Content distribution network security protection method, device, equipment, medium and product

Abstract

The present disclosure relates to the technical field of content distribution network, and discloses a security protection method, device, equipment, medium and product for content distribution network, wherein the method is used for edge nodes in edge network cluster, including: obtaining access requests initiated by clients in the content distribution network; using a protection module set in the edge node to detect the access request, and determine whether the client initiating the access request is an abnormal client; if the client is determined to be an abnormal client, intercepting the access request initiated by the client; and pulling the access request initiated by the same client to the same edge node within a specified time. By implementing the technical solution of the present disclosure, the edge node server of the content distribution network is protected from attacks, and adaptive protection of the edge node is achieved, reducing the load pressure of the unified calculation of the central server of the content distribution network and the instability caused by the request central server, reducing the protection response delay, and improving the protection response efficiency.

Description

Technical Field

[0001] The present disclosure relates to the technical field of content distribution networks, and in particular to security protection methods, devices, equipment, media and products for content distribution networks. Background Art

[0002] Content Delivery Network (CDN) is a distributed server network deployed around the world to accelerate content transmission and delivery services on the Internet. Distributed Denial of Service (DDoS) attack (Challenge Collapsar Attack, CC) is an attack on the server, and its attack intensity is usually measured in the number of requests per second or the number of packets per second. Attackers can simulate a large number of users or manipulate botnets (RobotNetwork) to continuously access pages that require a large amount of CPU resources, resulting in a waste of server resources.

[0003] The CDN edge network cluster includes a large number of CDN nodes. Each node is composed of a varying number of physical / virtual servers and provides services through a limited number of virtual IP addresses (VIP). Once a CDN node is attacked by CC, the source station will be affected and crash immediately, resulting in business damage. As the attack volume increases, the business of other customers on the node will be damaged simultaneously, resulting in irreparable full service downtime. Therefore, how to effectively defend against CC attacks to improve network security needs to be solved urgently. Summary of the invention

[0004] In view of this, the present disclosure provides a content distribution network security protection method, device, equipment, medium and product to solve the problem of difficulty in effectively defending against CC attacks.

[0005] In a first aspect, the present disclosure provides a security protection method for a content distribution network, which is used for an edge node in an edge network cluster, wherein a protection module is provided in the edge node, and the method comprises: obtaining an access request initiated by a client in the content distribution network; detecting the access request using the protection module to determine whether the client initiating the access request is an abnormal client; if the client is determined to be an abnormal client, intercepting the access request initiated by the client; and pulling the access request initiated by the same client to the same edge node within a specified time.

[0006] In a second aspect, the present disclosure provides a security protection method for a content distribution network, which is used for a central server, and the central server is communicated with an edge node in an edge network cluster. The method includes: obtaining request aggregation results for each client of the content distribution network reported by the edge nodes in the edge network cluster; determining at least one client whose access request volume reaches a preset limit value based on the request aggregation results; determining at least one client as an abnormal client, and sending the information of the abnormal client to the edge node, so that the edge node intercepts the access request initiated by the abnormal client.

[0007] In a third aspect, the present disclosure provides a security protection device for a content distribution network, which is used for an edge node in an edge network cluster. A protection module is provided in the edge node, and the device includes: an access request acquisition module, which is used to acquire an access request initiated by a client in the content distribution network; a detection module, which is used to detect the access request using the protection module to determine whether the client initiating the access request is an abnormal client; an interception module, which is used to intercept the access request initiated by the client if it is determined that the client is an abnormal client; and a traction module, which is used to pull the access request initiated by the same client to the same edge node within a specified time.

[0008] In a fourth aspect, the present disclosure provides a security protection device for a content distribution network, which is used for a central server, and the central server is communicated with an edge node in an edge network cluster. The device includes: an aggregation result acquisition module, which is used to obtain the request aggregation results reported by the edge nodes in the edge network cluster for each client in the content distribution network; a request quantity comparison module, which is used to determine at least one client whose access request quantity reaches a preset limit value based on the request aggregation results; and an abnormality determination module, which is used to determine at least one client as an abnormal client and send the information of the abnormal client to the edge node, so that the edge node intercepts the access request initiated by the abnormal client.

[0009] In a fifth aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the security protection method for a content distribution network of the first aspect or any corresponding embodiment thereof, or executes the security protection method for a content distribution network of the second aspect or any corresponding embodiment thereof by executing the computer instructions.

[0010] In a sixth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the content distribution network security protection method of the first aspect or any corresponding embodiment thereof, or to execute the content distribution network security protection method of the second aspect or any corresponding embodiment thereof.

[0011] In a seventh aspect, the present disclosure provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the content distribution network security protection method of the above-mentioned first aspect or any corresponding embodiment thereof, or to execute the content distribution network security protection method of the above-mentioned second aspect or any corresponding embodiment thereof.

[0012] The security protection method, device, equipment, medium and product of the content distribution network provided by the embodiments of the present disclosure set a protection module in the edge node. When the client initiates an access request to the server of the edge node, the access request first enters the protection module, and the protection module detects the access request initiated by the client this time to determine whether the client initiating the access request is an abnormal client initiating an attack. If the client is an abnormal client, the access request is directly intercepted by the protection module to prevent the edge node server in the content distribution network from being attacked, and realizes adaptive protection of the edge node, reducing the load pressure of the unified calculation of the central server of the content distribution network and the instability caused by the request to the central server. Furthermore, by pulling the same client to the same edge node for access, if the client is an abnormal client, all attacks of the abnormal client can be counted by the same edge node protection module, which can reduce the response delay time, thereby reducing the protection response delay and improving the protection response efficiency, so as to achieve a microsecond level protection response effect.

