A CDN gateway encryption method, device, equipment and storage medium

Abstract

The application provides a CDN gateway encryption method, device, equipment and storage medium, and belongs to the technical field of data processing. The method comprises the following steps: in response to a target request initiated by any client, analyzing and determining security information carried in the target request; sending a sub-request corresponding to the target request to a CDN system, receiving a first content file returned by the CDN system in response to the sub-request, and encrypting the first content file to obtain encrypted request content; sending a main request corresponding to the target request to the CDN system, receiving a second content file returned by the CDN system in response to the main request as non-encrypted request content, and returning the target response including an encrypted sequence header, the encrypted request content and the non-encrypted request content to the client. The application aims to improve business security.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of data processing, in particular, to a CDN gateway encryption method, device, equipment and storage medium. BACKGROUND

[0002] The CDN gateway is combined with the content distribution network, and through technical means such as cache control, content routing, security enhancement, load balancing and content optimization, efficient content transmission, performance improvement and security are realized; but at present, when various manufacturers obtain requested content such as video content, static webpages or game installation packages through a CDN gateway, they are all through setting various anti-link protection, parameter decryption authentication and remote authentication, and the corresponding content is returned after verification, so how to avoid anti-link protection and authentication being cracked or content results being stolen becomes an important technical field to improve the competitiveness of CDN manufacturers, and the traditional CDN still has some problems that can be linked and cracked.

[0003] Because the anti-link authentication provided or configured by some customers is too simple, or the anti-link protection is generated by using a conventional encryption and decryption method, there is a risk that the anti-link protection is easily stolen and cracked, and finally the requested content such as video content, static webpages or game installation packages is stolen, resulting in low business security. SUMMARY

[0004] Embodiments of the present application provide a CDN gateway encryption method, device, equipment and storage medium, aiming to improve business security.

[0005] In a first aspect, the present application provides a CDN gateway encryption method applied to a CDN gateway of a CDN system, and the method comprises:

[0006] In response to a target request initiated by any client, the security information carried in the target request is parsed and determined, and the security information includes encryption information and an encryption interval;

[0007] A sub-request corresponding to the target request is sent to the CDN system, a first content file returned by the CDN system in response to the sub-request corresponding to the target request is received, and the first content file is encrypted according to the encryption information and the encryption interval to obtain encrypted requested content, wherein the first content file is a content file corresponding to the encryption interval;

[0008] A main request corresponding to the target request is sent to the CDN system, and a second content file returned by the CDN system in response to the main request corresponding to the target request is received as non-encrypted requested content, wherein the second content file is a content file corresponding to a non-encryption interval;

[0009] a target response corresponding to the target request is returned to the client, the target response including an encrypted sequence header, encrypted request content, and non-encrypted request content, wherein the encrypted sequence header represents an encrypted interval corresponding to the encrypted request content and an encrypted start value.

[0010] Optionally, in response to a target request initiated by any client, security information carried in the target request is parsed and determined, including:

[0011] In response to a target request initiated by any client, anti-theft chain authentication parameters carried in the target request are parsed.

[0012] Anti-theft chain authentication is performed according to the anti-theft chain authentication parameters.

[0013] When the anti-theft chain authentication fails, an error response is directly returned to the client, and a target error code is carried in the header of the error response.

[0014] When the anti-theft chain authentication succeeds, security information carried in the target request is parsed.

[0015] Optionally, in response to a target request initiated by any client, security information carried in the target request is parsed and determined, including:

[0016] In response to a target request initiated by any client, it is determined whether an encrypted interval is carried in the target request.

[0017] When the target request does not carry an encrypted interval, a preset default interval is used as the encrypted interval in the security information of the target request.

[0018] Optionally, the encryption information includes a key index parameter and an encryption parameter; and the first content file is encrypted according to the encryption information and the encrypted interval to obtain encrypted request content, including:

[0019] According to the key index parameter in the encryption information, an encryption key corresponding to the key index parameter is determined in a preset key pool.

[0020] An encryption dynamic library is called to execute an encryption strategy on the first content file according to the encryption key, the encryption parameter, and the encrypted interval to obtain the encrypted request content.

[0021] Optionally, the encryption strategy includes:

[0022] After the first content file is compressed and encoded, a compressed and encoded file is obtained.

[0023] The first compressed and encoded file of the compressed and encoded file is encrypted according to the encryption key to obtain a first encrypted file.

