Access control method and device of content distribution network, node, medium and product

Abstract

The invention discloses an access control method and device for a content distribution network, a node, a medium and a product. The access control method comprises the following steps: receiving an access request, wherein the access request comprises an address of a user side; if it is determined that the user side is authenticated according to an address list, the user side is authenticated according to a preset authentication mode to obtain an authentication result, and the address list is used for indicating addresses of the user sides needing to be authenticated and / or not needing to be authenticated; and processing the access request according to the authentication result. According to the technical scheme, the address list is utilized to perform preliminary judgment on the user side to determine that authentication needs to be performed, then the preset authentication mode is adopted to perform authentication on the user side, and two-layer access control is performed on the user side, so that the security of edge node data access is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and in particular to an access control method, device, node, medium and product for a content distribution network. Background Art

[0002] Content Delivery Network (CDN) is an intelligent virtual network built on the existing network. It relies on edge nodes deployed in various places and through the load balancing, content distribution, scheduling and other functional modules of the central platform, it enables users to obtain the required content nearby, reduce network congestion, and improve user access response speed and hit rate. CDN can use caching technology to solve the problem of how to quickly and reliably deliver data from the source station to the user. When users obtain data, they do not need to obtain it directly from the source station. Through CDN distribution, users can obtain data from a better server, thereby achieving fast access and reducing the load pressure on the source station.

[0003] CDN access control is a key technology of CDN. Before using CDN, authentication and response are completed at the source site. When the end user initiates a request for a resource, the request arrives at the source site to first check whether it complies with the permission control rules. If the authentication is successful, the source site will respond to the content requested by the end user. When the business uses CDN, in general, the content distributed at the CDN edge node is a public resource by default. At this time, the authentication rules of the source site will not be triggered, and direct access is only required for the corresponding URL. Since CDN lacks a complete access control mechanism, it is easy to cause resource leakage, theft and high traffic, etc., affecting the security of product data. Summary of the invention

[0004] The present application provides an access control method, device, node, medium and product for a content distribution network to improve the security of edge node data access.

[0005] In a first aspect, an embodiment of the present application provides an access control method, which is applied to an edge node, including:

[0006] receiving an access request, wherein the access request includes an address of a user terminal;

[0007] If it is determined to authenticate the user terminal according to the address list, the user terminal is authenticated according to a preset authentication method to obtain an authentication result, wherein the address list is used to indicate the addresses of the user terminals that need to be authenticated and / or do not need to be authenticated;

[0008] The access request is processed according to the authentication result.

[0009] In a second aspect, an embodiment of the present application further provides an access control device, including:

[0010] A receiving module, used for receiving an access request, wherein the access request includes an address of a user terminal;

[0011] an authentication module, configured to authenticate the user terminal according to a preset authentication method to obtain an authentication result if it is determined to authenticate the user terminal according to the address list, wherein the address list is used to indicate the addresses of the user terminals that need to be authenticated and / or do not need to be authenticated;

[0012] A processing module is used to process the access request according to the authentication result.

[0013] In a third aspect, an embodiment of the present application provides an edge node, including:

[0014] one or more processors;

[0015] A storage device for storing one or more programs;

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the access control method as described in the first aspect.

[0017] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the access control method as described in the first aspect.

[0018] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the access control method as described in any of the above embodiments.

[0019] The embodiments of the present application provide an access control method, device, node, medium and product for a content distribution network, the access control method comprising: receiving an access request, the access request including the address of a user terminal; if it is determined to authenticate the user terminal based on an address list, authenticating the user terminal based on a preset authentication method to obtain an authentication result, wherein the address list is used to indicate the addresses of user terminals that need to be authenticated and / or do not need to be authenticated; processing the access request based on the authentication result. The above technical solution uses the address list to make a preliminary judgment on the user terminal to determine whether authentication is required, and then uses the preset authentication method to authenticate the user terminal. By performing two-layer access control on the user terminal, the security of edge node data access is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0021] Figure 1 A flowchart of an access control method provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a request header authentication provided for an embodiment of the present application

[0023] Figure 3 A schematic diagram of an anti-hotlink authentication provided in an embodiment of the present application

[0024] Figure 4 A schematic diagram of a back-to-source authentication provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of the structure of an access control device provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of an edge node provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0028] It should be mentioned before discussing the exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the steps as sequential processes, many of the steps therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the steps can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0029] It should be noted that the concepts of "first", "second", etc. mentioned in the embodiments of the present application are only used to distinguish different devices, modules, units or other objects, and are not used to limit the order or interdependence of the functions performed by these devices, modules, units or other objects.

