Control method and device for establishing SSL (Secure Socket Layer) connection, equipment and medium

Abstract

The invention discloses a control method and device for establishing an SSL connection, equipment and a medium, and the method comprises the steps: receiving a request message for establishing the SSL connection sent by a terminal, the request message comprising target network address information and request time; determining target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information based on the request message; if the remaining SSL connection establishment times in the target SSL connection limitation information are smaller than or equal to a set time threshold value and the target duration is smaller than a set duration threshold value, the SSL connection establishment process is ended, and the target duration is the duration between the request time and the time for recently resetting the remaining SSL connection establishment times. According to the method, the SSL connection establishment capability of the target network address information can be limited, the resource consumption is reduced, and the influence on the SSL connection establishment of other network address information in the reverse proxy server is reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security, and in particular to a control method, device, equipment and medium for establishing an SSL connection. Background Art

[0002] The Secure Sockets Layer (SSL) protocol is mainly used for data encryption of web services to ensure the data security of web communications between users and servers. The SSL protocol can be divided into two layers: SSL Record Protocol: It is built on a reliable transmission protocol (such as the Transmission Control Protocol (TCP)) to provide support for basic functions such as data encapsulation, compression, and encryption for high-level protocols. SSL Handshake Protocol: It is built on the SSL Record Protocol and is used for the communication parties to authenticate their identities, negotiate encryption algorithms, and exchange encryption keys before the actual data transmission begins.

[0003] For SSL related services, a reverse proxy server (Nginx) is usually used for reverse proxy. For example, reverse proxy forwarding services such as Hypertext Transfer Protocol Secure (HTTPS) or Hypertext Transfer Protocol (HTTP) or TCP can be performed.

[0004] At present, security vendors usually configure different domain names of multiple different tenants on a single Nginx. Different domain names / TCP ports of different tenants on a single Nginx can share the ability of the entire Nginx to establish SSL connections. If a domain name / TCP port on a certain Nginx is attacked by a large number of requests to establish SSL connections, the ability of the Nginx to establish SSL connections for the domain name / TCP port will be quickly consumed, and the establishment of SSL connections for the domain name / TCP port will consume a lot of resources and affect the establishment of SSL connections for other domain names / TCP ports on the Nginx. Summary of the invention

[0005] The embodiments of the present application provide a control method, device, equipment and medium for establishing an SSL connection, which is used to limit the ability of the target network address information to establish an SSL connection, reduce resource consumption, and reduce the impact on the establishment of SSL connections for other network address information in the reverse proxy server.

[0006] In a first aspect, an embodiment of the present application provides a control method for establishing an SSL connection, including:

[0007] A request message for establishing an SSL connection sent by a receiving terminal, wherein the request message includes target network address information and request time;

[0008] Based on the request message, determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information;

[0009] If the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, the SSL connection establishment process is terminated, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

[0010] In an embodiment of the present application, a request message for establishing an SSL connection is sent by a receiving terminal, and based on the request message, the target SSL connection restriction information corresponding to the target network address information in the request message is determined from the pre-configured SSL connection restriction information; if the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, then it indicates that the number of SSL connection establishment times allowed for the target network address information has been consumed, and therefore, it is necessary to end the SSL connection establishment process to end the request before the most resource-consuming asymmetric encryption calculation stage, that is, by limiting the ability of the target network address information to establish an SSL connection, the rate of establishing an SSL connection for the target network address information is controlled, resource consumption is reduced, and the impact on the establishment of SSL connections for other network address information in the reverse proxy server is reduced.

[0011] In a possible design, after determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information based on the request message, the method further includes:

[0012] If the remaining number of SSL connection establishment times is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishment times is reset, and after the reset is completed, the remaining number of SSL connection establishment times after the reset is updated, and the SSL connection establishment process continues to execute;

[0013] If the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated, and the SSL connection establishment process continues.

[0014] In an embodiment of the present application, if the remaining number of SSL connection establishments is less than or equal to the set number threshold and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishments is greater than the set number threshold and the target duration is greater than or equal to the set duration threshold, it indicates that although the number of times the target network address information allows the establishment of SSL connections may have been consumed, the remaining number of SSL connection establishments has reached the reset time, and therefore, it is necessary to reset the remaining number of SSL connection establishments, and update the remaining number of SSL connection establishments after the reset after the reset, so as to continue to execute the SSL connection establishment process. And, if the remaining number of SSL connection establishments is greater than the set number threshold, and the target duration is less than the set duration threshold, it indicates that the number of times the target network address information allows the establishment of SSL connections has not been consumed, therefore, the remaining number of SSL connection establishments is updated, and the SSL connection establishment process is continued. The present application determines whether to continue to execute the SSL connection establishment process based on the remaining number of SSL connection establishments and the set number threshold, as well as the target duration and the set duration threshold, thereby improving the accuracy of the judgment.

[0015] In one possible design, determining, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information includes:

[0016] Based on the request type of the request message and a set first correspondence relationship, determining a target configuration block corresponding to the request type from a configuration file, wherein the first correspondence relationship is a correspondence relationship between each request type and each configuration block;

[0017] Based on the target network address information and a set second correspondence relationship, determining a service server configuration block corresponding to the target network address information from the target configuration block, wherein the second correspondence relationship is a correspondence relationship between each network address information and each server configuration block, and the server configuration block includes a shared memory area;

[0018] Based on the target network address information and the name of the shared memory area, target SSL connection restriction information is determined from the SSL connection restriction information contained in the shared memory area.

[0019] In an embodiment of the present application, based on the request type of the request message and the set first correspondence, the target configuration block corresponding to the request type is determined from the configuration file, based on the target network address information and the set second correspondence, the server configuration block corresponding to the target network address information is determined from the target configuration block, based on the target network address information and the name of the shared memory area of ​​the server configuration block, the target SSL connection restriction information is determined from the SSL connection restriction information contained in the shared memory area, thereby improving the accuracy of the determined target SSL connection restriction information.

