Access control method and device

Abstract

The invention discloses an access control method and device, and relates to the technical field of data security. A specific embodiment of the method comprises the steps of obtaining a user identifier and a control type in an access request, and querying whether a counter corresponding to the user identifier exists in a cache; if yes, executing an operation of allowing or rejecting the access request according to a size relationship between a count value of the counter and a preset threshold value; if not, querying whether a control value and data updating time corresponding to the user identifier exist in a persistent database; and calculating an initialization count value according to the query result and the control parameter value corresponding to the control type, subtracting a preset value from the initialization count value to obtain a new count value, storing the new count value in a cache, and executing an operation of allowing the access request. According to the embodiment, dynamic and flexible access control is achieved by combining a positive feedback mechanism and a time degeneration mechanism, hostile attacks and abuse can be effectively prevented, and limitation can be gradually relaxed when user behaviors are good.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an access control method and device. Background Art

[0002] Sending SMS verification codes is widely used for login authentication. Users enter their mobile phone numbers and verification codes to complete the verification. This scenario does not involve authentication. Anyone can enter any mobile phone number to initiate a request, so the request needs to be restricted to prevent malicious use. At the same time, considering that a natural person may have multiple mobile phone numbers, or the same mobile phone number may be used by different people over time, the management of mobile phone numbers should not be too mechanical to avoid accidentally hurting normal users. Summary of the invention

[0003] In view of this, the embodiments of the present invention provide an access control method and device, which can at least solve the problem that the access control in the prior art is not flexible enough and has poor effect.

[0004] To achieve the above object, according to one aspect of an embodiment of the present invention, there is provided an access control method, comprising:

[0005] Obtaining the user identifier and control type in the access request, and querying in the cache whether there is a counter corresponding to the user identifier; wherein the counter is used to count the remaining allowed access times;

[0006] In response to the query result being existence, performing an operation of allowing or denying the access request according to a relationship between the count value of the counter and a preset threshold;

[0007] In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request;

[0008] According to the query result and the control parameter value corresponding to the control type, the initialization count value is calculated, the preset value is subtracted from the initialization count value, a new count value is obtained and stored in the cache, and an operation of allowing the access request is performed.

[0009] Optionally, the operation of allowing or denying the access request according to the relationship between the count value of the counter and a preset threshold value includes:

[0010] Subtract the preset value from the count value of the counter to obtain a new count value;

[0011] In response to the new count value being greater than or equal to zero, performing an operation of allowing the access request and updating the count value of the counter to the new count value;

[0012] In response to the new count value being less than zero, an operation of denying the access request is performed, and a query is made from the cache whether there is a control value corresponding to the user identifier, and a corresponding processing strategy is called according to the query result to update the control value and the data update time.

[0013] Optionally, calling a corresponding processing strategy according to the query result to update the control value and the data update time includes:

[0014] If the query result is that the user ID does not exist, it is determined that this is the first time that the access is denied, the control value is initialized to a preset value, and a new record is created to store the relationship between the user ID and the control value, so as to be stored in the cache;

[0015] If the query result is that the control value exists, the sum of the control value and the preset value is used as the new control value, so as to update the control value corresponding to the user identifier in the cache to the new control value;

[0016] Get the maximum number of times within the cycle corresponding to the control type, respond to the new control value being an integer multiple of the maximum number of times within the cycle, use the access time of the access request as the data update time, and store the correspondence between the user identifier and the new control value and the data update time in a persistent database.

[0017] Optionally, when the query result is yes, calculating the initialization count value according to the query result and the control parameter value corresponding to the control type includes:

[0018] Determine the current system time, calculate the difference between the current system time and the data update time, the product of the preset regression speed parameter and the preset regression unit, and then obtain the quotient of the difference and the product;

[0019] The difference between the control value and the quotient is taken as the number of exceedances for which regression correction has been made; where regression means that the control strength decays over time;

[0020] The initialization count value is calculated based on the maximum number of times within the cycle, the preset positive feedback influence factor, and the number of excess times after regression correction.

