CDN gateway encryption method and device, equipment and storage medium

Abstract

The invention provides a CDN gateway encryption method and device, equipment and a storage medium, and belongs to the technical field of data processing. The method comprises the following steps: in response to a target request initiated by any client, analyzing and determining security information carried in the target request; sending a sub-request corresponding to the target request to the CDN system, receiving a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypting the first content file to obtain encrypted request content; and sending a main request corresponding to the target request to the CDN system, receiving a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content, and returning a target response comprising the encrypted sequence header, the encrypted request content and the non-encrypted request content to the client. The invention aims to improve the service security.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data processing, and in particular, to an encryption method, apparatus, device and storage medium for a CDN gateway. Background Art

[0002] CDN gateway is combined with content distribution network to achieve efficient content transmission, improve performance and security through technical means such as cache control, content routing, security enhancement, load balancing and content optimization. However, when various manufacturers request CDN gateway to obtain requested content, such as video content, static web pages or game installation packages, they set up various anti-hotlinking, parameter decryption authentication and remote authentication. Once the verification is passed, the corresponding content of the request can be returned. Therefore, how to avoid anti-hotlinking and authentication being cracked or content results being stolen has become an important technical field to enhance the competitiveness of CDN manufacturers. Traditional CDN still has some problems with content results that can be hotlinked and cracked.

[0003] Because the anti-hotlink authentication provided or configured by some customers is too simple, or the anti-hotlink is generated using conventional encryption and decryption methods, there is a risk that the anti-hotlink can be easily hotlinked and cracked, and finally the requested content such as video content, static web pages or game installation packages can be stolen, resulting in low business security. Summary of the invention

[0004] The embodiments of the present application provide an encryption method, apparatus, device and storage medium for a CDN gateway, aiming to improve service security.

[0005] In a first aspect, an embodiment of the present application provides an encryption method for a CDN gateway, which is applied to a CDN gateway of a CDN system. The method includes: In response to a target request initiated by any client, parse and determine security information carried in the target request, the security information including encryption information and encryption interval; Sending a sub-request corresponding to the target request to the CDN system, receiving a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypting the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval; Sending a main request corresponding to the target request to the CDN system, and receiving a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content, wherein the second content file is a content file corresponding to the non-encrypted interval; A target response corresponding to the target request is returned to the client, wherein the target response includes an encrypted sequence header, encrypted request content, and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

[0006] Optionally, in response to a target request initiated by any client, parsing and determining security information carried in the target request includes: In response to a target request initiated by any client, parse the anti-hotlink authentication parameters carried in the target request; Perform anti-hotlink authentication according to the anti-hotlink authentication parameters; When the anti-hotlink authentication fails, an error response is directly returned to the client, and the header of the error response carries a target error code; When the anti-hotlink authentication is successful, the security information carried in the target request is parsed and obtained.

[0007] Optionally, in response to a target request initiated by any client, parsing and determining security information carried in the target request includes: In response to a target request initiated by any client, determining whether the target request carries an encryption interval; When the target request does not carry an encryption interval, a preset default interval is used as the encryption interval in the security information of the target request.

[0008] Optionally, the encryption information includes a key index parameter and an encryption parameter; and according to the encryption information and the encryption interval, the first content file is encrypted to obtain encryption request content, including: According to the key index parameter in the encryption information, determining the encryption key corresponding to the key index parameter in a preset key pool; The encryption dynamic library is called, and according to the encryption key, the encryption parameter and the encryption interval, the first content file executes the encryption strategy to obtain the encryption request content.

[0009] Optionally, executing the encryption policy includes: After compressing and encoding the first content file, a compressed encoding file is obtained; Encrypting the first compressed coded file of the compressed coded file according to the encryption key to obtain a first encrypted file; Encrypting a second compressed coded file of the compressed coded file according to the encryption parameter to obtain a second encrypted file; The first encrypted file and the second encrypted file that are combined are compressed and decoded to obtain encryption request content and an encryption sequence, wherein the encryption sequence includes the encryption interval and the encryption start value.

[0010] Optionally, after obtaining the encrypted request content, the method further includes: In the header filter stage, an encrypted sequence header is generated according to the encrypted sequence.

