Resource processing method and apparatus, server, and storage medium

Abstract

Embodiments of the present application disclose a resource processing method and device, a server and a storage medium, and belong to the technical field of computers. A business service and a first proxy service run in a first server. The method comprises the following steps: in response to an external resource processing request sent by a client, sending, by the business service, a first access address corresponding to the external resource processing request to the first proxy service; in the case that the first access address is verified, acquiring, by the first proxy service, a first resource corresponding to the first access address and sending the first resource to the business service; and sending, by the business service, a resource processing result to the client based on the first resource. The method provided by the embodiments of the present application does not require the business service to directly access an external device, avoids the case that the business service is attacked from outside, and thus improves the security of the business service.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer, and particularly relate to a resource processing method and device, a server and a storage medium. BACKGROUND

[0002] With the continuous development of the Internet, Internet services are becoming more and more diverse. In different service scenarios, business services need to be deployed to provide services for clients. A user sends a processing request to a business service through a client, and the business service directly accesses a requested resource based on the processing request. This way of directly accessing based on the processing request makes the business service vulnerable to external attacks, resulting in poor security of the business service. SUMMARY

[0003] Embodiments of the present application provide a resource processing method, device, server and storage medium, which can improve the security of the business service. The technical solution is as follows:

[0004] In one aspect, a resource processing method is provided, which is executed by a first server, the first server running a business service and a first proxy service, and the method comprises:

[0005] In response to an external resource processing request sent by a client, a first access address corresponding to the external resource processing request is sent to the first proxy service through the business service, the external resource being a resource stored in a device other than the first server;

[0006] Through the first proxy service, in a case where the first access address is verified, a first resource corresponding to the first access address is obtained, and the first resource is sent to the business service;

[0007] Through the business service, a resource processing result is sent to the client based on the first resource.

[0008] In one possible implementation, the first access address is obtained by the business service based on at least one of a business type to which the external resource processing request belongs or a business identifier carried by the external resource processing request, comprising:

[0009] Through the business service, an address template corresponding to the target format is obtained, the address template comprising at least one of a business type field or a business identifier field and an address field;

[0010] Based on the address template, at least one of the type identifier of the service type or the service identifier and the second access address are filled in corresponding fields respectively to obtain the first access address.

[0011] In another possible implementation, the sending, by the first server, of the resource processing result to the client based on the first resource comprises any one of the following:

[0012] sending the first resource to the client;

[0013] processing the first resource to obtain the resource processing result, and sending the resource processing result to the client.

[0014] In another aspect, a resource processing apparatus is provided, which is executed by a first server in which a service and a first proxy service are run, and the apparatus comprises:

[0015] a first sending module configured to, in response to an external resource processing request sent by a client, send, by the service, a first access address corresponding to the external resource processing request to the first proxy service, the external resource being a resource stored in a device other than the first server;

[0016] a second sending module configured to, by the first proxy service, acquire a first resource corresponding to the first access address in a case where the first access address passes verification, and send the first resource to the service;

[0017] a third sending module configured to, by the service, send a resource processing result to the client based on the first resource.

[0018] In a possible implementation, the first sending module comprises:

[0019] a first conversion unit configured to, by the service, perform format conversion on a second access address carried by the external resource processing request to obtain the first access address in a target format, the target format being an address format supported by the first proxy service;

[0020] a first sending unit configured to, by the service, send the first access address to the first proxy service.

[0021] In another possible implementation, the first conversion unit is configured to, by the service, perform format conversion on the second access address based on at least one of a service type to which the external resource processing request belongs or a service identifier carried by the external resource processing request to obtain the first access address.

[0022] In a possible implementation, the first conversion unit is configured to acquire, by the service server, an address template corresponding to the target format, the address template comprising at least one of a service type field or a service identifier field and an address field; and fill at least one of a type identifier of the service type or the service identifier and the second access address in the corresponding fields based on the address template to obtain the first access address.

[0023] In a possible implementation, the apparatus further comprises:

[0024] The verification module is configured to verify, by the first proxy server, the received first access address.

[0025] The determination module is configured to determine that the first access address passes the verification in a case where the first access address does not belong to a target network segment, the target network segment being a network segment that is not allowed to be accessed.

[0026] In a possible implementation, the determination module is configured to determine that the first access address passes the verification in a case where the first access address does not belong to a target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, the jump address being an address to which access to the first access address automatically jumps.

[0027] In a possible implementation, the determination module is configured to determine that the first access address passes the verification in a case where the first access address does not belong to the target network segment, the first access address is associated with multiple-level jump addresses, and none of the multiple-level jump addresses belongs to the target network segment.

[0028] In a possible implementation, the second sending module comprises:

[0029] The obtaining unit is configured to obtain a second resource stored under the first access address.

[0030] The second conversion unit is configured to, in a case where the second resource belongs to an index file type and the second resource contains a third access address, convert the third access address into a fourth access address that belongs to a target format, the target format being an address format supported by the first proxy server.

[0031] The obtaining unit is further configured to obtain the first resource stored under the fourth access address.

[0032] In another possible implementation, the obtaining unit is further configured to verify, by the first proxy service, the fourth access address; and obtain, by the first proxy service, the first resource stored at the fourth access address, in a case where the fourth access address passes the verification.

[0033] In another possible implementation, the first server does not have external access permission; the second sending module is configured to send, by the first proxy service, the first access address to a second proxy service in a case where the first access address passes the verification, obtain, by the second proxy service, the first resource corresponding to the first access address, send, by the second proxy service, the first resource to the first proxy service, and deploy a second server of the second proxy service, which has external access permission; and the first proxy service is configured to receive the first resource sent by the second proxy service.

[0034] In another possible implementation, the first access address includes a service identifier; and the second sending module is configured to obtain the first resource corresponding to the service identifier and stored at the first access address, based on the service identifier in the first access address.

[0035] In another possible implementation, the second sending module includes:

[0036] The determining unit is configured to query a mapping relationship between a service identifier and a key based on the service identifier in the first access address, and determine the key corresponding to the service identifier.

[0037] The obtaining unit is configured to obtain the first resource corresponding to the service identifier and stored at the first access address, based on the key corresponding to the service identifier.

[0038] In another possible implementation, the key has a valid time length; and the apparatus further includes:

[0039] The fourth sending module is configured to send, by the first proxy service, a key obtaining request to a key distribution service every target time length, the key obtaining request carrying the service identifier; and the key distribution service is configured to generate a new key for the service identifier based on the key obtaining request, and send the new key to the first proxy service.

[0040] The updating module is configured to receive, by the first proxy service, the new key sent by the key distribution service, and update the mapping relationship based on the new key.

[0041] In another possible implementation manner, the third sending module is configured to send the first resource to the client, or process the first resource to obtain the resource processing result, and send the resource processing result to the client.

[0042] In another aspect, a server is provided, which includes a processor and a memory, and the memory stores at least one computer program, which is loaded and executed by the processor to implement the operations performed by the resource processing method according to the above aspects.

[0043] In another aspect, a computer readable storage medium is provided, which stores at least one computer program, which is loaded and executed by a processor to implement the operations performed by the resource processing method according to the above aspects.

[0044] In still another aspect, a computer program product is provided, which includes a computer program, and the computer program is executed by a processor to implement the operations performed by the resource processing method according to the above aspects.