[0030] In addition, the embodiments in the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0031] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0032] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the relevant content of the solution.

[0033] Figure 1 A flowchart of an access control method provided in an embodiment of the present application, which can be applied to the case of processing access requests from a user terminal. Specifically, the access control method can be executed by an access control device, which can be implemented by software and / or hardware and integrated in the edge node of the CDN.

[0034] like Figure 1 As shown, the method specifically comprises the following steps:

[0035] S110: Receive an access request, where the access request includes an address of a user terminal.

[0036] In this embodiment, the user terminal sends an access request to the edge node to access the data or resources of the edge node. The access request includes the address of the user terminal, and each user terminal has a unique address.

[0037] S120: If it is determined to authenticate the user terminal according to the address list, authenticate the user terminal according to a preset authentication method to obtain an authentication result.

[0038] The address list can be used to specify the addresses of the user terminals that need to be authenticated and / or the addresses of the user terminals that do not need to be authenticated. The address list can be used to filter the user's access request, intercept or allow the access of the user terminals with specific addresses, thereby limiting the access source and preventing malicious theft or attack.

[0039] For example, the address list may specify the addresses of some clients that cannot access edge nodes (which may also be understood as clients without access rights or are untrustworthy), and no authentication is required for these clients, and their access requests may be directly rejected; the address list may specify the addresses of some clients that can access edge nodes after authentication (which may also be understood as clients with access rights or are trustworthy), and these clients may be further authenticated and subsequently processed; the address list may specify the addresses of some clients that can directly access edge nodes (which may also be understood as clients with access rights or are trustworthy), and these clients may not be authenticated, and may be directly allowed to access data of edge nodes, etc. It is understandable that the address list may indicate the addresses of one or more of the above-mentioned clients.

[0040] On this basis, for the user end that needs to be authenticated, the preset authentication method can be used to identify whether the user end has the authority to obtain the resource. The preset authentication method may include at least one of the following: anti-hotlink authentication, back-to-source authentication, request header authentication, internal redirection authentication, etc. The specific authentication method to be used can be determined based on the actual situation of the user end and the CDN network. This embodiment does not specifically limit the preset authentication method.

[0041] S130: Process the access request according to the authentication result.

[0042] In this embodiment, if the user terminal passes the authentication, the edge node can respond to the access request of the user terminal, for example, it can transmit the response data or resources to the user terminal; if the user terminal fails the authentication, the edge node can reject the access request of the user terminal.

[0043] An access control method provided in an embodiment of the present application provides a strategic and global content distribution network access control design method, which uses an address list to make a preliminary judgment on the user terminal to determine whether authentication is required, and then uses a preset authentication method to authenticate the user terminal. By performing two-layer access control on the user terminal, the security of edge node data access is improved; in addition, access control services suitable for their own business scenarios and resource characteristics can be provided for various access business applications of the content distribution network, achieving an application-level or even finer-grained access control management method, which can ensure that each application has an independent and complete access control method, and ensure the security and privacy of edge node data.

[0044] In one embodiment, the method further comprises:

[0045] S1010, obtaining an address list from a content distribution network server and saving the address list;

[0046] S1020: Map the configuration information of the address list to variables of the website and the proxy server.

[0047] Among them, the content distribution network server can also be understood as the CDN platform, origin site or origin server, that is, the site where the resources of the CDN edge node originally come from. Traditional CDN uses Nginx technology to configure the address list. The address list in the address list may change at any time. Each time the relevant configuration file is modified, Nginx needs to be hot restarted. This operation will affect data transmission, user access query rate per second (QPS) and other service performance. In addition, a large number of CDN edge nodes require an additional reload command and one more operation and maintenance operation, which increases the risk of system automation operation.

[0048] In this embodiment, the address list in the address list can be dynamically updated, and a hot validation method of the address list based on the website server and the proxy server (Openresty) is adopted for this purpose. Specifically, the edge node can obtain the address list from the CDN server regularly, and save it in the memory based on the Lua module of Openresty; in the Nginx configuration file, the configuration related to the address list can be designed as an Nginx variable, and it can be modified through Lua, and it can take effect without hot restarting Nginx, which improves service performance and reduces the risk of system automation operation.

[0049] In one embodiment, the preset authentication method includes request header authentication; the access request carries request header authentication information; the user terminal is authenticated according to the preset authentication method, and the authentication result is obtained, including:

[0050] S1210, obtaining key information issued by a content distribution network server;

[0051] S1220. Authenticate the request header authentication information according to the key information to obtain an authentication result.