[0021] Optionally, when the query result is non-existent, calculating the initialization count value according to the query result and the control parameter value corresponding to the control type includes:

[0022] The number of excess times for which degenerate correction has been made is set to zero, and the initialization count value is calculated based on the maximum number of times within the cycle and the preset positive feedback influence factor.

[0023] Optionally, the user identifier includes one or more of a user's mobile phone number and an Internet Protocol address (IP address).

[0024] To achieve the above object, according to another aspect of an embodiment of the present invention, there is provided an access control device, comprising:

[0025] A query module, used to obtain the user identifier and control type in the access request, and query whether there is a counter corresponding to the user identifier in the cache; wherein the counter is used to count the remaining allowed access times;

[0026] A processing module, configured to, in response to the query result being existence, execute an operation of allowing or denying the access request according to a magnitude relationship between a count value of the counter and a preset threshold;

[0027] In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request;

[0028] According to the query result and the control parameter value corresponding to the control type, the initialization count value is calculated, the preset value is subtracted from the initialization count value, a new count value is obtained and stored in the cache, and an operation of allowing the access request is performed.

[0029] Optionally, the processing module is used to: subtract a preset value from the count value of the counter to obtain a new count value; in response to the new count value being greater than or equal to zero, execute an operation of allowing the access request and update the count value of the counter to the new count value; in response to the new count value being less than zero, execute an operation of denying the access request, and query whether there is a control value corresponding to the user identifier from the cache, and call a corresponding processing strategy based on the query result to update the control value and data update time.

[0030] Optionally, the processing module is used to: if the query result is that the user ID does not exist, determine that this is the first time that the access is denied, initialize the control value to a preset value, and create a new record for storing the relationship between the user ID and the control value to store in the cache;

[0031] If the query result is that the control value exists, the sum of the control value and the preset value is used as the new control value, so as to update the control value corresponding to the user identifier in the cache to the new control value;

[0032] Get the maximum number of times within the cycle corresponding to the control type, respond to the new control value being an integer multiple of the maximum number of times within the cycle, use the access time of the access request as the data update time, and store the correspondence between the user identifier and the new control value and the data update time in a persistent database.

[0033] Optionally, when the query result is yes, the processing module is used to:

[0034] Determine the current system time, calculate the difference between the current system time and the data update time, the product of the preset regression speed parameter and the preset regression unit, and then obtain the quotient of the difference and the product;

[0035] The difference between the control value and the quotient is taken as the number of exceedances for which regression correction has been made; where regression means that the control strength decays over time;

[0036] The initialization count value is calculated based on the maximum number of times within the cycle, the preset positive feedback influence factor, and the number of excess times after regression correction.

[0037] Optionally, when the query result is non-existent, the processing module is used to: set the number of excess times for which degenerate correction has been made to zero, and calculate the initialization count value based on the maximum number of times within the cycle and a preset positive feedback influence factor.

[0038] Optionally, the user identifier includes one or more of a user's mobile phone number and an Internet Protocol address (IP address).

[0039] To achieve the above objective, according to another aspect of an embodiment of the present invention, an access control electronic device is provided.

[0040] The electronic device of the embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement any of the access control methods described above.

[0041] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, any of the above access control methods is implemented.

[0042] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer program product is provided. A computer program product according to an embodiment of the present invention includes a computer program, and when the program is executed by a processor, the access control method provided by the embodiment of the present invention is implemented.

[0043] According to the solution provided by the present invention, an embodiment of the above invention has the following advantages or beneficial effects: by combining the positive feedback mechanism and the time regression mechanism, a dynamic and flexible access control strategy is implemented. Specifically, an independent control value is set for each user ID to form a positive feedback system. The larger the control value, the easier it is to trigger rejection, thereby effectively preventing malicious attacks and abuse. In addition, a method for regression control based on time is proposed to gradually relax the control effect according to time and eventually return to the initial setting. Different user IDs are treated differently and controlled independently to avoid the problem of one-size-fits-all, further enhancing flexibility and security. Through these measures, not only the performance and response speed are improved, but also the frequent access to the persistent database is effectively reduced.