[0045] The method, device, server and storage medium provided by the embodiments of the present application deploy a business service and a first proxy service in the same server, the business service is used to provide services for clients, when the client needs to access an external resource in the process of the business service providing services for the client, the first proxy service is used to replace the business service, the external resource is accessed under the condition that the access address is verified, and then the business service returns a resource processing result to the client based on the external resource accessed by the first proxy service. This access mode does not need the business service to directly access the external device, avoids the situation that the business service is attacked by the external, and improves the security of the business service. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0047] Figure 1 is a structural schematic diagram of an implementation environment provided by the embodiments of the present application;

[0048] Figure 2 is a flowchart of a resource processing method provided by the embodiments of the present application;

[0049] Figure 3 is a flowchart of a resource processing method provided by the embodiments of the present application;

[0050] Figure 4 is a flowchart of accessing a cloud resource provided by an embodiment of the present application;

[0051] Figure 5 is a flowchart of accessing a cloud resource provided by an embodiment of the present application;

[0052] Figure 6 is a flowchart of updating a mapping relationship provided by an embodiment of the present application;

[0053] Figure 7 is a flowchart of accessing a cloud resource provided by an embodiment of the present application;

[0054] Figure 8 is a flowchart of obtaining a first resource corresponding to the first access address provided by an embodiment of the present application;

[0055] Figure 9 is a flowchart of processing based on the first access address by a first proxy service provided by an embodiment of the present application;

[0056] Figure 10 is a flowchart of obtaining a first resource stored under the first access address provided by an embodiment of the present application;

[0057] Figure 11 is a flowchart of accessing a public network resource provided by an embodiment of the present application;

[0058] Figure 12 is a flowchart of accessing a public network resource provided by an embodiment of the present application;

[0059] Figure 13 is a structural schematic diagram of a resource processing apparatus provided by an embodiment of the present application;

[0060] Figure 14 is a structural schematic diagram of a resource processing apparatus provided by an embodiment of the present application;

[0061] Figure 15 is a structural schematic diagram of a server provided by an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0063] As used herein, the terms "first", "second", "third", "fourth" and the like can be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, a first access address can be referred to as a second access address, and similarly, a second access address can be referred to as a first access address, without departing from the scope of the present application.

[0064] As used herein, the terms "at least one", "multiple", "each", "any" include one, two or more, multiple includes two or more, and each refers to each of the corresponding multiple, and any refers to any one of the multiple. For example, multiple access addresses include 3 access addresses, and each refers to each of the 3 access addresses, and any refers to any one of the 3 access addresses, which can be the first access address, or the second access address, or the third access address.

[0065] Cloud Technology refers to the series of resources such as hardware, software, network, etc. unified in a wide area network or a local area network, to realize the calculation, storage, processing and sharing of data.

[0066] Cloud Technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on cloud computing business model application, which can form a resource pool, and be used on demand, flexibly and conveniently. Cloud computing technology will become an important support. The background service of the technical network system needs a large amount of computing and storage resources, such as video websites, picture websites and more portal websites. With the high development and application of the Internet industry, every item may have its own identification mark in the future, and needs to be transmitted to the background system for logical processing. Different levels of data will be processed separately, and various industry data will need strong system support, which can only be realized through cloud computing.

[0067] Cloud Storage is a new concept extended and developed on the basis of the concept of cloud computing. Distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that cooperatively works together to provide data storage and business access functions by collecting a large number of various types of storage devices (storage nodes) in the network through cluster application, grid technology and distributed storage file system functions, etc.

[0068] Currently, the storage method of storage systems is as follows: Logical volumes are created. During the creation of a logical volume, physical storage space is allocated to each logical volume. This physical storage space may consist of a single storage device or the disks of several storage devices. Clients store data on a logical volume, which means storing the data on the file system. The file system divides the data into many parts, each part being an object. Each object contains not only the data but also additional information such as a data identifier (ID, ID entity). The file system writes each object to the physical storage space of that logical volume and records the storage location information of each object. Therefore, when a client requests access to data, the file system can allow the client to access the data based on the storage location information of each object.

[0069] The process by which a storage system allocates physical storage space to a logical volume is as follows: based on the capacity estimate of the objects stored in the logical volume (which often has a large margin relative to the actual capacity of the objects to be stored) and the grouping of Redundant Array of Independent Disks (RAID), the physical storage space is first divided into strips. A logical volume can be understood as a strip, thus allocating physical storage space to the logical volume.

[0070] The resource processing method provided in this application embodiment is executed by a first server. Optionally, the first server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, but is not limited to these. In some embodiments, the first server and other servers distributed in multiple locations and interconnected through a communication network can form a blockchain system.

[0071] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application. See also... Figure 1 The implementation environment includes at least one terminal 101 ( Figure 1 (Taking three as an example) and the first server 102. The terminal 101 and the first server 102 are directly or indirectly connected through wired or wireless communication, which is not limited in this application.

[0072] The first server 102 runs a business service and a first proxy service, and a client provided by the business service is installed on the terminal 101, and the terminal 101 can implement functions such as data transmission and resource processing through the client. Optionally, the terminal 101 is a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a smart voice interaction device, a smart home appliance, a vehicle terminal, or the like, but is not limited thereto. Optionally, the client is a client in the operating system of the terminal 101, or a client provided by a third party. For example, the client is a picture processing client, which has a picture processing function, and of course, the picture processing client can also have other functions, such as a video playing function, an image transcoding function, and the like.

[0073] The terminal 101 logs in the client based on a user identifier, sends an external resource processing request to the first server 102 through the client, the first server 102 receives the external resource processing request through the business service, and obtains a first resource stored outside the first server through the first proxy service by interaction between the business service and the first proxy service, returns the first resource to the business service, and returns a resource processing result to the client based on the first resource through the business service.

[0074] Figure 2 is a flowchart of a resource processing method provided by an embodiment of the present application, and the method is executed by a first server, and the first server runs a business service and a first proxy service, as shown in Figure 2 , the method comprises the following steps.

[0075] 201. The first server sends a first access address corresponding to an external resource processing request to the first proxy service through the business service in response to the external resource processing request sent by the client.

[0076] For example, the resource is a public resource, such as a video or a picture in a public website. For another example, the resource is a resource required by the business service to provide a service for the client, such as a resource requested by the client to store if the business service provides a storage service for the client. If the resource is stored on the first server, the resource is an external resource for the first server; if the resource is stored on another device outside the first server, the resource is an external resource for the first server. The first access address is used to access the external resource, and the first access address indicates a storage location of the external resource. The first access address is an address carried by the external resource processing request, or is an address obtained by processing an address carried by the external resource processing request. The first access address is an address supported by the first proxy service, and the first proxy service can access according to the first access address.

[0077] In the embodiment of the present application, the first server is a server for providing a service, the first server is deployed with a service and a first proxy service, the service is used to provide a service for the client, and the first proxy service is used to access resources stored by other devices outside the first server. The client can send an external resource processing request to the first server, and the first server responds to the external resource processing request by sending a first access address corresponding to the external resource processing request to the first proxy service through the service, so that the first proxy server accesses according to the first access address subsequently.

[0078] 202、The first server acquires the first resource corresponding to the first access address through the first proxy service, and sends the first resource to the service under the condition that the first access address is verified.

[0079] The first resource is any type of resource, for example, the first resource is a text, an image, an audio or a video, etc. The first resource corresponds to the first access address, and the first resource is a resource stored under the first access address, or the first resource is a resource associated with the resource stored under the first access address. The first access address is verified through the first proxy service, and only in the case that the first access address is verified, the first resource corresponding to the first access address is acquired, so as to ensure the security of the access.

