Resource access limiting method, electronic equipment, storage medium and program product

Abstract

The invention provides a resource access limiting method, electronic equipment, a readable storage medium and a computer program product. The resource access limiting method comprises the steps of obtaining a request message of a resource access request in response to the resource access request; detecting rule factors respectively matched with a plurality of message features in the request message, and determining the rule factors matched with the message features as target factors; querying a limit strategy containing each target factor, and determining the limit strategy containing each target factor as a target limit strategy; outputting an access limiting instruction in the target limiting strategy, wherein the access limiting instruction is used for intercepting the resource access request to access the server; wherein the message feature comprises a request line and a request header, and the rule factor is configured to limit a logical relationship between a character string in the message feature and a specific character string.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a resource access restriction method, electronic device, storage medium and program product. Background Art

[0002] With the booming development of mobile Internet, more and more enterprises are gradually transforming to digitalization and onlineization. With the development of digitalization, enterprises are storing and displaying more and more data, and people can search for information and data they are interested in through the Internet. These search technologies are actually based on the collection of Internet information by web crawlers. In this regard, web crawlers play a big role.

[0003] However, there are still a number of malicious web crawlers on the Internet. These crawlers do not follow the Internet crawler protocol and crawl information recklessly. Such behavior will put a lot of pressure on enterprise servers, causing normal users to have access problems at best, and even paralyzing the server at worst. Current anti-crawler methods mainly detect malicious crawlers by identifying the behavior of web crawlers, and then ban them. If malicious crawlers disguise their behavior as that of well-intentioned users, it will be difficult to effectively ban them. Summary of the invention

[0004] The present disclosure provides a resource access restriction method, electronic device, storage medium and program product.

[0005] According to one aspect of the present disclosure, a method for restricting resource access is provided, comprising: in response to a resource access request, obtaining a request message of the resource access request; detecting rule factors that match each of a plurality of message features in the request message, and determining the rule factors that match the message features as target factors; querying a restriction policy containing each of the target factors, and determining the restriction policy containing each of the target factors as a target restriction policy; and outputting an access restriction instruction in the target restriction policy, the access restriction instruction being used to intercept the resource access request from accessing a server; wherein the message features include a request line and a request header, and the rule factors are configured to limit the logical relationship between a character string in the message features and a specific character string.

[0006] According to the resource access restriction method of at least one embodiment of the present disclosure, the rule factors that match each of the multiple message features in the request message are detected, and the rule factors that match the message features are determined as target factors, including: obtaining a factor pool, which is the union of the multiple rule factors included in the restriction policy that has been issued; and for each of the message features, traversing the rule factors in the factor pool, obtaining the rule factor that matches the message feature and determining it as the target factor.

[0007] According to at least one embodiment of the resource access restriction method disclosed herein, the method further includes: obtaining the newly issued restriction policy according to an update time interval; in response to obtaining the newly issued restriction policy, determining the newly issued restriction policy as the issued restriction policy; and integrating the union of the multiple rule factors contained in each of the issued restriction policies into a factor pool.

[0008] According to the resource access restriction method of at least one embodiment of the present disclosure, the access restriction instruction in one of the target restriction policies includes: a first restriction instruction, the first restriction instruction is used to instruct the gateway to intercept the resource access request to access the server, and is used to instruct the gateway to send an interception page to the request source of the resource access request; or a second restriction instruction, the second restriction instruction is used to instruct the gateway to intercept the resource access request to access the server, and is used to instruct the gateway to send a verification pop-up window to the request source of the resource access request.

[0009] According to at least one embodiment of the resource access restriction method of the present disclosure, it also includes: querying the grayscale release field in the target restriction policy; and in response to the existence of the grayscale release field in the target restriction policy, outputting a grayscale release instruction and recording the release result of the resource access request; wherein the grayscale release instruction is used to instruct the gateway to forward the resource access request to the server.

[0010] According to the resource access restriction method of at least one embodiment of the present disclosure, the rule factor is configured to: limit the string in the message feature to include the specific string; and / or limit the string in the message feature to not include the specific string; and / or limit the string in the message feature to be equal to the specific string; and / or limit the string in the message feature to not be equal to the specific string; and / or limit the prefix of the string in the message feature to be equal to the specific string; and / or limit the specific string to exist in the message feature; and / or limit the specific string to not exist in the message feature; and / or limit the string in the message feature to belong to the specific string; and / or limit the string in the message feature to not belong to the specific string.

[0011] According to at least one embodiment of the resource access restriction method disclosed herein, in response to a resource access request, a request message of the resource access request is obtained, including: in response to the resource access request, obtaining an unedited request message of the resource access request and obtaining a request source address of the resource access request; and adding the request source address to a request header of the unedited request message to obtain the edited request message.

[0012] According to another aspect of the present disclosure, an electronic device is provided, comprising: a memory storing execution instructions; and a processor executing the execution instructions stored in the memory, so that the processor executes the resource access restriction method of any embodiment of the present disclosure.

[0013] According to another aspect of the present disclosure, a readable storage medium is provided, wherein the readable storage medium stores execution instructions, and when the execution instructions are executed by a processor, the resource access restriction method of any embodiment of the present disclosure is implemented.

