Service request processing method and device, electronic equipment and readable storage medium

Abstract

The invention provides a service request processing method and device, electronic equipment and a readable storage medium, and the method is applied to a server, and comprises the steps: responding to a target service request sent by a client, obtaining the service request information of the target service request, and obtaining the service request information of the target service request in a preset time period according to a service identifier in the service request information, the method comprises the following steps: sending request times of a service request for accessing a target service based on a source internet interconnection protocol address, then judging whether the target service request is an abnormal request according to the request times, a preset request time threshold, a data packet size and a preset data packet size threshold, and sending the abnormal request to the target service according to a judgment result. And determining the access authority of the client to the target service. According to the method provided by the embodiment, data leakage can be prevented, and the security of service access is improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a service request processing method, device, electronic device and readable storage medium. Background Art

[0002] The user can send a service request to a server or other service-side device through the client. The server performs service access according to the service request, obtains the service access result, and returns the service access result to the client.

[0003] In the related art, when the server receives a service request, it directly performs service access according to the service request and returns the obtained service access result to the client.

[0004] According to the methods of related technologies, it may happen that when the server receives an abnormal business request, it still executes it and returns the access result according to the business request, which may cause illegal users to obtain the access result and cause data leakage. Summary of the invention

[0005] The present application aims to provide a business request processing method, device, electronic device and readable storage medium, which at least solves the problem that the business request processing method in the prior art is prone to data leakage.

[0006] In a first aspect, an embodiment of the present application discloses a service request processing method, which is applied to a server, and the method includes:

[0007] In response to a target service request sent by a client, obtaining service request information of the target service request; the service request information includes: a target service identifier of a target service accessed by the target service request, a source Internet protocol address when the client sends the target service request, and a data packet size corresponding to the target service request;

[0008] According to the service identifier, obtaining the number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period;

[0009] Obtaining a judgment result of whether the target service request is an abnormal request according to the number of requests and the preset number of requests threshold, and the data packet size and the preset data packet size threshold;

[0010] According to the determination result, the access rights of the client to the target service are determined.

[0011] In a second aspect, an embodiment of the present application discloses a service request processing device, which is applied to a server, and the device includes:

[0012] A first acquisition module is used to respond to a service request sent by a client and acquire service request information of the service request; the service request information includes: a target service identifier of a target service accessed by the service request, a source Internet protocol address when the client sends the service request, and a data packet size corresponding to the service request;

[0013] A second acquisition module, configured to acquire, according to the service identifier, a number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period;

[0014] A third acquisition module, used to determine whether the service request is an abnormal request according to the number of requests and a preset request number threshold, and the data packet size and a preset data packet size threshold;

[0015] The first determination module is used to determine the access rights of the client to the target service according to the determination result.

[0016] In a third aspect, an embodiment of the present application further discloses an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0017] In a fourth aspect, an embodiment of the present application further discloses a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0018] In summary, when obtaining a target service request, according to the service identifier of the target service to be accessed by the target service request sent by the client, the number of requests for service requests for accessing the target service based on the source Internet Protocol address within a preset time period is obtained. According to the number of requests and the preset request number threshold, as well as the data packet size and the preset data packet size threshold, it is possible to accurately determine whether the target service request is an abnormal request, and determine the client's access rights to the target service based on the judgment result. Based on the method of this embodiment. Thus, it is possible to avoid abnormal target service requests with abnormal number of requests or abnormal data packet size from accessing the target service, avoid the server from executing abnormal target service requests, and feed back the access results to the client, avoiding the problem of leaking data to illegal clients that perform abnormal service access. This embodiment improves the security of service request processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In the attached picture:

[0020] Figure 1 It is a flowchart of a method for processing a business request provided by an embodiment of the present application;

[0021] Figure 2 is a flowchart of another method for processing a service request provided by an embodiment of the present application;

[0022] Figure 3 This is a flowchart of another method for processing a service request provided by an embodiment of the present application;

[0023] Figure 4 is a block diagram of a service request processing device provided in an embodiment of the present application;

[0024] Figure 5 is a block diagram of an electronic device according to an embodiment of the present application;

[0025] Figure 6 It is a block diagram of an electronic device of another embodiment provided by the embodiments of the present application. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0028] Figure 1 This is a service request processing method provided by this embodiment, which is applied to the server. Figure 1 , the method may include the following steps:

[0029] Step 101: In response to a target service request sent by a client, obtain service request information of the target service request.

[0030] The service request information includes: a target service identifier of a target service accessed by the target service request, a source Internet protocol address, and a data packet size corresponding to the target service request.

[0031] The service request is used to access the target service. The target service identifier of the target service may be the name, number, or other identifier of the target service. The target service may be a service for transmitting and storing data from the client to the server, a service for obtaining data from the server, or other services. The type of the target service is not limited here.

[0032] For example, by parsing the target service request, the service request information in the target service request is obtained. The source Internet Protocol (IP) address is the IP address used by the client when issuing the target service request. The data packet corresponding to the target service request may be a data packet carrying the service request information of the target service request, a data packet that needs to be transmitted to the server for storage, or a data packet including the return result corresponding to the target service.