[0080] 203、The first server sends a resource processing result to the client based on the first resource through the service.

[0081] Through the service, the first resource is acquired, and the resource processing result sent by the client is acquired based on the first resource, the resource processing result is sent to the client, and the resource processing service is provided for the client through the service and the first proxy service.

[0082] The method provided in the embodiment of the present application deploys a service for providing a service for a client and a first proxy service in the same server, when the client needs to access an external resource in the process that the service provides a service for the client, the first proxy service is used to replace the service to access the external resource under the condition that the access address is verified, and then the service returns a resource processing result to the client based on the external resource accessed by the first proxy service. This access mode does not need the service to access the external device directly, avoids the case that the service is attacked externally, and thus improves the security of the service.

[0083] In Figure 2On the basis of the embodiment shown, the address carried by the external resource processing request sent by the client is first converted into an address in the format supported by the first proxy service, and then the first resource is acquired based on the address after the format conversion through the first proxy service. The specific process is described in detail in the following embodiments.

[0084] Figure 3 is a flowchart of a resource processing method provided by an embodiment of the present application. The method is executed by a first server in which a business service and a first proxy service are running, as shown in Figure 3 The method includes the following steps.

[0085] 301. The first server, in response to an external resource processing request sent by a client, performs format conversion on a second access address carried by the external resource processing request through the business service, to obtain a first access address in a target format.

[0086] The target format is a format supported by the first proxy service, and the first proxy service can access an address in the target format. In the embodiment of the present application, the first access address and the second access address indicate the same storage location, and only the address formats of the first access address and the second access address are different. The second access address is in a format not supported by the first proxy service, and the first access address is obtained by performing format conversion on the second access address. The first access address is in the target format supported by the first proxy service, and thus the first proxy service can access the first access address subsequently. After the business service receives the external resource processing request sent by the client, it performs format conversion on the second access address, so that the first proxy service can access the first access address after the format conversion subsequently, that is, the business service is replaced by the proxy service to access the external resource.

[0087] In a possible implementation manner, the step 301 includes: performing format conversion on the second access address based on at least one of a business type to which the external resource processing request belongs or a business identifier carried by the external resource processing request, through the business service, to obtain the first access address.

[0088] The business identifier indicates a business corresponding to the external resource processing request, and the business identifier can be represented in any form, for example, the business identifier is a business Key (key value). The business type indicates a type to which a business requested by the external resource processing request belongs. In the embodiment of the present application, the business service can provide multiple types of services for the client, for example, the business service provides access services for public network resources for the client, or the business service provides cloud storage services for the client, etc. For the same type of business, there can be multiple businesses, each of which corresponds to a business identifier. Different businesses can be distinguished based on the business identifier, and different types of businesses can be distinguished based on the business type.

[0089] The second access address is format-converted based on at least one of a service type to which the external resource processing request belongs or a service identifier carried by the external resource processing request, so that the first proxy service can subsequently learn the service corresponding to the external resource processing request or the service type to which the service belongs based on the first access address.

[0090] Optionally, the process of format-converting the first access address based on at least one of the service type to which the external resource processing request belongs or the service identifier carried by the external resource processing request comprises: obtaining, by the service service, an address template corresponding to the target format; and filling at least one of the type identifier of the service type or the service identifier and the second access address in corresponding fields based on the address template to obtain the first access address.

[0091] The address template comprises at least one of a service type field or a service identifier field and an address field, the service type field is used to fill a type identifier of a service type, the service identifier field is used to fill a service identifier, and the address field is used to fill an access address. When the second access address is format-converted, the second access address is filled in the address field in the address template, and at least one of the type identifier or the service identifier is filled in at least one of the service type field or the service identifier field. The address template after filling is the first access address obtained after format-conversion.

[0092] Optionally, the address template further comprises other content. For example, the address template further comprises a domain name supported by the first proxy service. For example, the address template is “http: / / 111.0.0.1: [service type field] / [service identifier field] / http(s) / [address field]”, and “http: / / 111.0.0.1:” is the domain name supported by the first proxy service.

[0093] Optionally, the second access address comprises a domain name and a resource path, and the address field in the address template comprises a domain name field and a path field. When format-conversion is performed, the domain name and the resource path in the second access address are filled in the domain name field and the path field in the address template respectively, so as to obtain the first access address. For example, the second access address is example.com / action, the domain name is “example.com”, and the resource path is “action”.

[0094] 302. The first server sends the first access address to the first proxy service through the service service.

[0095] The first proxy service is used to provide the service of the service service with access to the external resource, and the first proxy service is any form of service, for example, the first proxy service is a local secure proxy (LSP). In the embodiment of the application, a communication connection is established between the service service and the first proxy service in the first server, and after the service service obtains the first access address, the first proxy service is sent to the first proxy service through the communication connection between the service service and the first proxy service, so as to subsequently access the first proxy service according to the first access address.

[0096] It should be noted that the embodiment of the application is to process the request of the external resource carrying the second access address, and the second access address is converted into the first access address by the service service, and then the first access address is sent to the first proxy service. In another embodiment, the steps 301-302 do not need to be performed, and other ways can be adopted to respond to the external resource processing request sent by the client, and the first access address corresponding to the external resource processing request is sent to the first proxy service through the service service.

[0097] In a possible implementation manner, the external resource processing request sent by the client carries the first access address, the first proxy service supports the format to which the first access address belongs, and after the external resource processing request is received through the service service, the first proxy service directly sends the first access address carried by the external resource processing request.

[0098] 303, the first server receives the first access address sent by the service service through the first proxy service, and verifies the received first access address.

[0099] The first proxy service receives the first access address sent by the service service through the communication connection between the service service and the first proxy service, and needs to verify the first access address before accessing the first access address, so as to ensure the security of resource access.

[0100] In a possible implementation manner, the process of verifying the first access address includes: determining, by the first proxy service, whether the first access address belongs to a target network segment, and determining that the first access address is verified in the case that the first access address does not belong to the target network segment; and determining that the first access address is not verified in the case that the first access address belongs to the target network segment.

[0101] The target network segment is a network segment that is not allowed to be accessed. For example, the target network segment is a network segment of an internal network where the first server is located and which is not allowed to be directly accessed by the client. In a case where the first access address does not belong to the target network segment, it is determined that the first access address is allowed to be accessed, and it is determined that the first access address passes the verification. In a case where the first access address belongs to the target network segment, it is determined that the first access address is not allowed to be accessed, and it is determined that the first access address fails the verification.

[0102] Optionally, the target network segment is represented by a target string. In a case where the first access address includes the target string, it is determined that the first access address belongs to the target network segment. In a case where the first access address does not include the target string, it is determined that the first access address does not belong to the target network segment. For example, the target string is “1.2.3.4.5”.

[0103] Optionally, in the process of verifying the first access address, the jump address associated with the first access address also needs to be verified. That is, the process of verifying the first access address includes: in a case where the first access address does not belong to the target network segment, determining whether the first access address is associated with a jump address; in a case where the first access address does not belong to the target network segment, the first access address is associated with a jump address, and the jump address does not belong to the target network segment, it is determined that the first access address passes the verification; and in a case where the first access address does not belong to the target network segment, the first access address is associated with a jump address, and the jump address belongs to the target network segment, it is determined that the first access address passes the verification.