[0014] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the resource access restriction method of any embodiment of the present disclosure is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings illustrate exemplary embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0016] Figure 1 It is a schematic diagram of an application scenario of a resource access restriction method according to an embodiment of the present disclosure.

[0017] Figure 2 The figure is a flowchart of a method for limiting resource access according to an embodiment of the present invention.

[0018] Figure 3 The figure is a flowchart of a method for limiting resource access according to an embodiment of the present invention.

[0019] Figure 4 The figure is a flowchart of a method for limiting resource access according to an embodiment of the present invention.

[0020] Figure 5 It is a schematic diagram of an application scenario of a resource access restriction method according to an embodiment of the present disclosure.

[0021] Figure 6 The figure is a flowchart of a method for limiting resource access according to an embodiment of the present invention.

[0022] Figure 7 The figure is a flowchart of a method for limiting resource access according to an embodiment of the present invention.

[0023] Figure 8 The figure is a schematic block diagram of the structure of a resource access restriction device according to an embodiment of the present disclosure.

[0024] Fig. 9The present invention is a block diagram showing the structure of an electronic device equipped with a device for limiting resource access according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present disclosure is further described in detail below in conjunction with the accompanying drawings and examples. It is understood that the specific examples described herein are only used to explain the relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only the parts related to the present disclosure are shown in the accompanying drawings.

[0026] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The technical solution of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] With the booming development of mobile Internet, more and more enterprises are gradually transforming to digitalization and onlineization. With the development of digitalization, enterprises are storing and displaying more and more data, and people can search for information and data they are interested in through the Internet. These search technologies are actually based on the collection of Internet information by web crawlers. In this regard, web crawlers play a big role.

[0028] However, there are still a number of malicious web crawlers on the Internet. These crawlers do not follow the Internet crawler protocol and crawl information recklessly. Such behavior will put a lot of pressure on enterprise servers, causing normal users to have access problems at best, and even paralyzing the server at worst. Current anti-crawler methods mainly detect malicious crawlers by identifying the behavior of web crawlers, and then ban them. If malicious crawlers disguise their behavior as that of well-intentioned users, it will be difficult to effectively ban them.

[0029] To this end, the present disclosure proposes a resource access restriction method to solve the above problem.

[0030] For the convenience of description and to make the technical solutions of the specific implementation methods of the present disclosure easier to understand, before describing the resource access restriction method implemented by the present disclosure, the technical terms involved in the specific implementation methods of the present disclosure are defined as follows: Web crawler, also known as spider, is a program that automatically crawls Internet information and is also a core component of search engines. Web crawlers can download web pages, pictures, videos and other content from the Internet according to specified rules, and extract useful information for processing.

[0031] Resource access request refers to the request sent by the client (such as a browser, mobile application or other program) to the server to obtain a certain type of resource. These resources can be web pages, pictures, video streams, API data, etc. In the HTTP protocol (Hypertext Transfer Protocol), resource access requests are usually implemented by sending an HTTP request, which contains a series of information to tell the server what resources are needed and how to handle the request.

[0032] A request message is an HTTP request message, which is a message sent by a client (usually a browser) to a server. A request message usually includes a request line, a request header, and a possible message body.

[0033] Figure 1 The application scenario of a resource access restriction method of an embodiment of the present disclosure is shown. Malicious crawlers are blocked by deploying a resource access restriction method in an anti-crawler system. The anti-crawler system is a rule engine system that makes decisions by executing logical operations through software. Deploying a resource access restriction method in an anti-crawler system means that the logical operations executed in the anti-crawler system include steps in the resource access restriction method.

[0034] exist Figure 1 In the application scenario shown, the administrator of the anti-crawler system issues restriction policies in the anti-crawler policy library. The restriction policies in the anti-crawler policy library are regularly issued to the anti-crawler system according to the update time. The restriction policy contains multiple rule factors, each of which is a restriction rule used to limit the logical relationship between the string in the request message and the specific string. For example, the rule factor can be used to limit the string in the request header in the request message to include the specific string "User-Agent", where "include" belongs to the logical relationship limited by the rule factor. For another example, the rule factor can be used to limit the string of the request path in the request line in the request message to not include the specific string "abc", where "do not include" belongs to the logical relationship limited by the rule factor. The restriction policy also includes access restriction instructions, which are used to instruct the gateway to intercept resource access requests sent by the client.

[0035] The client sends a resource access request to the gateway, and the resource access request is used to access the resource data in the server. The server may include multiple business servers, each of which stores resource data for a business. Assume that the business server includes a product information server, and the resource data stored in the product information server includes pictures of products. The access object of the resource access request sent by a client is a picture of a certain product in the product information server. If the gateway trusts the resource access request, the client can access the picture of the product in the product information server. The gateway can restrict the client's resource access, for example, it is necessary to restrict the client to pass verification before allowing access, restrict the client to access at a specified time, restrict the client from not allowing access, and so on. The resource access restriction method is used to output an access restriction instruction to instruct the gateway to restrict the client's resource access when the resource access request meets certain conditions.