[0044] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific implementation examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0046] Figure 1 This is a schematic diagram of the main flow of an access control method according to an embodiment of the present invention;

[0047] Figure 2 is a flowchart of an optional access control method according to an embodiment of the present invention;

[0048] Figure 3 is a flowchart of another optional access control method according to an embodiment of the present invention;

[0049] Figure 4 is a flowchart of a specific access control method according to an embodiment of the present invention;

[0050] Figure 5 is a schematic diagram of main modules of an access control device according to an embodiment of the present invention;

[0051] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0052] Figure 7 It is a schematic diagram of the structure of a computer system of a mobile device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0054] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0055] In the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other. The acquisition, transmission, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of national laws and regulations, and are used for legal and reasonable purposes, and are not shared, disclosed, or sold outside of these legal uses, and are subject to supervision and management by regulatory authorities.

[0056] For user information, necessary measures should be taken to prevent illegal access to such personal information data, ensure that persons who have access to personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once such user personal information data is no longer needed, risks should be minimized by limiting or even prohibiting data collection and / or deleting data. When applicable, including in certain relevant applications, protect user privacy by de-identifying data, such as by removing specific identifiers (e.g., date of birth, etc.), controlling the amount or specificity of stored data (e.g., collecting location data at the city level rather than at the specific address level), controlling how data is stored, and / or other methods of de-identification.

[0057] Sending SMS verification codes is a widely used scenario. For example, during login authentication, the system uses the mobile phone number entered by the customer and the SMS verification code of the mobile phone number as authentication information to proceed to the next step. In this scenario, sending SMS verification codes is a non-authentication scenario, which means that anyone can enter any mobile phone number to initiate a request. At this time, the system must screen and restrict these requests to avoid malicious use. In addition, there is not a one-to-one correspondence between natural persons and mobile phone numbers, and this relationship will change over time. A natural person may have multiple mobile phone numbers, and a mobile phone number may be used by different natural persons over time. If the control of mobile phone numbers is too mechanical, it is easy to intercept normal access.

[0058] There are currently multiple implementations for this scenario, but each of these implementations has its own drawbacks:

[0059] Method 1: Pre-graphic verification code solution: refers to requiring customers to pass the graphic verification code verification before sending the SMS verification code without authentication. Only after passing the verification can the SMS verification code be successfully sent. The steps include: the customer enters the user login page (non-authentication), enters the mobile phone number, clicks to obtain the SMS verification code, the graphic verification code pops up on the page, the customer enters the graphic verification result, and the SMS verification code is sent to the customer after the graphic verification passes. This solution has been widely adopted and is a common method for human-machine identification and reducing the frequency of sending. However, this method has two main disadvantages: First, the graphic verification code needs to be as complex as possible, because a simple graphic verification code is easily cracked by cracking tools, and a complex verification code may lead to unfriendly recognition, poor user experience and high system resource consumption; second, even if the graphic verification code is cracked or maliciously identified manually, a large number of requests can still be sent.

[0060] Method 2: Ordinary time-limited protection method: It means that each mobile phone number can only send a limited number of SMS verification codes in each time period. The steps include: the customer enters the user login page (non-authentication), enters the mobile phone number, clicks to obtain the SMS verification code, and the system verifies the number of requests for the mobile phone number in the current time period. If it exceeds the limit, it refuses to send. This solution is a big improvement over Solution 1, but it is not flexible enough. Everyone is under the same control at all times. If the control is too tight, it is easy to kill normal users by mistake; if the control is too loose, it is easy to be used for malicious attacks.

[0061] Method 3: Time-limited per-time protection with blacklist mechanism: On the basis of the ordinary time-limited per-time protection method, a blacklist is maintained, and SMS verification codes are refused to be sent to the mobile phone numbers in the blacklist. This method can solve most problems, but if a mobile phone number originally belonged to natural person A, was later cancelled, and then applied for by natural person B, the previous control over the mobile phone number will still exist, resulting in accidental harm to normal users.