[0033] The client may be a terminal device, and the server may be an electronic device such as a server. For example, the server allocates a unique business ID (Business Identity Document, Business ID) to each preset business function, wherein the target business is one of the preset businesses and the target business also has its business ID.

[0034] The server can also assign a unique user ID (UserId) to each user account. For example, based on the service ID and user ID, when the client sends a target service request to the server, the server can identify and track the executed target service through the service ID and user ID in the process of executing the corresponding target service according to the target service request, so as to prevent information from being maliciously tampered with or obtained in the business process.

[0035] Step 102: According to the service identifier, the number of service requests for accessing the target service based on the source Internet Protocol address within a preset time period is obtained.

[0036] For example, the server stores the service identifiers of the services accessed by each service request sent from the source IP address within a preset time period.

[0037] When receiving a target service request sent by a client, the number of service identifiers identical to the target service identifier is obtained from the service identifiers of the services stored by the server within a preset time period, and the number of service identifiers identical to the target service identifier is determined as the number of requests for sending service requests for accessing the target service based on the source Internet Protocol address within the preset time period.

[0038] Step 103: Obtain a judgment result of whether the target service request is an abnormal request based on the number of requests and the preset number of requests threshold, as well as the data packet size and the preset data packet size threshold.

[0039] Specifically, the judgment result includes: whether the target service request is a normal request or an abnormal request.

[0040] The preset request number threshold and the preset data packet size threshold can be set according to user needs. For example, if the data security requirement is relatively high, the preset data packet size can be set smaller, otherwise, the preset data packet size can be set larger.

[0041] For example, if the number of requests is greater than or equal to the request number threshold, or the data packet size is greater than or equal to the preset data packet size threshold, the target service request is determined to be an abnormal request; if the number of requests is less than the request number threshold, or the data packet is less than the preset data packet size threshold, the target service request is determined to be a normal request.

[0042] Furthermore, the time when the client sends the service request can be obtained, and whether the target service request is an abnormal request can be determined based on the number of requests and the preset request number threshold, the data packet size and the preset data packet size threshold, as well as the sending time and the preset time period.

[0043] Specifically, if the number of requests is greater than or equal to the request number threshold, or the data packet size is greater than or equal to the preset data packet size threshold, or the sending time is outside the preset time period, the target service request is determined to be an abnormal request. If the number of requests is less than the request number threshold, and the data packet size is less than the preset data packet size threshold, and the sending time is within the preset time period, the target service request is determined to be an abnormal request, and the target service request is determined to be a normal request.

[0044] Step 104: Determine the access rights of the client to the target service according to the determination result.

[0045] The judgment result includes: the target service request is a normal request, or the target service request is an abnormal request. If the judgment result is that the target service request is a normal request, it is determined that the client has access rights to the target service; if the judgment result is that the target service request is an abnormal request, it is determined that the client does not have access rights to the target service.

[0046] In one embodiment, the service request information also includes the client's identity authentication information, such as the account and password information for logging into the client and sending the target service request through the client. The server authenticates the client according to the client's identity authentication information and obtains an authentication result.

[0047] Furthermore, the server side obtains the identity authentication information in the service request information, as well as the target service identifier, source IP address, and data packet size corresponding to the target service request of the target service accessed by the target service request in response to the target service request sent by the client side. The identity authentication result is obtained based on the identity authentication information, and the judgment result of whether the target service request is an abnormal request is obtained based on the target service identifier, source IP address, and data packet size. The access rights of the client to the target service are determined based on the identity authentication result and the judgment result of whether the target service request is an abnormal request.

[0048] For example, when the identity authentication result is that the identity authentication is passed and the judgment result is that the target business request is a normal request, it is determined that the client has access rights to the target business; when the identity authentication result is that the identity authentication is failed, or the judgment result is that the target business request is an abnormal request, it is determined that the client does not have access rights to the target business.

[0049] By combining the identity authentication result and the judgment result of whether the target business request is an abnormal request, a double judgment is made on the target business request. This can prevent illegal users from stealing the account and password information of legitimate users, logging in to the client with the account and password information, and sending the target business request from the client. The server directly executes the target business request, which causes the target business data leakage, thereby improving the security of business access.

[0050] For example, when the number of requests is greater than or equal to a preset request number threshold, and / or the data packet size is greater than or equal to a preset data packet size threshold, the target service request is determined to be an abnormal request, and it is determined that the client has access rights to access the target service. If the number of requests is less than the preset request number threshold, and the data packet size is less than the preset data packet size threshold, the target service request is determined to be a normal request, and it is determined that the client does not have access rights to access the target service. Based on this embodiment, legitimate users can be prevented from sending abnormal requests through the client, and access to the target service based on abnormal requests can avoid leakage of target service data, thereby improving the security of service access.