[0011] Optionally, after receiving the second content file returned by the CDN system in response to the primary request corresponding to the target request as non-encrypted request content, the method further includes: In the body filter stage, the encrypted request content and the non-encrypted request content are merged; The encrypted sequence header, encrypted request content and non-encrypted request content are used as the target response corresponding to the target request.

[0012] In a second aspect, an embodiment of the present application provides an encryption device for a CDN gateway, which is applied to a CDN gateway of a CDN system, and the device includes: A parsing module, configured to respond to a target request initiated by any client, parse and determine security information carried in the target request, wherein the security information includes encryption information and encryption interval; A first request module, configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval; A second request module, configured to send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content; A response module is used to return a target response corresponding to the target request to the client, wherein the target response includes an encrypted sequence header, encrypted request content and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

[0013] In a third aspect, an embodiment of the present application provides a computer device, comprising: at least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein when the processor executes the computer program, the encryption method of the CDN gateway described in the embodiment is executed.

[0014] In a fourth aspect, an embodiment of the present application provides a non-volatile readable storage medium, wherein the non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the encryption method of the CDN gateway described in the embodiment is executed.

[0015] Beneficial effects: In response to a target request initiated by any client, parse and determine security information carried in the target request, the security information including encryption information and encryption interval, send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, encrypt the first content file according to the encryption information and the encryption interval to obtain encrypted request content, send a main request corresponding to the target request to the CDN system, receive a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content, return a target response corresponding to the target request to the client, the target response including an encryption sequence header, encrypted request content and non-encrypted request content, wherein the encryption sequence header represents the encryption interval and encryption start value corresponding to the encrypted request content.

[0016] This method divides the target request into a sub-request and a main request according to the encryption interval in the security information carried in the target request. First, the first content file corresponding to the encryption interval is obtained according to the sub-request, and then encrypted according to the encryption information to obtain the encrypted request content. Then, the second content file corresponding to the non-encrypted interval is obtained according to the main request as the non-encrypted request content. Finally, the encrypted sequence header, the encrypted request content and the non-encrypted request content are used as the target response corresponding to the target request. The encrypted sequence header in the target response can be used by the user to decrypt the encrypted request content, so as to obtain the complete request content, which further improves the security of the content file of the target request, thereby improving the security of the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 This is a flowchart of the steps of the encryption method of the CDN gateway proposed in one embodiment of the present application; Figure 2 is a flowchart of the steps for executing the encryption strategy proposed in one embodiment of the present application; Figure 3 is a schematic diagram of an encryption process and a decryption process provided by an embodiment of the present application; Figure 4 is an execution flow chart of the encryption method of the CDN gateway proposed in one embodiment of the present application; Figure 5It is a schematic diagram of the stage processing of the encryption method of the CDN gateway proposed in one embodiment of the present application; Figure 6 This is a functional module diagram of the encryption device of the CDN gateway proposed in one embodiment of the present application Figure 7 is a schematic diagram of a computer device provided by an embodiment of the present application; Figure 8 It is a schematic diagram of a non-volatile readable storage medium proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] CDN: Content Delivery Network, a layer of intelligent virtual network based on the existing Internet, which is formed by placing node servers in various places on the network. The CDN system can redirect user requests to the service node closest to the user in real time based on comprehensive information such as network traffic and the connection and load status of each node, as well as the distance to the user and response time. Its purpose is to enable users to obtain the required content nearby, solve the problem of network congestion, and improve the response speed of users visiting websites. Gateway is also called network connector or protocol converter. It realizes network interconnection above the network layer. It is a complex network interconnection device and is only used for interconnection between two networks with different high-level protocols. URL: uniform resource locator, uniform resource locator system; OpenResty: OpenResty is a high-performance Web platform based on Nginx. It can easily build dynamic Web applications, Web services, and dynamic gateways that handle ultra-high concurrency. OpenResty integrates Lua / LuaJIT into Nginx by implementing Nginx modules such as ngx_lua and stream_lua. Therefore, Lua scripts can be embedded in Nginx, and complex HTTP / TCP / UDP business logic can be implemented in Lua language, while still maintaining a high degree of concurrent service capabilities. Rewrite phase: A request in OpenResty begins the rewrite phase, which is responsible for parsing request parameters, rewriting parameters, and URL redirection. Access phase: An access permission check phase in OpenResty. The standard module ngx_access, the third-party module ngx_auth_request, and the access_by_lua instruction of the third-party module ngx_lua are run in this phase. Configuration instructions are mostly used to perform access control related tasks, such as checking the user's access permissions and checking whether the user's source IP is legal; Header filter stage: a response header processing stage in OpenResty, responsible for adding, modifying, and filtering response headers; Body filter phase: A response body processing phase in OpenResty, responsible for handling response body splicing and filtering operations.