[0052] In this embodiment, request header authentication is a relatively simple and efficient authentication method. Its principle is that the user end (service consumer) carries the request header authentication information (authentication Header, also called authentication key information) in the request header of the access request. The edge node verifies the request header authentication information. If the verification passes, the corresponding cache resource is returned to the user end. If the verification fails, the request fails.

[0053] Figure 2 A schematic diagram of a request header authentication provided in an embodiment of the present application. Figure 2 As shown in the figure, the request header authentication process includes:

[0054] ①The CDN service provider configures the key information (Header) in the CDN platform;

[0055] ②The CDN platform distributes key information to each edge node;

[0056] ③ The user sends an access request with authentication information in the request header to request the edge node for the required accelerated resources;

[0057] ④The CDN edge node verifies the request header authentication information based on the key information. If the verification is successful, the corresponding cache resources are returned to the user end. If the verification fails, the user end’s access is denied.

[0058] In one embodiment, the preset authentication method includes anti-hotlink authentication; the access request carries a link with authentication parameters, the link is provided to the user terminal by the content distribution network server, the authentication parameters include the link validity period and the signature, the signature is generated according to the agreed key, the file path and the link validity period; the user terminal is authenticated according to the preset authentication method, and the authentication result is obtained, including:

[0059] S1230: Authenticate the validity of the link and the correctness of the signature to obtain an authentication result.

[0060] Among them, anti-hotlink (Refer) authentication mainly refers to the identification and filtering of visitor identities by configuring the Referer of the access request source, limiting users who access CDN resources, and prohibiting other websites from referencing resource links. Traditional Refer anti-hotlink is based on the Referer of the HTTP request header, which can be forged and cannot be customized to authenticate any request header.

[0061] In this embodiment, anti-hotlinking refers to the check field in the Uniform Resource Locator (URL) of the streaming playback, and its function is to prevent attackers from illegally stealing the playback address. Figure 3 A schematic diagram of an anti-hotlink authentication provided in an embodiment of the present application. Figure 3As shown, the source server can return the URL with authentication parameters to the user end according to the authentication rules. The user end carries the request verification information to initiate a content request to the edge node, such as: https: / / host:port / xxx / xxx? sign=signature&t=expTime. Among them, signature can be understood as a signature, which can be used as an authentication credential. Its generation method can be MD5 (secret, path, expTime), where secret is the agreed key, path is the file path, and expTime means the expiration time, which can also be understood as the validity period of the link, converting the time into a UNIX timestamp. After the access request reaches the edge node, it is authenticated by the edge node. When the timestamp or authentication credential carried by the user end is wrong, access will be denied, for example, the status code 403 will be returned.

[0062] In one embodiment, the preset authentication method includes back-to-source authentication; authenticating the user terminal according to the preset authentication method to obtain an authentication result includes:

[0063] S1240, sending a callback request to a content distribution network server, so that the content distribution network server authenticates the user terminal;

[0064] S1250: Receive the authentication result returned by the content distribution network server.

[0065] Specifically, back-to-source can be understood as the process in which the CDN node initiates a resource request to the source station and caches the resource if the resource does not exist in the CDN edge node cache when the user accesses the resource for the first time. Back-to-source authentication uses a callback mechanism to transparently transmit the service request information to the authentication center of the source station to determine the legitimacy of the request and release the request only after verification. For more complex authentication scenarios (for example, when anti-hotlink authentication cannot meet the authentication requirements of the business), authentication can be performed through back-to-source.

[0066] Figure 4 A schematic diagram of a back-to-source authentication provided in an embodiment of the present application. Figure 4 As shown, business applications can configure whether to enable back-to-origin authentication on the management side of the CDN server, as well as the request URL specifications and carried parameters of the authentication HTTP callback. After receiving the resource request, the edge node initiates an HTTP callback request to the authentication server of the origin station, which performs authentication and then returns the authentication result to the edge node. If the authentication passes, the request is released for resource download; if the authentication fails, access is denied.

[0067] In one embodiment, the preset authentication method includes internal redirection authentication; the user terminal is authenticated according to the preset authentication method to obtain an authentication result, including:

[0068] S1260, adding an authentication tag to the access request and forwarding the access request to the content distribution network server;

[0069] S1270: Receive the authentication result returned by the content distribution network server.

[0070] In this embodiment, the access request is processed according to the authentication result, including: if the authentication is passed, the access request is internally redirected to the internal response block of the edge node, so that the internal response block completes resource distribution.

[0071] Specifically, internal redirect authentication is a more customized back-to-source authentication. The business party can customize the authentication requirements, authentication strategies, and authentication granularity. In addition, the authentication subject task is undertaken by the business party, who needs to provide authentication service support and cooperate with the CDN service provider to carry out relevant customized transformation.