[0062] See also Figure 1 , which shows a main flow chart of an access control method provided by an embodiment of the present invention, comprising the following steps:

[0063] S101: Obtain a user identifier and a control type in an access request, and query whether there is a counter corresponding to the user identifier in a cache; wherein the counter is used to count the remaining allowed access times;

[0064] S102: in response to the query result being existence, executing an operation of allowing or denying the access request according to a relationship between the count value of the counter and a preset threshold;

[0065] S103: In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request;

[0066] S104: Calculate an initialization count value according to the query result and the control parameter value corresponding to the control type, subtract a preset value from the initialization count value to obtain a new count value and store it in the cache, and perform an operation of allowing the access request.

[0067] In the above implementation, this scheme sets up an access control method based on the common time-limited protection method. On this basis, a positive feedback system is established to count the situations in which rejection is triggered. The more times it is rejected, the more likely it is to be rejected again in the future. On the basis of this positive feedback, the idea of ​​regression by time is introduced. The longer there is no rejection, the more relaxed the control is, gradually tending to the initial situation. At the same time, the performance of the device must be very good, and the reading of the persistent database must be minimized to cope with a large number of access requests.

[0068] For step S101, an access request is received, such as the login request or other request. Each time a request is made, a user identifier is obtained from the request, and it is checked whether there is a counter for the user identifier, which is recorded as C. Here, one user identifier corresponds to one counter. Assuming that there are two mobile phone numbers P and Q, it means that there is one counter corresponding to P and another counter corresponding to Q. The counter is for each user identifier; for Redis, the amount of data will not be too large. User identifiers such as mobile phone numbers and IP addresses (Internet Protocol Address) are understandably not limited to mobile phone numbers and IP addresses. In actual operation, mobile phone numbers and IP addresses are usually jointly controlled to enhance security and prevent fraud. Mobile phone numbers can be used for identity authentication, such as sending verification codes, but mobile phone numbers are easy to forge, while IP addresses can help identify the user's geographic location and network environment, and IP addresses are not easy to change. This serial combination can effectively reduce the occurrence of malicious behavior, such as account theft or identity forgery, and achieve the purpose of multi-dimensional control.

[0069] For step S102, see Figure 2 As shown, if C exists, use C=C-1 to calculate the new count value. If the new count value C is greater than or equal to 0, it means that the number of accesses of the user ID has not exceeded the quota. The output is, indicating that access is allowed. The count value of the counter in the cache is updated to the new count value, and the process exits.

[0070] If the new count value C is less than 0, it means that the quota has been used up, and the output result is no, and the access request is denied. Check whether there is a control value n for the user ID in Redis. The aforementioned C is the calculated number of allowed accesses. After this number is used up, n begins to accumulate. If there is no control value n in Redis, it means that the denial is triggered for the first time, so a new Redis record is created, and the control value n is set to 1, that is, initialized to 1, and then the relationship record between the user ID and the control value is stored in Redis.

[0071] If there is a control value n in Redis, add 1 to the control value in Redis to get a new control value. Get the maximum number of times in the cycle corresponding to the control type, and the control parameter values ​​corresponding to different control types, including the time cycle and the maximum number of times a in the cycle. If the modulus of the new control value n and the maximum number of times a in the cycle is equal to 0, assuming n is 10 and the maximum number of times in the cycle is 5, then 10 needs to be put in the persistent database, and the access time of this access request is used as the data update time update_time. If the modulus is not 0, access is directly denied.

[0072] This operation is designed to write persistent data only when the number of denied accesses reaches an integer multiple of the maximum number of times in the cycle. Compared with writing to the persistent database every time, it can reduce the number of accesses to the persistent database and improve performance. In addition, the expiration time of the Redis control value n can be reset, such as the time when the access was denied this time. The more and closer the access is denied, the tighter the rules should be. Therefore, the expiration time can be set to a time period.

[0073] For steps S103 and S104, if there is no C corresponding to the user ID in the cache, it means that the user ID is accessing for the first time in the new time period, and all times in the new time period are recalculated. For example, the initial setting is: each IP can access 6 times per minute, and each minute is a new time period. This means that the counter is dissipated with the time period and needs to be rebuilt in the new time period.