[0021] CDN gateways are combined with content distribution networks (CDNs) to achieve efficient content transmission, improved performance and security through technical means such as cache control, content routing, security enhancement, load balancing and content optimization. Through close integration with CDNs, gateways can intelligently set cache headers, such as Cache-Control and Expires, to guide CDNs on how to cache and update content; this refined cache strategy not only greatly improves the content transmission speed, but also significantly reduces the load on the source server, allowing websites to easily cope with high concurrent access.

[0022] However, currently, when various manufacturers request CDN gateways to obtain requested content, such as video content, static web pages or game installation packages, they all set up various anti-hotlinking, parameter decryption authentication and remote authentication. Once the verification is passed, the corresponding content of the request can be returned. Therefore, how to prevent anti-hotlinking and authentication from being cracked or content results from being stolen has become an important technical field to enhance the competitiveness of CDN manufacturers. However, traditional CDNs still have some problems with content results that can be hotlinked and cracked.

[0023] The anti-hotlink authentication provided or configured by some customers is too simple, or the anti-hotlink is generated using conventional encryption and decryption methods, which poses a risk of the anti-hotlink being easily hotlinked and cracked, ultimately leading to the theft of requested content such as video content, static web pages, or game installation packages, resulting in low business security.

[0024] Therefore, in order to improve business security, an embodiment of the present application provides an encryption method for a CDN gateway.

[0025] Reference Figure 1 , shows a flowchart of a CDN gateway encryption method in an embodiment of the present application, the method can be applied to a CDN gateway of a CDN system, and the method can specifically include the following steps: S101: In response to a target request initiated by any client, parse and determine security information carried in the target request, where the security information includes encryption information and an encryption interval.

[0026] The CDN system can provide services for different customers, and different customers can configure the security policy corresponding to the request URL according to their own needs, thereby improving the security of the customer's own business. For any customer's business service, the target request of its client may include request content such as video content, web page content, and any installation package, etc. The scope of the target request can be customized according to the needs of the actual application, and this embodiment does not impose any restrictions.

[0027] In this embodiment, the target request of any client can carry security information. When the CDN gateway responds to the target request initiated by any client, it can parse the security information in the target request. The security information includes the encryption information and encryption interval agreed upon by the customer and the CDN manufacturer. The encryption information is used to encrypt the request content, and the encryption interval is used to specify the location and length of the request content that needs to be encrypted.

[0028] For example, the encryption interval can be from the starting position 0 to a of the request content, or it can be the range of ab. For example, for a request content of 100M, the encryption interval can be used to specify the encryption of the request content in the range of 0-10M, or the encryption interval can be used to specify the encryption of the request content in the range of 10M-20M, or the encryption interval can be used to specify the encryption of the request content in the range of 0-10M and 15M-20M. The encryption interval can be set according to the needs of the actual application.

[0029] In a feasible implementation, the target request can be firstly authenticated against hotlinks. Specifically, in response to a target request initiated by any client, the anti-hotlink authentication parameters carried in the target request are first parsed, and then anti-hotlink authentication is performed based on the anti-hotlink authentication parameters. The anti-hotlink authentication parameters are used to perform entry verification on the URL of the target request.

[0030] When the anti-hotlink authentication fails, an error response is directly returned to the client. The header of the error response carries a target error code, and the returned target error code can be configured and defined by the client; that is, if the anti-hotlink authentication fails, the subsequent encryption process is no longer performed on the target request.

[0031] When the anti-hotlink authentication is successful, further analysis is performed to obtain the security information carried in the target request.