[0024] The second compressed encoded file of the compressed encoded file is encrypted according to the encryption parameters to obtain the second encrypted file;

[0025] The merged first and second encrypted files are compressed and decoded to obtain the encryption request content and the encryption sequence, wherein the encryption sequence includes the encryption range and the encryption start value.

[0026] Optionally, after obtaining the encrypted request content, the method further includes:

[0027] In the header filter stage, an encrypted sequence header is generated based on the encrypted sequence.

[0028] Optionally, after receiving the second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content, the method further includes:

[0029] During the body filter phase, the encrypted request content and the unencrypted request content are merged.

[0030] The encrypted sequence header, the encrypted request content, and the unencrypted request content are used as the target response corresponding to the target request.

[0031] Secondly, embodiments of this application provide an encryption device for a CDN gateway, applied to a CDN gateway in a CDN system, the device comprising:

[0032] The parsing module is used to respond to any target request initiated by a client, parse and determine the security information carried in the target request, the security information including encryption information and encryption range;

[0033] The first request module is configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption range to obtain encrypted request content, wherein the first content file is the content file corresponding to the encryption range;

[0034] The second request module is used to send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content.

[0035] The response module is used to return the target response corresponding to the target request to the client. The target response includes an encrypted sequence header, encrypted request content, and unencrypted request content. The encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content.

[0036] Thirdly, embodiments of this application provide a computer device, including: at least one processor and a memory, the memory storing a computer program executable on the processor, wherein the processor executes the computer program to perform the encryption method of the CDN gateway described in the embodiments.

[0037] Fourthly, embodiments of this application provide a non-volatile readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the encryption method of the CDN gateway described in the embodiments.

[0038] Beneficial effects:

[0039] In response to a target request initiated by any client, the system parses and determines the security information carried in the target request, which includes encryption information and an encryption range. It then sends a sub-request corresponding to the target request to the CDN system, receives a first content file returned by the CDN system in response to the sub-request, and encrypts the first content file according to the encryption information and the encryption range to obtain encrypted request content. Finally, it sends a main request corresponding to the target request to the CDN system, receives a second content file returned by the CDN system in response to the main request as unencrypted request content, and returns a target response corresponding to the target request to the client. The target response includes an encrypted sequence header, encrypted request content, and unencrypted request content, wherein the encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content.

[0040] This method divides the target request into a sub-request and a main request based on the encrypted section in the security information carried in the target request. First, it obtains the first content file corresponding to the encrypted section based on the sub-request, and then encrypts it according to the encryption information to obtain the encrypted request content. Then, it obtains the second content file corresponding to the unencrypted section based on the main request as the unencrypted request content. Finally, it uses the encrypted sequence header, the encrypted request content, and the unencrypted request content as the target response corresponding to the target request. The encrypted sequence header in the target response can be used by the user to decrypt the encrypted request content to obtain the complete request content, which further improves the security of the content file of the target request, thereby improving the security of the business. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of the encryption method for a CDN gateway proposed in an embodiment of this application;

[0043] Figure 2 This is a flowchart illustrating the steps of implementing an encryption strategy according to an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the encryption and decryption process provided in an embodiment of this application;

[0045] Figure 4 This is an execution flowchart of the encryption method for a CDN gateway proposed in an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of the stage processing of the encryption method for a CDN gateway proposed in an embodiment of this application;

[0047] Figure 6 This is a functional block diagram of an encryption device for a CDN gateway according to an embodiment of this application.

[0048] Figure 7 This is a schematic diagram of a computer device provided in an embodiment of this application;

[0049] Figure 8 This is a schematic diagram of a non-volatile readable storage medium proposed in an embodiment of this application. Detailed Implementation

[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] CDN: Content Delivery Network. It is an intelligent virtual network built on top of the existing Internet by placing node servers in various locations. The CDN system can redirect user requests to the nearest service node in real time based on comprehensive information such as network traffic, the connection and load status of each node, as well as the distance and response time to the user. Its purpose is to enable users to obtain the content they need from the nearest location, solve network congestion, and improve the response speed of users accessing websites.

[0052] A gateway, also known as an internetwork connector or protocol converter, is a complex network interconnection device that enables network interconnection at the network layer and above. It is used only for interconnecting two networks with different high-level protocols.