[0036] Specifically, the gateway forwards the resource access request message to the anti-crawler system. The resource access restriction method deployed in the anti-crawler system can detect the request message using the restriction policy issued by the anti-crawler policy library to determine whether the request message matches a restriction policy. The anti-crawler system then returns the detection result to the gateway, and the gateway decides to release or intercept the resource access request based on the detection result of the anti-crawler system.

[0037] If the character string in the request message meets the rules defined by all rule factors included in a restriction policy, the request message is considered to match the restriction policy.

[0038] If the request message matches a restriction policy, the detection result returned to the gateway includes the access restriction instruction in the restriction policy, so that the gateway intercepts the resource access request in response to the access restriction instruction. The interception method can be to display an interception page without returning the requested resource data, or to return a verification page. If the request message does not match the restriction policy, the detection result returned to the gateway includes a release instruction, so that the gateway forwards the resource access request to the server in response to the release instruction.

[0039] Based on the above scheme, when the specific character string defined in the rule factor included in the restriction policy is a character string in the request message of the malicious crawler that is specifically limited, the resource access restriction method can specifically ban the malicious crawler. In this way, the resource access restriction method in the embodiment of the present disclosure does not detect the behavior of the malicious crawler, but bans the malicious crawler based on whether the request message of the malicious crawler hits the restriction policy. Even if the malicious crawler disguises its behavior as the behavior of a good-intentioned user, it cannot change the result that its request message hits the restriction policy, so the malicious crawler can be banned regardless of its behavior disguise.

[0040] Figure 2 FIG. 1 is a schematic diagram showing the overall flow of a resource access restriction method M100 according to an embodiment of the present disclosure. Figure 2 The method shown includes steps S110 to S140. The method can be executed by electronic devices such as mobile phones and tablet computers.

[0041] Specifically, Figure 2 The methods shown include: S110. In response to the resource access request, obtain a request message of the resource access request.

[0042] The resource access request is information sent by the client to obtain data in the server. The resource access request may be an HTTP request under the HTTP protocol, and accordingly, the request message is an HTTP request message.

[0043] S120: Detect rule factors that match each of the multiple message features in the request message, and determine the rule factors that match the message features as target factors.

[0044] Among them, the message features include the request line and the request header. Usually, the request message consists of three main parts: the request line, the request header, and the possible message body.

[0045] The request line contains three fields: the request method, the URL (Uniform ResourceLocator) or the path (Path), and the HTTP protocol version used. For example, the request method can be GET, POST, PUT, DELETE, etc. The request target can be a path relative to the server root directory.

[0046] The request header contains multiple fields, each of which appears in the form of a key-value pair, which is used to pass client information, request parameters, etc. Common request header field keys include: Host, User-Agent, Accept, Accept-Language, Accept-Encoding, Cookie, etc.

[0047] A request message may include multiple request lines and multiple request headers. Multiple message features in a request message refer to all request lines and all request headers in the request message. One message feature is one request line or one request header.

[0048] For example, the request message includes "GET / index.html HTTP / 1.1", "Host: www.example.com" and "User-Agent: xxxxxxxx", that is, a request line and two request headers, then the request message includes three message features.

[0049] The rule factor is configured to define the logical relationship between the string in the message feature and the specific string. For example, the rule factor can define: among the strings constituting the request line, the string of the request method includes the specific string "GET", where "include" belongs to the logical relationship defined by the rule factor. For another example, the rule factor can define: among the strings constituting the request line, the string of the requested path does not include the specific string "abc", where "does not include" belongs to the logical relationship defined by the rule factor.

[0050] When the string in a message feature meets the logical relationship defined by a rule factor, the message feature is considered to match the rule factor. For example, a message feature is "Host: www.example.com", and the rule factor "kRules-01" defines: the string that constitutes the key of the request header contains a specific string "User-Agent"; the rule factor "kRules-02" defines: the string that constitutes the key of the request header contains a specific string "Host"; the rule factor "kvRules-03" defines: the string that constitutes the key of the request header contains a specific string "Host", and the string that constitutes the value of the request header contains a specific string "example". Then the message feature meets the logical relationship defined by the rule factors "kRules-02" and "kvRules-03", but does not meet the logical relationship defined by the rule factor "kRules-01". Therefore, the message feature matches the rule factors "kRules-02" and "kvRules-03", and the rule factors "kRules-02" and "kvRules-03" are determined as target factors.

[0051] S130: Query the restriction policy including each target factor, and determine the restriction policy including each target factor as the target restriction policy.

[0052] The restriction policy includes multiple rule factors and a restriction instruction. Multiple rule factors constitute the restriction policy's content restriction on the request message. If the content of the request message meets the rule restriction of the restriction policy, the resource access request corresponding to the request message will be intercepted by the restriction instruction in the restriction policy.

[0053] When each rule factor in a restriction policy is determined as a target factor, this restriction policy is the restriction policy that matches the request message, and is recorded as the target restriction policy.