[0032] And in the process of parsing and determining the security information carried in the target request, it can respond to the target request initiated by any client, first determine whether the target request carries an encryption interval, that is, determine whether the target request carries a specified encryption interval. If the target request does not carry an encryption interval, the preset default interval is used as the encryption interval in the security information of the target request; the default interval can be an encryption interval agreed upon by the customer and the CDN manufacturer, and the encryption interval carried in the target request has a higher priority than the preset default interval. The default interval can be set according to the needs of the actual application. For example, corresponding default intervals can be set for different types of requests.

[0033] S102: Sending a sub-request corresponding to the target request to the CDN system, receiving a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypting the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval.

[0034] Specifically, the content file corresponding to the target request can be divided into two parts according to the encryption interval, one part is the first content file corresponding to the encryption interval, and the other part is the second content file corresponding to the non-encryption interval. The CDN gateway can generate a sub-request for requesting the first content file and send the sub-request to the CDN system. The CDN system returns the first content file after responding to the sub-request.

[0035] In the actual implementation process, the encryption information in the security information can be an encryption key or a key index parameter. The customer and the CDN manufacturer agree to preset a key pool. According to the key index parameter carried in the security information of the current target parameter, the key corresponding to the key index parameter is matched in the preset key pool as the encryption key. In the actual implementation process, for the client's request for the same request content, the key index parameters can be different or the same.

[0036] In a feasible implementation manner, the encryption information may include a key index parameter and an encryption parameter. The first content file is encrypted according to the encryption information and the encryption interval, and a process of obtaining the encrypted request content includes the following steps: A1: According to the key index parameter in the encryption information, determine the encryption key corresponding to the key index parameter in a preset key pool.

[0037] When the encryption information includes a key index parameter, the encryption key corresponding to the key index parameter is obtained from a preset key pool. The key pool includes multiple keys, each of which has a unique key index parameter. In the actual implementation process, customers and CDN manufacturers can update the preset key pool.

[0038] A2: calling the encryption dynamic library, and executing the encryption strategy on the first content file according to the encryption key, the encryption parameter and the encryption interval to obtain the encryption request content.

[0039] The encryption dynamic library can be provided by the customer, that is, the content of the encryption policy executed by the customer. In the actual implementation process, the customer can specify different encryption dynamic libraries according to different types of requests. The encryption method of the encryption policy adopted by any encryption dynamic library can also be customized according to the needs of the actual application, thereby improving the flexibility of encryption.

[0040] When the customer does not provide an encrypted dynamic library, the default encrypted dynamic library of the CDN gateway is used.

[0041] Reference Figure 2 , shows a flowchart of the steps of executing the encryption strategy provided by an embodiment of the present application. In a feasible implementation, executing the encryption strategy includes the following steps: B1: After compressing and encoding the first content file, a compressed encoding file is obtained.

[0042] B2: Encrypt the first compressed coded file of the compressed coded file according to the encryption key to obtain a first encrypted file.

[0043] B3: Encrypt the second compressed coded file of the compressed coded file according to the encryption parameter to obtain a second encrypted file.

[0044] B3: compress and decode the merged first encrypted file and second encrypted file to obtain encryption request content and encryption sequence.

[0045] In this implementation, double encryption is performed by using both an encryption key and encryption parameters specified by the target request, thereby further improving the security of encryption.

[0046] S103: Sending a main request corresponding to the target request to the CDN system, and receiving a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content, wherein the second content file is a content file corresponding to the non-encrypted interval.

[0047] The main request is used to request the remaining requested content, namely the second content file. For example, the requested content size is 100M. Assuming the encryption interval is 0-10M, the size of the first content file corresponding to the sub-request is 0-10M, and the size of the second content file corresponding to the main request is 11-100M.

[0048] S104: Return a target response corresponding to the target request to the client, wherein the target response includes an encrypted sequence header, encrypted request content, and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

[0049] After the first content file is encrypted, an encrypted sequence header is generated according to the encrypted sequence in the header filter stage, and the encrypted request content and the non-encrypted request content are merged in the body filter stage; the encrypted sequence header, the encrypted request content and the non-encrypted request content are used as the target response corresponding to the target request.

[0050] After the client corresponding to the target request receives the target response, it can decrypt the encrypted request content according to the encryption sequence header in the target response, and the decrypted first content file and the non-encrypted request content are combined to become the request content corresponding to the target request.