[0072] In this embodiment, after the access request reaches the edge node, the edge node will add an authentication tag to the corresponding request and forward it to the source server. The source server will erase the corresponding tag after completing the authentication. If the authentication fails, 403 can be returned; if the authentication is successful, the request will be redirected internally to the internal (Internal) response block of the edge node through the X-Accel-Redirect keyword of Nginx, and the Internal response block will complete the distribution of resources, thereby completing the user-level authentication of resources.

[0073] Optionally, in addition to authentication methods, some special protections can be used to control access to content distribution networks. For example, if a malicious attack causes a slow response, malicious traffic can be intercepted through frequency control, or regional bans can be implemented to block access requests from designated areas. In addition, the edge Web application firewall (WAF) capabilities can be combined to identify malicious features and protect business traffic.

[0074] The following five access control strategies are mainly provided in the embodiments of this application:

[0075] 1) IP blacklist and whitelist: By configuring IP blacklist and whitelist, user requests can be filtered, and access from specific IP addresses can be blocked or allowed, thereby limiting the access source and preventing malicious fraud and attacks. The blacklist and whitelist configuration can be made hot effective through the Openresty-lua module.

[0076] 2) Request header authentication: The service consumer carries an authentication header in the request header. The CDN edge node verifies the header information. If the verification passes, the cached resource is returned. If the verification fails, the request fails.

[0077] 3) Chain authentication: Control the access rights of resources by setting signatures and coordinating the expiration time of signatures. The origin station constrains the authentication key and encryption rules in the CDN, and the origin server provides the signed URL, and the business server of the CDN edge node provides the verification service.

[0078] 4) Back-to-source authentication: After receiving the request, the edge node initiates an HTTP callback request to the origin authentication server, which performs authentication. The origin authentication server returns the authentication result to the edge node. If the authentication passes, the request is released; otherwise, access is denied.

[0079] 5) Redirection authentication: After receiving the access request, the CDN edge node forwards the request to the origin authentication server for request authentication. If the origin authentication server passes the authentication, the request is forwarded to the edge node through NGINX internal redirection for resource access; if the authentication fails, access is denied.

[0080] On the basis of the above, two-layer access control is performed on the user side, and a variety of different authentication methods can be flexibly adopted to suit different application scenarios, ensuring that each business can use access control services that meet its own resource characteristics and needs, and flexibly realize customized authentication needs; different businesses can be configured and managed separately, and can have independent access control methods without affecting each other. Among them, the address list is hot-effective, and there is no need to reload frequently, which provides support for the system's automated operation and maintenance security.

[0081] The access control method of the embodiment of the present application includes IP black and white lists, anti-hotlink authentication, back-to-source authentication, request header authentication and internal redirect authentication. On this basis, the business party accessing the CDN can select a suitable authentication method according to its own product characteristics to customize access control. In the implementation process, after the CDN edge node receives the user request, it can first identify and filter the visitor's identity according to the address list to meet the requirements of only some IP users being able to access, or specific user IPs not being allowed to access; for the user end that needs authentication, it can be authenticated according to the authentication method configured by the business party on the CDN platform. The authentication method can be any one of anti-hotlink authentication, request header authentication, back-to-source authentication and internal redirect authentication, which can be freely configured according to business needs. Then the edge node responds to the user request according to the authentication result, or rejects illegal content acquisition requests, to achieve flexible and reliable access control and improve the security of edge node data access.

[0082] Figure 5 A schematic diagram of the structure of an access control device provided in an embodiment of the present application. The access control device provided in this embodiment includes:

[0083] The receiving module 210 is used to receive an access request, wherein the access request includes an address of a user terminal;

[0084] An authentication module 220 is used to authenticate the user terminal according to a preset authentication method to obtain an authentication result if it is determined to authenticate the user terminal according to the address list, wherein the address list is used to indicate the addresses of the user terminals that need to be authenticated and / or do not need to be authenticated;

[0085] The processing module 230 is used to process the access request according to the authentication result.

[0086] The device uses a neural network model to predetermine the encoding parameters corresponding to different complexity levels, and selects appropriate target encoding parameters according to the complexity level during the encoding process to improve the quality and efficiency of access control.

[0087] Optionally, the device further comprises:

[0088] A list acquisition module, used to acquire an address list from a content distribution network server and save the address list;

[0089] The list mapping module maps the configuration information of the address list into variables of the website and the proxy server.

[0090] Optionally, the preset authentication method includes request header authentication; the access request carries request header authentication information;

[0091] The authentication module 220 is specifically used for:

[0092] Obtain key information issued by the content distribution network server;

[0093] The request header authentication information is authenticated according to the key information to obtain an authentication result.