[0054] In one example, the restriction policy is configured by an administrator who manages server resource access permissions, and the configured restriction policy is sent to the anti-crawler policy library, which can store one or more restriction policies. The administrator can configure specific restriction policies according to the message characteristics of the request message of the resource access request (such as malicious crawlers) to be restricted, so as to restrict the resource access requests with the same message characteristics from accessing the resources in the server.

[0055] For example, the anti-crawler policy library stores a first restriction policy and a second restriction policy. The first restriction policy includes rule factors "kRules-01", "vRules-01" and "kvRules-01", and the second restriction policy includes rule factors "kRules-01", "vRules-02" and "kvRules-02". Assuming that the rule factors "kRules-01", "vRules-01" and "kvRules-01" are determined as target factors, at this time, since the first restriction policy contains each target factor, the first restriction policy is determined as the target restriction policy.

[0056] S140: Output the access restriction instruction in the target restriction policy, where the access restriction instruction is used to intercept resource access requests from accessing the server.

[0057] Exemplarily, the restriction policy can be saved in the form of a json string. The restriction policy includes a policy number, an expiration time, a scope name, a restriction means, and a rule set. The rule set includes multiple rule factors. The restriction means includes an access restriction instruction.

[0058] The policy number is used to mark the restriction policy and serves as the identity ID of the restriction policy. For example, the policy number is in the form of "id": 1", which indicates that the restriction policy is numbered 1.

[0059] The expiration time is used to indicate the expiration time of the restriction policy. The restriction policy will no longer be effective after the expiration time. For example, the expiration time is in the form of "expire": "2025-01-01 00:00:00"", which means that the restriction policy will expire at 0:0:0:00 on January 1, 2025. In one example, the restriction policy is configured to be automatically destroyed when the expiration time is reached. This can prevent the restriction policy from taking effect after the expiration. In another example, the restriction policy is configured to make the rule set unreadable when the expiration time is reached. In this way, when the expiration time is reached, the rule factors in the rule set will not be determined as target factors because the rule set is unreadable, thereby preventing the restriction policy from taking effect after the expiration. In addition, the restriction policy will still remain after the expiration, and the restriction policy can be made effective again by reconfiguring the expiration time.

[0060] The scope domain name is used to indicate the domain name on which the restriction policy is effective. For example, the policy number scope domain name is in the form of "hosts": ["a.com", "b.com"]", which means that the restriction policy is effective for the domain names "a.com" and "b.com".

[0061] Restriction means is used to indicate how the restriction policy restricts resource access requests. In another example, the restriction means is in the form of ""dispose": {"model": 1}". Among them, "dispose" represents the restriction means part of the restriction policy, "model" represents the access restriction means, and "1" is the enumeration value of the access restriction means, representing a specific access restriction instruction. The access restriction means can be configured with one or more enumeration values. When the access restriction means is configured with multiple enumeration values, different enumeration values ​​represent different restriction instructions. For example, when the enumeration value of the access restriction means is "1", the specific access restriction instruction is "intercept resource access requests and return the interception page"; when the enumeration value of the access restriction means is "2", the specific access restriction instruction is "intercept resource access requests and return the verification page".

[0062] Assume that the restriction policy includes a first restriction policy and a second restriction policy, and the restriction means of the first restriction policy is in the form of ""dispose": {"model": 1}", and the restriction means of the second restriction policy is in the form of ""dispose": {"model":2}". If the first restriction policy is determined as the target restriction policy, the access restriction instruction represented by ""model": 1" is output.

[0063] When the restriction policy is determined as the target restriction policy, it means that the request message of the resource access request hits the restriction rule of the restriction policy, and the restriction means in the restriction policy should be executed to restrict the access to the resource access request. Outputting the access restriction instructions in the target restriction policy means outputting the access restriction instructions represented by the enumeration value of the access restriction means. Figure 1 ,In one example, the output access restriction instructions are executed by the ,gateway, and resource access requests are intercepted at the gateway layer.

[0064] If the target restriction policy cannot be determined, there is no output of the access restriction instruction. In one example, if the gateway does not respond to the access restriction instruction within a predetermined time, the resource access request is released by default. In another example, if the target restriction policy cannot be determined, the anti-crawler system outputs an access release instruction, which is used to instruct the gateway to release the resource access request.

[0065] In summary, the resource access restriction method provided in this embodiment can use the rule factors in the restriction policy to limit the message characteristics of the request message, and intercept the resource access request corresponding to the message characteristics matching the restriction policy, so as to automatically intercept and restrict the resource access request with specific message characteristics from accessing the server. In this way, as long as the rule factors in the restriction policy are configured to limit the message characteristics of the request message of the malicious crawler, the malicious crawler with the same message characteristics can be intercepted, so that the malicious crawler can be banned without identifying the behavior of the malicious crawler.

[0066] Regarding step S110, in some embodiments of the present disclosure, it may include: Figure 3 Steps S1101 to S1102 are shown.

[0067] S1101. In response to a resource access request, obtain an unedited request message of the resource access request, and obtain a request source address of the resource access request.

[0068] The unedited request message refers to the original request message carried by the resource access request. The request source of the resource access request is usually the client that sends the resource access request. The request source address is the IP address of the request source.