[0051] For example, the server stores data that can only be accessed by registered legitimate users. These data can be product development data, copyrighted books and journals, etc. If an illegal user obtains the identity information of a legitimate user, and based on the identity information of the legitimate user, frequently sends target business requests to the server for obtaining these data, the server can determine the client's access rights based on the number of business requests for data calls within a preset time period and the data packet size of the data to be called by the target business request. If the number of requests is too large or the data packet size is too large, the client will not be granted the right to retrieve the data, so as to avoid data leakage and improve the business access security in this application scenario.

[0052] In this embodiment, when obtaining a target service request, the number of requests for service requests for accessing the target service based on the source Internet Protocol address is obtained according to the service identifier of the target service to be accessed by the target service request sent by the client within a preset time period. According to the number of requests and the preset request number threshold, as well as the data packet size and the preset data packet size threshold, it is possible to accurately determine whether the target service request is an abnormal request, and determine the client's access rights to the target service according to the judgment result. Based on the method of this embodiment. Thus, it is possible to avoid abnormal target service requests with abnormal number of requests or abnormal data packet size from accessing the target service, avoid the server from executing abnormal target service requests, and feed back the access results to the client, avoiding the problem of data leakage to illegal clients that perform abnormal service access. This embodiment improves the security of service request processing.

[0053] In one embodiment, referring to Figure 2 , the method may include the following steps:

[0054] Step 201: In response to a target service request sent by a client, obtain service request information of the target service request.

[0055] The service request information includes: a target service identifier of a target service accessed by the target service request, a source Internet protocol address, and a data packet size corresponding to the target service request.

[0056] Step 202: According to the service identifier, the number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period is obtained.

[0057] The method of this step has been described in the aforementioned step 102 and will not be repeated here.

[0058] Step 203 , judging whether the target service request is an abnormal request according to the number of requests and the preset number of requests threshold, as well as the data packet size and the preset data packet size threshold.

[0059] For example, step 203 may include the following sub-steps:

[0060] Step 2031: If the number of requests is greater than or equal to a preset number of requests threshold, and / or the data packet size is greater than or equal to a preset data packet size threshold, it is determined that the target service request is an abnormal request.

[0061] If the number of requests is greater than or equal to the preset request number threshold, it means that the target service requests sent from the source IP to access the target service are too frequent and the target service requests are abnormal requests.

[0062] If the data packet size is greater than or equal to the preset data packet size threshold, it means that the data packet corresponding to the target service request is too large and the target service request is an abnormal request.

[0063] For example, the sending time when the client sends the target service request may also be obtained to determine whether the sending time is outside the preset time period.

[0064] If the target service request meets any of the following conditions, the target service request is determined to be an abnormal request: the number of requests is greater than or equal to the preset request number threshold, the data packet size is greater than or equal to the preset data packet size threshold, and the sending time is outside the preset time period.

[0065] If the target service request satisfies all of the following conditions at the same time, the target service request is determined to be a normal request: the number of requests is less than the preset request number threshold, the data packet size is less than the preset data packet size threshold, and the sending time is within the preset time period.

[0066] The preset time period may be a time period set by a user. For example, the preset time period is the working hours on weekdays, for example, the preset time period is from 9 am to 6 pm from Monday to Friday, and a target service request sent outside the time period is an abnormal request.

[0067] Step 2032: If the number of requests is less than the preset request number threshold, and the data packet size is less than the preset data packet size threshold, it is determined that the target service request is a normal request.

[0068] If the number of requests is less than the preset request number threshold, and the data packet size is less than the preset data packet size threshold, it means that the target service request sent from the source IP to access the target service is not frequent, and the data packet size of the data packet corresponding to the target service request is not abnormal. In this case, the target service request is determined to be a normal request.

[0069] The service request information also includes: when the client sends a target service request based on the source Internet Protocol address, the authority level corresponding to the source Internet Protocol address.

[0070] For example, an initial permission level is assigned to the source IP address based on the user's trust in the source IP address. When a service request is sent to the server for the first time based on the source IP address, the permission level corresponding to the source IP address is the initial permission level. When a service request is subsequently sent based on the source IP address, the permission level of the source IP address when sending the service request is gradually adjusted according to the method of steps 204 to 205 to obtain a new permission level, and the service request is processed according to the new permission level.

[0071] Step 204, obtaining the abnormal number of abnormal service requests sent from the source Internet Protocol address within a preset time period.

[0072] For example, each time the server receives a service request sent from a source IP address, it determines whether the service request is an abnormal request. If so, it records the abnormal request and accumulates the number of abnormal requests.

[0073] The method for determining abnormal service requests may refer to the description of step 2031 and will not be described in detail here.

[0074] Step 205: If the number of exceptions is greater than or equal to the first preset exception number threshold, the authority level is lowered to obtain a new authority level.

[0075] If the number of exceptions is greater than or equal to the first preset exception number threshold, it means that the number of abnormal requests sent from the source IP address is too large, and the trustworthiness of the source IP address is low, and its permission level is reduced to confirm the access rights of the target business through the reduced permission level. In this way, the server can be prevented from executing the target business request sent by the untrustworthy source IP address, avoiding the problem of data leakage.