[0020] In a possible design, determining the target SSL connection restriction information from the SSL connection restriction information contained in the shared memory area based on the target network address information and the name of the shared memory area includes:

[0021] Based on the target network address information and the name of the shared memory area, key information is determined, and a hash operation is performed on the key information to obtain a hash value, wherein the key information is used to characterize the attribute characteristics of the required SSL connection restriction information;

[0022] Matching the hash value with the hash value of each hash bucket in the shared memory area respectively to determine a matching hash bucket;

[0023] The key information is matched with each piece of SSL connection restriction information in the matching hash bucket respectively, and the matched SSL connection restriction information is used as the target SSL connection restriction information.

[0024] In an embodiment of the present application, key information is determined based on the target network address information and the name of the shared memory area, and a hash operation is performed on the key information to obtain a hash value, and the hash value is matched with the hash value of each hash bucket in the shared memory area to determine the matching hash bucket, that is, the hash bucket where the required SSL connection restriction information is located, and the key information is matched with each SSL connection restriction information in the matching hash bucket, and the matching SSL connection restriction information is used as the target SSL connection restriction information, thereby improving the accuracy of the determined target SSL connection restriction information.

[0025] In a possible design, after determining the server configuration block corresponding to the target network address information from the target configuration block based on the target network address information and the second correspondence, the method further includes:

[0026] Based on the version number type to which the version number in the request message belongs and the set third correspondence, the shared memory area corresponding to the version number type is determined from the server configuration block, wherein the third correspondence is the correspondence between each version number type and each shared memory area.

[0027] In an embodiment of the present application, based on the version number type to which the version number in the request message belongs and the set third correspondence, the shared memory area corresponding to the version number type is determined from the server configuration block to limit the ability to establish SSL connections for different version number types of the target network address information, thereby more effectively protecting some businesses that are less susceptible to attacks.

[0028] In a second aspect, an embodiment of the present application provides a control device for establishing an SSL connection, including:

[0029] A receiving module, used for receiving a request message for establishing an SSL connection sent by a terminal, wherein the request message includes target network address information and request time;

[0030] A determination module, configured to determine, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information;

[0031] A control module, used to terminate the SSL connection establishment process if the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to a set number threshold, and the target duration is less than a set duration threshold, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

[0032] In a third aspect, the present application provides an electronic device, including:

[0033] A memory for storing program instructions;

[0034] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0036] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0037] The technical effects brought about by the second to fifth aspects and any one of their designs can refer to the technical effects brought about by the corresponding designs in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0039] Figure 2 A schematic diagram of another application scenario provided for an embodiment of the present application;

[0040] Figure 3 A flow chart of a control method for establishing an SSL connection provided in an embodiment of the present application;

[0041] Figure 4 A detailed flow chart of a control method for establishing an SSL connection provided in an embodiment of the present application;

[0042] Figure 5 A flowchart of a method for determining target SSL connection restriction information corresponding to target network address information provided by an embodiment of the present application;

[0043] Figure 6 A flowchart of a method for determining target SSL connection restriction information provided by an embodiment of the present application;

[0044] Figure 7 A flowchart of a control method for establishing an SSL connection for an HTTPS type request message provided in an embodiment of the present application;

[0045] Figure 8 A schematic diagram of a control device for establishing an SSL connection provided in an embodiment of the present application;

[0046] Fig. 9 A flowchart of a control method for establishing an SSL connection for a TCP type request message provided in an embodiment of the present application;

[0047] Fig.10 A schematic diagram of the structure of a control device for establishing an SSL connection provided in an embodiment of the present application;

[0048] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0050] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0051] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0052] Before introducing a control method for establishing an SSL connection provided in an embodiment of the present application, in order to facilitate understanding, the technical background of the embodiment of the present application is first introduced in detail below.

[0053] The SSL protocol is mainly used for data encryption of web services to ensure the data security of web communications between users and servers. The SSL protocol can be divided into two layers: SSL Record Protocol: built on a reliable transmission protocol (such as TCP), providing support for basic functions such as data encapsulation, compression, and encryption for high-level protocols. SSL Handshake Protocol: built on the SSL Record Protocol, used for identity authentication, negotiation of encryption algorithms, and exchange of encryption keys between communicating parties before the actual data transmission begins.

[0054] For SSL-related services, Nginx is usually used as a reverse proxy. For example, reverse proxy forwarding services such as HTTPS, HTTP, or TCP can be performed.

[0055] At present, security vendors usually configure different domain names of multiple different tenants on a single Nginx. Different domain names / TCP ports of different tenants on a single Nginx can share the ability of the entire Nginx to establish SSL connections. If a domain name / TCP port on a certain Nginx is attacked by a large number of requests to establish SSL connections, the ability of the Nginx to establish SSL connections for the domain name / TCP port will be quickly consumed, and the establishment of SSL connections for the domain name / TCP port will consume a lot of resources and affect the establishment of SSL connections for other domain names / TCP ports on the Nginx.

[0056] In order to solve the above problems, the present application proposes a control method, device, equipment and medium for establishing an SSL connection, which is used to limit the ability of the target network address information to establish an SSL connection, reduce resource consumption, and reduce the impact on the establishment of SSL connections for other network address information in the reverse proxy server.

[0057] First reference Figure 1 , which is a schematic diagram of an application scenario of an embodiment of the present application, including a terminal 11 and a server 12. The terminal 11 and the server 12 are connected to each other through a network, and the network can be a local area network, a wide area network, etc. The terminal 11 can be a convenient device (for example: a mobile phone, a tablet, a laptop, etc.), or a personal computer (PC), and the server 12 can be any device that can provide Internet services. The terminal 11 is used to send a request message for establishing an SSL connection to the server 12. The server 12 is used to determine whether to end the SSL connection establishment process based on the request message.