[0053] URL: uniform resource locator;

[0054] OpenResty: OpenResty is a high-performance web platform based on Nginx, which can easily build dynamic web applications, web services and dynamic gateways that can handle ultra-high concurrency. By implementing Nginx modules such as ngx_lua and stream_lua, OpenResty integrates Lua / LuaJIT into Nginx, so that Lua scripts can be embedded inside Nginx to implement complex HTTP / TCP / UDP business logic in Lua language, while still maintaining high concurrency service capabilities.

[0055] The rewrite phase: In OpenResty, a request begins to be rewritten, which is responsible for parsing request parameters, rewriting parameters, and handling URL redirection, etc.

[0056] The access phase: This is an access permission check phase in OpenResty. The standard module ngx_access, the third-party module ngx_auth_request, and the access_by_lua directive of the third-party module ngx_lua all run in this phase. Configuration directives primarily perform access control-related tasks, such as checking user access permissions and verifying the legitimacy of the user's source IP address.

[0057] Header filter phase: A response header processing phase in OpenResty, responsible for adding, modifying, and filtering response headers.

[0058] Body filter stage: A response body processing stage in OpenResty, responsible for handling operations such as response body splicing and filtering.

[0059] A CDN gateway, combined with a Content Delivery Network (CDN), utilizes technologies such as cache control, content routing, security enhancement, load balancing, and content optimization to achieve efficient content delivery and improve performance and security. Through tight integration with the CDN, the gateway can intelligently configure cache headers, such as Cache-Control and Expires, to guide the CDN on how to cache and update content. This granular caching strategy not only significantly improves content delivery speed but also substantially reduces the load on the origin server, enabling websites to easily handle high-concurrency access.

[0060] However, currently, when various vendors request content such as video content, static web pages, or game installation packages through CDN gateways, they all set up various anti-hotlinking measures, parameter decryption authentication, and remote authentication. Once the verification is successful, the corresponding content will be returned. Therefore, how to prevent anti-hotlinking and authentication from being cracked or content results from being stolen has become an important technical field for improving the competitiveness of CDN vendors. Traditional CDNs still have some problems with content results being hotlinked and cracked.

[0061] Some customers provide or configure overly simplistic anti-leeching authentication methods, or use conventional encryption and decryption methods to generate anti-leeching links. This poses a risk that the anti-leeching links can be easily stolen and cracked, ultimately leading to the theft of requested content such as video content, static web pages, or game installation packages, resulting in low business security.

[0062] Therefore, in order to improve business security, this application provides an encryption method for a CDN gateway.

[0063] Reference Figure 1 This document illustrates a flowchart of an encryption method for a CDN gateway according to an embodiment of this application. The method can be applied to a CDN gateway in a CDN system, and specifically includes the following steps:

[0064] S101: In response to a target request initiated by any client, parse and determine the security information carried in the target request, the security information including encryption information and encryption range.

[0065] The CDN system can provide services to different customers, and different customers can configure the security policies corresponding to the request URLs according to their own needs, thereby improving the security of their own business. For any customer's business service, the target request of its client can include video content, web page content, and any installation package, etc. The scope of the target request can be customized according to the actual application needs, and this embodiment does not impose any restrictions.

[0066] In this embodiment, any client's target request may carry security information. When the CDN gateway responds to any client's target request, it can parse the security information in the target request. The security information includes the encryption information and encryption range agreed upon by the client and the CDN provider. The encryption information is used to encrypt the request content, and the encryption range is used to specify the position and length of the request content that need to be encrypted.

[0067] For example, the encryption range can be from the starting position 0 of the request content to a, or it can be the range ab. For example, for a 100M request content, the encryption range can be used to specify encryption of the request content in the range of 0-10M, or the request content in the range of 10M-20M, or the request content in the range of 0-10M and 15M-20M can be encrypted. The encryption range can be set according to the actual application requirements.

[0068] In one feasible implementation, the target request can first be authenticated against hotlinking. Specifically, in response to any target request initiated by a client, the hotlinking authentication parameters carried in the target request are first parsed, and then hotlinking authentication is performed based on the hotlinking authentication parameters. The hotlinking authentication parameters are used to perform entry verification on the URL of the target request.

[0069] When the anti-leeching authentication fails, an error response is directly returned to the client. The header of the error response carries the target error code, and the returned target error code can be configured and defined by the client. That is, if the anti-leeching authentication fails, the subsequent encryption process for the target request will no longer be performed.