[0074] First, query the persistent database to see whether there is a control value n and data update time update_time corresponding to the user ID. This solution has different execution strategies for different query results. Control type: defined by the user. A control type points to a set of configuration items. When the product specifies the control type when calling, it can control according to the configuration items specified by this control type. For example, the control type sent during the first call is "IP control solution_1" to implement access control to the IP. The control type sent during the second call is "mobile phone number control solution_1" to implement access control to the mobile phone number. The two are combined in series to achieve simultaneous control of the input IP and mobile phone number.

[0075] The control parameter values ​​corresponding to different control types include the time period, the maximum number of times a within the period, the regression speed parameter v, the regression unit, and the positive feedback impact factor; among them, the regression unit is such as regression by day, regression by hour, and regression by minute, and the positive feedback impact factor defaults to 1, and the value is a positive number. The larger the impact factor, the faster the positive feedback speed and the stricter the control. In order to avoid excessive service pressure and network pressure caused by obtaining the control parameter values ​​corresponding to the control type from the server, cloud, etc. every time, this solution preferably loads these control parameter values ​​locally first, so here the control parameter values ​​corresponding to the control type are loaded from the local.

[0076] This solution pre-constructs a regression correction formula and a positive feedback control formula. For the overall process, see Figure 3 As shown:

[0077] Degenerate correction formula: x=n-(sys_time-update_time) / (v×degenerate unit milliseconds). x is the result of the formula output, indicating the number of times the degenerate correction has been made; n is the cumulative number of times the number of times the user visits and is rejected, n will increase by 1; sys_time is the current system timestamp; update_time is the timestamp of the last update of the number of times this record exceeded, and the update time is compared with the current system time, reflecting the characteristics of "degenerate"; v is the configured degenerate speed parameter, the larger the v value, the faster the degenerate speed, when the maximum value is taken, it means that there is no positive feedback memory function, the smaller the value, the slower the degenerate speed, when the minimum value is taken, it means that there is no degenerate over time, only positive feedback function, and no degenerate function; the default option of v is 1, which means that 1 degenerate unit is required for each degenerate.

[0078] Positive feedback control formula: y=2×a^2 / (mx+2a)+1. Among them, y is the result of the formula output, which indicates the count value at the current initialization; x is the number of excess times calculated using the degenerate correction formula, and the degenerate correction has been made; parameter a is the maximum number of times in the cycle in the configuration item corresponding to the control type; m is the preset positive feedback influence factor, the value of this factor is greater than 0, and the default value is 1. The larger m is, the greater the impact after the trigger exceeds the number of times, and the stricter the control is. This parameter can be used as an advanced parameter in the configuration.

[0079] The calculation result y of the formula is assigned to C. C=C-1, and then the C value is registered in Redis. However, if there is no control value n and data update time update_time corresponding to the user ID, x is directly assigned to 0. At this time, y=2×a^2 / (m*0+2a)+1=2×a^2 / (2a)+1=a+1. The output is, indicating that access is allowed, and the process is exited. This means that at least one access can be allowed within a time period, that is, the first access is allowed.

[0080] The method provided in the above embodiment realizes a dynamic and flexible access control strategy by combining a positive feedback mechanism and a time regression mechanism. It can not only effectively prevent malicious attacks and abuse, but also gradually relax restrictions when user behavior is good, thereby improving user experience. At the same time, it improves performance and response speed by reducing frequent access to the persistent database.

[0081] See also Figure 4 , shows a schematic flow chart of a specific access control method according to an embodiment of the present invention, comprising the following steps:

[0082] Step 1: Receive an access request and obtain the user ID and control type from the access request;

[0083] Step 2: Query whether there is a counter C corresponding to the user ID in Redis; wherein the counter is used to count the remaining allowed access times;

[0084] Step 3: In response to the query result being yes, the count value of the counter is subtracted from the preset value, C=C-1, to obtain a new count value C;

[0085] Step 4: If the new count value C is greater than or equal to 0, it means that the number of accesses of the user ID has not exceeded the quota. The output is yes, indicating that access is allowed. The count value of the counter in Redis is updated to the new count value, and the process is exited.