[0013] The security protection method, device, equipment, medium and product of the content distribution network provided by the embodiments of the present disclosure are as follows: the central server receives the request aggregation results for the client reported by each edge node in the edge network cluster to determine whether the access request amount initiated by each client in the content distribution network exceeds the limit, determines the client with the access request amount exceeding the limit as an abnormal client, and spreads the information of the abnormal client to each edge node in the edge network cluster, so that each edge node can intercept the access request initiated by the abnormal client. In this way, it is possible to avoid the abnormal client changing the attacking edge node and bypassing the protection, and the protection for the abnormal client is achieved globally, ensuring the security of the global network. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the specific embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1is a schematic diagram of a CDN edge node in an embodiment of the present disclosure;

[0016] Figure 2 is a schematic diagram of a CC attack in an embodiment of the present disclosure;

[0017] Figure 3 It is a protection schematic diagram of connecting WAF in series before the source station in the embodiment of the present disclosure;

[0018] Figure 4 It is a protection schematic diagram of connecting WAF in series before the CDN edge node in the embodiment of the present disclosure;

[0019] Figure 5 is a schematic diagram of setting a protection module inside a CDN edge node according to an embodiment of the present disclosure;

[0020] Figure 6 It is a flowchart of a security protection method for a content distribution network at an edge node side according to an embodiment of the present disclosure;

[0021] Figure 7 It is a flowchart of another content distribution network security protection method at the edge node side according to an embodiment of the present disclosure;

[0022] Figure 8 is a schematic diagram of a protection module and abnormality determination according to an embodiment of the present disclosure;

[0023] Fig. 9 is a schematic diagram of spreading the interception status to other edge nodes according to an embodiment of the present disclosure;

[0024] Fig.10 is a schematic diagram of a global CC attack according to an embodiment of the present disclosure;

[0025] Fig.11 It is a flowchart of a security protection method for a content distribution network on a central server side according to an embodiment of the present disclosure;

[0026] Fig.12 It is a schematic diagram of a process in which an edge node asynchronously uploads a request aggregation result to a central server and a central server sends abnormal information to an edge node according to an embodiment of the present disclosure;

[0027] Fig.13 It is a flowchart of another content distribution network security protection method at the central server side according to an embodiment of the present disclosure;

[0028] Fig.14 is a schematic diagram of spreading the interception status to other edge nodes that have not reported the request aggregation result according to an embodiment of the present disclosure;

[0029] Fig.15is a structural block diagram of a security protection device for a content distribution network at an edge node side according to an embodiment of the present disclosure;

[0030] Fig.16 is a structural block diagram of a security protection device for a content distribution network at a central server side according to an embodiment of the present disclosure;

[0031] Fig.17 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0033] Content Delivery Network (CDN) is a distributed server network deployed around the world to accelerate content transmission and delivery services on the Internet. When a user client requests to access a website or application, CDN will select the nearest server to provide content based on the location of the user client, thereby reducing loading time and increasing website performance.

[0034] The working principle of CDN is to cache the static resources of the website (such as pictures, videos, CSS, JavaScript files, etc.) on servers located in different geographical locations. When the user client requests to access these resources, CDN will use the domain name service to try to pull the request initiated by the user client to the nearest edge node and transmit the content to the user client instead of loading it directly from the original server. This can greatly reduce the load on the original server while reducing network congestion, reducing latency, increasing page loading speed, and improving user experience.

[0035] Challenge Collapsar Attack (CC) is an attack against the server. The attacker simulates a large number of user clients or manipulates the bot network to continuously access pages that require a large amount of data operations (which require a large amount of CPU resources), resulting in a waste of server resources. The CPU usage rate is at 100% for a long time, causing the server to continue processing connections until the network is congested, resulting in the termination of normal access.

[0036] like Figure 1As shown in the figure, there are a large number of CDN nodes (i.e., edge nodes of the CDN edge network cluster) in the CDN edge network system. Each node is composed of a varying number of physical / virtual servers, and they provide services to the outside world through limited virtual IP addresses (VIP).

[0037] Each edge node may be scattered in any location, and the network is physically isolated, such as Figure 1 As shown in the figure, edge nodes are deployed at locations A and B, and the origin is deployed at location C. When a client accessing an edge node is attacked by CC, it is difficult to pay attention to the events occurring at each edge node in a centralized manner. Once a CDN node is attacked by CC, the origin will be affected and crash immediately, resulting in business damage. As the attack volume increases, the business of other customers on the node will also be damaged, resulting in irreparable full service downtime, such as Figure 2 shown.

[0038] In related technologies, a web application firewall (WAF) is usually connected in series in front of the source station for protection, such as Figure 3 However, this method is only effective for the origin site, and normal user clients still cannot access the server, which will still cause business damage to the origin site. Or connect WAF in series in front of the CDN edge node for protection, such as Figure 4 However, doing so will cause a surge in overall latency, defeating the purpose of accessing a CDN.

[0039] CDN networks are generally implemented based on optical fiber transmission technology. In theory, it takes about 5 microseconds per kilometer. Taking Ping delay and different servers in the same region and node as an example, under normal circumstances, the delay between different servers is about 50~100 microseconds, and there will be a lot of losses in actual network transmission beyond theoretical calculations.