[0104] The jump address is an address to which the first access address automatically jumps when the first access address is accessed. For example, the first access address is associated with a 302 jump address. When the first access address is accessed, the jump address is jumped to, and then the jump address is accessed. Therefore, before the jump address is accessed, the jump address needs to be verified to ensure the security of the access.

[0105] Optionally, the first access address is associated with a plurality of jump addresses. The process of verifying the plurality of jump addresses includes: in a case where the first access address does not belong to the target network segment, the first access address is associated with the plurality of jump addresses, and none of the plurality of jump addresses belongs to the target network segment, it is determined that the first access address passes the verification.

[0106] In the case of accessing the first access address, the jump is performed according to the order between the first access address and the multi-level jump addresses associated with the first access address. For example, in the case of accessing the first access address, the jump is performed to the first-level jump address; in the case of accessing the first-level jump address, the jump is performed to the second-level jump address; and in the case of accessing the second-level jump address, the jump is performed to the third-level jump address. In the embodiment of the present application, the first access address is associated with the multi-level jump addresses, and the first access address and the multi-level jump addresses need to be verified. Only in the case that the first access address and the multi-level jump addresses associated with the first access address are verified, the first access address is determined to be verified, and then the resource is obtained according to the first access address and the multi-level jump addresses associated with the first access address. In this way, the security risk of the jump address is avoided, and the security of the access is ensured.

[0107] Optionally, in the case that the first access address does not belong to the target network segment, it is determined whether the first access address is associated with a jump address; in the case that the first access address is associated with a jump address, it is determined whether the first-level jump address associated with the first access address belongs to the target network segment; in the case that the first-level jump address does not belong to the target network segment, it is determined whether the first-level jump address is associated with a second-level address; in the case that the first-level jump address is associated with a second-level jump address, it is determined whether the second-level jump address belongs to the target network segment, and the above steps are repeated until it is determined whether the last-level jump address belongs to the target network segment. Only in the case that the first access address and the multi-level jump addresses associated with the first access address do not belong to the target network segment, the first access address is determined to be verified.

[0108] Optionally, the first access address is obtained by performing format conversion on the second access address carried by the processing request for the external resource, the first access address includes at least one of a service identifier or a type identifier and the second access address, and the process of verifying the first access address includes: determining, by the first proxy service, whether the second access address belongs to the target network segment, and in the case that the second access address does not belong to the target network segment, determining that the second access address is verified; and in the case that the second access address belongs to the target network segment, determining that the second access address is not verified. In the case that the second access address does not belong to the target network segment, it is determined whether the second access address is associated with a jump address, in the case that the second access address does not belong to the target network segment, the second access address has the associated jump address, and the jump address does not belong to the target network segment, it is determined that the second access address is verified; and in the case that the second access address does not belong to the target network segment, the second access address has the associated jump address, and the jump address belongs to the target network segment, it is determined that the second access address is verified.

[0109] 304. The first server, through the first proxy service, obtains the first resource stored under the first access address after the first access address is verified, and sends the first resource to the business service.

[0110] The first resource is the resource requested by the client. In this embodiment, the first resource is stored under the first access address. The first resource is obtained through the first proxy service according to the first access address; or, the first access address is associated with a redirect address. When the first access address is accessed through the first proxy service, the user is redirected to the redirect address to obtain the first resource stored under the redirect address.

[0111] In one possible implementation, the first access address includes a type identifier of the service type and a second access address carried by the external resource processing request. The process of obtaining the first resource through the first proxy service includes: if the first access address is verified, the first resource stored under the second access address is obtained through the first proxy service based on the port that matches the service type indicated by the type identifier.

[0112] In this embodiment, the first server provides multiple different ports, each adapted to a different service type. For example, the first server provides a NAT (Network Address Translation) port and a cloud resource port. The first proxy service can access resources on the public network through the NAT port and access resources stored in the cloud, such as COS (Cloud Object Storage) resources, through the cloud resource port. When the first proxy service accesses based on a first access address, it accesses the resource using the port adapted to the service type corresponding to that first access address. This allows the first proxy service to distinguish access addresses corresponding to different service types, enabling access to be performed according to the corresponding service type. For example, if the service type corresponding to the first access address is a public network access type, then the public network resource can be accessed directly using the first access address via the port adapted to that public network access type. As another example, if the service type corresponding to the first access address is a cloud resource type, then the key corresponding to the service identifier in the first access address is determined based on the port adapted to that cloud resource type, and then the cloud resource is accessed based on the key corresponding to the service identifier and the first access address.

[0113] Optionally, different service types can be adapted to the same port, meaning the first proxy service uses the same port to access resources for multiple service types. The type identifier in the first access address will no longer need to distinguish between different types; instead, the service identifier will be a single character, for example, "default".

[0114] 305. The first server receives the first resource sent by the first proxy service through the service service, and sends a resource processing result to the client based on the first resource.

[0115] After the service service receives the first resource, the service service sends a resource processing result to the client according to the external resource processing request sent by the client, so as to implement the service of providing resource processing to the client.

[0116] In a possible implementation, the step 305 includes any of the following:

[0117] The first item: the first server sends the first resource to the client through the service service.

[0118] In the embodiment of the present application, the first resource corresponds to the resource processing result corresponding to the external resource processing request sent by the client, that is, the external resource processing request sent by the client is actually an access request for requesting to access the first resource, and then the first server directly sends the first resource to the client after the service service obtains the first resource.

[0119] For example, the external resource processing request sent by the client is a picture download request, and then the target picture obtained by the service service is the resource processing result corresponding to the picture download request, and the target picture is sent to the client.

[0120] The second item: the first server processes the first resource through the service service to obtain the resource processing result, and sends the resource processing result to the client.

[0121] In the embodiment of the present application, the external resource processing request sent by the client indicates to process the first resource stored in other devices other than the first server, and then the first server processes the first resource to obtain the resource processing result after the service service obtains the first resource, and sends the resource processing result to the client.

[0122] For example, the external resource processing request sent by the client is a resource transcoding request, and then the service service transcodes the first resource after obtaining the first resource, and the transcoded resource is the resource processing result corresponding to the resource transcoding request, and the transcoded resource is sent to the client.

[0123] For another example, the external resource processing request sent by the client is a picture processing request, and then the service service processes the target picture after obtaining the target picture, such as size adjustment, color adjustment, etc., and the processed picture is the resource processing result corresponding to the resource transcoding request, and the processed picture is sent to the client.

[0124] It should be noted that the embodiments of the present application are explained in the case of passing the verification of the first access address, and in another embodiment, after step 303, the first proxy service sends a verification failure notification to the service service in the case of passing the verification of the first access address, the service service receives the verification failure notification, and based on the verification failure notification, sends an access failure notification to the client to prompt that the second access address is not allowed.

[0125] The method provided by the embodiments of the present application can also be applied to other scenarios, such as online translation scenarios, public network resource access scenarios, or cloud resource access scenarios. According to the above access method, the service service does not directly connect with the external device, which can reduce the risk of SSRF (Server-Side Request Forgery) vulnerability attacks and improve the security defense of the system, thereby greatly ensuring the information security of the system.

[0126] The method provided by the embodiments of the present application deploys a service service for providing services for clients and a first proxy service in the same server. In the process of the service service providing services for the client, when the client needs to access external resources, the first proxy service is used to replace the service service to access the external resources in the case of passing the verification of the access address, and then the service service returns the resource processing result to the client based on the external resources accessed by the first proxy service. This access method does not require the service service to directly access the external device, avoiding the situation that the service service is attacked from the outside, thereby improving the security of the service service. Moreover, the method provided by the embodiments of the present application can improve the security of the service service by deploying only one first proxy service in the first server, without the need to manage the firewall, and the cost of service code transformation is low and the deployment cost is low.