[0086] Step 5: If the new count value C is less than 0, it means that the quota has been used up. The output result is no, and the access request is denied. Check whether there is a control value n for the user ID in Redis.

[0087] Step 6: If there is no control value n in Redis, it means that the rejection is triggered for the first time, so a new Redis record is created and the control value n is set to 1, that is, initialized to 1, and then the relationship record between the user ID and the control value is stored in Redis;

[0088] Step 7: If there is a control value n in Redis, add 1 to the control value in Redis to get a new control value. Get the maximum number of times in the cycle corresponding to the control type. If the modulus of the new control value n and the maximum number of times a in the cycle is equal to 0, the new control value n needs to be put into the persistent database, and the access time of this access request is used as the data update time update_time; if the modulus is not 0, directly deny access;

[0089] Step 8: In response to the query result being that it does not exist, query whether there is a control value n and a data update time update_time corresponding to the user identifier in the persistent database;

[0090] Step 9: According to the query results and the control parameter values ​​corresponding to the control type, use the degenerate correction formula: x=n-(sys_time-update_time) / (v×milliseconds of the degenerate unit) and the positive feedback control formula, y=2×a^2 / (mx+2a)+1, calculate the initialization count value y, and assign it to C;

[0091] Step 10: C=C-1 and store it in Redis, and execute the operation of allowing the access request.

[0092] The basis of this solution is the common time-limited protection method. On this basis, a positive feedback system is established to count the situations in which rejection is triggered. The more times rejection occurs, the more likely it is to be rejected again in the future. On the basis of this positive feedback, the idea of ​​regression based on time is introduced. The longer there is no rejection, the more relaxed the control is, and it gradually tends to the initial situation. At the same time, the performance of the solution must be very good, and the database reading must be minimized to cope with a large number of requests. Taking the login and verification code sending as an example, the components of the solution are as follows:

[0093] 1. Input: user identification (such as the mobile phone number of the SMS to be sent, user IP address, etc.), control type;

[0094] 2. Configuration items: ① Control type; ② Control parameter values ​​corresponding to different control types, including time period, maximum number of times within the period a, regression speed parameter v, regression unit, and positive feedback influence factor m;

[0095] 3. Output: Yes (allow verification code to be sent) / No (do not allow verification code to be sent).

[0096] In non-authentication scenarios, such as sending SMS verification codes, it is a widely used technology, but it is easy to be used by malicious people, causing the following problems: 1. Brute force cracking the system by obtaining verification codes multiple times; 2. Sending a large number of verification codes will cause operating cost losses; 3. The control is relatively mechanical and the personalized customization capability is insufficient. The method provided by the above embodiment has at least the following advantages compared to the existing technology:

[0097] 1. Prevent brute force cracking and verification code abuse: By setting the time period and the maximum number of times the verification code is sent within the period, the multiple sending of the verification code can be effectively controlled, thereby reducing operating cost losses. At the same time, with the help of the positive feedback mechanism, the frequency of attempts by malicious attackers can be reduced, improving system security.

[0098] 2. Introduce a positive feedback mechanism to punish malicious attackers and enhance the system's defense capabilities. Introduce a time-based regression control mechanism, considering that user identification and real users are not necessarily one-to-one. For example, mobile phone numbers may be used by others, and IPs are more likely to be assigned to others. If they are always persistently memorized, it will cause control errors. The use of a time-based regression control scheme is equivalent to giving a chance to correct the error, but if the same user triggers the restriction multiple times, the system will quickly identify and strengthen control measures.

[0099] 3. Highly customizable: Provides multiple core parameter setting options for control types, including time period, maximum number of transmissions, positive feedback influencing factors, and regression speed parameters, etc., supporting users to perform simple or highly customized configurations according to their needs.