[0069] Please combine Figure 1 In one example, a resource access request is sent from a request source to a gateway. The gateway obtains the IP address of the request source while obtaining the resource access request, and then forwards the resource access request and the IP address of the request source to the anti-crawler system. If the gateway has not edited the request message of the resource access request, the request message carried by the resource access request obtained by the anti-crawler system from the gateway is an unedited request message.

[0070] S1102: Add the request source address to the request header of the unedited request message to obtain the edited request message.

[0071] In one example, a key of a request header is configured as "X-Real-Ip", which indicates the request source address, and the value corresponding to this key is the specific request source address. For example, the request source address added to the request header is in the form of "X-Real-Ip: 10.1.1.1", where "10.1.1.1" is the specific IP address of the request source.

[0072] In the case where step S110 is specifically implemented through steps S1101 to S1102, the message detected in step S120 is the edited request message obtained in step S1102. Since the request source address is added to the request header, it is a message feature, so the message feature of the edited request message at least includes the request source address.

[0073] The resource access restriction method of the embodiment of the present disclosure mainly limits the message features in the request message by configuring the rule factors of the restriction policy. Usually, the request message does not contain the request source address, resulting in the request source address not belonging to the definable range of the restriction policy. Through the above steps S1101 to S1102, the request source address can be added to the request message, so that the request source address becomes a message feature and falls within the definable range of the restriction policy, so that the rule factor that limits the IP address string can be configured to limit the request source address, expand the restriction range of resource access, and adapt to the banning of malicious crawlers with specific IP addresses.

[0074] In addition, in some embodiments of the present disclosure, when the gateway obtains the resource access request and the request source address, the request message of the resource access request can be edited by the gateway, and the request source address is added to the request header of the unedited request message to obtain the edited request message. In this way, the request message forwarded by the gateway to the anti-crawler system is an edited request message, which at least includes the message feature of the request source address. In this case, it is not necessary to execute steps S1101 to S1102 in the anti-crawler system.

[0075] Regarding step S120, in some embodiments of the present disclosure, it may also include the following Figure 4 Steps S1201 to S1202 are shown.

[0076] S1201. Obtain a factor pool, which is a union of multiple rule factors included in the issued restriction policy.

[0077] Please combine Figure 5In one example, the issued restriction policies include the first restriction policy, the second restriction policy, and the third restriction policy. The rule factors in the first restriction policy include "kRules-01", "vRules-01", and "kvRules-01", the rule factors in the second restriction policy include "kRules-01", "vRules-02", and "kvRules-01", and the rule factors in the third restriction policy include "kRules-01", "vRules-01", and "kvRules-02". The issued restriction policies contain the union of multiple rule factors: ["kRules-01", "vRules-01", "vRules-02", "kvRules-01", "kvRules-02"], which is the factor pool.

[0078] S1202: For each message feature, traverse each rule factor in the factor pool, obtain a rule factor that matches the message feature, and determine it as a target factor.

[0079] Please combine Figure 5 In an example, suppose: The rule factor "kRules-01" specifies that: the string that constitutes the key of the request header contains the specific string "User-Agent"; The rule factor "vRules-01" defines that: the string that constitutes the value of the request line contains the specific string " / a"; The rule factor "vRules-02" defines that: the string that constitutes the value of the request line contains the specific string " / b"; The rule factor "kvRules-01" specifies that: the string constituting the key of the request header contains a specific string "Host", and the string constituting the value corresponding to the key of the request header contains a specific string "cd"; The rule factor "kvRules-02" defines that a specific string "Host" exists in the string constituting the key of the request header, and a specific string "ef" exists in the string constituting the value corresponding to the key of the request header.

[0080] A request message includes three message features, namely: "GET / api HTTP / 1.0", "Host:abcd.com" and "User-Agent: xxxxxxxx". When detecting the rule factors matched by the message features of the request message, the three message features are used to traverse the rule factors in the factor pool.

[0081] For example, the factor pool is traversed for the message feature "GET / api HTTP / 1.0". Since the message feature is a request line and the value string contains a specific string " / a", the message feature meets the restricted content of the rule factor "vRules-01". The rule factor "vRules-01" is the target factor that matches the message feature "GET / api HTTP / 1.0".

[0082] At the same time, the factor pool is traversed for the message feature "Host:abcd.com". Since the message feature is a request header, and the key string of the request header contains a specific string "Host", and the value string "abcd.com" corresponding to the key "Host" contains a specific string "cd", the message feature meets the restricted content of the rule factor "kvRules-01", and the rule factor "kvRules-01" is the target factor that matches the message feature "Host:abcd.com".

[0083] At the same time, the factor pool is traversed for the message feature "User-Agent: xxxxxxxx". Since the message feature is a request header and the key string of the request header contains a specific string "User-Agent", the message feature meets the limited content of the rule factor "kRules-01". The rule factor "kRules-01" is the target factor that matches the message feature "User-Agent: xxxxxxxx".