[0127] Moreover, when the first proxy service accesses based on the first access address, the port adapted based on the business type corresponding to the first access address is accessed, so that the first proxy service can distinguish the access addresses corresponding to different business types, to ensure that the first access address can be accessed successfully, thereby ensuring the accuracy of resource access.

[0128] On the basis of the above Figure 3 According to step 304, the process of obtaining the first resource stored under the first access address includes: based on the business identification in the first access address, obtaining the first resource stored under the first access address and corresponding to the business identification through the first proxy service in the case of passing the verification of the first access address.

[0129] In the embodiment of the present application, the first access address comprises a service identifier. There can be multiple first resources corresponding to service identifiers stored under the first access address. Based on the service identifier in the first access address, the first resource corresponding to the service identifier can be determined.

[0130] In a possible implementation, the first proxy service stores a mapping relationship between service identifiers and keys. The process of obtaining the first resource comprises: querying the mapping relationship between service identifiers and keys based on the service identifier in the first access address to determine the key corresponding to the service identifier in the first access address; and obtaining the first resource corresponding to the service identifier under the first access address based on the key corresponding to the service identifier in the first access address.

[0131] The mapping relationship between service identifiers and keys comprises at least one service identifier and a corresponding key. In the case where the key in the mapping relationship is set with a valid time length, the key is a temporary key, which is valid only within the valid time length; or in the case where the key in the mapping relationship is not set with a valid time length, the key is a permanent key, which is always valid without being changed. The mapping relationship is queried based on the service identifier in the first access address to determine the key corresponding to the service identifier, and the first resource corresponding to the service identifier under the first access address is obtained based on the queried key.

[0132] Optionally, the mapping relationship between service identifiers and keys stored in the first proxy service is configured in the first proxy service in an encoded manner, or is obtained by interacting with a configuration center. The configuration center is used to manage keys corresponding to multiple service identifiers, for example, the configuration center is a server other than the first server. Optionally, the keys corresponding to service identifiers in the configuration center are configured by administrators. As shown in Figure 4 In the first proxy service where the mapping relationship is configured in an encoded manner, the key included in the mapping relationship is a permanent key. The first proxy service is accessed by a business service, and the first proxy service accesses the resource corresponding to a service identifier in a cloud resource based on the permanent key in the mapping relationship. As shown in Figure 5 The first proxy service obtains the permanent key corresponding to the service identifier by interacting with the configuration center, generates the mapping relationship, and accesses the first proxy service by the business service. The first proxy service accesses the resource corresponding to a service identifier in a cloud resource based on the permanent key in the mapping relationship.

[0133] Optionally, the process of obtaining the first resource based on the key corresponding to the service identifier by the first proxy service comprises the following two ways:

[0134] The first mode: the first proxy service sends the key corresponding to the service identifier to the third server based on the first access address, the third server verifies the key, and sends the first resource corresponding to the service identifier stored under the first access address to the first proxy service when the key is verified.

[0135] The third server is a server other than the first server, and the storage location indicated by the first access address is in the third server. For example, the first resource is a resource in a cloud resource, the cloud resource is in the form of distributed storage, and the third server is any server in the distributed storage system corresponding to the cloud resource. In the embodiment of the application, in the process of the first proxy service interacting with the third server to obtain the first resource, the third server verifies the key, and only returns the first resource to the first proxy service when the key is verified, thereby ensuring the security of the resource stored in the third server.

[0136] Optionally, the third server verifies the key in the following manner: the third server stores the key corresponding to the service identifier, and determines that the key is verified when the key sent by the first proxy service is the same as the key corresponding to the service identifier in the third server, and determines that the key is not verified when the key sent by the first proxy service is different from the key corresponding to the service identifier in the third server.

[0137] The second mode: the first proxy service encrypts the service identifier based on the key to obtain an encrypted service identifier, sends the encrypted service identifier to the third server based on the first access address, the third server decrypts the encrypted service identifier to obtain the service identifier, and returns the resource corresponding to the service identifier stored under the first access address to the first proxy service.

[0138] In the process of the first proxy service interacting with the third server to obtain the first resource, the first proxy service encrypts the service identifier based on the key, and the third server decrypts the encrypted service identifier. Only when the decryption is successful, the corresponding stored first resource is queried, and the queried first resource is returned to the first proxy service, thereby ensuring the security of the resource stored in the third server.

[0139] Optionally, the third server stores a correspondence between a service identifier and a key, and after receiving the encrypted service identifier and the first access address sent by the first proxy service, the third server determines the service identifier corresponding to the resource stored at the first access address, queries the correspondence based on the service identifier, determines the key corresponding to the service identifier, decrypts the encrypted service identifier based on the key, obtains the decrypted service identifier, and in a case where the decrypted service identifier is the same as the service identifier corresponding to the first access address, queries the corresponding stored first resource and returns the queried first resource to the first proxy service.

[0140] In the embodiment of the present application, in a case where the first proxy service stores a mapping relationship between a service identifier and a key, the first proxy service acquires the corresponding first resource based on the key corresponding to the service identifier in the first access address, thereby ensuring the security of the acquired resource.

[0141] It should be noted that the embodiment of the present application is described by taking the acquisition of the resource corresponding to each service identifier as an example, and in another embodiment, in a case where the service identifier in the first access address is a target service identifier, the mapping relationship does not include the key corresponding to the target service identifier, indicating that the resource corresponding to the target service identifier is a public resource and the target service identifier corresponding resource can be accessed without a key. For example, in a case where the service identifier in the first access address is a target service identifier, there is no need to query the key corresponding to the target service identifier, and the resource stored at the first access address is directly acquired.

[0142] It should be noted that, on the basis of the above-mentioned embodiments, the key has a valid time length, and the first proxy service periodically interacts with the key distribution service to update the key in the mapping relationship, that is, taking the fourth server on which the key distribution service is deployed outside the first server as an example, the first proxy service periodically interacts with the key distribution service to update the mapping relationship, and the process is as shown in Figure 6 , which includes:

[0143] 601. The first server acquires the key by sending a key acquisition request to the key distribution service through the first proxy service every target time length.

[0144] The target time length is an arbitrary time length, for example, the target time length is one week or one month, etc. The key acquisition request carries a service identifier, and the key acquisition request is used to request the key distribution service to generate a key for the service identifier. The key distribution service is used to generate a key for the service identifier. In the embodiment of the application, the key in the mapping relationship between the service identifier and the key has a valid time length. Within the valid time length, the key is valid. Outside the valid time length, the key cannot be used. Optionally, within the target time length after the generation time point of the key, the key is within the valid time length. Optionally, the valid time length of the key is identified in the form of a time period. For example, the key corresponds to a start time point and an end time point. The time length of the time period between the start time point and the end time point corresponding to the key is the valid time length corresponding to the key. Therefore, the first proxy service needs to send a key acquisition request to the key distribution service every target time length to acquire a new key corresponding to each service identifier.

[0145] 602. The fourth server receives the key acquisition request through the key distribution service, generates a new key for the service identifier based on the key acquisition request, and sends the new key to the proxy service.

[0146] The fourth server is any server other than the first server, and the key distribution service is deployed in the server.