[0076] Step 206: If the target service request is an abnormal request and / or the new permission level is lower than the permission level threshold set for the target service, it is determined that the client does not have the access rights to access the target service.

[0077] The new permission level is lower than the permission level threshold set for the target business, indicating that the new permission level does not meet the permission level requirements of the target business. Therefore, it is determined that the client does not have the access rights to access the target business, so as to prevent a business with a low permission level from requesting a target business with a high permission level, thereby causing data leakage of the target business with a high permission level.

[0078] Step 207: If the target service request is an abnormal request, the user privacy information in the service request information is determined based on the preset keyword.

[0079] The keyword is a field used to locate user privacy information. For example, in one embodiment, the WiFi account password of the client when connecting to the Internet is the user privacy information, and the field used to locate the WiFi account password in the target service request can be determined as the keyword in this step.

[0080] For example, the client is a client terminal device installed with application software (Application, APP) for controlling home appliances. When the client communicates with the home appliances through the APP, the communication data is forwarded by the server. The server receives the service request sent by the client and captures the data in the service request through the tracking method.

[0081] In actual applications, due to the limitations of request codes, it is difficult to generate codes for filtering user privacy information for each business request in each application scenario. For example, in some application scenarios, user privacy information is the WiFi account and password when the client is connected to the Internet, and in some application scenarios, user privacy information is the user account and password when the user logs in through the client.

[0082] For example, in the smart home business system, in the application scenario of testing the communication status between the client and the server, the client sends a data packet, and the server receives the data packet and tests it. In this application scenario, the server does not know whether the data packet sent by the client contains WiFi account password data. When the client sends a service request, the WiFi account password data carried will be merged with the data packet and reported to the server without the server knowing. However, in this application scenario, the WiFi account password is data that the server does not need to analyze. If the WiFi account password data is not filtered, the server will store and use the WiFi account password, which may lead to the leakage of user privacy information. In order to avoid this problem, the data reported in the business process between the client and the server can be collected through the buried point technology, and the data set as user privacy information can be filtered.

[0083] Step 208: Filter the user privacy information in the service request information to obtain filtered service request information.

[0084] For example, the extended Berkeley Packet Filter (eBPF) technology can be combined to detect and protect user privacy information. Specifically, the eBPF technology is used to detect the execution process of business requests and the communication of the User Datagram Protocol (UDP) protocol in real time at the kernel level of the operating system.

[0085] Based on eBPF technology, real-time detection code can be inserted into the kernel layer to obtain and analyze network data packets and system calls. The data packets reported by the device are randomly checked by setting parameter conditions, and the set parameter conditions include keywords for determining user privacy information. For example, user privacy information can be detected and filtered for each data packet, or the received data packets can be randomly checked according to the set detection ratio. For example, a random check can be performed once every 100 packets received.

[0086] For example, you can also set keywords or key fields of the information that the server needs to store, and based on the set keywords, filter out the target information from the business request and store it. For example, the data packet uploaded by the device can be data in JSON format. When analyzing and filtering the data packet, you can perform regular matching with the keywords or key fields that the server database originally needs to store to obtain the target information that needs to be stored. For example, keywords can be "name", "phone", etc.

[0087] For example, you can set keywords based on the input anchor point, scan the device reported text or data packets, and capture keywords. For example, according to the input anchor point type, insert the output anchor point, and obtain the output result after the business access is completed. Based on the output result, check whether the entire business flow involves user privacy information.

[0088] Step 209: store the filtered service request information, and generate an abnormal service request log based on the filtered service request information.

[0089] In modern information systems, the protection of user privacy information such as phone numbers and ID card numbers is crucial. For example, in the application scenario of system testing, how to conduct effective business function testing without leaking user privacy information is an urgent problem to be solved. When processing user privacy information according to the system testing method of related technology, there is a risk of information leakage and tampering. In this embodiment, system testing can be performed through eBPF technology to filter out user privacy information, thereby ensuring that user privacy information is effectively protected during the test process to prevent information leakage and tampering.

[0090] In one embodiment, by inserting anchor points in each business function and combining eBPF technology to detect and protect user privacy information in real time, it can be ensured that user privacy information will not be leaked during the entire business implementation process. At the same time, an ID identifier can be set for each business and a UID identifier can be set for each user to prevent malicious tampering or acquisition of user privacy information during business access, thereby improving information security during business access such as system testing, ensuring the security of user privacy information, and solving the problem of protecting user privacy information during system testing.

[0091] Furthermore, when executing the system test service, user privacy information such as phone numbers and ID cards is detected by setting anchor points. Anchor points are inserted into each service function, including input parameter anchor points and output parameter anchor points. The input parameter anchor points and output parameter anchor points are respectively inserted into the code before and after the execution of the service request. This ensures that no information leakage occurs during the execution of the entire service request. Real-time detection through eBPF technology protects service information during UDP communication, so that the entire service information will not be intercepted or tampered with during transmission.