[0070] When the anti-leeching authentication is successful, the security information carried in the target request is further parsed.

[0071] Furthermore, in the process of parsing and determining the security information carried in the target request, in response to any target request initiated by a client, it can first determine whether the target request carries an encrypted range, that is, whether the target request carries a specified encrypted range. If the target request does not carry an encrypted range, the preset default range is used as the encrypted range in the security information of the target request. The default range can be an encrypted range agreed upon by the client and the CDN provider. The encrypted range carried in the target request has a higher priority than the preset default range. The default range can be set according to the needs of the actual application. For example, different default ranges can be set for different types of requests.

[0072] S102: Send a sub-request corresponding to the target request to the CDN system, receive the first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption range to obtain encrypted request content, wherein the first content file is the content file corresponding to the encryption range.

[0073] Specifically, based on the encrypted range, the content file corresponding to the target request can be divided into two parts: a first content file corresponding to the encrypted range and a second content file corresponding to the unencrypted range. The CDN gateway can generate a sub-request for the first content file and send the sub-request to the CDN system. The CDN system responds to the sub-request and returns the first content file.

[0074] In practice, the encrypted information in the security information can be an encryption key or a key index parameter. The client and the CDN provider agree to preset a key pool. Based on the key index parameter carried in the security information of the current target parameter, the key corresponding to the key index parameter is matched in the preset key pool as the encryption key. In practice, for client requests with the same request content, the key index parameters can be different or the same.

[0075] In one feasible implementation, the encryption information may include key index parameters and encryption parameters. The process of encrypting the first content file according to the encryption information and the encryption range to obtain the encrypted request content includes the following steps:

[0076] A1: Based on the key index parameter in the encrypted information, determine the encryption key corresponding to the key index parameter in the preset key pool.

[0077] When the encrypted information includes a key index parameter, the encrypted key corresponding to the key index parameter is obtained from the preset key pool. The key pool includes multiple keys, each with a unique key index parameter. In actual implementation, customers and CDN providers can update the preset key pool.

[0078] A2: Call the encryption dynamic library, and execute the encryption strategy on the first content file according to the encryption key, the encryption parameters and the encryption range to obtain the encryption request content.

[0079] Encryption dynamic libraries can be provided by the customer, meaning the content of the encryption strategy is executed by the customer. In actual implementation, the customer can specify different encryption dynamic libraries according to different types of requests. The encryption method of any encryption dynamic library can also be customized according to the actual application requirements, thereby improving the flexibility of encryption.

[0080] If the customer does not provide an encrypted dynamic library, the CDN gateway's default encrypted dynamic library will be used.

[0081] Reference Figure 2 The flowchart illustrating the steps of executing an encryption strategy according to an embodiment of this application is shown. In one feasible implementation, executing the encryption strategy includes the following steps:

[0082] B1: After compressing and encoding the first content file, a compressed encoded file is obtained.

[0083] B2: Encrypt the first compressed encoded file of the compressed encoded file according to the encryption key to obtain the first encrypted file.

[0084] B3: Encrypt the second compressed encoded file of the compressed encoded file according to the encryption parameters to obtain the second encrypted file.

[0085] B3: Compress and decode the merged first and second encrypted files to obtain the encryption request content and encryption sequence.

[0086] In this embodiment, the security of encryption is further improved by using both the encryption key and the encryption parameters specified in the target request for double encryption.

[0087] S103: Send a main request corresponding to the target request to the CDN system, and receive the second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content, wherein the second content file is the content file corresponding to the unencrypted range.

[0088] The main request is used to request the remaining content, i.e., the second content file. For example, if the size of the request content is 100M and the encryption range is 0-10M, then the size of the first content file corresponding to the sub-request is 0-10M, and the size of the second content file corresponding to the main request is 11-100M.

[0089] S104: Return the target response corresponding to the target request to the client. The target response includes an encrypted sequence header, encrypted request content, and unencrypted request content. The encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content.

[0090] After the first content file is encrypted, in the header filter stage, an encrypted sequence header is generated based on the encrypted sequence. In the body filter stage, the encrypted request content and the unencrypted request content are merged. The encrypted sequence header, the encrypted request content, and the unencrypted request content are used as the target response corresponding to the target request.