[0058] In the embodiment of the present disclosure, as an optional implementation, the server 12 receives a request message for establishing an SSL connection sent by the terminal 11, wherein the request message includes target network address information and request time; based on the request message, the target SSL connection restriction information corresponding to the target network address information is determined from the pre-configured SSL connection restriction information; if the remaining number of SSL connection establishments in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, then the SSL connection establishment process is terminated, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishments was most recently reset.

[0059] refer to Figure 2, which is another application scenario schematic diagram of an embodiment of the present application, including a terminal 21 and a server 22, wherein the server 22 includes a reverse proxy server 221 and a back-end server 222. Among them, the terminal 21 and the server 22 are connected to each other through a network, and the network can be a local area network, a wide area network, etc. The terminal 21 can be a convenient device (for example: a mobile phone, a tablet, a laptop, etc.), or a personal computer (PC, Personal Computer), and the back-end server 222 can be any device that can provide Internet services. The reverse proxy server 221 can be Nginx, which is a high-performance HTTP and reverse proxy server software that can perform reverse proxy forwarding services such as HTTP / HTTPS / TCP / UDP (User Data Protocol, User Datagram Protocol). The industry usually deploys it on the front side of the application layer. When the business has SSL-related business, it completes SSL unloading and then proxies the request to the back-end server 222. The terminal 21 is used to send a request message to the server 22 to establish an SSL connection. The server 22 is used to determine whether to end the SSL connection establishment process based on the request message.

[0060] In the embodiment of the present disclosure, as an optional implementation, the reverse proxy server 221 receives a request message for establishing an SSL connection sent by the terminal 11, wherein the request message includes a target network address information and a request time; based on the request message, the target SSL connection restriction information corresponding to the target network address information is determined from the pre-configured SSL connection restriction information; if the remaining number of SSL connection establishments in the target SSL connection restriction information is less than or equal to a set number threshold, and the target duration is less than a set duration threshold, then the SSL connection establishment process is terminated, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishments was most recently reset.

[0061] Reference below Figure 3 A flowchart of a control method for establishing an SSL connection is shown to illustrate the technical solution provided by an embodiment of the present application:

[0062] Step 301: Receive a request message for establishing an SSL connection sent by a terminal.

[0063] The request message includes target network address information and request time. The target network address information may be a target domain name, a TCP port information, or other network address information.

[0064] Step 302: Based on the request message, determine the target SSL connection restriction information corresponding to the target network address information from the pre-configured SSL connection restriction information.

[0065] The pre-configured SSL connection restriction information is stored in a configuration file, and the target SSL connection restriction information includes the remaining number of SSL connection establishment times.

[0066] Step 303: If the remaining number of SSL connection establishments in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, the SSL connection establishment process is terminated.

[0067] Among them, the setting number threshold can be set according to actual conditions, for example, the setting number threshold can be 0. The setting duration threshold can be set according to actual conditions, for example, the setting duration threshold can be 1 second. The target duration is the duration between the request time and the time when the remaining SSL connection establishment times were most recently reset. For example, the request time is 2024 / 11 / 11 / 10:00:02, the time when the remaining SSL connection establishment times were first reset is 2024 / 11 / 11 / 9:59:57, and the time when the remaining SSL connection establishment times were second reset is 2024 / 11 / 11 / 10:00:00. Therefore, the time when the remaining SSL connection establishment times were most recently reset is 2024 / 11 / 11 / 10:00:00, that is, the target duration is 2 seconds.

[0068] In the embodiment of the present application, the remaining number of SSL connection establishments is reset according to a set interval duration, wherein the set interval duration may be the same as the set duration threshold. For example, the remaining number of SSL connection establishments is reset every 1 second.

[0069] Optionally, after determining the target SSL connection restriction information corresponding to the target network address information from the pre-configured SSL connection restriction information based on the request message, the method further includes:

[0070] If the remaining number of SSL connection establishments is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishments is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishments is reset, and after the reset is completed, the remaining number of SSL connection establishments after the reset is updated, and the SSL connection establishment process continues;

[0071] If the remaining number of SSL connection establishment times is greater than the set number threshold and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated and the SSL connection establishment process continues.

[0072] In an embodiment of the present application, a request message for establishing an SSL connection is sent by a receiving terminal, and based on the request message, the target SSL connection restriction information corresponding to the target network address information in the request message is determined from the pre-configured SSL connection restriction information; if the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, then it indicates that the number of SSL connection establishment times allowed for the target network address information has been consumed, and therefore, it is necessary to end the SSL connection establishment process to end the request before the most resource-consuming asymmetric encryption calculation stage, that is, by limiting the ability of the target network address information to establish an SSL connection, the rate of establishing an SSL connection for the target network address information is controlled, resource consumption is reduced, and the impact on the establishment of SSL connections for other network address information in the reverse proxy server is reduced.

[0073] The specific steps of the control method for establishing an SSL connection provided above are described in detail below. Figure 4 As shown:

[0074] Step 401: Receive a request message for establishing an SSL connection sent by a terminal.

[0075] Among them, the request message includes the target network address information and the request time. The request message can be a ClientHello message. The ClientHello message refers to the first data packet sent before the SSL connection. The ClientHello message includes information such as the cipher suite (Cipher Suites), a random string (random), a session identifier (Session ID), and an extension service name (Extension server name). The present application can parse the extension service name from the ClientHello information, and parse the target network address information under the service name indication (Server Name Indication, SNI) field from the extension service name.

[0076] SNI is an extension of the Transport Layer Security (TLS) protocol that allows the terminal to tell the server the host name it is trying to connect to during the TLS handshake process. It is very useful for websites that host multiple SSL / TLS certificates on the same IP (Internet Protocol) address, and the server can provide the correct certificate based on the domain name requested by the terminal.

[0077] In the embodiment of the present application, since the request message exists in the form of a connection, it is necessary to convert the connection structure into a pseudo request structure to facilitate subsequent processing.

[0078] Step 402: Based on the request message, determine the target SSL connection restriction information corresponding to the target network address information from the pre-configured SSL connection restriction information.