[0092] The input parameter anchor is used to obtain the input parameters of the business request, and the output parameter anchor is used to obtain the output results after the business is executed. By setting the anchor, the user's privacy information can be detected and protected at the key nodes of the business request execution. The inserted anchor can be a custom field that needs to be tested, such as the user's name, mobile phone number, ID card number and other user sensitive information, to avoid leakage of user sensitive information.

[0093] For example, the user's sensitive information can be detected and protected in real time by combining business or code with eBPF technology. Specifically, the execution process of business functions and UDP communication can be detected in real time at the operating system kernel level using eBPF technology. eBPF technology can insert detection code at the kernel layer to obtain and analyze network data packets and system calls to ensure that user privacy information is not intercepted or tampered with during transmission.

[0094] For example, you can insert an output parameter anchor point according to the input parameter anchor point type, obtain the output result after the business execution is completed, and check whether the entire business flow involves user privacy information based on the output result.

[0095] Furthermore, before the service request is executed, the eBPF program can be used to obtain input parameters and perform security checks. After the service request is executed, the eBPF program can be used to obtain output results and perform security checks. During UDP communication, the eBPF program can be used to perform real-time detection of network data packets to ensure the integrity and confidentiality of the data packets.

[0096] Furthermore, business processes can be monitored in real time, and if malicious attacks occur, timely reports and reminders can be made to effectively ensure user information security.

[0097] Step 210: If the target service request is a normal request and the new permission level is higher than or equal to the permission level threshold set for the target service, it is determined that the client has access rights to access the target service.

[0098] The target business request is a normal request, and the new permission level is higher than or equal to the permission level threshold set for the target business, indicating that the permission level of the target business request is high enough and the target business request is a normal request. It is determined that the client has access rights to access the target business, which can ensure that access to the target business is safe, avoid abnormal or low-permission-level business requests from accessing high-permission-level target businesses, avoid data leakage of the target business, and improve the data security of the target business.

[0099] Step 211: access the target service according to the service request and obtain the access result of the target service.

[0100] For example, if the target service to be accessed by the service request is a test service of the client system, the system test information in the service request is obtained, the client system is tested according to the system test information, and the test result is returned to the client as a service access result.

[0101] Step 212: Obtain a target data transmission speed for transmitting access results to the client.

[0102] For example, the target data transmission speed may be a fixed value set for the source IP address used when the client sends a service request, or may be obtained by adjusting the set data transmission speed based on historical abnormal data of service requests sent from the source IP.

[0103] For example, step 212 may include the following sub-steps:

[0104] Sub-step 2121, obtaining the initial data transmission speed configured for the source Internet Protocol address when receiving the service request sent by the client.

[0105] The initial data transmission speed can be set according to the credibility of the source IP address and the set initial permission level. For example, the higher the credibility and the higher the initial permission level, the higher the initial data transmission speed is set. Conversely, the lower the initial data transmission speed is set.

[0106] Sub-step 2122, if the abnormal number of abnormal service requests sent from the source Internet Protocol address within the preset time period is greater than or equal to the second preset abnormal number threshold, then reduce the initial data transmission speed to obtain the target data transmission speed.

[0107] If the number of exceptions is greater than or equal to the second preset number of exceptions threshold, it means that the number of exception requests sent from the source IP address is too many and the credibility of the source IP address is low. In this case, the initial data transmission speed is reduced to obtain the target data transmission speed.

[0108] For example, after sub-step 2122, the method further includes:

[0109] Sub-step 2123, using the target data transmission speed to update the initial data transmission speed, so that when a new service request sent by the client is received, a new target data transmission speed is obtained based on the updated initial data transmission speed.

[0110] Specifically, the target data transmission speed is used to replace the initial data transmission speed, and the target data transmission speed is determined as the initial data transmission speed when a new service request is received from the client. Based on the updated initial data transmission speed, refer to the method of sub-steps 2121 to sub-step 2122 to obtain a new target data transmission speed.

[0111] Step 213: based on the target data transmission speed, transmit the access result to the client.

[0112] In this embodiment, when the number of abnormal requests sent from the source IP address is greater than or equal to the first preset abnormal number threshold, the permission level for the source IP address is reduced. When it is determined that the target service request is an abnormal request, or the new permission level is lower than the permission level threshold set for the target service, it is determined that the client does not have the access authority to access the target service, so as to avoid abnormal target service requests or target service requests with low permission levels accessing the target service, resulting in leakage of target service data.

[0113] When determining abnormal requests for target services, user privacy information is quickly determined based on keywords, and the determined user privacy information is filtered from the service request information, and then stored and logs are generated. In this way, abnormal target service requests can be saved for analysis and recording, and user privacy leakage can be avoided.

[0114] If the target service request is a normal request and the new permission level is higher than or equal to the permission level threshold set for the target service, it is determined that the client has the access right to access the target service, thereby ensuring the security of the target service. The target data transmission speed is obtained, and the access result is transmitted based on the target data transmission speed, which can meet the data transmission requirements between the server and the client.