[0084] In summary, the target factors matched by the multiple message features of the request message are "kRules-01", "vRules-01" and "kvRules-01". Among the restriction policies that have been issued, the first restriction policy contains each of the above target factors, so the first restriction policy is determined as the target restriction policy corresponding to the request message. In this way, when determining the target restriction policy corresponding to the request message, instead of matching each restriction policy with the multiple message features in the request message in turn, the rule factors of the restriction policy that has been issued are split into a factor pool, so that multiple message features can traverse the factor pool in parallel to match the corresponding target factors, and finally all the matched target factors are integrated, and the restriction policy containing each target factor is queried to obtain the target restriction policy, thereby improving the efficiency of determining the target restriction policy. In the case where the number of restriction policies that have been issued is large, it is possible to avoid matching each restriction policy with the request message one by one, which can greatly improve the efficiency of determining the target restriction policy.

[0085] In some embodiments of the present disclosure, before step S110, the following may also be included: Figure 6 Steps S1001 to S1003 are shown.

[0086] S1001. Obtain a newly issued restriction policy according to an update time interval.

[0087] Please combine Figure 1 In one example, the anti-crawler system communicates with the anti-crawler policy library at regular intervals. If there is a newly issued restriction policy in the anti-crawler policy library, the newly issued restriction policy can be obtained in a timely manner.

[0088] S1002: In response to obtaining a newly issued restriction policy, determine the newly issued restriction policy as an issued restriction policy.

[0089] The factor pool is the union of multiple rule factors contained in the issued restriction policy. When there is a newly issued restriction policy, the factor pool needs to be updated accordingly. Therefore, the newly issued restriction policy is determined as the issued restriction policy so that the rule factors in the newly issued restriction policy can be included in the factor pool.

[0090] S1003: Integrate the union of multiple rule factors included in each issued restriction policy into a factor pool.

[0091] After the newly issued restriction policy is determined as the issued restriction policy, multiple rule factors in the newly issued restriction policy are added to the factor pool and repeated rule factors are removed to obtain an updated factor pool.

[0092] In some embodiments of the present disclosure, the logical relationship between the character string in the message feature defined by the rule factor and the specific character string includes: contains, does not contain, is equal to, is not equal to, prefix matches, exists, does not exist, belongs to, does not belong to, so that the restricted scope of resource access can cover more types of business scenarios.

[0093] In one example, the rule factor is configured to: limit the character string in the message feature to include a specific character string. For example, including the specific character string "bc" means that the character string "abcd" in the message feature includes the character string "bc".

[0094] In one example, the rule factor is configured to: limit the character string in the message feature to not contain a specific character string. For example, not containing the specific character string "bc" means that the character string "xyz" in the message feature does not contain the character string "bc".

[0095] In one example, the rule factor is configured to: limit the character string in the message feature to be equal to a specific character string. For example, equal to a specific character string "abc", which means that the character string "abc" in the message feature is equal to the character string "abc".

[0096] In one example, the rule factor is configured to: limit the character string in the message feature to not be equal to a specific character string. For example, not being equal to a specific character string "abc" means that the character string "abc" in the message feature is not equal to the character string "aec".

[0097] In one example, the rule factor is configured to: limit the prefix of the string in the message feature to be equal to a specific string. For example, the prefix is ​​equal to the specific string "ab", which means that the prefix of the string "abcde" in the message feature is equal to "ab".

[0098] In one example, the rule factor is configured to: limit the string in the message feature to the presence of a specific string. For example, the presence of the specific string "abc" means that the string "abc" in the message feature exists.

[0099] In one example, the rule factor is configured to: limit the character string in the message feature to not contain a specific character string. For example, the absence of the specific character string "abc" means that the character string "xyz" in the message feature does not contain "xyz".

[0100] In one example, the rule factor is configured to limit the string in the message feature to belong to a specific string. For example, belonging to the specific string "10.1.1.1 / 24" network segment means that the string (request source address) "10.1.1.1" in the message feature belongs to the "10.1.1.1 / 24" network segment.

[0101] In one example, the rule factor is configured to limit the string in the message feature to not belonging to a specific string. For example, not belonging to the specific string "10.1.1.1 / 24" network segment means that the string (request source address) "10.2.2.2" in the message feature does not belong to the "10.1.1.1 / 24" network segment.

[0102] In one example, the rule factors include four types: value rule factors, key rule factors, key-value rule factors, and address rule factors.

[0103] Value rule factors, denoted as "vRules", are used to limit the message features in the request message to only the values ​​that need to be logically processed. For example, limit the request method part and the request path part in the request line. The logical processing of the value rule factor "vRules" can be configured as: contains, does not contain, equals, does not equal, and prefix match.

[0104] Key rule factors, denoted as "kRules", are used to limit the message features in the request message to only the key that needs to be logically processed. For example, limit the query type keys of the request header: "GET", "Host", etc.; limit the header type keys of the request header: "User-Agent", "Accept", etc.; and limit the Cookie type keys of the request header: "Cookie". The logical processing of the key rule factor "kRules" can be configured as: existence or non-existence.

[0105] The key-value rule factor, denoted as "kvRules", is used to limit the message features that need to be logically processed for the key-value pairs in the request message. For example, limit the query type key and corresponding value of the request header, limit the header type key and corresponding value of the request header, and limit the Cookie type key and corresponding value of the request header. The logical processing of the key-value rule factor "kvRules" can be configured as: contains, does not contain, equals, does not equal, and prefix match.