[0079] Among them, the target SSL connection restriction information includes the remaining number of SSL connection establishment times.

[0080] In the embodiment of the present application, the token bucket algorithm can be used to limit the establishment rate of the SSL connection. Therefore, based on the request message, the target token bucket corresponding to the target network address information is determined from the pre-configured SSL connection restriction information, and the number of tokens in the target token bucket is the remaining number of SSL connection establishments.

[0081] The token bucket algorithm is a commonly used flow control technology, mainly used to limit the request rate of applications or smooth the sending of network data packets. The core idea of ​​the token bucket algorithm is to maintain a "token bucket" in which a certain number of tokens are stored. Whenever a request comes in, a token needs to be taken out of the token bucket to continue processing the request. If there are not enough tokens, the request will be rejected or queued.

[0082] Step 403, determine whether the remaining number of SSL connection establishments is less than or equal to the set number threshold, if so, execute step 404, otherwise, execute step 407.

[0083] Step 404, determine whether the target duration is less than the set duration threshold, if so, execute step 405, otherwise, execute step 406.

[0084] Step 405, ending the SSL connection establishment process.

[0085] Step 406, reset the remaining number of SSL connection establishment times, and after the reset is completed, update the remaining number of SSL connection establishment times after the reset, and continue to execute the SSL connection establishment process.

[0086] Among them, resetting the remaining number of SSL connection establishments refers to resetting the current remaining number of SSL connection establishments to the set initial number of SSL connection establishments. The initial number of SSL connection establishments can be set according to actual conditions. For example, the initial number of SSL connection establishments can be 10. The process of establishing an SSL connection is a prior art and will not be described in detail here.

[0087] Optionally, updating the remaining number of SSL connection establishments after the reset after the reset is completed includes: after the reset is completed, reducing the remaining number of SSL connection establishments after the reset by 1. For example, if the remaining number of SSL connection establishments after the reset is 10, the remaining number of SSL connection establishments after the reset is updated, and the updated remaining number of SSL connection establishments is 9.

[0088] Step 407 , determining whether the target duration is greater than or equal to a set duration threshold, if so, executing step 406 , otherwise, executing step 408 .

[0089] Step 408, update the remaining number of SSL connection establishment times, and continue to execute the SSL connection establishment process.

[0090] Optionally, updating the remaining number of SSL connection establishments includes: reducing the remaining number of SSL connection establishments by 1. For example, if the current remaining number of SSL connection establishments is 8, the remaining number of SSL connection establishments is updated, and the updated remaining number of SSL connection establishments is 7.

[0091] In an embodiment of the present application, based on the request message, the target SSL connection restriction information corresponding to the target network address information is determined from the pre-configured SSL connection restriction information. Figure 5 A flowchart of a method for determining target SSL connection restriction information corresponding to target network address information provided by an embodiment of the present application, such as Figure 5 As shown, the above step 402 at least includes the following steps 501-503:

[0092] Step 501: Based on the request type of the request message and a set first correspondence, determine a target configuration block corresponding to the request type from a configuration file.

[0093] The first corresponding relationship is the corresponding relationship between each request type and each configuration block. The request type of the request message can be an HTTPS type or a TCP type.

[0094] Specifically, if the request type of the request message is HTTPS, the target configuration block corresponding to the HTTPS type is determined from the configuration file to be the http configuration block; if the request type of the request message is TCP, the target configuration block corresponding to the TCP type is determined from the configuration file to be the stream configuration block.

[0095] Step 502: Based on the target network address information and the set second correspondence, determine the server configuration block corresponding to the target network address information from the target configuration block.

[0096] The second correspondence is the correspondence between each network address information and each server configuration block, and the server configuration block includes a shared memory zone. The target network address information can be a target domain name or a target TCP port information. When the request type is HTTPS type, the target network address information is the target domain name. When the request type is TCP type, the target network address information is the target TCP port information.

[0097] Specifically, if the target network address information is the target domain name, the server configuration block corresponding to the target domain name is determined from the http configuration block; if the target network address information is the target TCP port information, the server configuration block corresponding to the target TCP port information is determined from the stream configuration block.

[0098] Step 503: Determine target SSL connection restriction information from the SSL connection restriction information contained in the shared memory area based on the target network address information and the name of the shared memory area.

[0099] The shared memory area includes at least one piece of SSL connection restriction information.

[0100] In the embodiment of the present application, the shared memory area of ​​the server configuration block of the http configuration block is configured by the following two configuration instructions:

[0101] limit_ssl_cps_zone is used to define the shared memory area used for SSL connection restrictions. Because Nginx uses multi-process worker mode, the use of shared memory allows multiple worker processes to share a copy of SSL connection restriction information, thereby maintaining precise control over establishing SSL connections.

[0102] limit_ssl_cps is used to specify the shared memory zone to be used. When used, directly set the shared memory zone name defined in the limit_ssl_cps_zone directive.

[0103] For example, use the limit_ssl_cps_zone and limit_ssl_cps directives to add the SSL connection limit information corresponding to the domain name test1.test.com in the configuration file:

[0104] http{ / / http configuration block;

[0105] server{ / / server configuration block;

[0106] listen 443ssl; / / Listen to port 443;

[0107] server_name test1.test.com; / / Domain name is test1.test.com;

[0108] limit_ssl_cps_zone only_one_key zone=ssl_cps_zone1:32k rate=10r / s; / / define the shared memory zone used for SSL connection limit as ssl_cps_zone1;

[0109] limit_ssl_cps ssl_cps_zone1; / / Specify the shared memory area to be used as ssl_cps_zone1;

[0110] }}

[0111] In the embodiment of the present application, in the http configuration block, under the server configuration block corresponding to the test1.test.com domain name, the limit_ssl_cps_zone and limit_ssl_cps instructions are used to configure the SSL connection limit information of the shared memory zone ssl_cps_zone1. Among them, the size of the shared memory zone ssl_cps_zone1 is 32k (kilobytes), the key information is only_one_key, and the SSL connection limit information is 10r / s (times / second), indicating that the initial remaining SSL connection establishment times are 10 times, and the remaining SSL connection establishment times are reset once every 10 seconds.