[0115] This embodiment also provides a service request processing method, which is applied to a client and includes:

[0116] A target service request is sent to a server, so that the server can obtain, according to the service identifier, the number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period; based on the number of requests and a preset request number threshold, as well as the data packet size and the preset data packet size threshold, determine whether the target service request is an abnormal request; and based on the judgment result, determine the client's access rights to the target service.

[0117] Among them, the target service identifier of the target service accessed by the target service request, the source Internet protocol address when the client sends the target service request, and the data packet size corresponding to the target service request.

[0118] Based on the method of this embodiment, it is possible to avoid access to the target service by abnormal target service requests with abnormal number of requests or abnormal data packet size, avoid the server from executing abnormal target service requests, and feed back the access results to the client, thereby avoiding the problem of data leakage to illegal clients that perform abnormal service access. This embodiment improves the security of service request processing.

[0119] Reference Figure 3 The service request processing method of this embodiment may further include the following steps:

[0120] Step S1, the server sets the service identifier and the user identifier.

[0121] The server assigns a unique business ID to each business function and a unique user ID to each user. During the execution of business functions, business requests are identified and tracked through business IDs and user IDs, which can prevent information from being maliciously tampered with or obtained during the business process.

[0122] Step S2: The server obtains the network traffic when the client sends a target service request to the server at the kernel level.

[0123] For example, eBPF technology can be used to obtain network traffic data in real time at the kernel level, including but not limited to key information such as IP address, port number, packet size, and transmission protocol. This helps to fully understand the dynamic changes of network traffic and detect potential abnormal traffic in a timely manner.

[0124] Step S3, analyzing the network traffic for sending the target service request.

[0125] For example, a machine learning algorithm may be used to analyze traffic data obtained based on a target service request to identify whether the target service request is an abnormal request.

[0126] For example, by comparing normal traffic characteristics, abnormal behavior can be distinguished.

[0127] For example, a flow limiting rule may be formulated, and based on the flow limiting rule, flow limits may be imposed on abnormal target service requests, or access to the target service may be blocked.

[0128] Specifically, the current limiting rules may include: limiting the access frequency of a specific IP, limiting the amount of data transmission within a specific time period, etc. By implementing current limiting rules, the spread of abnormal traffic can be effectively controlled to prevent it from further affecting the system.

[0129] Step S4, determine whether the target service request is an abnormal request, if yes, go to step S5, otherwise return to step S2.

[0130] For example, the abnormal request may include at least one of the following: sending data packets to the server at a high frequency, abnormal data packet size, sending service requests during an abnormal data transmission period, etc.

[0131] If the target service request meets any of the above abnormal requests, it is determined to be an abnormal request; otherwise, the target service request is determined to be a normal request.

[0132] Step S5: storing and analyzing data related to the target business request.

[0133] Data can be collected and analyzed for both normal and abnormal business requests, or only for abnormal target business requests.

[0134] Specifically, the IP address, event, behavior, time and other data of the target business request can be obtained and stored for subsequent analysis. Based on the analysis results, the characteristics and rules of abnormal behavior can be further understood to formulate more accurate current limiting strategies based on the characteristics and rules.

[0135] Step S6, based on the analysis result, the data flow and permission level of the data transmitted between the server and the client are controlled.

[0136] The method of flow restriction level control may include: performing flow restriction level control on IP addresses according to the analysis results. For IP addresses that frequently exhibit abnormal behavior, stricter flow restriction measures may be adopted, such as reducing their access rights, limiting their data transmission speed, etc. For IP addresses with normal behavior, their access rights may be maintained or appropriately relaxed to ensure the normal operation of the system.

[0137] Step S7: blocking the target service request sent by the client according to the controlled data flow and permission level.

[0138] After identifying abnormal behavior, it is marked and tracked by business ID and user ID, and blocking measures are taken in time to prevent it from spreading and spreading. At the same time, necessary detection and protection should be carried out for normal behavior to ensure that it is not affected by abnormal behavior. For example, by implementing blocking strategies at the kernel level, abnormal behavior can be effectively isolated to protect the security and stability of the system.

[0139] refer to Figure 4 , which shows a service request processing device 30 provided in an embodiment of the present application, the service request processing device 30 includes:

[0140] The first acquisition module 301 is used to respond to the service request sent by the client and acquire the service request information of the service request; the service request information includes: the target service identifier of the target service accessed by the service request, the source Internet protocol address when the client sends the service request, and the data packet size corresponding to the service request;

[0141] The second acquisition module 302 is used to acquire, according to the service identifier, the number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period;

[0142] The third acquisition module 303 is used to obtain a judgment result of whether the service request is an abnormal request according to the number of requests and the preset request number threshold, and the data packet size and the preset data packet size threshold;

[0143] The first determination module 304 is used to determine the access rights of the client to the target service according to the determination result.

[0144] Optionally, the service request information further includes: when the client sends a target service request based on the source Internet Protocol address, the authority level corresponding to the source Internet Protocol address. The service request processing device also includes:

[0145] A fourth acquisition module, used to acquire an abnormal number of abnormal service requests sent from a source Internet Protocol address within a preset time period;

[0146] A first updating module, configured to reduce the authority level to obtain a new authority level if the number of exceptions is greater than or equal to a first preset threshold of the number of exceptions;

[0147] The first determination module 304 includes:

[0148] The first determination submodule is used to determine that the client does not have access rights to the target service if the target service request is an abnormal request and / or the new permission level is lower than the permission level threshold set for the target service.