[0106] The address rule factor, denoted as "ipRules", is used to limit the request source address in the request message. The address rule factor "ipRules" can limit the complete request source address or the partial network segment in the request source address. The logical processing of the address rule factor "ipRules" can be configured as: belongs to and does not belong to.

[0107] In some embodiments of the present disclosure, an access restriction instruction in a target restriction policy includes one of a first restriction instruction and a second restriction instruction.

[0108] The first restriction instruction is used to instruct the gateway to intercept resource access requests from accessing the server, and to instruct the gateway to send an interception page to the request source of the resource access request. Figure 1 ,In one example, when the gateway responds to the first restriction instruction, the gateway will not return the real ,resource data to the client, but will display an interception page to indicate that the client’s ,resource access request has been intercepted.

[0109] The second restriction instruction is used to instruct the gateway to intercept resource access requests to the server and to instruct the gateway to send a verification pop-up window to the source of the resource access request. Figure 1 In one example, when the gateway responds to the first restriction instruction, the gateway will not return the real resource data to the client, but will send a verification pop-up window to the client. If the client passes the verification pop-up window, the gateway can return the real resource data to the client after responding to the client's verification information.

[0110] In some embodiments of the present disclosure, the resource access restriction method M100 may also include: Figure 7 Step S1415 and step S150 are shown.

[0111] S1415. Query the grayscale release field in the target restriction policy.

[0112] Step S1415 may be implemented in the form of judgment logic, that is, judging whether there is a grayscale release field in the target restriction policy.

[0113] Among them, if there is a grayscale release field in the target restriction policy, it means that even if multiple message features of the request message match multiple rule factors of the target restriction policy, the access restriction instruction in the target restriction policy will not be used to restrict the resource access request, but the resource access request will be allowed to access the resource data in the server, but the release result of the resource access request will be recorded in the background. In this way, the effectiveness of the target restriction policy can be verified based on whether the release result of the resource access request is recorded in the background without affecting the client's acquisition of resources.

[0114] Specifically, if the resource access request hits the target restriction policy, but the target hit policy contains the grayscale release field, the client can successfully access the resources in the server, and the background log will record that the resource access request hits the target restriction policy, indicating that the target restriction policy is in effect but not enabled. If you want to enable the target restriction policy, just remove the grayscale direction field.

[0115] In one example, the restriction policy also includes a grayscale release part, which is recorded as the "isGrey" key. The values ​​of the "isGrey" key include "true" and "false". When the "isGrey" key of the restriction policy is "true", it is in the form of: ""isGrey":true", indicating that there is a grayscale release field in the restriction policy, where "true" is the grayscale release field. When the "isGrey" key is in the form of "false", it is in the form of: ""isGrey":false", indicating that there is no grayscale release field in the restriction policy.

[0116] S150. In response to the existence of a grayscale release field in the target restriction policy, output a grayscale release instruction and record a release result of the resource access request.

[0117] Among them, the grayscale release instruction is used to instruct the gateway to forward the resource access request to the server. In this way, when there is a grayscale release field in the target restriction policy, the output grayscale release instruction can instruct the gateway to forward the resource access request without affecting the client's acquisition of real resource data; at the same time, the release result can be recorded in the background to facilitate the management personnel to confirm whether the target restriction policy is effective.

[0118] Based on any of the above implementations, the present disclosure also provides a device for limiting resource access. Figure 8 The figure is a schematic block diagram of the structure of a resource access restriction device according to an embodiment of the present disclosure.

[0119] like Figure 8 As shown, the resource access restriction device includes: The acquisition module 110 is used to acquire a request message of the resource access request in response to the resource access request.

[0120] The detection module 120 is used to detect rule factors that match each of the multiple message features in the request message, and determine the rule factors that match the message features as target factors.

[0121] The query module 130 is used to query the restriction policy including each target factor, and determine the restriction policy including each target factor as the target restriction policy.

[0122] The output module 140 is used to output the access restriction instructions in the target restriction policy, where the access restriction instructions are used to intercept resource access requests from accessing the server.

[0123] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0124] The execution subject of the resource access restriction method in the specific implementation mode of the present disclosure may be a mobile phone, a tablet computer, a server or other electronic device.

[0125] Therefore, based on any of the above embodiments, the present disclosure also provides an electronic device, which can execute the resource access restriction method of any of the embodiments described above in the present disclosure, and the resource access restriction device of any of the embodiments described above can be configured on the electronic device.

[0126] Fig. 9 It is a schematic block diagram of the structure of an electronic device 1000 configured with a resource access restriction device for restricting resource access according to an embodiment of the present disclosure.

[0127] The hardware structure of the electronic device 1000 can be implemented using a bus architecture. The bus architecture can include any number of interconnected buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 1100 connects various circuits including one or more processors 1200, memory 1300 and / or hardware modules together. The bus 1100 can also connect various other circuits 1400 such as peripherals, voltage regulators, power management circuits, external antennas, etc.

[0128] The bus 1100 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Component (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the figure only uses one connecting line, but does not mean that there is only one bus or one type of bus.