[0112] In the embodiment of the present application, the shared memory area of ​​the server configuration block of the stream configuration block is configured through the following two configuration instructions:

[0113] limit_ssl_cps_zone is used to define the shared memory area used for SSL connection restrictions. Because Nginx uses multi-process worker mode, the use of shared memory allows multiple worker processes to share a copy of SSL connection restriction information, thereby maintaining precise control over establishing SSL connections.

[0114] limit_ssl_cps is used to specify the shared memory zone to be used. When used, directly set the shared memory zone name defined in the limit_ssl_cps_zone directive.

[0115] For example, use the limit_ssl_cps_zone and limit_ssl_cps directives to add the SSL connection limit information corresponding to TCP8443 port in the configuration file:

[0116] stream{ / / stream configuration block;

[0117] server{ / / server configuration block;

[0118] listen 8443ssl; / Listen on TCP port 8443;

[0119] limit_ssl_cps_zone only_one_key zone=tcp_ssl_cps_zone1:32k rate=10r / s;

[0120] / / Define the shared memory area used for SSL connection restriction as tcp_ssl_cps_zone1;

[0121] limit_ssl_cps tcp_cps_zone1; / / Specify the shared memory area to be used as tcp_ssl_cps_zone1;

[0122] }}

[0123] In the embodiment of the present application, in the stream configuration block, under the server configuration block corresponding to TCP port 8443, the limit_ssl_cps_zone and limit_ssl_cps instructions are used to configure the SSL connection limit information of the shared memory zone tcp_ssl_cps_zone1. Among them, the size of the shared memory zone tcp_ssl_cps_zone1 is 32k, the key information is only_one_key, and the SSL connection limit information is 10r / s, indicating that the initial remaining SSL connection establishment times are 10 times, and the remaining SSL connection establishment times are reset once every 10 seconds.

[0124] Figure 6 A flowchart of a method for determining target SSL connection restriction information provided by an embodiment of the present application, such as Figure 6 As shown, the above step 503 at least includes the following steps 601-603:

[0125] Step 601, based on the target network address information and the name of the shared memory area, determine the key information, and perform a hash operation on the key information to obtain a hash value.

[0126] The key information may also be referred to as a key (Key), which is used to characterize the attribute characteristics of the required SSL connection restriction information. In the embodiment of the present application, a hash function may be used to perform a hash operation on the key information to obtain a hash value (Value).

[0127] Optionally, based on the target network address information and the name of the shared memory area, determining the key information includes: connecting the target network address information and the name of the shared memory area using a setting symbol to obtain the key information. The setting symbol can be set according to actual conditions, and the setting symbol can be "_". For example, if the target network address information is test.com, and the name of the shared memory area is ssl_cps_zone1, the target network address information and the name of the shared memory area are connected using "_", and the key information obtained is test.com_ssl_cps_zone1.

[0128] In the embodiment of the present application, due to the different request types of the request message, the target network address information is different. Therefore, if the request type of the request message is HTTPS, the key information is determined based on the target domain name of the target network address information and the name of the shared memory area, and the key information is hashed to obtain a hash value. If the request type of the request message is TCP, the key information is determined based on the target TCP port information of the target network address information and the name of the shared memory area, and the key information is hashed to obtain a hash value.

[0129] Step 602: Match the hash value with the hash value of each hash bucket in the shared memory area to determine a matching hash bucket.

[0130] The shared memory area includes at least one hash bucket, which is a basic component unit of a hash table and is used to store key-value pairs with the same hash value.

[0131] Step 603, matching the key information with each piece of SSL connection restriction information in the matching hash bucket, and using the matching SSL connection restriction information as the target SSL connection restriction information.

[0132] In an embodiment of the present application, the server configuration block may only include a shared memory area corresponding to the national encryption type, or may only include a shared memory area corresponding to the international type, or may also include a shared memory area corresponding to the national encryption type and a shared memory area corresponding to the international type.

[0133] At present, it is impossible to limit the ability to establish SSL connections for different versions of target network address information. When the ability to establish SSL connections for different versions of target network address information is attacked to different degrees, it is impossible to ensure the normal use of services with a smaller degree of attack. Therefore, in order to solve the above problem, after determining the server configuration block corresponding to the target network address information from the target configuration block based on the target network address information and the second corresponding relationship, it also includes:

[0134] Based on the version number type to which the version number in the request message belongs and the set third correspondence, a shared memory area corresponding to the version number type is determined from the server configuration block.

[0135] The third corresponding relationship is the corresponding relationship between each version number type and each shared memory area. The version number type can be a national secret type or an international type.

[0136] Specifically, if the version number type of the version number in the request message is a national secret type, the shared memory area corresponding to the national secret type is determined from the server configuration block; if the version number type of the version number in the request message is an international type, the shared memory area corresponding to the international type is determined from the server configuration block.

[0137] For example, use the limit_ssl_cps_zone and limit_ssl_cps directives to add the SSL connection limit information corresponding to the domain name test.com in the configuration file:

[0138] http{ / / http configuration block;

[0139] server{ / / server configuration block;

[0140] listen 443ssl; / / Listen to port 443;

[0141] server_name test.com; / / Domain name is test1.test.com;

[0142] limit_ssl_cps_zone only_one_key zone=ssl_cps_zone1:32k rate=10r / s; / / define the shared memory zone of international type used for SSL connection limit as ssl_cps_zone1;

[0143] limit_ssl_cps ssl_cps_zone1; / / Specify the shared memory area to be used as ssl_cps_zone1;

[0144] limit_ssl_cps_zone only_one_key zone=gm_ssl_cps_zone1:32k rate=10r / s;

[0145] / / Define the shared memory area of ​​national encryption type used for SSL connection restriction as gm_ssl_cps_zone1;