[0149] Optionally, the first determining module 304 includes:

[0150] A second determination submodule is used to determine that the client has access rights to access the target service if the target service request is a normal request and the new permission level is higher than or equal to the permission level threshold set for the target service;

[0151] If it is determined that the client has access rights to access the target service, the device 30 further includes:

[0152] A fifth acquisition module is used to access the target business according to the target business request after determining the access rights of the client to the target business according to the judgment result, and obtain the access result of the target business;

[0153] A sixth acquisition module, used to acquire a target data transmission speed for transmitting access results to a client;

[0154] The first transmission module is used to transmit the access result to the client based on the target data transmission speed.

[0155] Optionally, the fifth acquisition module may include:

[0156] An acquisition submodule, used to acquire an initial data transmission speed configured for a source Internet Protocol address when receiving a target service request sent by a client;

[0157] The second updating submodule is used to reduce the initial data transmission speed to obtain the target data transmission speed if the abnormal number of abnormal service requests sent from the source Internet Protocol address within the preset time period is greater than or equal to the second preset abnormal number threshold.

[0158] Optionally, the device 30 further includes:

[0159] The third update submodule is used to update the initial data transmission speed using the target data transmission speed after obtaining the data transmission speed for transmitting the access result to the client, so as to obtain a new target data transmission speed based on the updated initial data transmission speed when receiving a new service request sent by the client.

[0160] Optionally, when the service request information includes user privacy information, the device 30 further includes:

[0161] A second determination module is used to determine the access rights of the client to the target service according to the judgment result, and if the judgment result is that the target service request is an abnormal request, determine the user privacy information in the service request information based on a preset keyword;

[0162] A seventh acquisition module, used to filter the user privacy information in the service request information to obtain the filtered service request information;

[0163] The log generation module is used to store the filtered service request information and generate an abnormal service request log based on the filtered service request information.

[0164] Optionally, the first determination module includes:

[0165] A third determination submodule, configured to determine that the target service request is an abnormal request if the number of requests is greater than or equal to a preset number of requests threshold, and / or the data packet size is greater than or equal to a preset data packet size threshold;

[0166] The fourth determination submodule is used to determine that the target service request is a normal request if the number of requests is less than a preset request number threshold and the data packet size is less than a preset data packet size threshold.

[0167] In this embodiment, it is possible to avoid abnormal target service requests with abnormal number of requests or abnormal data packet size from accessing the target service, avoid the server from executing abnormal target service requests, and feed back the access results to the client, thereby avoiding the problem of data leakage to illegal clients that perform abnormal service access. This embodiment improves the security of service request processing.

[0168] Reference Figure 5 , the electronic device 400 may include one or more of the following components: a processing component 402 , a memory 404 , a power component 406 , a multimedia component 408 , an audio component 410 , an input / output (I / O) interface 412 , a sensor component 414 , and a communication component 416 .

[0169] The processing component 402 generally controls the overall operation of the electronic device 400, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 402 may include one or more modules to facilitate the interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate the interaction between the multimedia component 408 and the processing component 402.

[0170] The memory 404 is used to store various types of data to support the operation of the electronic device 400. Examples of such data include instructions for any application or method operating on the electronic device 400, contact data, phone book data, messages, pictures, multimedia, etc. The memory 404 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0171] The power supply component 406 provides power to the various components of the electronic device 400. The power supply component 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 400.

[0172] The multimedia component 408 includes an interface that provides an output interface between the electronic device 400 and the user. In some embodiments, the interface may include a liquid crystal display (LCD) and a touch panel (TP). If the interface includes a touch panel, the interface may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 408 includes a front camera and / or a rear camera. When the electronic device 400 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0173] The audio component 410 is used to output and / or input audio signals. For example, the audio component 410 includes a microphone (MIC), and when the electronic device 400 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is used to receive an external audio signal. The received audio signal can be further stored in the memory 404 or sent via the communication component 416. In some embodiments, the audio component 410 also includes a speaker for outputting audio signals.

[0174] The input / output I / O interface 412 provides an interface between the processing component 402 and the peripheral interface module, which may be a keyboard, a click wheel, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0175] The sensor assembly 414 includes one or more sensors for providing various aspects of status assessment for the electronic device 400. For example, the sensor assembly 414 can detect the open / closed state of the electronic device 400, the relative positioning of components, such as the display and keypad of the electronic device 400, and the sensor assembly 414 can also detect the position change of the electronic device 400 or a component of the electronic device 400, the presence or absence of user contact with the electronic device 400, the orientation or acceleration / deceleration of the electronic device 400, and the temperature change of the electronic device 400. The sensor assembly 414 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 414 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 414 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0176] The communication component 416 is used to facilitate wired or wireless communication between the electronic device 400 and other devices. The electronic device 400 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 416 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0177] In an exemplary embodiment, the electronic device 400 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to implement a service request processing method provided in an embodiment of the present application.