[0100] 4. Easy to expand: It supports multiple control types and can realize serial control of multiple entities. It is suitable for various scenarios, such as: short-term user mobile phone number access counter, short-term user IP access counter, long-term user mobile phone number access counter, and long-term user IP access counter. By setting different parameters, users can flexibly combine multiple entities to achieve more refined control effects. In addition, it can also be combined with pre-control measures such as graphic verification codes, front-end countdown, and blacklists to achieve flexible deployment. Or users can also choose to cancel the graphic verification code according to the situation, thereby improving the user experience.

[0101] 5. Efficiency: The core algorithm is simple and efficient in design. Most data processing is done in memory, and the persistent database is accessed only during initialization and when a certain amount of access is reached.

[0102] See also Figure 5 , shows a schematic diagram of main modules of an access control device 500 provided by an embodiment of the present invention, including:

[0103] The query module 501 is used to obtain the user identifier and the control type in the access request, and query whether there is a counter corresponding to the user identifier in the cache; wherein the counter is used to count the remaining allowed access times;

[0104] Processing module 502, for executing an operation of allowing or denying the access request in response to the query result being existence, according to a relationship between a count value of the counter and a preset threshold;

[0105] In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request;

[0106] According to the query result and the control parameter value corresponding to the control type, the initialization count value is calculated, the preset value is subtracted from the initialization count value, a new count value is obtained and stored in the cache, and an operation of allowing the access request is performed.

[0107] In the implementation device of the present invention, the processing module 502 is used to: subtract a preset value from the count value of the counter to obtain a new count value; in response to the new count value being greater than or equal to zero, perform an operation of allowing the access request and update the count value of the counter to the new count value; in response to the new count value being less than zero, perform an operation of denying the access request, and query whether there is a control value corresponding to the user identifier from the cache, and call the corresponding processing strategy according to the query result to update the control value and data update time.

[0108] In the implementation device of the present invention, the processing module 502 is used to: if the query result is not present, determine that this is the first access denial, initialize the control value to a preset value, and create a new record for storing the relationship between the user identifier and the control value to store in the cache;

[0109] If the query result is that the control value exists, the sum of the control value and the preset value is used as the new control value, so as to update the control value corresponding to the user identifier in the cache to the new control value;

[0110] Get the maximum number of times within the cycle corresponding to the control type, respond to the new control value being an integer multiple of the maximum number of times within the cycle, use the access time of the access request as the data update time, and store the correspondence between the user identifier and the new control value and the data update time in a persistent database.

[0111] In the implementation device of the present invention, when the query result is that the information exists, the processing module 502 is used to: determine the current system time, calculate the difference between the current system time and the data update time, the product of the preset retrograde speed parameter and the preset retrograde unit, and then obtain the quotient of the difference and the product;

[0112] The difference between the control value and the quotient is taken as the number of exceedances for which regression correction has been made; where regression means that the control strength decays over time;

[0113] The initialization count value is calculated based on the maximum number of times within the cycle, the preset positive feedback influence factor, and the number of excess times after regression correction.

[0114] In the implementation device of the present invention, when the query result is non-existent, the processing module 502 is used to: set the number of excess times for which regression correction has been made to zero, and calculate the initialization count value based on the maximum number of times within the cycle and the preset positive feedback influence factor.

[0115] In the implementation device of the present invention, the user identification includes one or more of the user's mobile phone number and Internet Protocol address (IP) address.

[0116] In addition, the specific implementation content of the device described in the embodiment of the present invention has been described in detail in the method described above, so the repeated content will not be described again here.

[0117] Figure 6 An exemplary system architecture 600 to which embodiments of the present invention may be applied is shown, including terminal devices 601 , 602 , 603 , a network 604 and a server 605 (only an example).

[0118] Terminal devices 601, 602, 603 can be various electronic devices with display screens and supporting web browsing, and various communication client applications are installed. Users can use terminal devices 601, 602, 603 to interact with server 605 through network 604 to receive or send messages, etc.

[0119] The network 604 is used to provide a medium for communication links between the terminal devices 601, 602, 603 and the server 605. The network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0120] The server 605 may be a server that provides various services, such as a backend management server that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603 (for example only). The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information - for example only) to the terminal device. It should be noted that the method provided in the embodiment of the present invention is generally executed by the server 605, and accordingly, the device is generally set in the server 605.