[0040] Based on this, the technical solution disclosed in the present invention is to set up a CC protection module inside the CDN edge node for protection, which greatly reduces the load pressure of the central unified computing and the instability caused by the request center from the architectural perspective; reduces the response delay time from the performance perspective, and can reduce the response delay from the maximum 200ms to 100μs; makes full use of the local resources of the edge node, and does not require the construction of an additional central computer room to provide CC protection, greatly reducing the protection cost.

[0041] like Figure 5 As shown in Figure 1, when a client initiates an access request to a server at an edge node, the access request first enters the protection module ( Figure 5The protection module detects the access request initiated by the client to determine whether the client that initiated the access request is an abnormal client that initiated the attack. If the client is an abnormal client, the protection module directly intercepts the access request. In this way, it can solve the problem of CC attacks occurring at any place and at any time in CDN scenarios, and achieve defense with microsecond response delay.

[0042] According to an embodiment of the present disclosure, an embodiment of a security protection method for a content distribution network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] In this embodiment, a security protection method for a content distribution network is provided, which can be used for edge nodes in an edge network cluster, such as edge nodes composed of computer devices such as computers and servers. Figure 6 is a flow chart of a security protection method for a content distribution network according to an embodiment of the present disclosure, such as Figure 6 As shown, the process includes the following steps:

[0044] Step S101: obtaining an access request initiated by a client in a content distribution network.

[0045] An access request refers to a request sent by a client in a content distribution network to an edge node server to obtain access rights to specific resources or services, such as web pages, files, data, and other resources or access rights. The CDN edge network cluster has a large number of CDN edge nodes. Each CDN edge node is composed of a varying number of physical / virtual servers, and provides services to the outside world through limited virtual IP addresses. A protection module is set up in the edge node, and normal access requests are sent to the server through the protection module.

[0046] When a client initiates an access request, the CDN will try to pull the access request initiated by the client to the nearest edge node to provide services to the client through the server in the edge node. Correspondingly, the edge node can receive the access request initiated by the client and pull the access request to the protection module for detection before sending the access request to the edge node server.

[0047] Step S102: Use the protection module to detect the access request to determine whether the client that initiates the access request is an abnormal client.

[0048] When the edge node receives an access request initiated by the client, it will lead the access request to the protection module, which will parse the access request to obtain the characteristic information of the access request. Specifically, the characteristic information may include one or more of the client identifier, request type, resource identifier, access permission, time of initiating the request, frequency of the request, and source IP address. The content of the characteristic information is not specifically limited here, and those skilled in the art can determine it according to actual needs.

[0049] The access request initiated by the abnormal client is a network attack for the edge node server. Specifically, according to the characteristic information of the access request, the access request is compared with the preset abnormal request characteristics to implement detection for the access request and determine whether the client initiating the access request is an abnormal client. If the client is determined to be an abnormal client, step S103 is executed, otherwise, the access request initiated by the client is sent to the edge node server, and the edge node server sends the resources or access rights corresponding to the access request to the client.

[0050] Step S103: if it is determined that the client is an abnormal client, the access request initiated by the client is intercepted.

[0051] When the client is determined to be an abnormal client, the edge node will intercept the access request initiated by the client and record and save the IP address and client identifier of the abnormal client and other related information used to characterize the client. When the client initiates an access request again, the edge node can determine whether to receive the access request initiated by it based on the cached client information.

[0052] Step S104: pull access requests initiated by the same client to the same edge node within a specified time.

[0053] The specified time is a pre-set time range for receiving access requests from the same client, for example, 5 minutes, 10 minutes, 30 minutes, 1 hour, etc., which is not specifically limited here. For access requests initiated by the same client, obtain the timestamp of each access request initiated. Determine whether the initiation time of each access request is within the specified time based on the timestamp. If it is within the specified time, the domain name system (DNS) of the CDN can be relied on to consistently pull the same client, and pull multiple access requests initiated by the same client to the same edge node in the edge network cluster for access.

[0054] The security protection method for the content distribution network provided in this embodiment sets a protection module in the edge node. When the client initiates an access request to the server of the edge node, the access request first enters the protection module, and the protection module detects the access request initiated by the client this time to determine whether the client initiating the access request is an abnormal client that initiates the attack. If the client is an abnormal client, the access request is directly intercepted by the protection module to prevent the edge node server of the content distribution network from being attacked, and realizes adaptive protection of the edge node, reducing the load pressure of the unified calculation of the central server of the content distribution network and the instability caused by the request to the central server. Furthermore, by pulling the same client to the same edge node for access, if the client is an abnormal client, all attacks of the abnormal client can be counted by the same edge node protection module, which can reduce the response delay time, thereby reducing the protection response delay and improving the protection response efficiency, so as to achieve a microsecond protection response effect.

[0055] In this embodiment, a security protection method for a content distribution network is provided, which can be used for edge nodes in an edge network cluster, such as edge nodes composed of computer devices such as computers and servers. Figure 7 is a flow chart of a security protection method for a content distribution network according to an embodiment of the present disclosure, such as Figure 7 As shown, the process includes the following steps:

[0056] Step S201: Obtain an access request initiated by a client in a content distribution network. Figure 6 Step S101 of the illustrated embodiment will not be described in detail here.

[0057] Step S202: Use the protection module to detect the access request to determine whether the client that initiates the access request is an abnormal client.

[0058] Specifically, the above step S202 includes:

[0059] Step S2021, obtaining a preset matching rule corresponding to the access request.

[0060] The preset matching rule is a pre-set rule for judging abnormal requests, that is, for determining whether the CC attack feature is hit. Specifically, the preset matching rule can be set based on the source of the request, the frequency of the request, the parameters of the request, the time of the request, etc. The preset matching rule can be pre-stored in the configuration file or database of the edge node protection module. When processing an access request, the preset matching rule is obtained by reading the corresponding configuration information to determine the preset matching access request.