[0147] Through the key distribution service, a new key is generated for the service identifier carried by the key acquisition request, and the new key is sent to the first proxy service, so that the first proxy service updates the mapping relationship subsequently.

[0148] In a possible implementation manner, the key distribution service generates a new key through a permanent key of the service identifier. In this case, the 602 includes: for any service identifier, a new key corresponding to the service identifier is generated through the key distribution service based on a target key corresponding to the service identifier.

[0149] The target key is a permanent key, and the target key is permanently valid. The target key of the service identifier is used to generate a new key corresponding to the service identifier, so as to ensure that the new key has a valid time length.

[0150] Optionally, through the key distribution service, an effective time length is determined based on the target key corresponding to the service identifier, and the target key and the effective time length are encoded to obtain the new key.

[0151] The target key corresponding to the service identifier and the valid time length are encoded, so that the new key has a time limit for validity, and the new key is valid within the valid time length and invalid outside the valid time length, so as to avoid the situation that key leakage leads to unsafe access, thereby ensuring the security of access.

[0152] Optionally, the manner in which the key distribution service obtains the target key corresponding to the service identifier comprises: the key distribution service sends a key obtaining request to the configuration center, the key obtaining request carrying the service identifier; the configuration center receives the key obtaining request, queries the target key corresponding to the service identifier based on the key obtaining request, and sends the target key corresponding to the service identifier to the key distribution service; and the key distribution service receives the target key corresponding to the service identifier and stores the target key corresponding to the service identifier.

[0153] In the embodiment of the application, the configuration center is configured with target keys corresponding to a plurality of service identifiers, and optionally, the target keys corresponding to the plurality of service identifiers included in the configuration center are configured by an administrator.

[0154] 603、The first server receives the new key sent by the key distribution service through the first proxy service, and updates the mapping relationship based on the new key.

[0155] The new key sent by the key distribution service is received through the first proxy service, and the mapping relationship is updated based on the new key corresponding to the service identifier, so as to ensure that each key corresponding to each service identifier in the mapping relationship is the latest key and each key is currently valid.

[0156] It should be noted that, in the above Figure 6 In another embodiment, the key distribution service is deployed in the first server, and the above step 602 is not required, and the first server can receive the key obtaining request through the key distribution service, generate a new key for the service identifier based on the key obtaining request, and send the new key to the proxy service.

[0157] The method provided in the embodiment of the application sets a valid time length for the key stored in the first proxy service, and acquires the resource based on the key with the valid time length, thereby reducing the influence of key leakage and ensuring the security of the service.

[0158] Also, the method provided by the embodiments of the present application generates a key with a valid time length for the first proxy service by the key issuing service, and the code of the service service is less changed, and the key can be reused within the valid time length of the key, so that a key does not need to be generated every time the key is used, the number of times of generating the key is reduced, and the overhead caused by generating the key is reduced.

[0159] As shown in the Figure 7 embodiments, in the scenario of acquiring cloud resources, the administrator configures the permanent keys corresponding to the multiple service identifiers in the configuration center, the fourth server interacts with the configuration center through the key issuing service to acquire the permanent keys corresponding to the multiple service identifiers, the first server interacts with the key issuing service through the first proxy service to acquire the temporary keys corresponding to the multiple service identifiers, and the mapping relationship in the cache is updated based on the temporary keys corresponding to the multiple service identifiers. The service service accesses the first proxy service, and the first proxy service accesses the resources corresponding to the service identifiers in the cloud resources based on the temporary keys in the mapping relationship.

[0160] It should be noted that the Figure 3 embodiments shown above are examples in which the first resource stored under the first access address is taken as an example, the first resource stored under the first access address is acquired through the first proxy service, and in another embodiment, step 304 is not performed, and other manners can be adopted to acquire the first resource corresponding to the first access address through the first proxy service under the condition that the first access address is verified.

[0161] As shown in the Figure 8 embodiments, examples in which the resource stored under the first access address is not the first resource are taken, and the process of acquiring the first resource corresponding to the first access address after the first access address is verified includes the following steps.

[0162] 801、The first server acquires the second resource stored under the first access address through the first proxy service.

[0163] In the embodiments of the present application, the resource stored under the first access address is the second resource, and the second resource is a resource of any type, for example, the second resource is an index file of the first resource, the index file is used to index the corresponding resource, and the address included in the second resource is the storage address of the resource corresponding to the index file. Optionally, for an audio resource, the index file corresponding to the audio resource includes storage addresses of multiple audio segments in the audio resource. Optionally, for a video resource, the index file corresponding to the video resource includes storage addresses of multiple video segments in the video resource.

[0164] 802. The first server, through the first proxy service, converts the third access address into a fourth access address belonging to the target format when the second resource is of the index file type and the second resource contains a third access address.

[0165] The index file type indicates that the corresponding resource is used to index other resources. For example, the index file type is m3u8 (Moving Picture Experts Group Audio Layer 3 Uniform Resource Locator UTF-8, a file format) or other types. The process of format conversion for the third access address is the same as step 301 above, and will not be repeated here.

[0166] If the second resource is an index file type, it is necessary to index other resources according to the second resource. However, the address contained in the second resource does not belong to the format supported by the first proxy service. Therefore, it is necessary to convert the format of the address contained in the second resource so that the first proxy service can index other resources corresponding to the second resource according to the converted address.

[0167] 803. The first server obtains the first resource stored under the fourth access address through the first proxy service.

[0168] The fourth access address belongs to the target format, that is, the fourth access address is the address supported by the first proxy service. After converting the third access address in the second resource, which belongs to the index file type, into the fourth access address supported by the first proxy service, the first resource stored under the fourth access address can be obtained through the first proxy service.

[0169] In one possible implementation, step 803 includes: verifying the fourth access address through the first proxy service, and if the fourth access address is verified, obtaining the first resource stored under the fourth access address.

[0170] In this embodiment, after the first proxy service obtains the second resource according to the first access address, and the second resource is of the index file type, it converts the third access address in the second resource into a fourth access address of the target format. Then, it directly obtains the first resource stored under the fourth access address and returns the first resource to the business service. There is no need to return the second resource to the business service and then have the business service interact with the first proxy service to obtain the first resource, thus reducing communication overhead. This also enables the interception of malicious resources containing addresses, such as malicious audio and video resource attacks, and has a wide range of applications.

[0171] For example, the first proxy service obtains the first resource based on the first access address, and the process flow is as shown in FIG. 8. Figure 9 As shown in FIG. 8, after obtaining the first access address, the first proxy service first checks whether the first access address is an internal network address that is not allowed to be accessed. If the first access address is an internal network address, a verification failure notification is sent to the business service to prompt that the first access address is an internal network address that is not allowed to be accessed. If the first access address is not an internal network address, it is determined whether the first access address has an associated jump address, such as a 302 jump address. If the first access address has an associated jump address, it is checked whether the jump address is an internal network address that is not allowed to be accessed. If the jump address is not an internal network address, the resource stored under the jump address is obtained. If the jump address is an internal network address, a verification failure notification is sent to the business service to prompt that the jump address is an internal network address that is not allowed to be accessed. If the first access address does not have an associated jump address, the resource stored under the first access address is obtained.