[0051] Reference Figure 3 , showing a schematic diagram of the encryption process and decryption process provided by an embodiment of the present application. In the encryption process of the CND gateway, the first content file corresponding to the encryption interval is first compressed and encoded, and then one-half of the obtained compressed encoded file is encrypted using an encryption key, and one-half of the obtained compressed encoded file is encrypted using an encryption parameter, and then the contents encrypted by the encryption key and the encryption parameter are merged, and compressed and decoded to generate encryption request content and an encryption sequence, wherein the encryption sequence includes the encryption interval and the encryption start value, and double encryption is performed by simultaneously using the encryption key and the encryption parameter specified by the target request, thereby further improving the security of the encryption.

[0052] Since the encryption process is agreed upon by the customer and the CND manufacturer, during the client's decryption process, when any client corresponding to the customer obtains the encrypted request content and the encryption sequence through the target request, during the decryption process, the encryption interval and the encryption start value are first parsed according to the encryption sequence, and then the encrypted request content in the target response is determined, and the encrypted request content is encoded and decompressed, and the encryption key is used to decrypt half of the decompressed file, and the encryption parameter is used to decrypt the half of the decompressed file, and then the decrypted contents with the encryption key and the encryption parameter are merged, and the decrypted first content file can be obtained by decoding and decompression. The first content file and the second content file constitute the completed request content.

[0053] Reference Figure 4 , shows an execution flow chart of an encryption method of a CDN gateway provided in an embodiment of the present application. In a feasible manner, the client initiates a target request to the CDN gateway. After the CDN gateway receives the target request, it parses and obtains the anti-hotlink authentication parameters, key index parameters and encryption parameters carried in the target request.

[0054] Then, anti-hotlink authentication is performed according to the anti-hotlink authentication parameters. If the anti-hotlink authentication fails, an error response is directly returned to the client; if the anti-hotlink authentication is successful, the encryption interval carried in the target request is parsed and the encryption key is determined in the key pool according to the key index parameter.

[0055] The CDN gateway initiates a sub-request to obtain the first content file corresponding to the encryption interval, calls the encryption dynamic library, encrypts the first content file according to the encryption key, encryption parameters and encryption interval, and obtains the encryption request content and encryption sequence returned by the encryption dynamic library.

[0056] The CDN gateway generates an encryption sequence header based on the encryption sequence and temporarily stores the encrypted request content.

[0057] The CDN gateway initiates a main request to obtain the second content file as the non-encrypted request content, and then merges the encrypted request content and the non-encrypted request content.

[0058] Finally, the CDN gateway returns the encrypted sequence header and the combined encrypted request content and non-encrypted request content to the client as a target response corresponding to the target request.

[0059] Reference Figure 5 , showing a schematic diagram of the stage processing of the encryption method of the CDN gateway provided in an embodiment of the present application. In a feasible implementation manner, the processing stages of the CDN gateway for any target request include a rewrite stage, an access stage, a header filter stage, and a body filter stage.

[0060] After responding to any target request, the anti-hotlink authentication parameters, key index parameters and encryption parameters carried in the target request can be parsed in the rewrite stage of the CND gateway, and then the encryption key can be determined in the key pool according to the key index parameters to parse the encryption interval carried in the target request.

[0061] Then, in the access phase of the CND gateway, anti-hotlink authentication is performed according to the anti-hotlink authentication parameters. After the anti-hotlink authentication is successful, a sub-request is initiated, and the returned first content file is encrypted to obtain the encrypted request content and encryption sequence, and a main request is initiated to obtain the second content file.

[0062] In the header filter stage of the CND gateway, the encryption sequence header is set according to the encryption sequence; by obtaining and generating the encrypted request content through the sub-request, the size of the encrypted request content can be obtained in advance, and the encryption sequence can be obtained before the header filter stage. If the encryption sequence is obtained in the header filter stage, the main request has been completed at this time, and the main request cannot know the size of the remaining request content that needs to be requested.

[0063] In the body filter stage of the CND gateway, the encrypted request content and the non-encrypted request content are merged.

[0064] Finally, the CND gateway returns the encrypted sequence header, encrypted request content and non-encrypted request content to the client as the target response corresponding to the target request.