[0061] Step S2022: perform feature matching on the access request according to the preset matching rule to determine whether the access request matches the preset matching rule.

[0062] When receiving an access request, extract the characteristic information carried by the access request, including the IP address, URL (Uniform Resource Locator), timestamp, etc. of the access request. Perform feature matching on the extracted characteristic information of the access request with the preset matching rules to determine whether the access request meets the conditions of an abnormal request.

[0063] Specifically, Figure 8 As shown, the characteristic information of the access request can be matched with the preset matching rules by pattern matching, conditional judgment, statistical analysis, etc., and whether the access request hits the preset matching rules can be judged according to the result of characteristic matching. If the access request matches the preset rules, it can be determined that the access request hits the preset matching rules; otherwise, it is regarded as a normal access request.

[0064] Step S2023: If the access request hits the preset matching rule, the access request is counted to obtain a count value of the access request.

[0065] If it is determined that the access request hits the preset matching rule, the client that initiated the access request is determined based on the source of the access request, and the access requests initiated by the client that hit the preset matching rule are accumulated to obtain the count value of the access requests initiated by the client that hit the preset matching rule within the specified time.

[0066] Step S2024: If the count value satisfies the preset rate limiting rule, the client is determined to be an abnormal client.

[0067] The preset rate limit rule is used to specify the number of abnormal requests allowed within a certain period of time. The accumulated count value is compared with the value specified in the preset rate limit rule, and based on the comparison result, it is determined whether the client initiating the access request is an abnormal client, that is, whether the access request initiated by the client needs to be intercepted.

[0068] Specifically, if the count value reaches the value specified in the preset rate limiting rule, the client is determined to be an abnormal client, and a penalty operation is performed on the abnormal client to intercept the access request. The intercepted access request can return an error response, perform log recording, etc. If the count value does not reach the value specified in the preset rate limiting rule, the client is determined to be a normal client, the access request initiated by the normal client is released, and the edge node server responds to the access request.

[0069] In some optional embodiments, such as Figure 8 As shown, a fuse is provided in the protection module, and the fuse is used to set the target request amount that the protection module can bear. Accordingly, the above method also includes:

[0070] Step a1, obtaining the amount of access requests received by the protection module.

[0071] Step a2: If the access request amount exceeds the target request amount, the access requests exceeding the target request amount are directly returned through the fuse.

[0072] The target request volume is the number of requests or the request capacity that the protection module can carry in advance. The access request volume is the number or capacity of access requests received by the protection module from the client. Specifically, the protection module can count the access requests it receives to obtain the access request volume it receives; the protection module can also generate logs to record relevant information about the access requests, and analyze the log information to extract relevant data about the access requests to determine the access request volume. Of course, the access request volume can also be obtained by other means, which are not specifically limited here.

[0073] Specifically, the fuse is a protection mechanism adopted when the protection module faces high load or failure, to prevent the protection module from crashing or seriously failing due to overload. The access request volume received by the edge node protection module is compared with the target request volume to determine whether the access request volume exceeds the target request volume. When the access request volume exceeds the target request volume set by the fuse, the fuse will directly return the access requests that exceed the target request volume and will not continue to process these access requests.

[0074] It should be noted that the load range and release strategy of the fuse can be reasonably configured according to the architecture of the protection module and the expected load conditions, and the load range and release strategy are not specifically limited here.

[0075] By setting a fuse in the edge node protection module to quickly release access requests that exceed the carrying range, it is possible to prevent the server in the edge node from being blocked or unavailable for a long time due to responding to excessive access requests, thereby improving the network security of the edge node and further improving the reliability and stability of the edge node server operation.

[0076] In some optional embodiments, such as Figure 8 As shown, the protection module is also provided with a whitelist and a blacklist. Accordingly, the above method further includes:

[0077] Step b1, detecting whether the access request is in the whitelist or blacklist.

[0078] Step b2: If the access request is in the whitelist, it is directly released.

[0079] Step b3: If the access request is in the blacklist, it is directly intercepted.

[0080] The whitelist records the IP addresses and client IDs that are allowed to access, while the blacklist records the IP addresses and client IDs that are prohibited from accessing. The whitelist and blacklist can be stored in the protection module in the form of configuration files or databases.

[0081] If the number of access requests does not exceed the target number of requests, the relevant information of the access request (such as the source IP address of the access request, the client identifier of the access request, etc.) will be matched with the whitelist and blacklist respectively to determine whether the relevant information of the access request is in the whitelist or blacklist. If the relevant information of the access request is in the whitelist, the access request can be directly released without the need to perform feature matching on the access request; if the relevant information of the access request is in the blacklist, the access request can be intercepted to refuse to respond to the access request without performing feature matching on the access request.

[0082] By setting up whitelists and blacklists, it can be ensured that access requests in the whitelists and blacklists can be processed quickly without the need for feature matching, thereby improving the processing efficiency of access requests.

[0083] Step S203: If the client is determined to be an abnormal client, the access request initiated by the client is intercepted. Figure 6 Step S103 of the illustrated embodiment will not be described in detail here.

[0084] Step S204: Drag access requests initiated by the same client to the same edge node within a specified time. Figure 6 Step S104 of the illustrated embodiment will not be described in detail here.

[0085] In some optional implementations, the above method further includes:

[0086] Step c1: execute penalty operation on abnormal clients to restrict the abnormal clients' access to edge nodes.