[0129] The present disclosure also provides a readable storage medium, in which a computer program is stored, and the computer program is used to implement the above method when executed by a processor. "Readable storage medium" can be any device that can contain, store, communicate, propagate or transmit a program for use in an instruction execution system, device or equipment or in combination with these instruction execution systems, devices or equipment. More specific examples of readable storage media include the following: an electrical connection portion (electronic device) with one or more wirings, a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable read-only memory (CDROM), etc.

[0130] The present disclosure also provides a computer program product. The method of the present disclosure can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed, the process or function of the present disclosure is executed in whole or in part.

[0131] A computer program or instruction may be stored in a readable storage medium or transmitted from one readable storage medium to another readable storage medium, for example, a computer program or instruction may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The readable storage medium may be any available medium that can be accessed or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid state drive. The computer readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0132] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable resource-access-restricted device to produce a machine, so that the instructions executed by the processor of the computer or other programmable resource-access-restricted device produce instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable resource access-restricted device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions may also be loaded onto a restricted device accessed by a computer or other programmable resource so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments / methods or examples described in this specification and features of different embodiments / methods or examples, unless they are contradictory.

[0137] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0138] Those skilled in the art should understand that the above embodiments are only for the purpose of clearly illustrating the present disclosure, and are not intended to limit the scope of the present disclosure. For those skilled in the art, other changes or modifications may be made based on the above disclosure, and these changes or modifications are still within the scope of the present disclosure.

[0139] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0140] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0141] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0142] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0143] At the same time, it is understandable that the data involved in the technical solution of the present disclosure (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

Claims

1. A method for limiting resource access, characterized in that: include: In response to a resource access request, obtaining a request message of the resource access request; Detecting rule factors that are matched by each of the plurality of message features in the request message, and determining the rule factors that are matched by the message features as target factors; Querying a restriction policy including each of the target factors, and determining the restriction policy including each of the target factors as a target restriction policy; as well as Outputting the access restriction instruction in the target restriction policy, wherein the access restriction instruction is used to intercept the resource access request from accessing the server; The message feature includes a request line and a request header, and the rule factor is configured to limit the logical relationship between a character string in the message feature and a specific character string.

2. The resource access restriction method according to claim 1, characterized in that: Detecting rule factors that match each of the plurality of message features in the request message, and determining the rule factors that match the message features as target factors, including: Acquire a factor pool, where the factor pool is a union of multiple rule factors included in the issued restriction policy; and For each of the message features, the rule factors in the factor pool are traversed to obtain the rule factor that matches the message feature and determine it as the target factor.

3. The resource access restriction method according to claim 1, characterized in that: Also includes: Obtain the newly issued restriction policy according to the update time interval; In response to acquiring the newly issued restriction policy, determining the newly issued restriction policy as the issued restriction policy; as well as The union of the plurality of rule factors contained in each of the issued restriction policies is integrated into a factor pool.

4. The resource access restriction method according to claim 1, characterized in that: The access restriction instructions in one of the target restriction policies include: a first restriction instruction, wherein the first restriction instruction is used to instruct the gateway to intercept the resource access request from accessing the server, and to instruct the gateway to send an interception page to the request source of the resource access request; or The second restriction instruction is used to instruct the gateway to intercept the resource access request to access the server, and is used to instruct the gateway to send a verification pop-up window to the request source of the resource access request.

5. The resource access restriction method according to claim 1, characterized in that: The resource access restriction method also includes: Querying the grayscale release field in the target restriction policy; and In response to the grayscale release field existing in the target restriction policy, outputting a grayscale release instruction and recording a release result of the resource access request; The grayscale release instruction is used to instruct the gateway to forward the resource access request to the server.

6. The resource access restriction method according to claim 1, characterized in that: The rule factors are configured as: Limiting the character string in the message feature to include the specific character string; and / or Limiting the character string in the message feature to not include the specific character string; and / or Limiting the character string in the message feature to be equal to the specific character string; and / or Limiting the character string in the message feature to not be equal to the specific character string; and / or Limiting the prefix of the character string in the message feature to be equal to the specific character string; and / or Limiting the message features to include the specific character string; and / or Limiting the message feature to not contain the specific character string; and / or Limiting the character string in the message feature to belong to the specific character string; and / or It is limited that the character string in the message feature does not belong to the specific character string.

7. The resource access restriction method according to claim 1, characterized in that: In response to a resource access request, obtaining a request message of the resource access request includes: In response to a resource access request, obtaining an unedited request message of the resource access request and obtaining a request source address of the resource access request; and The request source address is added to the request header of the unedited request message to obtain the edited request message.

8. An electronic device, characterized in that: include: A memory storing execution instructions; as well as A processor, wherein the processor executes the execution instruction stored in the memory, so that the processor executes the resource access restriction method according to any one of claims 1 to 8.

9. A readable storage medium, characterized in that: The readable storage medium stores execution instructions, which are used to implement the resource access restriction method according to any one of claims 1 to 8 when executed by a processor.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the resource access restriction method according to any one of claims 1 to 8 is implemented.

Images