[0091] After the client receiving the target response receives the target response, it can decrypt the encrypted request content based on the encrypted sequence header in the target response. The first content file after decryption, combined with the unencrypted request content, is the request content corresponding to the target request.

[0092] Reference Figure 3 The diagram illustrates the encryption and decryption processes provided in this application embodiment. During the encryption process of the CND gateway, the first content file corresponding to the encryption range is first compressed and encoded. Then, half of the resulting compressed and encoded file is encrypted using an encryption key, and the other half is encrypted using encryption parameters. The encrypted content obtained by the encryption key and encryption parameters is then merged and compressed and decoded to generate an encryption request content and an encryption sequence. The encryption sequence includes the encryption range and the encryption start value. By simultaneously using the encryption key and the encryption parameters specified in the target request for double encryption, the security of the encryption is further improved.

[0093] Since the encryption process is agreed upon by the client and the CND vendor, during the client's decryption process, once any client receives the encrypted request content and encryption sequence through the target request, the decryption process first parses the encryption sequence to obtain the encryption range and encryption start value, thereby determining the encrypted request content in the target response. The encrypted request content is then encoded and decompressed. Half of the decompressed file is decrypted using the encryption key, and the other half is decrypted using the encryption parameters. The decrypted content obtained by the encryption key and encryption parameters is then merged, and the first decrypted content file is obtained by decoding and decompressing. The first content file and the second content file together constitute the complete request content.

[0094] Reference Figure 4 The diagram illustrates the execution flowchart of an encryption method for a CDN gateway provided in an embodiment of this application. In one feasible manner, the client initiates a target request to the CDN gateway. After receiving the target request, the CDN gateway parses the anti-leeching authentication parameters, key index parameters, and encryption parameters carried in the target request.

[0095] Then, anti-hotlinking authentication is performed according to the anti-hotlinking authentication parameters. If the anti-hotlinking authentication fails, an error response is returned directly to the client. If the anti-hotlinking authentication succeeds, the encrypted range carried in the target request is parsed, and the encryption key is determined from the key pool according to the key index parameter.

[0096] The CDN gateway initiates a sub-request to obtain the first content file corresponding to the encryption range. It then calls the encryption dynamic library to encrypt the first content file based on the encryption key, encryption parameters, and encryption range, obtaining the encrypted request content and encryption sequence returned by the encryption dynamic library.

[0097] The CDN gateway generates an encrypted sequence header based on the encrypted sequence and temporarily stores the encrypted request content.

[0098] The CDN gateway initiates a main request to obtain the second content file as the unencrypted request content, and then merges the encrypted request content and the unencrypted request content.

[0099] Finally, the CDN gateway returns the encrypted sequence header, the merged encrypted request content, and the unencrypted request content as the target response corresponding to the target request to the client.

[0100] Reference Figure 5 This illustration shows a schematic diagram of the stages of the encryption method of the CDN gateway provided in an embodiment of this application. In one feasible implementation, the CDN gateway's processing stages for any target request include a rewrite stage, an access stage, a header filter stage, and a body filter stage.

[0101] Upon responding to any target request, the anti-leeching authentication parameters, key index parameters, and encryption parameters carried in the target request can be parsed during the rewrite phase of the CND gateway. Then, the encryption key is determined from the key pool based on the key index parameters, and the encryption range carried in the target request is parsed.

[0102] Then, during the access phase of the CND gateway, anti-hotlinking authentication is performed based on the anti-hotlinking authentication parameters. After successful anti-hotlinking authentication, a sub-request is initiated, and the returned first content file is encrypted to obtain the encrypted request content and encryption sequence. Then, the main request is initiated to obtain the second content file.

[0103] During the header filter phase of the CND gateway, the encrypted sequence header is set according to the encrypted sequence. The encrypted request content is obtained and generated through sub-requests. The size of the encrypted request content can be obtained in advance, and the encrypted sequence can be obtained before the header filter phase. If the encrypted sequence is obtained during the header filter phase, the main request has already been completed, and the main request cannot know the size of the remaining request content.

[0104] During the body filter phase of the CND gateway, encrypted and unencrypted request content are merged.

[0105] Finally, the CND gateway returns the encrypted sequence header, encrypted request content, and unencrypted request content to the client as the target response corresponding to the target request.