[0172] In the audio and video scenario, after obtaining the resource corresponding to the first access address through the first proxy service, it is determined whether the resource is an audio file or a video file. If it is determined that the obtained resource is not an audio file or a video file, but an index file, the third access address in the index file needs to be format-converted to obtain a fourth access address in a target format. The fourth access address is an address supported by the first proxy service. For example, the address included in the index file is "abc.1", and the fourth access address after format conversion is "http / example.com / abc.1". The fourth access address is verified through the first proxy service. If the verification of the fourth access address is passed, the first resource stored under the fourth access address is obtained, that is, the audio resource or the video resource is obtained. The first resource is returned to the business service, so that the business service can use FFmpeg (Fast Forward mpeg, an open source plug-in) to process the audio resource or the video resource.

[0173] It should be noted that the embodiments of the present application are described by taking the second resource including one third access address as an example. In another embodiment, the second resource includes multiple third access addresses. After step 802 is executed, multiple fourth access addresses are obtained. According to step 803 described above, the resources under the multiple fourth access addresses are obtained respectively, and the resources under the multiple fourth access addresses are combined to form the first resource. For example, the resources stored under the multiple fourth access addresses are video clips of a target video, and the multiple video clips are combined to form the target video.

[0174] It should be noted that in the above embodiment, the first server has external access permission, and the first proxy service can directly access the external resource according to the access address. Alternatively, the first server is configured with an external network card or a NAT (Network Address Translation) interface, and the first proxy service accesses the external resource according to the access address based on the external network card or the NAT interface. In another embodiment, the first server does not have external access permission, and a second server needs to be configured, the second server is deployed with a second proxy service, a communication connection is established between the first server and the second server, the first proxy service interacts with the second proxy service, and the second proxy service accesses the external resource. As shown in FIG. 8, the first server accesses the first resource stored in the first access address through the first proxy service in the case that the first access address is verified, and the process includes the following steps. Figure 10

[0175] 1001, the first server sends the first access address to the second proxy service through the first proxy service in the case that the first access address is verified.

[0176] The verification process is the same as step 303, and will not be repeated here. In the embodiment of the application, the first server does not have external access permission; the second server deployed with the second proxy service has external access permission, and the first proxy service can send the first access address to the second proxy service based on the communication connection between the first server and the second server.

[0177] 1002, the second server receives the first access address sent by the first proxy service through the second proxy service, obtains the first resource corresponding to the first access address, and sends the first resource to the first proxy service.

[0178] In a possible implementation manner, the first resource stored in the first access address, and the process of obtaining the first resource corresponding to the first access address includes: obtaining the first resource stored in the first access address through the second proxy service.

[0179] ​In another possible implementation manner, the second resource is stored under the first access address, and the second resource belongs to an index file type. The process of obtaining the first resource corresponding to the first access address includes: sending the second resource to the first proxy service through the second proxy service, receiving the second resource through the first proxy service, in a case where the second resource belongs to an index file type and the second resource contains a third access address, converting the third access address into a fourth access address belonging to a target format, verifying the fourth access address through the first proxy service, in a case where the fourth access address passes the verification, sending the fourth access address to the second proxy service through the first proxy service, obtaining the first resource stored under the fourth access address through the second proxy service, and sending the first resource to the first proxy service.

[0180] 1003、The first server receives the first resource sent by the second proxy service through the first proxy service.

[0181] The first proxy service receives the first resource sent by the second proxy service, which realizes the way of accessing the external resource through the second proxy service, and avoids the business service from being attacked by the external resource, thereby ensuring the security of the business service.

[0182] As shown in Figure 11 , in a case where the first server has external access authority, the user equipment is installed with a client of the business service, and the client is used to send an external resource processing request to the business service based on a gateway corresponding to the first server. The business service accesses the first proxy service in a proxy manner, and the first proxy service accesses a public network resource corresponding to the external resource processing request.

[0183] As shown in Figure 12 , in a case where the first server does not have external access authority, the user equipment is installed with a client of the business service, and the client is used to send an external resource processing request to the business service based on a gateway corresponding to the first server. The business service accesses the first proxy service in a proxy manner, and the first proxy service accesses the second proxy service in the second proxy server, and the second proxy service accesses a public network resource corresponding to the external resource processing request.

[0184] Figure 13 is a structural schematic diagram of a resource processing apparatus provided by an embodiment of the present application, executed by a first server, and the first server runs a business service and a first proxy service, as shown in Figure 13 , the apparatus includes:

[0185] The first sending module 1301 is configured to, in response to the external resource processing request sent by the client, send, through the service service, a first access address corresponding to the external resource processing request to the first proxy service, the external resource being a resource stored in a device other than the first server.

[0186] The second sending module 1302 is configured to, through the first proxy service, acquire the first resource corresponding to the first access address in a case where the first access address passes the verification, and send the first resource to the service service.

[0187] The third sending module 1303 is configured to, through the service service, send, based on the first resource, a resource processing result to the client.

[0188] In a possible implementation manner, as shown in Figure 14 The first sending module 1301 comprises:

[0189] The first conversion unit 1311 is configured to, through the service service, perform format conversion on a second access address carried in the external resource processing request, to obtain a first access address in a target format, the target format being an address format supported by the first proxy service.

[0190] The first sending unit 1312 is configured to, through the service service, send the first access address to the first proxy service.

[0191] In another possible implementation manner, the first conversion unit 1311 is configured to, through the service service, perform format conversion on the second access address based on at least one of a service type to which the external resource processing request belongs or a service identifier carried in the external resource processing request, to obtain the first access address.

[0192] In another possible implementation manner, the first conversion unit 1311 is configured to, through the service service, acquire an address template corresponding to the target format, the address template comprising at least one of a service type field or a service identifier field and an address field; and based on the address template, fill at least one of a type identifier of the service type or the service identifier and the second access address in the corresponding fields, to obtain the first access address.

[0193] In another possible implementation manner, as shown in Figure 14 The apparatus further comprises:

[0194] The verification module 1304 is configured to, through the first proxy service, perform verification on the received first access address.

[0195] The determination module 1305 is configured to, in a case where the first access address does not belong to a target network segment, determine that the first access address passes the verification, the target network segment being a network segment that is not allowed to be accessed.

[0196] In a possible implementation, the determining module 1305 is configured to determine that the first access address passes the verification in a case where the first access address does not belong to the target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, the jump address being an address to which the first access address automatically jumps when accessed.

[0197] In a possible implementation, the determining module 1305 is configured to determine that the first access address passes the verification in a case where the first access address does not belong to the target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, the jump address being an address to which the first access address automatically jumps when accessed.

[0198] In a possible implementation, as shown in Figure 14 the second sending module 1302 includes:

[0199] The obtaining unit 1321 is configured to obtain a second resource stored at the first access address.

[0200] The second converting unit 1322 is configured to, in a case where the second resource belongs to an index file type and the second resource contains a third access address, convert the third access address into a fourth access address belonging to a target format, the target format being an address format supported by the first proxy service.

[0201] The obtaining unit 1321 is further configured to obtain the first resource stored at the fourth access address.

[0202] In a possible implementation, the obtaining unit 1321 is further configured to perform verification on the fourth access address by the first proxy service; and obtain the first resource stored at the fourth access address by the first proxy service in a case where the fourth access address passes the verification.

[0203] In a possible implementation, the first server does not have external access authority; and the second sending module 1302 is configured to, in a case where the first access address passes the verification, send, by the first proxy service, the first access address to a second proxy service, obtain, by the second proxy service, the first resource corresponding to the first access address, send, by the second proxy service, the first resource to the first proxy service, and the second server deploying the second proxy service has external access authority; and receive, by the first proxy service, the first resource sent by the second proxy service.