[0146] limit_gm_ssl_cps gm_ssl_cps_zone1 / / Specify the shared memory area to be used as gm_ssl_cps_zone1;

[0147] }}

[0148] In an embodiment of the present application, in the http configuration block, under the server configuration block corresponding to the test.com domain name, the limit_ssl_cps_zone and limit_ssl_cps instructions are used to configure the SSL connection restriction information of the international type shared memory zone ssl_cps_zone1. Among them, the size of the shared memory zone ssl_cps_zone1 is 32k, the key information is only_one_key, and the SSL connection restriction information is 10r / s, indicating that the initial remaining number of SSL connection establishments is 10 times, and the remaining number of SSL connection establishments is reset once every 10 seconds. In addition, in the http configuration block, under the server configuration block corresponding to the test.com domain name, the limit_ssl_cps_zone and limit_ssl_cps instructions are used to configure the SSL connection restriction information of the national secret type shared memory zone gm_ssl_cps_zone1. The size of the shared memory area gm_ssl_cps_zone1 is 32k, the key information is only_one_key, and the SSL connection limit information is 10r / s, which means that the initial remaining number of SSL connection establishments is 10 times, and the remaining number of SSL connection establishments is reset once every 10 seconds.

[0149] Figure 7 A flowchart of a control method for establishing an SSL connection for an HTTPS type request message provided in an embodiment of the present application, such as Figure 7 As shown, at least the following steps 701-713 are included:

[0150] Step 701: Receive a request message of HTTPS type for establishing an SSL connection sent by a terminal.

[0151] Step 702: Determine the http configuration block corresponding to the HTTPS type from the configuration file.

[0152] Step 703: Based on the target domain name in the request message and the set second correspondence, determine the server configuration block corresponding to the target domain name from the http configuration block.

[0153] Step 704: Based on the version number type to which the version number in the request message belongs and the set third corresponding relationship, determine the shared memory area corresponding to the version number type from the server configuration block.

[0154] Step 705: determine key information based on the target domain name and the name of the shared memory area, and perform a hash operation on the key information to obtain a hash value.

[0155] Step 706: Match the hash value with the hash value of each hash bucket in the shared memory area to determine a matching hash bucket.

[0156] Step 707: Match the key information with each piece of SSL connection restriction information in the matching hash bucket, and use the matched SSL connection restriction information as the target SSL connection restriction information.

[0157] Step 708, determine whether the remaining number of SSL connection establishments is less than or equal to the set number threshold, if so, execute step 709, otherwise, execute step 712.

[0158] Step 709 , determine whether the target duration is less than the set duration threshold, if so, execute step 610 , otherwise, execute step 711 .

[0159] The target duration is the duration between the request time of the request message and the time when the remaining number of SSL connection establishment times is most recently reset.

[0160] Step 710, ending the SSL connection establishment process.

[0161] Step 711, reset the remaining number of SSL connection establishment times, and after the reset is completed, update the remaining number of SSL connection establishment times after the reset, and continue to execute the SSL connection establishment process.

[0162] Step 712, determine whether the target duration is greater than or equal to the set duration threshold, if so, execute step 711, otherwise, execute step 713.

[0163] Step 713, update the remaining number of SSL connection establishment times, and continue to execute the SSL connection establishment process.

[0164] Figure 8 A schematic diagram of a control device for establishing an SSL connection provided in an embodiment of the present application, such as Figure 8As shown, the HTTPS SSL connection establishment module receives an HTTPS type request message for establishing an SSL connection sent by the first terminal, extracts the target domain name in the SNI field from the HTTPS type request message, and calls the SNI callback function to enter the HTTPS SSL connection restriction module, wherein the callback function can be the ngx_http_limit_ssl_cps_handler() function. The HTTPSSSL connection restriction module determines the http configuration block corresponding to the HTTPS type from the configuration file; based on the target domain name of the request message and the set second correspondence, determines the server configuration block corresponding to the target domain name from the http configuration block; based on the version number type to which the version number in the request message belongs and the set third correspondence, determines the shared memory area corresponding to the version number type from the server configuration block; based on the target domain name and the name of the shared memory area, determines the key information, and performs a hash operation on the key information to obtain a hash value; locks the shared memory area, matches the hash value with the hash value of each hash bucket in the shared memory area, determines the matching hash bucket, matches the key information with each SSL connection restriction information in the matching hash bucket, and uses the matching SSL connection restriction information as the target SSL connection restriction information; based on the relationship between the remaining SSL connection establishment times of the target SSL connection restriction information and the set times threshold, and the relationship between the target duration and the set duration threshold, determines whether to end the SSL connection establishment process; if so, unlocks the shared memory area, and returns an indication of prohibiting SSL connection establishment to the HTTPS SSL connection establishment module to end the SSL connection establishment process; if not, unlocks the shared memory area, and returns a request to the HTTPS The SSL connection establishment module returns an instruction to continue establishing the SSL connection to continue the SSL connection establishment process.

[0165] Fig. 9 A flowchart of a control method for establishing an SSL connection for a TCP type request message provided in an embodiment of the present application, such as Fig. 9 As shown, at least the following steps 901-913 are included:

[0166] Step 901: receiving a TCP type request message for establishing an SSL connection sent by a terminal.

[0167] Step 902: determine the stream configuration block corresponding to the TCP type from the configuration file.

[0168] Step 903: Based on the target TCP port information in the request message and the set second correspondence, determine the server configuration block corresponding to the target TCP port information from the stream configuration block.

[0169] Step 904: Based on the version number type to which the version number in the request message belongs and the set third corresponding relationship, determine the shared memory area corresponding to the version number type from the server configuration block.

[0170] Step 905, based on the target TCP port information and the name of the shared memory area, determine the key information, and perform a hash operation on the key information to obtain a hash value.

[0171] Step 906: Match the hash value with the hash value of each hash bucket in the shared memory area to determine a matching hash bucket.