[0106] In this method, the target request is divided into a sub-request and a main request based on the encrypted section in the security information carried in the target request. The first content file corresponding to the encrypted section is obtained through the sub-request and then encrypted to obtain the encrypted request content and the encrypted sequence. The second content file is obtained according to the main request as the unencrypted request content. Finally, the encrypted sequence header, the encrypted request content and the unencrypted request content are used as the target response corresponding to the target request.

[0107] The encrypted sequence header in the target response allows users to decrypt the encrypted request content to obtain the complete request content. This ensures that a portion of the request content returned by the CDN gateway to the client is encrypted, preventing it from being opened even if the requested content is stolen. For example, if the requested content is a video, part of the video is encrypted and can only be played normally after being decrypted by the customer's official player. This improves the security of the customer's business, protects the customer's interests, and also enhances the competitiveness of the CDN provider.

[0108] Meanwhile, the encryption dynamic library can be configured according to the actual user application needs, which improves the flexibility of the encryption process. By using a preset key pool, the key index parameter in the target request is matched in the preset key pool, which can avoid the problem of the target request directly carrying the key and being cracked, thus reducing security. In addition, the encryption process can use multiple methods, such as combining the encryption key and the specified encryption parameters for double encryption, which can further improve the security of the business.

[0109] Reference Figure 6 This diagram illustrates a functional block diagram of an encryption device for a CDN gateway according to an embodiment of this application. The device is applied to a CDN gateway in a CDN system and includes:

[0110] The parsing module 100 is used to respond to a target request initiated by any client, and parse and determine the security information carried in the target request, wherein the security information includes encrypted information and encrypted range;

[0111] The first request module 200 is configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption range to obtain encrypted request content, wherein the first content file is the content file corresponding to the encryption range;

[0112] The second request module 300 is used to send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content.

[0113] The response module 400 is used to return a target response corresponding to the target request to the client. The target response includes an encrypted sequence header, encrypted request content, and unencrypted request content. The encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content.

[0114] Optionally, the parsing module includes:

[0115] The first parsing unit is used to respond to any target request initiated by a client and parse the anti-leeching authentication parameters carried in the target request;

[0116] A verification unit is used to perform anti-leeching authentication based on the anti-leeching authentication parameters.

[0117] When the anti-leeching authentication fails, an error response is returned directly to the client, and the header of the error response carries the target error code;

[0118] When the anti-leeching authentication is successful, the security information carried in the target request is parsed and obtained.

[0119] Optionally, the parsing module includes:

[0120] The encryption interval determination unit is used to determine whether the target request carries an encryption interval in response to any target request initiated by a client.

[0121] When the target request does not carry an encrypted range, the preset default range will be used as the encrypted range in the security information of the target request.

[0122] Optionally, the encryption information includes a key index parameter and encryption parameters; the first request module includes:

[0123] The key determination unit is used to determine the encryption key corresponding to the key index parameter in a preset key pool based on the key index parameter in the encryption information.

[0124] An encryption unit is used to call an encryption dynamic library to execute an encryption strategy on the first content file based on the encryption key, the encryption parameters, and the encryption range, thereby obtaining the encrypted request content.

[0125] Optionally, the encryption unit includes:

[0126] The first unit is used to compress and encode the first content file to obtain a compressed and encoded file;

[0127] The second unit is used to encrypt the first compressed encoded file of the compressed encoded file according to the encryption key to obtain the first encrypted file;

[0128] The third unit is used to encrypt the second compressed encoded file of the compressed encoded file according to the encryption parameters to obtain the second encrypted file;

[0129] The fourth unit is used to compress and decode the merged first and second encrypted files to obtain the encryption request content and the encryption sequence, wherein the encryption sequence includes the encryption range and the encryption start value.

[0130] Optionally, the device further includes:

[0131] An encrypted sequence header generation module is used to generate an encrypted sequence header based on the encrypted sequence during the header filter stage.

[0132] Optionally, the device further includes:

[0133] The merging module is used to merge the encrypted request content and the unencrypted request content during the body filter stage; and to use the encrypted sequence header, the encrypted request content, and the unencrypted request content as the target response corresponding to the target request.

[0134] Reference Figure 7 The diagram illustrates a computer device provided in an embodiment of this application, including: at least one processor 701 and a memory 702, wherein the memory 702 stores a computer program that can run on the processor 701, wherein the processor 701 executes the computer program to perform the encryption method of the CDN gateway described in the embodiment.