[0178] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 404 including instructions, and the instructions can be executed by a processor 420 of an electronic device 400 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0179] Figure 6is a block diagram of an electronic device 500 according to another embodiment of the present invention. For example, the electronic device 500 may be provided as a server. Figure 6 The electronic device 500 includes a processing component 522, which further includes one or more processors, and a memory resource represented by a memory 532, for storing instructions that can be executed by the processing component 522, such as an application. The application stored in the memory 532 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 522 is configured to execute instructions to perform a service request processing method provided in an embodiment of the present application.

[0180] The electronic device 500 may also include a power supply component 526 configured to perform power management of the electronic device 500, a wired or wireless network interface 550 configured to connect the electronic device 500 to a network, and an input / output (I / O) interface 558. The electronic device 500 may operate based on an operating system stored in the memory 532, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0181] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0182] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for processing a business request, characterized in that: Applied to the server, the method includes: In response to the target service request sent by the client, obtaining service request information of the target service request; the service request information includes: a target service identifier of the target service accessed by the target service request, a source Internet protocol address, and a data packet size corresponding to the target service request; According to the service identifier, obtaining the number of requests for sending a service request for accessing the target service based on the source Internet Protocol address within a preset time period; Obtaining a judgment result of whether the target service request is an abnormal request according to the number of requests and the preset number of requests threshold, and the data packet size and the preset data packet size threshold; The access rights of the client to the target service are determined according to the determination result.

2. The method according to claim 1, characterized in that: If the service request information further includes: when the client sends the target service request based on the source Internet Protocol address, the permission level corresponding to the source Internet Protocol address, the method further includes: Obtaining an abnormal number of abnormal service requests sent from the source Internet Protocol address within a preset time period; If the number of exceptions is greater than or equal to a first preset threshold number of exceptions, lowering the authority level to obtain a new authority level; Determining the access rights of the client to the target service according to the judgment result includes: If the target service request is an abnormal request, and / or the new permission level is lower than the permission level threshold set for the target service, it is determined that the client does not have the access authority to access the target service.

3. The method according to claim 2, characterized in that Determining the access rights of the client to the target service according to the judgment result includes: If the target service request is a normal request and the new permission level is higher than or equal to the permission level threshold set for the target service, it is determined that the client has the access authority to access the target service; If it is determined that the client has the access right to access the target service, after determining the access right of the client to the target service according to the determination result, the method further includes: Accessing the target service according to the target service request, and obtaining an access result of the target service; Obtaining a target data transmission speed for transmitting access results to the client; Based on the target data transmission speed, the access result is transmitted to the client.

4. The method according to claim 3, characterized in that: Obtaining a target data transmission speed for transmitting access results to the client, including: acquiring an initial data transmission speed configured for the source Internet Protocol address when receiving a target service request sent by the client; If, within the preset time period, the abnormal number of abnormal service requests sent from the source Internet Protocol address is greater than or equal to a second preset abnormal number threshold, the initial data transmission speed is reduced to obtain the target data transmission speed.

5. The method according to claim 4, characterized in that After obtaining the target data transmission speed for transmitting the access result to the client, the method further includes: The target data transmission speed is used to update the initial data transmission speed, so that when a new service request sent by the client is received, a new target data transmission speed is obtained based on the updated initial data transmission speed.

6. The method according to claim 1, characterized in that If the service request information includes user privacy information, after determining the access right of the client to the target service according to the judgment result, the method further includes: If the judgment result is that the target service request is an abnormal request, determining the user privacy information in the service request information based on the preset keyword; Filtering the user privacy information in the service request information to obtain filtered service request information; The filtered service request information is stored, and based on the filtered service request information, an abnormal service request log is generated.

7. The method according to any one of claims 1 to 6, characterized in that The obtaining, according to the number of requests and the preset number of requests threshold, and the data packet size and the preset data packet size threshold, a judgment result of whether the target service request is an abnormal request includes: If the number of requests is greater than or equal to the preset number of requests threshold, and / or the data packet size is greater than or equal to the preset data packet size threshold, then determining that the target service request is an abnormal request; If the number of requests is less than the preset request number threshold, and the data packet size is less than the preset data packet size threshold, it is determined that the target service request is a normal request.

8. A service request processing device, characterized in that: Applied to the server, the device comprises: A first acquisition module is used to respond to a service request sent by a client and acquire service request information of the service request; the service request information includes: a target service identifier of a target service accessed by the service request, a source Internet protocol address, and a data packet size corresponding to the service request; A second acquisition module, configured to acquire, according to the service identifier, a number of service requests for accessing the target service sent based on the source Internet Protocol address within a preset time period; A third acquisition module, used to obtain a judgment result of whether the service request is an abnormal request according to the number of requests and a preset request number threshold, and the data packet size and a preset data packet size threshold; The first determination module is used to determine the access rights of the client to the target service according to the determination result.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images