[0172] Step 907: Match the key information with each piece of SSL connection restriction information in the matching hash bucket, and use the matched SSL connection restriction information as the target SSL connection restriction information.

[0173] Step 908, determine whether the remaining number of SSL connection establishments is less than or equal to the set number threshold, if so, execute step 909, otherwise, execute step 912.

[0174] Step 909, determine whether the target duration is less than the set duration threshold, if so, execute step 910, otherwise, execute step 911.

[0175] The target duration is the duration between the request time of the request message and the time when the remaining number of SSL connection establishment times is most recently reset.

[0176] Step 910, ending the SSL connection establishment process.

[0177] Step 911, reset the remaining number of SSL connection establishment times, and after the reset is completed, update the remaining number of SSL connection establishment times after the reset, and continue to execute the SSL connection establishment process.

[0178] Step 912, determine whether the target duration is greater than or equal to the set duration threshold, if so, execute step 911, otherwise, execute step 913.

[0179] Step 913, update the remaining number of SSL connection establishment times, and continue to execute the SSL connection establishment process.

[0180] like Figure 8As shown, the TCP SSL connection establishment module receives a TCP type request message for establishing an SSL connection sent by the second terminal, extracts the target TCP port information in the SNI field from the TCP type request message, and calls the SNI callback function to enter the TCP SSL connection restriction module, wherein the callback function can be the ngx_http_limit_ssl_cps_handler() function. The TCP SSL connection restriction module determines the stream configuration block corresponding to the TCP type from the configuration file; determines the server configuration block corresponding to the target TCP port information from the stream configuration block based on the target TCP port information of the request message and the set second correspondence; determines the shared memory area corresponding to the version number type from the server configuration block based on the version number type to which the version number in the request message belongs and the set third correspondence; determines the key information based on the target TCP port information and the name of the shared memory area, and performs a hash operation on the key information to obtain a hash value; locks the shared memory area, matches the hash value with the hash value of each hash bucket in the shared memory area, determines the matching hash bucket, matches the key information with each SSL connection restriction information in the matching hash bucket, and uses the matching SSL connection restriction information as the target SSL connection restriction information; determines whether to end the SSL connection establishment process based on the relationship between the remaining SSL connection establishment times of the target SSL connection restriction information and the set times threshold, and the relationship between the target duration and the set duration threshold; if so, unlocks the shared memory area and sends a request to TCP The SSL connection establishment module returns an instruction to prohibit the establishment of the SSL connection to end the SSL connection establishment process; if not, the shared memory area is unlocked and an instruction to continue to establish the SSL connection is returned to the TCP SSL connection establishment module to continue the SSL connection establishment process.

[0181] Based on the same technical concept, the present application exemplarily provides a control device for establishing an SSL connection, such as Fig.10 As shown, the device comprises:

[0182] The receiving module 101 is used to receive a request message for establishing an SSL connection sent by a terminal, wherein the request message includes target network address information and request time;

[0183] A determination module 102, configured to determine, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information;

[0184] The control module 103 is used to terminate the SSL connection establishment process if the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

[0185] Optionally, after determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information based on the request message, the determination module 102 is further configured to:

[0186] If the remaining number of SSL connection establishment times is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishment times is reset, and after the reset is completed, the remaining number of SSL connection establishment times after the reset is updated, and the SSL connection establishment process continues to execute;

[0187] If the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated, and the SSL connection establishment process continues.

[0188] Optionally, the determining module 102 is used to:

[0189] Based on the request type of the request message and a set first correspondence relationship, determining a target configuration block corresponding to the request type from a configuration file, wherein the first correspondence relationship is a correspondence relationship between each request type and each configuration block;

[0190] Based on the target network address information and a set second correspondence relationship, determining a service server configuration block corresponding to the target network address information from the target configuration block, wherein the second correspondence relationship is a correspondence relationship between each network address information and each server configuration block, and the server configuration block includes a shared memory area;

[0191] Based on the target network address information and the name of the shared memory area, target SSL connection restriction information is determined from the SSL connection restriction information contained in the shared memory area.

[0192] Optionally, the determining module 102 is used to:

[0193] Based on the target network address information and the name of the shared memory area, key information is determined, and a hash operation is performed on the key information to obtain a hash value, wherein the key information is used to characterize the attribute characteristics of the required SSL connection restriction information;

[0194] Matching the hash value with the hash value of each hash bucket in the shared memory area respectively to determine a matching hash bucket;

[0195] The key information is matched with each piece of SSL connection restriction information in the matching hash bucket respectively, and the matched SSL connection restriction information is used as the target SSL connection restriction information.

[0196] Optionally, after determining the server configuration block corresponding to the target network address information from the target configuration block based on the target network address information and the second corresponding relationship, the determining module 102 is further configured to:

[0197] Based on the version number type to which the version number in the request message belongs and the set third correspondence, the shared memory area corresponding to the version number type is determined from the server configuration block, wherein the third correspondence is the correspondence between each version number type and each shared memory area.

[0198] Based on the same inventive concept, the embodiment of the present application provides an electronic device, which can implement the function of the control device for establishing an SSL connection discussed above, please refer to Fig.11 , the device comprises a processor 111 and a memory 112, wherein the memory 112 is used to store program instructions;

[0199] The processor 111 calls the program instructions stored in the memory and executes the program instructions to implement the following steps:

[0200] A request message for establishing an SSL connection sent by a receiving terminal, wherein the request message includes target network address information and request time;

[0201] Based on the request message, determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information;

[0202] If the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, the SSL connection establishment process is terminated, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

[0203] Optionally, after determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information based on the request message, the processor 111 is further configured to execute:

[0204] If the remaining number of SSL connection establishment times is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishment times is reset, and after the reset is completed, the remaining number of SSL connection establishment times after the reset is updated, and the SSL connection establishment process continues to execute;

[0205] If the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated, and the SSL connection establishment process continues.