[0094] Optionally, the preset authentication method includes anti-hotlink authentication; the access request carries a link with authentication parameters, the link is provided to the user terminal by the content distribution network server, the authentication parameters include the link validity period and a signature, and the signature is generated according to the agreed key, file path and link validity period;

[0095] The authentication module 220 is specifically used to authenticate the validity of the link and the correctness of the signature to obtain an authentication result.

[0096] Optionally, the preset authentication method includes back-to-source authentication;

[0097] The authentication module 220 is specifically used for:

[0098] Sending a callback request to a content distribution network server so that the content distribution network server authenticates the user terminal;

[0099] Receive the authentication result returned by the content distribution network server.

[0100] Optionally, the preset authentication method includes internal redirection authentication;

[0101] The authentication module 220 is specifically used for:

[0102] adding an authentication tag to the access request and forwarding the access request to a content distribution network server;

[0103] Receive the authentication result returned by the content distribution network server.

[0104] Processing the access request according to the authentication result includes:

[0105] If the authentication is successful, the access request is internally redirected to the internal response block of the edge node, so that the internal response block completes resource distribution.

[0106] The access control device provided in the embodiments of the present application can be used to execute the access control method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0107] Figure 6 A schematic diagram of an edge node 10 that can be used to implement an embodiment of the present application is shown. The edge node 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0108] like Figure 6 As shown, the edge node 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the edge node 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0109] Multiple components in the edge node 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the edge node 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, wireless networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above.

[0111] In some embodiments, the method of the above embodiment may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the edge node 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform any of the above embodiment methods in any other appropriate manner (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow charts and / or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein may be implemented on an edge node 10 having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the edge node 10. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0117] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0118] An embodiment of the present application further provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the access control method as described in any of the above embodiments.

[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0120] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. An access control method, characterized in that: Applied to an edge node, the method comprises: receiving an access request, wherein the access request includes an address of a user terminal; If it is determined to authenticate the user terminal according to the address list, the user terminal is authenticated according to a preset authentication method to obtain an authentication result, wherein the address list is used to indicate the addresses of the user terminals that need to be authenticated and / or do not need to be authenticated; The access request is processed according to the authentication result.

2. The method according to claim 1, characterized in that: Also includes: Obtaining an address list from a content distribution network server and storing the address list; The configuration information of the address list is mapped to variables of the website and the proxy server.

3. The method according to claim 1, characterized in that The preset authentication method includes request header authentication; the access request carries request header authentication information; The step of authenticating the user terminal according to a preset authentication method to obtain an authentication result includes: Obtain key information issued by the content distribution network server; The request header authentication information is authenticated according to the key information to obtain an authentication result.

4. The method according to claim 1, characterized in that: The preset authentication method includes anti-hotlink authentication; the access request carries a link with authentication parameters, the link is provided to the user terminal by the content distribution network server, the authentication parameters include the link validity period and the signature, and the signature is generated according to the agreed key, the file path and the link validity period; The step of authenticating the user terminal according to a preset authentication method to obtain an authentication result includes: The validity of the link and the correctness of the signature are authenticated to obtain an authentication result.

5. The method according to claim 1, characterized in that The preset authentication method includes back-to-source authentication; The step of authenticating the user terminal according to a preset authentication method to obtain an authentication result includes: Sending a callback request to a content distribution network server so that the content distribution network server authenticates the user terminal; Receive the authentication result returned by the content distribution network server.

6. The method according to claim 1, characterized in that The preset authentication method includes internal redirection authentication; The step of authenticating the user terminal according to a preset authentication method to obtain an authentication result includes: adding an authentication tag to the access request and forwarding the access request to a content distribution network server; Receiving the authentication result returned by the content distribution network server; Processing the access request according to the authentication result includes: If the authentication is successful, the access request is internally redirected to the internal response block of the edge node, so that the internal response block completes resource distribution.

7. An access control device, characterized in that: include: A receiving module, used for receiving an access request, wherein the access request includes an address of a user terminal; an authentication module, configured to authenticate the user terminal according to a preset authentication method to obtain an authentication result if it is determined to authenticate the user terminal according to the address list, wherein the address list is used to indicate the addresses of the user terminals that need to be authenticated and / or do not need to be authenticated; A processing module is used to process the access request according to the authentication result.

8. An edge node, characterized in that: include: at least one processor; a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the access control method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the access control method as described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or the instructions are executed by a processor, the access control method as described in any one of claims 1 to 6 is implemented.

Images