[0204] In a possible implementation, the first access address includes a service identifier; and the second sending module 1302 is configured to obtain the first resource corresponding to the service identifier and stored at the first access address based on the service identifier in the first access address.

[0205] In a possible implementation, as shown in Figure 14 the second sending module 1302 includes:

[0206] The determining unit 1323 is configured to query a mapping relationship between a service identifier and a key based on the service identifier in the first access address, and determine the key corresponding to the service identifier.

[0207] The obtaining unit 1321 is configured to obtain a first resource stored corresponding to the service identifier under the first access address based on the key corresponding to the service identifier.

[0208] In another possible implementation, the key has a valid time length; as shown in the figure, the apparatus further includes: Figure 14

[0209] The fourth sending module 1306 is configured to send, through the first proxy service, a key obtaining request to the key distribution service every target time length, the key obtaining request carrying the service identifier; the key distribution service is configured to generate a new key for the service identifier based on the key obtaining request, and send the new key to the first proxy service.

[0210] The updating module 1307 is configured to receive, through the first proxy service, the new key sent by the key distribution service, and update the mapping relationship based on the new key.

[0211] In another possible implementation, the third sending module 1303 is configured to send the first resource to the client; or, process the first resource to obtain a resource processing result, and send the resource processing result to the client.

[0212] It should be noted that: the resource processing apparatus provided in the above embodiments is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the first server is divided into different functional modules to complete all or part of the functions described above. In addition, the resource processing apparatus and the resource processing method provided in the above embodiments belong to the same concept, and the specific implementation process is described in detail in the method embodiments, which will not be repeated here.

[0213] The server provided in the embodiments of the present application includes a processor and a memory, and the memory stores at least one computer program, which is loaded and executed by the processor to implement the operations performed by the resource processing method of the above embodiments.

[0214] Figure 15 ​is a structural schematic diagram of a server provided by an embodiment of the present application. The server 1500 can have great differences due to different configurations or performances, and can include one or more processors (Central Processing Units, CPUs) 1501 and one or more memories 1502. The memory 1502 stores at least one computer program, and the at least one computer program is loaded and executed by the processor 1501 to implement the method provided by each method embodiment. Of course, the server can also have a wired or wireless network interface, a keyboard, an input and output interface, and other components for implementing device functions, and details are not described herein.

[0215] An embodiment of the present application further provides a computer readable storage medium, which stores at least one computer program. The at least one computer program is loaded and executed by a processor to implement the operations performed by the resource processing method of the above embodiment.

[0216] An embodiment of the present application further provides a computer program product, which includes a computer program. The computer program is executed by a processor to implement the operations performed by the resource processing method according to the above aspect.

[0217] Those skilled in the art can understand that all or part of the steps of the above embodiments can be completed by hardware, or by a program instructing relevant hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0218] The above description is only optional embodiments of the present application, and does not limit the embodiments of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the present application shall be included in the protection scope of the present application.

Claims

1. A resource processing method, characterized by, The method is executed by a first server, the first server running a service and a first proxy service, and the method comprises: In response to an external resource processing request sent by a client, the second access address carried by the external resource processing request is converted into a first access address of a target format by the service, the external resource being a resource stored in a device other than the first server, and the target format being an address format supported by the first proxy service; The first access address is sent to the first proxy service by the service; In the case that the first access address is verified, the first resource corresponding to the first access address is obtained by the first proxy service, and the first resource is sent to the service; The service sends a resource processing result to the client based on the first resource.

2. The method of claim 1, wherein, The second access address carried by the external resource processing request is converted into the first access address of the target format by the service, comprising: The second access address is converted into the first access address by the service based on at least one of a service type to which the external resource processing request belongs or a service identifier carried by the external resource processing request.

3. The method of claim 1, wherein, The method further comprises: The first access address received is verified by the first proxy service; In the case that the first access address does not belong to a target network segment, it is determined that the first access address is verified, and the target network segment is a network segment that is not allowed to be accessed.

4. The method of claim 3, wherein, In the case that the first access address does not belong to the target network segment, it is determined that the first access address is verified, comprising: In the case that the first access address does not belong to the target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, it is determined that the first access address is verified, and the jump address is an address automatically jumped to when accessing the first access address.

5. The method of claim 4, wherein, In the case that the first access address does not belong to the target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, it is determined that the first access address is verified, comprising: In the case that the first access address does not belong to the target network segment, the first access address has an associated jump address, and the jump address does not belong to the target network segment, it is determined that the first access address is verified.

6. The method of claim 1, wherein, In the case that the first access address is verified, the first resource corresponding to the first access address is obtained, comprising: The second resource stored under the first access address is obtained; In the case that the second resource belongs to an index file type and the second resource contains a third access address, the third access address is converted into a fourth access address of a target format, the target format being an address format supported by the first proxy service; The first resource stored under the fourth access address is obtained.

7. The method of claim 6, wherein, The first resource stored under the fourth access address is obtained, comprising: verify the fourth access address by the first proxy service; obtain the first resource stored at the fourth access address by the first proxy service if the fourth access address is verified.

8. The method of claim 1, wherein, The first server does not have external access permission; and the first resource corresponding to the first access address is obtained by the first proxy service if the first access address is verified, including: The first proxy service sends the first access address to a second proxy service if the first access address is verified, and the second proxy service obtains the first resource corresponding to the first access address, sends the first resource to the first proxy service, and a second server deploying the second proxy service has external access permission; The first resource sent by the second proxy service is received by the first proxy service.

9. The method of claim 1, wherein, The first access address includes a service identifier; and the first resource corresponding to the first access address is obtained, including: The first resource corresponding to the service identifier and stored at the first access address is obtained based on the service identifier in the first access address.

10. The method of claim 9, wherein, The first resource corresponding to the service identifier and stored at the first access address is obtained based on the service identifier in the first access address, including: A mapping relationship between a service identifier and a key is queried based on the service identifier in the first access address, and the key corresponding to the service identifier is determined; The first resource corresponding to the service identifier and stored at the first access address is obtained based on the key corresponding to the service identifier.

11. The method of claim 10, wherein, The key has a valid time length; and the method further includes: The first proxy service sends a key obtaining request to a key distribution service every target time length, and the key obtaining request carries the service identifier; the key distribution service generates a new key for the service identifier based on the key obtaining request, and sends the new key to the first proxy service; The new key sent by the key distribution service is received by the first proxy service, and the mapping relationship is updated based on the new key.

12. A resource processing device, characterized by A first server is executed, and a service and a first proxy service are run in the first server, and the device includes: A first sending module is configured to, in response to an external resource processing request sent by a client, convert a second access address carried by the external resource processing request into a first access address in a target format by the service, the external resource being a resource stored in a device other than the first server, and the target format being an address format supported by the first proxy service; and send the first access address to the first proxy service by the service; A second sending module is configured to, in the case that the first access address is verified by the first proxy service, obtain a first resource corresponding to the first access address, and send the first resource to the service. A third sending module, configured to send a resource processing result to the client based on the first resource through the service.

13. A server, characterized by The server comprises a processor and a memory, and the memory stores at least one computer program, which is loaded and executed by the processor to implement the operations performed by the resource processing method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one computer program, which is loaded and executed by the processor to implement the operations performed by the resource processing method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the operations performed by the resource processing method according to any one of claims 1 to 11.

Images