[0087] Step c2: caching the penalty status of the abnormal client.

[0088] The penalty operation is the processing performed by the protection module on abnormal clients. For example, the current access is intercepted and subsequent access is denied. The duration of the corresponding denial of subsequent access can be set according to actual needs and is not specifically limited here.

[0089] Specifically, after determining that the client is an abnormal client, the protection module in the edge node will intercept the abnormal client's access when receiving the access request initiated by the abnormal client, so as to limit the abnormal client's access to the edge node. Figure 8As shown, a cache space for caching penalty status is set in the protection module. When a penalty operation is performed on an abnormal client, a corresponding penalty status will be marked for the abnormal client, and the abnormal client in the penalty status will be cached in the corresponding cache space.

[0090] By caching the penalty status generated for abnormal clients, it is possible to directly intercept access requests initiated by the abnormal clients in the future, which is conducive to rapid protection response.

[0091] In some optional implementations, the above method further includes:

[0092] Step d1, accessing the cache space in the penalty state to determine the target client in the penalty state.

[0093] Step d2: When the target client initiates an access request to the edge node again, it is directly intercepted.

[0094] Since the access request initiated by the abnormal client in the penalty state will be intercepted, the penalty state of the abnormal client will be cached in the cache space of the protection module. Then, when receiving the access request initiated by the client, the protection module can access the cache space of the penalty state to determine the target client that is currently in the penalty state. The client that currently initiates the access request is compared with the target client to determine whether the client that currently initiates the access request is the target client. If the client that currently initiates the access request is the target client, it means that the client that currently initiates the access request is an abnormal client and the previous access request has been intercepted. At this time, the access request initiated again by the client does not need to be matched with features and can be directly intercepted.

[0095] By accessing the cache space of the penalty state, the target client that is currently in the penalty state can be determined. When the target client initiates an access request, there is no need to match the features of the access request and it can be directly intercepted. This reduces the protection response delay of the edge node server and improves the protection response effect of the edge node server.

[0096] In some optional implementations, the above method further includes: spreading the information of the abnormal client to other edge nodes in the edge network cluster, so that the other edge nodes intercept the access request initiated by the abnormal client.

[0097] When a client initiating an access request is determined to be an abnormal client, in order to prevent the abnormal client from attacking other edge node servers in the edge network cluster, the current edge node will spread its interception status of the abnormal client to other edge nodes in the edge network cluster in seconds, such as Fig. 9As shown, when other edge nodes in the edge network cluster receive access requests initiated by abnormal clients, they can directly intercept them, thereby achieving synchronous interception of all edge nodes corresponding to the CDN network.

[0098] By spreading the information of abnormal clients to other edge nodes in the edge network cluster, it is convenient to achieve synchronous interception of global edge nodes of the content distribution network. Furthermore, other edge nodes in the edge network cluster can determine abnormal clients without counting access requests initiated by clients, reducing the statistical consumption of access requests by edge nodes.

[0099] like Fig.10 As shown, since the attack initiated by the client may involve various edge nodes at the global level, the access request volume of each client IP at a single edge node may be so low that it is imperceptible, but from a global perspective, it can cause a huge source station attack effect. In some optional implementations, the above method also includes:

[0100] Step e1, aggregating the access requests initiated by each client to obtain the request aggregation result corresponding to each client.

[0101] Step e2: sending the request aggregation result to the central server, so that the central server determines the abnormal client based on the request aggregation result.

[0102] The edge node can receive access requests initiated by multiple clients at the same time. In order to determine the situation of each client initiating the access request, the edge node can aggregate the access requests initiated by each client according to a pre-set aggregation rule, for example, according to the request time, number of requests and client identification.

[0103] The edge node reports the request aggregation results obtained through aggregation to the central server, and the central server can count the access requests based on the request aggregation results uploaded by each edge node to identify clients with abnormal access request volume.

[0104] By aggregating the access requests initiated by each client, the central server can determine the abnormal client based on the request aggregation results. This can prevent the abnormal client from replacing the edge node to bypass the protection, thereby preventing the source station from being attacked and ensuring network security.

[0105] The security protection method for the content distribution network provided in this embodiment performs feature matching on access requests, counts the access requests that hit the preset matching rules, and compares the counted count values ​​with the preset rate limiting rules to determine the abnormal clients that meet the preset rate limiting rules, thereby achieving full filtering of access requests, thereby being able to accurately determine abnormal clients.

[0106] In this embodiment, a content distribution network security protection method is provided, which can be used for computer devices, such as a central server, etc. The central server is communicatively connected with edge nodes in an edge network cluster. Fig.11 is a flow chart of a security protection method for a content distribution network according to an embodiment of the present disclosure, such as Fig.11 As shown, the process includes the following steps:

[0107] Step S301: Obtain the request aggregation result for each client in the content distribution network reported by the edge node in the edge network cluster.

[0108] As mentioned above, a protection module is provided in the edge node, which can detect access requests initiated by the client to determine whether the client is an abnormal client (i.e., a network attacker). Considering that if the attack initiated by the client involves various edge nodes in the global edge network cluster, the number of access requests for each client IP at a single edge node may be so low that it is imperceptible. Therefore, each edge node in the edge network cluster will receive access requests initiated by different clients in real time. After receiving the access request, the protection module of the edge node can aggregate the access requests initiated by each client to obtain the corresponding request aggregation result, which includes the client identification, the time when the access request was initiated, the number of times the access request was initiated, etc., thereby realizing the statistics of the access requests initiated by each client.