[0065] In this method, according to the encryption interval in the security information carried in the target request, the target request is divided into a sub-request and a main request. The first content file corresponding to the encryption interval is obtained through the sub-request and then encrypted to obtain the encrypted request content and the encrypted sequence. The second content file is obtained according to the main request as the non-encrypted request content. Finally, the encrypted sequence header, the encrypted request content and the non-encrypted request content are used as the target response corresponding to the target request.

[0066] The encrypted sequence header in the target response allows users to decrypt the encrypted request content to obtain the complete request content, thereby ensuring that part of the request content returned by the CDN gateway to the client is encrypted. Even if the requested content is stolen, it cannot be opened. For example, if the request content is a video, part of the video is encrypted and can only be played normally after being decrypted by the customer's official player, which improves the security of the customer's business, protects the customer's interests, and also enhances the competitiveness of CDN manufacturers.

[0067] At the same time, the encryption dynamic library can be configured according to the actual needs of user applications, which improves the flexibility of the encryption process. By pre-setting the key pool and matching it in the preset key pool according to the key index parameters in the target request, it can avoid the problem of reduced security caused by the target request directly carrying the key being cracked. The encryption process can adopt a variety of methods, such as double encryption combining the encryption key and the specified encryption parameters, which can further improve the security of the business.

[0068] Reference Figure 6 , shows a functional module diagram of an encryption device of a CDN gateway provided in an embodiment of the present application, which is applied to a CDN gateway of a CDN system, and the device includes: The parsing module 100 is used to respond to a target request initiated by any client, parse and determine the security information carried in the target request, wherein the security information includes encryption information and encryption interval; The first request module 200 is configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval; The second request module 300 is used to send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content; The response module 400 is used to return a target response corresponding to the target request to the client, wherein the target response includes an encrypted sequence header, encrypted request content and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

[0069] Optionally, the parsing module includes: A first parsing unit, configured to respond to a target request initiated by any client and parse an anti-hotlink authentication parameter carried in the target request; A verification unit, used for performing anti-hotlink authentication according to the anti-hotlink authentication parameter; When the anti-hotlink authentication fails, an error response is directly returned to the client, and the header of the error response carries a target error code; When the anti-hotlink authentication is successful, the security information carried in the target request is parsed and obtained.

[0070] Optionally, the parsing module includes: An encryption interval determination unit, configured to respond to a target request initiated by any client and determine whether the target request carries an encryption interval; When the target request does not carry an encryption interval, a preset default interval is used as the encryption interval in the security information of the target request.

[0071] Optionally, the encryption information includes a key index parameter and an encryption parameter; and the first request module includes: A key determination unit, configured to determine, according to the key index parameter in the encryption information, an encryption key corresponding to the key index parameter in a preset key pool; The encryption unit is used to call the encryption dynamic library, and according to the encryption key, the encryption parameter and the encryption interval, the first content file executes the encryption strategy to obtain the encryption request content.

[0072] Optionally, the encryption unit includes: The first unit is used for compressing and encoding the first content file to obtain a compressed encoded file; A second unit is used to encrypt the first compressed coded file of the compressed coded file according to the encryption key to obtain a first encrypted file; A third unit is used to encrypt a second compressed coded file of the compressed coded file according to the encryption parameter to obtain a second encrypted file; The fourth unit is used to compress and decode the merged first encrypted file and the second encrypted file to obtain encryption request content and an encryption sequence, wherein the encryption sequence includes the encryption interval and the encryption start value.

[0073] Optionally, the device further comprises: The encryption sequence header generation module is used to generate an encryption sequence header according to the encryption sequence in the header filter stage.

[0074] Optionally, the device further comprises: A merging module is used to merge the encrypted request content and the non-encrypted request content in the body filter stage; and use the encrypted sequence header, the encrypted request content and the non-encrypted request content as the target response corresponding to the target request.

[0075] Reference Figure 7 , shows a schematic diagram of a computer device provided in an embodiment of the present application, including: at least one processor 701, and a memory 702, wherein the memory 702 stores a computer program that can be run on the processor 701, wherein the processor 701 executes the encryption method of the CDN gateway described in the embodiment when executing the computer program.

[0076] Reference Figure 8 , shows a schematic diagram of a non-volatile readable storage medium provided in an embodiment of the present application, wherein the non-volatile readable storage medium 800 stores a computer program 801, wherein the computer program 801, when executed by a processor, executes the encryption method of the CDN gateway described in the embodiment.

