3443243,22343453 means that all accesses from user IDs 3443243 and 22343453 are blocked for the entire application.

[0071] Inside the putLimitCondition(String method, String condition) method, the condition parameter will be separated by a semicolon ";" to separate the configuration of each current limiting actuator to be configured by the method. For example, xx.yy.hello=userCount:1 20;count:1 100 will be separated into two current limiting actuator configurations: "userCount:1 20" and "count:1 100". The current limiting actuator configuration uses ":" as a separator. The left side is the current limiting mode, and the right side, if it exists, is the current limiting parameter under the current limiting mode. Taking "count:1 100" as an example, it means that a new current limiting actuator based on frequency current limiting is to be created. This current limiting actuator limits the access to 100 times / 1 second. After all the current limiting actuators are built, they are assembled into a current limiter. Then check whether the parameter passed by the method is allmethod. If so, the current limiter is set as a global current limiter; if not, the parameter passed by the method and the current limiter are added to the list corresponding to the method current limiter;

[0072] The flow limiter is composed of a group of flow limit executors. For example, if xx.yy.hello=userCount:1 20;count:1100 is used as an example, the flow limiter for the method xx.yy.hello will consist of two executors: flow limit by frequency based on users and flow limit by frequency. All types of flow limit executors implement the flow limit strategy interface LimitStrategy, which is defined as follows:

[0073] public interface LimitStrategy {

[0074] int isAccessible();

[0075] LimitStrategyType getType();

[0076] }

[0077] The isAccessible() method can return values ​​of 1 (indicating that access is allowed), 0 (indicating that the current actuator passes), and -1 (indicating that access is blocked). The getType() method returns the mode to which the current limiting actuator belongs. The isAccessible method of all current limiting actuators can return values ​​such as Figure 4 As shown; Specifically, if the executor passes, it means that the current executor passes, and the current limit judgment will be made by the next executor. "Allow access" and "Block access" mean that the current executor directly returns the judgment result, and the subsequent executors will not be executed;

[0078] Preferably, between the data acquisition step and the global current limiter acquisition step, a business method pre-calling step is also included;

[0079] The pre-calling step of the business method: execute the preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) method, extract the sessionId and the user's IP from the parameter request, call the getUserId() method to obtain the userId, then store the sessionId, the user's IP and the userId into the current limiting context, and extract the method name of the business method from the parameter handler, and finally call the in(String method) method of the current limiting manager, where sessionId is the session ID and userId is the user ID;

[0080] The implementation logic of the current limiting manager's in(String method) method is: first call the accessible method, and if it returns a failure, throw a current limiting exception. Specifically, the accessible method decides whether to throw an exception based on the result of the checkAccessible method. Throwing a current limiting exception here refers to throw new Exception() in Java syntax. If it returns a success, call the "calling method counter" to count the current business method +1. In summary, the main calling process in in(String method) is as follows:

[0081] Current limiting manager.in(String method){

[0082] …

[0083] Current limiting manager.accessible(String method){

[0084] …

[0085] Current Limit Manager. checkAccessible(String limit){ / / limit is the current limiter

[0086] …

[0087] for(each current limiting executor){

[0088] …

[0089] CurrentLimitActuator.isAccessible();

[0090] …

[0091] }

[0092] …

[0093] }

[0094] …

[0095] }

[0096] …

[0097] }

[0098] It is worth noting that after the method limiter judgment step, a business method post-calling step is also included;

[0099] The business method post-call step: execute the postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager;

[0100] In this embodiment, the out(String method) method implementation logic is: first, the count of the current business method in the "calling method counter" is decremented by 1, and then the parameters in the current limiting context are cleared;

[0101] The internal structure of the current limiting interceptor is as follows Figure 3 As shown. The current limiting interceptor implements the interceptor interface of springMvc, and implements the preHandle method and the postHandle method. The preHandle method is executed before the business method is executed, and the postHandle method is executed after the business method is executed. In this embodiment, the business method is the method for processing requests in the application, that is, the code written by the programmer. Among them, the preHandle method will be called before calling the business method, and the postHandle method will be called after calling the business method;

[0102] It is worth noting that when using the present invention, the user needs to provide a class that inherits RateLimitInterceptor and implements getUserId. Then the spring configuration file is configured as follows:

[0103] <mvc:interceptors>

[0104] <!-- The class that inherits RateLimitInterceptor and implements getUserId -->

[0105] <bean class="xx.yy.MyRateLimitInterceptor " / >

[0106] < / mvc:interceptors>

[0107] In addition, add a file named rateLimitCofing.properties to the classPath directory of the project. The content of the file is as follows:

[0108] xx.yy.hello=userCount:1 20;count:1 100

[0109] xx.yy.world=ipBlackList:172.18.20.112,172.18.20.144;count:1 30

[0110] allmethod=userBlackList:3443243,22343453

[0111] The current limiting interceptor will load this file automatically when it starts;

[0112] Specifically, a current limiting system for protecting an application includes:

[0113] Data acquisition module: used to obtain the current access data, input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return;

[0114] Global current limiter acquisition module: used to obtain the global current limiter and determine whether the global current limiter is empty; used to execute the global current limiter judgment module when the global current limiter is not empty; used to execute the method current limiter judgment module when the global current limiter is empty;

[0115] Global current limiter judgment module: used to obtain the current limit judgment value corresponding to the global current limiter; used to judge the current limit judgment value corresponding to the global current limiter; used to allow access when the global current limit judgment value returns 1, used to intercept access when the global current limit judgment value returns -1, and used to execute the method current limiter judgment module when the global current limit judgment value returns 0;

[0116] Method current limiter judgment module: used to obtain each method current limiter and sort all method current limiters; used to obtain the current limit judgment value corresponding to the method current limiter in the sorted order, and judge the current limit judgment value corresponding to the method current limiter;

[0117] When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access.

[0118] When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value;

[0119] It is used to intercept access when the current limit judgment value of the current method limiter returns -1;

[0120] It is worth noting that the global current limiter judgment module is used to obtain the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method checkAccessible of the current limit manager; and is also used to judge the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method accessible(String method) of the current limit manager;

[0121] The method current limiter judgment module is used to obtain the current limit judgment value corresponding to the method current limiter by using the current limit manager by calling the private method checkAccessible of the current limit manager, and is also used to judge the current limit judgment value corresponding to the current limiter by using the current limit manager by calling the private method accessible(String method) of the current limit manager;

[0122] Preferably, it also includes a current limiting manager initialization module, which is used to obtain the current limiting configuration of the current limiting manager; to create a new current limiting manager object; to process the current limiting configuration line by line, and to call the putLimitCondition(String method, String condition) method of the current limiting manager object to cut out the configuration of each current limiting actuator and assemble it into a current limiter; to set the current limiter as a global current limiter when the parameter passed by method is allmethod; otherwise, add the parameter passed by method and the current limiter to the list corresponding to the method current limiter to form a method current limiter;

[0123] Optionally, it also includes a business method pre-call module, which is used to execute the preHandle(HttpServletRequest request, HttpServletResponse response, Objecthandler) method, extract the sessionId and the user's IP from the parameter request, and call the getUserId() method to obtain the userId, which is used to store the sessionId, the user's IP and the userId into the current limiting context, and extract the method name of the business method from the parameter handler, which is used to call the in(String method) method of the current limiting manager, where sessionId is the session ID and userId is the user ID;

[0124] Specifically, it also includes a business method post-call module, which is used to execute the postHandle(HttpServletRequest request, HttpServletResponse response, Objecthandler,ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager;

[0125] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A current limiting method for protecting an application, characterized in that: include: Data acquisition step: obtain the current access data and input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return; A global current limiter acquisition step: acquiring the global current limiter and determining whether the global current limiter is empty; when the global current limiter is not empty, executing a global current limiter determination step; when the global current limiter is empty, executing a method current limiter determination step; Global current limiter judgment step: obtain the current limit judgment value corresponding to the global current limiter; judge the current limit judgment value corresponding to the global current limiter; when the global current limit judgment value returns 1, access is allowed; when the global current limit judgment value returns -1, access is intercepted; when the global current limit judgment value returns 0, the method current limiter judgment step is executed; in the global current limiter judgment step, the current limit manager obtains the current limit judgment value corresponding to the global current limiter by calling the private method checkAccessible of the current limit manager; the current limit manager judges the current limit judgment value corresponding to the global current limiter by calling the private method accessible(Stringmethod) of the current limit manager; Method current limiter judgment step: obtaining each method current limiter and sorting all the method current limiters; obtaining the current limit judgment value corresponding to the method current limiter in the order of sorting, and judging the current limit judgment value corresponding to the method current limiter; When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access; When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value; When the current limit judgment value of the current method limiter returns -1, the access is intercepted; In the method current limiter judgment step, the current limiting manager obtains the current limiting judgment value corresponding to the method current limiter by calling the current limiting manager's private method checkAccessible, and the current limiting manager judges the current limiting judgment value corresponding to the current limiter by calling the current limiting manager's private method accessible(String method).