[0109] Each edge node aggregates the access requests it receives at a preset time interval (e.g., 10 minutes, 30 minutes, 1 hour, etc.), and asynchronously reports the request aggregation results to the central server. Fig.12 Correspondingly, the central server can asynchronously receive the request aggregation results reported by each edge node in the edge network cluster.

[0110] Step S302: Determine at least one client whose access request volume reaches a preset limit value according to the request aggregation result.

[0111] The preset limit value is the preset amount of requests allowed to be initiated by the client, which can be the number of requests or the frequency of requests, which is not limited here. After receiving the request aggregation result uploaded by the edge node, the central server extracts the client identifier and its corresponding access request initiation information (such as initiation time, number of initiations, etc.) in the request aggregation result, counts the number of access requests initiated by the same client based on the client identifier and its corresponding access request initiation information, and compares the corresponding access request amount of each client with the preset limit value to determine one or more clients that exceed the preset limit value.

[0112] Step S303: determine at least one client as an abnormal client, and send the information of the abnormal client to the edge node, so that the edge node intercepts the access request initiated by the abnormal client.

[0113] If the number of access requests initiated by the client exceeds the preset limit, it means that the access requests initiated by the client are actually attacks against the server, that is, the client is an attacker of the server, not a normal access client. At this time, one or more clients exceeding the preset limit are identified as abnormal clients, and the characteristic information of the abnormal clients is sent to the edge node, such as Fig.12 As shown. Accordingly, each edge node will immediately receive the information of the abnormal client, intercept the access request initiated by the abnormal client, and record and cache the penalty status generated for the abnormal client.

[0114] The security protection method for the content distribution network provided in this embodiment is that the central server receives the request aggregation results for the client reported by each edge node in the edge network cluster to determine whether the access request amount initiated by each client in the content distribution network exceeds the limit, and determines the client with the access request amount exceeding the limit as an abnormal client, and spreads the information of the abnormal client to each edge node in the edge network cluster, so that each edge node can intercept the access request initiated by the abnormal client. In this way, it can avoid the abnormal client changing the attacking edge node and bypassing the protection, and realizes the protection for the abnormal client from the global perspective, ensuring the security of the global network.

[0115] In this embodiment, a content distribution network security protection method is provided, which can be used for computer devices, such as a central server, etc. The central server is communicatively connected with edge nodes in an edge network cluster. Fig.13 is a flow chart of a security protection method for a content distribution network according to an embodiment of the present disclosure, such as Fig.13 As shown, the process includes the following steps:

[0116] Step S401, obtain the request aggregation results for each client in the content distribution network reported by the edge nodes in the edge network cluster. For details, please refer to Fig.11 Step S301 of the illustrated embodiment will not be described in detail here.

[0117] Step S402: According to the request aggregation result, determine at least one client whose access request volume reaches a preset limit value. Fig.11 Step S302 of the illustrated embodiment will not be described in detail here.

[0118] Step S403: determine at least one client as an abnormal client, and send the abnormal client information to the edge node, so that the edge node intercepts the access request initiated by the abnormal client. Fig.11 Step S303 of the illustrated embodiment will not be described in detail here.

[0119] Step S404: Detect whether there are other edge nodes in the edge network cluster that have not reported the request aggregation result.

[0120] After the central server feeds back the information of the abnormal client to the edge node that reports the request aggregation result, it can further detect the number of edge nodes that report the request aggregation result to it, and determine whether all edge nodes in the edge network cluster have reported the request aggregation result through the number. Specifically, if the number of edge nodes that report the request aggregation result is less than the number of edge nodes connected to the central server of the edge network cluster, it can be determined that there are other edge nodes that have not reported the request aggregation result.

[0121] Step S405: If there are other edge nodes in the edge network cluster that have not reported the request aggregation result, the information of the abnormal client is spread to other edge nodes in the edge network cluster, so that the other edge nodes intercept the access request initiated by the abnormal client.

[0122] When it is determined that there are other edge nodes that have not reported the request aggregation results, the edge nodes that have reported the request aggregation results are compared with the edge nodes connected to the central server to determine the other edge nodes that have not reported the request aggregation results, and the information of the abnormal client is spread to other edge nodes in the edge network cluster, such as Fig.14 As shown, other edge nodes in the edge network cluster can intercept access requests initiated by abnormal clients.

[0123] The security protection method for the content distribution network provided in this embodiment synchronizes the information of abnormal clients to each edge node corresponding to the central server through a diffusion mechanism. As a result, each edge node can intercept the access request initiated by the abnormal client, further avoiding the situation where the abnormal client bypasses the protection, thereby greatly improving the protection effect.

[0124] As a specific application example of the present disclosure, Fig.10 As shown in the figure, theoretically only 10,000 zombies are needed, and each zombie sends one access request to 100 nodes (that is, one access request per second (1QPS)) to trigger a medium-to-large CC attack with 1 million access requests. A zombie refers to an attack instance controlled by the attacker, which can be a home computer or a cloud server.

[0125] Under normal circumstances, the normal request access volume of user clients may exceed 1QPS. Therefore, the protection module (Limit module) in the conventional edge node cannot make any interception action, resulting in the attack being transmitted through the source station and possibly affecting other customer services of the edge node.