[0077] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0078] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0079] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0080] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0082] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0083] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0084] Moreover, the terms "include", "comprises" or any other variation thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device that includes a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of more restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or terminal device that includes the element.

[0085] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A CDN gateway encryption method, characterized in that: A CDN gateway applied to a CDN system, the method comprising: In response to a target request initiated by any client, parse and determine security information carried in the target request, the security information including encryption information and encryption interval; Sending a sub-request corresponding to the target request to the CDN system, receiving a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypting the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval; Sending a main request corresponding to the target request to the CDN system, and receiving a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content, wherein the second content file is a content file corresponding to the non-encrypted interval; A target response corresponding to the target request is returned to the client, wherein the target response includes an encrypted sequence header, encrypted request content, and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

2. The method according to claim 1, characterized in that: In response to a target request initiated by any client, parsing and determining security information carried in the target request includes: In response to a target request initiated by any client, parse the anti-hotlink authentication parameters carried in the target request; Perform anti-hotlink authentication according to the anti-hotlink authentication parameters; When the anti-hotlink authentication fails, an error response is directly returned to the client, and the header of the error response carries a target error code; When the anti-hotlink authentication is successful, the security information carried in the target request is parsed and obtained.

3. The method according to claim 1, characterized in that In response to a target request initiated by any client, parsing and determining security information carried in the target request includes: In response to a target request initiated by any client, determining whether the target request carries an encryption interval; When the target request does not carry an encryption interval, a preset default interval is used as the encryption interval in the security information of the target request.

4. The method according to claim 1, characterized in that The encryption information includes a key index parameter and an encryption parameter; the first content file is encrypted according to the encryption information and the encryption interval to obtain encryption request content, including: According to the key index parameter in the encryption information, determining the encryption key corresponding to the key index parameter in a preset key pool; The encryption dynamic library is called, and according to the encryption key, the encryption parameter and the encryption interval, the first content file executes the encryption strategy to obtain the encryption request content.

5. The method according to claim 4, characterized in that Enforcement of encryption policies includes: After compressing and encoding the first content file, a compressed encoding file is obtained; Encrypting the first compressed coded file of the compressed coded file according to the encryption key to obtain a first encrypted file; Encrypting a second compressed coded file of the compressed coded file according to the encryption parameter to obtain a second encrypted file; The first encrypted file and the second encrypted file that are combined are compressed and decoded to obtain encryption request content and an encryption sequence, wherein the encryption sequence includes the encryption interval and the encryption start value.

6. The method according to claim 5, characterized in that After obtaining the encrypted request content, the method further includes: In the header filter stage, an encrypted sequence header is generated according to the encrypted sequence.

7. The method according to claim 6, characterized in that After receiving the second content file returned by the CDN system in response to the primary request corresponding to the target request as non-encrypted request content, the method further includes: In the body filter stage, the encrypted request content and the non-encrypted request content are merged; The encrypted sequence header, encrypted request content and non-encrypted request content are used as the target response corresponding to the target request.

8. An encryption device for a CDN gateway, characterized in that: A CDN gateway applied to a CDN system, the device comprising: A parsing module, configured to respond to a target request initiated by any client, parse and determine security information carried in the target request, wherein the security information includes encryption information and encryption interval; A first request module, configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption interval to obtain encrypted request content, wherein the first content file is a content file corresponding to the encryption interval; A second request module, configured to send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as non-encrypted request content; A response module is used to return a target response corresponding to the target request to the client, wherein the target response includes an encrypted sequence header, encrypted request content and non-encrypted request content, wherein the encrypted sequence header represents an encryption interval and an encryption start value corresponding to the encrypted request content.

9. A computer device, characterized in that: include: At least one processor, and a memory, wherein the memory stores a computer program that can be run on the processor, wherein the processor executes the encryption method of the CDN gateway according to any one of claims 1-7 when executing the computer program.

10. A non-volatile readable storage medium, characterized in that: The non-volatile readable storage medium stores a computer program, wherein the computer program, when executed by a processor, executes the encryption method for the CDN gateway according to any one of claims 1 to 7.

Images