[0206] Optionally, the determining, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information includes:

[0207] Based on the request type of the request message and a set first correspondence relationship, determining a target configuration block corresponding to the request type from a configuration file, wherein the first correspondence relationship is a correspondence relationship between each request type and each configuration block;

[0208] Based on the target network address information and a set second correspondence relationship, determining a service server configuration block corresponding to the target network address information from the target configuration block, wherein the second correspondence relationship is a correspondence relationship between each network address information and each server configuration block, and the server configuration block includes a shared memory area;

[0209] Based on the target network address information and the name of the shared memory area, target SSL connection restriction information is determined from the SSL connection restriction information contained in the shared memory area.

[0210] Optionally, the determining the target SSL connection restriction information from the SSL connection restriction information contained in the shared memory area based on the target network address information and the name of the shared memory area includes:

[0211] Based on the target network address information and the name of the shared memory area, key information is determined, and a hash operation is performed on the key information to obtain a hash value, wherein the key information is used to characterize the attribute characteristics of the required SSL connection restriction information;

[0212] Matching the hash value with the hash value of each hash bucket in the shared memory area respectively to determine a matching hash bucket;

[0213] The key information is matched with each piece of SSL connection restriction information in the matching hash bucket respectively, and the matched SSL connection restriction information is used as the target SSL connection restriction information.

[0214] Optionally, after determining, based on the target network address information and the second corresponding relationship, a server configuration block corresponding to the target network address information from the target configuration block, the processor 111 is further configured to execute:

[0215] Based on the version number type to which the version number in the request message belongs and the set third correspondence, the shared memory area corresponding to the version number type is determined from the server configuration block, wherein the third correspondence is the correspondence between each version number type and each shared memory area.

[0216] Based on the same inventive concept, the embodiment of the present application provides a computer-readable storage medium, and the computer program product includes: computer program code, when the computer program code is executed on a computer, the computer executes any of the control methods for establishing an SSL connection discussed above. Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the control method for establishing an SSL connection, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0217] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the control methods for establishing an SSL connection discussed above. Since the principle of solving the problem by the above computer program product is similar to the control method for establishing an SSL connection, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0218] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0219] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0220] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0221] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of user-operated steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0222] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A control method for establishing a secure socket layer (SSL) connection, characterized in that: include: A request message for establishing an SSL connection sent by a receiving terminal, wherein the request message includes target network address information and request time; Based on the request message, determining the target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information; If the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to the set number threshold, and the target duration is less than the set duration threshold, the SSL connection establishment process is terminated, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

2. The method according to claim 1, characterized in that After determining the target SSL connection restriction information corresponding to the target network address information from the pre-configured SSL connection restriction information based on the request message, the method further includes: If the remaining number of SSL connection establishment times is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishment times is reset, and after the reset is completed, the remaining number of SSL connection establishment times after the reset is updated, and the SSL connection establishment process continues to execute; If the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated, and the SSL connection establishment process continues.

3. The method according to claim 1, characterized in that The determining, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information includes: Based on the request type of the request message and a set first correspondence relationship, determining a target configuration block corresponding to the request type from a configuration file, wherein the first correspondence relationship is a correspondence relationship between each request type and each configuration block; Based on the target network address information and a set second correspondence relationship, determining a service server configuration block corresponding to the target network address information from the target configuration block, wherein the second correspondence relationship is a correspondence relationship between each network address information and each server configuration block, and the server configuration block includes a shared memory area; Based on the target network address information and the name of the shared memory area, target SSL connection restriction information is determined from the SSL connection restriction information contained in the shared memory area.

4. The method according to claim 3, characterized in that The step of determining target SSL connection restriction information from SSL connection restriction information contained in the shared memory area based on the target network address information and the name of the shared memory area includes: Based on the target network address information and the name of the shared memory area, key information is determined, and a hash operation is performed on the key information to obtain a hash value, wherein the key information is used to characterize the attribute characteristics of the required SSL connection restriction information; Matching the hash value with the hash value of each hash bucket in the shared memory area respectively to determine a matching hash bucket; The key information is matched with each piece of SSL connection restriction information in the matching hash bucket respectively, and the matched SSL connection restriction information is used as the target SSL connection restriction information.

5. The method according to claim 3, characterized in that After determining the server configuration block corresponding to the target network address information from the target configuration block based on the target network address information and the second corresponding relationship, the method further includes: Based on the version number type to which the version number in the request message belongs and the set third correspondence, the shared memory area corresponding to the version number type is determined from the server configuration block, wherein the third correspondence is the correspondence between each version number type and each shared memory area.

6. A control device for establishing an SSL connection, characterized in that: include: A receiving module, used for receiving a request message for establishing an SSL connection sent by a terminal, wherein the request message includes target network address information and request time; A determination module, configured to determine, based on the request message, target SSL connection restriction information corresponding to the target network address information from pre-configured SSL connection restriction information; A control module, used to terminate the SSL connection establishment process if the remaining number of SSL connection establishment times in the target SSL connection restriction information is less than or equal to a set number threshold, and the target duration is less than a set duration threshold, wherein the target duration is the duration between the request time and the time when the remaining number of SSL connection establishment times was most recently reset.

7. The device according to claim 6, characterized in that After determining the target SSL connection restriction information corresponding to the target network address information from the pre-configured SSL connection restriction information based on the request message, the determination module is further used to: If the remaining number of SSL connection establishment times is less than or equal to the set number threshold, and the target duration is greater than or equal to the set duration threshold, or the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is greater than or equal to the set duration threshold, then the remaining number of SSL connection establishment times is reset, and after the reset is completed, the remaining number of SSL connection establishment times after the reset is updated, and the SSL connection establishment process continues to execute; If the remaining number of SSL connection establishment times is greater than the set number threshold, and the target duration is less than the set duration threshold, the remaining number of SSL connection establishment times is updated, and the SSL connection establishment process continues.

8. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods of claims 1-5 according to the obtained program instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 5.

10. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 5.

Images