[0126] In order to avoid the above situation, based on the protection module (Limit module) set in each edge node in the edge network cluster, a progressive central statistics protection mode is adopted to fight against the global CC, which can also ensure the effectiveness of microsecond-level CC protection. The progressive solution is:

[0127] (1) The Limit module in the edge node still uses the autonomous mode for CC protection, and the effective time remains in microseconds;

[0128] (2) The Limit module in the edge node pre-aggregates the access requests that match the CC attack matching features locally, generates the corresponding request aggregation results, and reports the request aggregation results to the central server in an asynchronous manner;

[0129] (3) After the edge node reports to the central server, the central server will analyze the request aggregation results, obtain the interception features to identify the abnormal client, and send the information of the abnormal client to the edge node so that the edge node can punish the abnormal client and restrict the access of the abnormal client.

[0130] Taking the above scenario as an example, the Limit module in the edge node still counts 1QPS for a single broiler and considers it to be consistent with a normal user client. After the edge node Limit module detects that the access request sent by the broiler hits the CC attack feature, it pre-aggregates the access request and triggers asynchronous reporting, reporting the pre-aggregated request aggregation result to the central server. The central server performs statistical analysis on the request aggregation results it receives. If it is found that the statistical data of a single broiler has reached 100QPS, it is determined to be an attack based on the rate limiting rule of the CC attack. The central server immediately returns to the edge node the information that the broiler should be punished, and all subsequent edge nodes reporting to the central server will directly return a rejection of the broiler's access request. The Limit module in the edge node will change the judgment of the broiler's characteristics from a normal client to an attacking client, and execute a penalty operation. For edge nodes that have not reported the broiler to the central server, the broiler's penalty status will be synchronized to each unreported edge node through the status diffusion mechanism.

[0131] Through the above progressive means, it can not only ensure that the delay of the request link does not increase extra, but also achieve the effect of global CC protection. Although there may be some penetration at the initial time of the CC attack, the protection will take effect immediately afterwards. Specifically, the delay depends on the communication interval between the edge node Limit module and the central server, and the delay can be increased or decreased according to the situation; relying on the global networking of CDN, the delay can also be controlled to a minimum of 20~200 milliseconds according to the regional network construction.

[0132] In this embodiment, a security protection device for a content distribution network is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0133] This embodiment provides a security protection device for a content distribution network, which is used for edge nodes in an edge network cluster. The edge nodes are provided with a protection module, such as Fig.15 As shown, the device comprises:

[0134] The access request acquisition module 501 is used to acquire an access request initiated by a client in a content distribution network.

[0135] The detection module 502 is used to detect the access request using the protection module to determine whether the client that initiates the access request is an abnormal client.

[0136] The interception module 503 is used to intercept the access request initiated by the client if it is determined that the client is an abnormal client;

[0137] The traction module 504 is used to pull the access requests initiated by the same client to the same edge node within a specified time.

[0138] In some optional implementations, the detection module 502 includes:

[0139] The rule acquisition unit is used to acquire the preset matching rule corresponding to the access request.

[0140] The feature matching unit is used to perform feature matching on the access request according to the preset matching rules to determine whether the access request hits the preset matching rules.

[0141] The statistical unit is used to count the access requests if the access requests hit the preset matching rule, so as to obtain the count value of the access requests.

[0142] The determination unit is configured to determine that the client is an abnormal client if the count value satisfies a preset rate limiting rule.

[0143] In some optional implementations, a fuse is provided in the protection module, and the fuse is used to set the target request amount that the protection module can bear. Accordingly, the above device also includes:

[0144] The request quantity acquisition unit is used to obtain the access request quantity received by the protection module.

[0145] The release return unit is used to directly return the access requests exceeding the target request amount through a fuse if the access request amount exceeds the target request amount.

[0146] In some optional implementations, a white list and a black list are also provided in the protection module. Accordingly, the above device further includes:

[0147] The detection unit is used to detect whether the access request is in the white list or the black list.

[0148] The release unit is used to directly release the access request if it is in the whitelist.

[0149] The interception unit is used to directly intercept the access request if it is in the blacklist.

[0150] In some optional embodiments, the above device further includes:

[0151] The penalty module is used to perform penalty operations on abnormal clients and restrict the access of abnormal clients to edge nodes.

[0152] The cache module is used to cache the penalty status of abnormal clients.

[0153] In some optional embodiments, the above device further includes:

[0154] The access module is used to access the cache space of the penalty state and determine the target client in the penalty state.

[0155] The interception determination module is used to directly intercept when the target client initiates an access request to the edge node again.

[0156] In some optional embodiments, the above device further includes:

[0157] The diffusion module is used to diffuse the information of abnormal clients to other edge nodes in the edge network cluster, so that other edge nodes can intercept the access requests initiated by the abnormal clients.

[0158] In some optional embodiments, the above device further includes:

[0159] The aggregation module is used to aggregate the access requests initiated by each client to obtain the request aggregation results corresponding to each client.

[0160] The sending module is used to send the request aggregation result to the central server, so that the central server determines the abnormal client based on the request aggregation result.

[0161] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0162] The security protection device of the content distribution network in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0163] The security protection device of the content distribution network provided by this embodiment sets a protection module in the edge node. When the client initiates an access request to the server of the edge node, the access request first enters the protection module, and the protection module detects the access request initiated by the client this time to determine whether the client initiating the access request is an abnormal client initiating an attack. If the client is an abnormal client, the access request is directly intercepted by the protection module to prevent the edge node server of the content distribution network from being attacked, and realizes adaptive protection of the edge node, reducing the load pressure of the unified calculation of the central server of the content distribution network and the instability caused by the request to the central server. Furthermore, by pulling the same client to the same edge node for access, if the client is an abnormal client, all attacks of the abnormal client can be counted by the same edge node protection module, which can reduce the response delay time, thereby reducing the protection response delay and improving the protection response efficiency, so as to achieve a microsecond protection response effect.