[0121] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0122] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0123] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0124] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0125] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0126] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0127] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0128] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor. For example, they may be described as: a processor includes a query module and a processing module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, a processing module may also be described as an "access control module."

[0129] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device executes any of the access control methods described above.

[0130] The computer program product of the present invention comprises a computer program, and when the computer program is executed by a processor, the access control method in the embodiment of the present invention is implemented.

[0131] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An access control method, characterized in that: include: Obtaining the user identifier and control type in the access request, and querying in the cache whether there is a counter corresponding to the user identifier; wherein the counter is used to count the remaining allowed access times; In response to the query result being existence, performing an operation of allowing or denying the access request according to a relationship between the count value of the counter and a preset threshold; In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request; According to the query result and the control parameter value corresponding to the control type, the initialization count value is calculated, the preset value is subtracted from the initialization count value, a new count value is obtained and stored in the cache, and an operation of allowing the access request is performed.

2. The method according to claim 1, characterized in that The operation of allowing or denying the access request according to the relationship between the count value of the counter and the preset threshold value includes: Subtract the preset value from the count value of the counter to obtain a new count value; In response to the new count value being greater than or equal to zero, performing an operation of allowing the access request and updating the count value of the counter to the new count value; In response to the new count value being less than zero, an operation of denying the access request is performed, and a query is made from the cache whether there is a control value corresponding to the user identifier, and a corresponding processing strategy is called according to the query result to update the control value and the data update time.

3. The method according to claim 2, characterized in that The calling of a corresponding processing strategy according to the query result to update the control value and the data update time includes: If the query result is that the user ID does not exist, it is determined that this is the first time that the access is denied, the control value is initialized to a preset value, and a new record is created to store the relationship between the user ID and the control value, so as to be stored in the cache; If the query result is that the control value exists, the sum of the control value and the preset value is used as the new control value, so as to update the control value corresponding to the user identifier in the cache to the new control value; Get the maximum number of times within the cycle corresponding to the control type, respond to the new control value being an integer multiple of the maximum number of times within the cycle, use the access time of the access request as the data update time, and store the correspondence between the user identifier and the new control value and the data update time in a persistent database.

4. The method according to claim 1, characterized in that: When the query result is yes, calculating the initialization count value according to the query result and the control parameter value corresponding to the control type includes: Determine the current system time, calculate the difference between the current system time and the data update time, the product of the preset regression speed parameter and the preset regression unit, and then obtain the quotient of the difference and the product; The difference between the control value and the quotient is taken as the number of exceedances for which regression correction has been made; where regression means that the control strength decays over time; The initialization count value is calculated based on the maximum number of times within the cycle, the preset positive feedback influence factor, and the number of excess times after regression correction.

5. The method according to claim 1 or 4, characterized in that: In the case that the query result is not present, the calculating of the initialization count value according to the query result and the control parameter value corresponding to the control type includes: The number of excess times for which degenerate correction has been made is set to zero, and the initialization count value is calculated based on the maximum number of times within the cycle and the preset positive feedback influence factor.

6. The method according to claim 1, characterized in that The user identification includes one or more of a user's mobile phone number and an Internet Protocol address (IP) address.

7. An access control device, characterized in that: include: A query module, used to obtain the user identifier and control type in the access request, and query whether there is a counter corresponding to the user identifier in the cache; wherein the counter is used to count the remaining allowed access times; A processing module, configured to, in response to the query result being existence, execute an operation of allowing or denying the access request according to a magnitude relationship between a count value of the counter and a preset threshold; In response to the query result being non-existent, querying in the persistent database whether there is a control value and a data update time corresponding to the user identifier; wherein the control value indicates the number of access denials, and the data update time is the access time of the denied access request; According to the query result and the control parameter value corresponding to the control type, the initialization count value is calculated, the preset value is subtracted from the initialization count value, a new count value is obtained and stored in the cache, and an operation of allowing the access request is performed.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images