2. A current limiting method for protecting applications according to claim 1, characterized in that: Before the data acquisition step, the method further includes a current limiting manager initialization step; The current limiting manager initialization step: obtaining the current limiting configuration of the current limiting manager; Create a new current limiting manager object; Process the current limiting configuration line by line, and call the putLimitCondition(String method,String condition) method of the current limiting manager object to cut out the configuration of each current limiting actuator and assemble it into a current limiter; When the parameter passed by method is allmethod, the current limiter is set to the global current limiter; otherwise, the parameter passed by method and the current limiter are added to the list corresponding to the method current limiter to form a method current limiter.

3. A current limiting method for protecting applications according to claim 2, characterized in that: Between the data acquisition step and the global current limiter acquisition step, a business method pre-calling step is also included; The business method pre-calling step: execute the preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) method, take out the sessionId and the user's IP from the parameter request, call the getUserId() method to obtain the userId, then store the sessionId, the user's IP and the userId into the current limiting context, and take out the method name of the business method from the parameter handler, and finally call the in(String method) method of the current limiting manager, where sessionId is the session ID and userId is the user ID.

4. A current limiting method for protecting applications according to claim 3, characterized in that: After the method limiter judgment step, a business method post-calling step is also included; The business method post-call step: execute the postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager.

5. A current limiting system for protecting an application, characterized in that: include: Data acquisition module: used to obtain the current access data, input it into the global limiter and each method limiter, and wait for the global limiter and each method limiter to return; Global current limiter acquisition module: used to obtain the global current limiter and determine whether the global current limiter is empty; used to execute the global current limiter judgment module when the global current limiter is not empty; used to execute the method current limiter judgment module when the global current limiter is empty; A global current limiter judgment module: used to obtain the current limit judgment value corresponding to the global current limiter; used to judge the current limit judgment value corresponding to the global current limiter; used to allow access when the global current limit judgment value returns 1, used to intercept access when the global current limit judgment value returns -1, and used to execute the method current limiter judgment module when the global current limit judgment value returns 0; the global current limiter judgment module is used to obtain the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method checkAccessible of the current limit manager; and is also used to judge the current limit judgment value corresponding to the global current limiter by using the current limit manager by calling the private method accessible(String method) of the current limit manager; Method current limiter judgment module: used to obtain each method current limiter and sort all method current limiters; used to obtain the current limit judgment value corresponding to the method current limiter in the sorted order, and judge the current limit judgment value corresponding to the method current limiter; When the current limit judgment value of the current method current limiter returns 0, continue to obtain and judge the current limit judgment value corresponding to the next method current limiter. If the current limit judgment values ​​corresponding to all method current limiters return 0, the current limit mode corresponding to the global current limiter and the current limit mode corresponding to all method current limiters are allowed to access. When the current limiting judgment value of the current method current limiter returns 1, the current limiting mode corresponding to the current method current limiter allows access, and continues to obtain the method current limiting judgment value corresponding to the next method current limiter and judge the method current limiting judgment value; It is used to intercept access when the current limit judgment value of the current method limiter returns -1; The method current limiter judgment module is used to use the current limiting manager to obtain the current limiting judgment value corresponding to the method current limiter by calling the private method checkAccessible of the current limiting manager, and is also used to use the current limiting manager to judge the current limiting judgment value corresponding to the current limiter by calling the private method accessible(String method) of the current limiting manager.

6. A current limiting system for protection applications according to claim 5, characterized in that: It also includes a current limiting manager initialization module, which is used to obtain the current limiting configuration of the current limiting manager; to create a new current limiting manager object; to process the current limiting configuration line by line, and to call the putLimitCondition(String method,String condition) method of the current limiting manager object to cut out the configuration of each current limiting executor and assemble it into a current limiter; when the parameter passed by the method is allmethod, the current limiter is set to the global current limiter; otherwise, the parameter passed by the method and the current limiter are added to the list corresponding to the method current limiter to form a method current limiter.

7. A current limiting system for protection applications according to claim 6, characterized in that: It also includes a business method pre-call module, which is used to execute the preHandle (HttpServletRequest request, HttpServletResponse response, Object handler) method, extract the sessionId and the user's IP from the parameter request, and call the getUserId () method to obtain the userId, which is used to store the sessionId, the user's IP and the userId into the current limiting context, and extract the method name of the business method from the parameter handler, which is used to call the in (String method) method of the current limiting manager, wherein sessionId is the session ID and userId is the user ID.

8. A current limiting system for protection applications according to claim 7, characterized in that: It also includes a business method post-call module, which is used to execute the postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) method, extract the method name from the parameter handler, and call the out(String method) method of the current limiting manager.

Images