[0164] This embodiment provides a security protection device for a content distribution network, which is used for a central server, and the central server is connected to an edge node in an edge network cluster for communication, such as Fig.16 As shown, the device comprises:

[0165] The aggregation result acquisition module 601 is used to obtain the request aggregation results for each client in the content distribution network reported by the edge nodes in the edge network cluster.

[0166] The request quantity comparison module 602 is used to determine at least one client whose access request quantity reaches a preset limit value according to the request aggregation result.

[0167] The abnormality determination module 603 is used to determine at least one client as an abnormal client, and send the information of the abnormal client to the edge node, so that the edge node intercepts the access request initiated by the abnormal client.

[0168] In some optional embodiments, the above device further includes:

[0169] The non-reporting detection module is used to detect whether there are other edge nodes in the edge network cluster that have not reported the request aggregation results.

[0170] The information diffusion module is used to diffuse the information of the abnormal client to other edge nodes in the edge network cluster if there are other edge nodes in the edge network cluster that have not reported the request aggregation results, so that other edge nodes can intercept the access request initiated by the abnormal client.

[0171] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0172] The security protection device of the content distribution network in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0173] In the security protection device for the content distribution network provided in this embodiment, the central server receives the request aggregation results for the client reported by each edge node to determine whether the access request amount initiated by each client exceeds the limit, determines the client with the access request amount exceeding the limit as an abnormal client, and spreads the information of the abnormal client to each edge node of the edge network cluster, so that each edge node can intercept the access request initiated by the abnormal client. In this way, it can be avoided that the abnormal client changes the attacking edge node and bypasses the protection, and the protection for the abnormal client is realized from the global perspective, ensuring the security of the global network.

[0174] The present disclosure also provides a computer device having the above Fig.15 The content distribution network security device shown, or Fig.16 The security protection device of the content distribution network is shown.

[0175] See also Fig.17 , Fig.17 is a schematic diagram of a computer device provided by an optional embodiment of the present disclosure, such as Fig.17As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.17 A processor 10 is taken as an example.

[0176] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0177] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0178] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0179] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0180] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0181] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0182] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0183] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A security protection method for a content distribution network, characterized in that: For an edge node in an edge network cluster, the edge node is provided with a protection module, and the method comprises: Obtaining access requests initiated by clients in the content distribution network; Detecting the access request using the protection module to determine whether the client initiating the access request is an abnormal client includes: obtaining a preset matching rule corresponding to the access request; performing feature matching on the access request according to the preset matching rule to determine whether the access request hits the preset matching rule; if the access request hits the preset matching rule, counting the access request to obtain a count value of the access request; if the count value satisfies a preset rate limiting rule, determining that the client is an abnormal client; If it is determined that the client is an abnormal client, intercepting the access request initiated by the client; Pulling the access request initiated by the same client to the same edge node within a specified time; The protection module is provided with a fuse, and the fuse is used to set the target request amount that the protection module can bear; the method further includes: Obtaining the amount of access requests received by the protection module; If the access request amount exceeds the target request amount, the access requests exceeding the target request amount are directly returned through the fuse.

2. The method according to claim 1, characterized in that Also includes: Performing a penalty operation on the abnormal client to restrict the abnormal client's access to the edge node; The penalty status of the abnormal client is cached.

3. The method according to claim 2, characterized in that Also includes: Accessing the cache space of the penalty state to determine the target client in the penalty state; When the target client initiates the access request to the edge node again, it is directly intercepted.

4. The method according to claim 1, characterized in that: The protection module is also provided with a white list and a black list, and the method further comprises: Detecting whether the access request is in the whitelist or the blacklist; If the access request is in the whitelist, it is directly released; If the access request is in the blacklist, it is directly intercepted.

5. The method according to claim 1, characterized in that Also includes: The information of the abnormal client is spread to other edge nodes in the edge network cluster, so that the other edge nodes intercept the access request initiated by the abnormal client.

6. The method according to claim 1, characterized in that Also includes: Aggregating the access requests initiated by each of the clients to obtain request aggregation results corresponding to each of the clients; The request aggregation result is sent to a central server, so that the central server determines an abnormal client based on the request aggregation result.

7. A security protection device for a content distribution network, characterized in that: Used for an edge node in an edge network cluster, the edge node is provided with a protection module, and the device comprises: An access request acquisition module, used to acquire an access request initiated by a client in a content distribution network; A detection module, used to detect the access request using the protection module to determine whether the client initiating the access request is an abnormal client; An interception module, configured to intercept an access request initiated by the client if the client is determined to be an abnormal client; A traction module, used for traction of the access request initiated by the same client to the same edge node within a specified time; The detection module includes: a rule acquisition unit, used to acquire a preset matching rule corresponding to the access request; a feature matching unit, used to perform feature matching on the access request according to the preset matching rule to determine whether the access request hits the preset matching rule; a statistical unit, used to count the access requests if the access request hits the preset matching rule to obtain a count value of the access request; a determination unit, used to determine that the client is an abnormal client if the count value satisfies a preset rate limiting rule; The protection module is provided with a fuse, and the fuse is used to set the target request amount that the protection module can bear; the device also includes: A request amount acquisition unit, used to acquire the access request amount received by the protection module; The release return unit is used to directly return the access requests exceeding the target request amount through the fuse if the access request amount exceeds the target request amount.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the content distribution network security protection method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the content distribution network security protection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the content distribution network security protection method according to any one of claims 1 to 6.

Images