[0135] Reference Figure 8 The diagram illustrates a non-volatile readable storage medium 800 provided in an embodiment of this application. The non-volatile readable storage medium 800 stores a computer program 801, wherein the computer program 801, when executed by a processor, performs the encryption method of the CDN gateway described in the embodiment.

[0136] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0137] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0138] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0139] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0141] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0142] Finally, it should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0143] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0144] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An encryption method for a CDN gateway, characterized in that, The method, applied to a CDN gateway in a CDN system, includes: In response to a target request initiated by any client, the security information carried in the target request is parsed and determined, the security information including encryption information and encryption range; Send a sub-request corresponding to the target request to the CDN system, receive the first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption range to obtain the encrypted request content, wherein the first content file is the content file corresponding to the encryption range; Send a main request corresponding to the target request to the CDN system, and receive a second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content, wherein the second content file is the content file corresponding to the unencrypted section; The target response corresponding to the target request is returned to the client. The target response includes an encrypted sequence header, an encrypted request content, and an unencrypted request content. The encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content. The encryption information includes a key index parameter and encryption parameters; based on the encryption information and the encryption range, the first content file is encrypted to obtain the encryption request content, including: Based on the key index parameter in the encrypted information, determine the encryption key corresponding to the key index parameter in the preset key pool; The encryption dynamic library is invoked, and the encryption strategy is executed on the first content file according to the encryption key, the encryption parameters, and the encryption range to obtain the encryption request content; Enforcing encryption policies includes: After compressing and encoding the first content file, a compressed and encoded file is obtained; The first compressed encoded file of the compressed encoded file is encrypted according to the encryption key to obtain the first encrypted file; The second compressed encoded file of the compressed encoded file is encrypted according to the encryption parameters to obtain the second encrypted file; The merged first and second encrypted files are compressed and decoded to obtain the encryption request content and the encryption sequence, wherein the encryption sequence includes the encryption range and the encryption start value.

2. The method according to claim 1, characterized in that, In response to a target request initiated by any client, the security information carried in the target request is parsed and determined, including: In response to a target request initiated by any client, parse the anti-leeching authentication parameters carried in the target request; Perform anti-leeching authentication based on the aforementioned anti-leeching authentication parameters; When the anti-leeching authentication fails, an error response is returned directly to the client, and the header of the error response carries the target error code; When the anti-leeching authentication is successful, the security information carried in the target request is parsed and obtained.

3. The method according to claim 1, characterized in that, In response to a target request initiated by any client, the security information carried in the target request is parsed and determined, including: In response to a target request initiated by any client, determine whether the target request carries an encrypted region; When the target request does not carry an encrypted range, the preset default range will be used as the encrypted range in the security information of the target request.

4. The method according to claim 1, characterized in that, After obtaining the encrypted request content, the method further includes: In the header filter stage, an encrypted sequence header is generated based on the encrypted sequence.

5. The method according to claim 4, characterized in that, After receiving the second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content, the method further includes: During the body filter phase, the encrypted request content and the unencrypted request content are merged. The encrypted sequence header, the encrypted request content, and the unencrypted request content are used as the target response corresponding to the target request.

6. An encryption device for a CDN gateway, characterized in that, A CDN gateway applied to a CDN system, the device comprising: The parsing module is used to respond to any target request initiated by a client, parse and determine the security information carried in the target request, the security information including encryption information and encryption range; The first request module is configured to send a sub-request corresponding to the target request to the CDN system, receive a first content file returned by the CDN system in response to the sub-request corresponding to the target request, and encrypt the first content file according to the encryption information and the encryption range to obtain encrypted request content, wherein the first content file is the content file corresponding to the encryption range; The second request module is used to send a main request corresponding to the target request to the CDN system, and receive the second content file returned by the CDN system in response to the main request corresponding to the target request as unencrypted request content. The response module is used to return the target response corresponding to the target request to the client. The target response includes an encrypted sequence header, encrypted request content, and unencrypted request content. The encrypted sequence header represents the encryption range and encryption start value corresponding to the encrypted request content. The encryption information includes a key index parameter and encryption parameters; the first request module includes: The key determination unit is used to determine the encryption key corresponding to the key index parameter in a preset key pool based on the key index parameter in the encryption information. An encryption unit is used to call an encryption dynamic library to execute an encryption strategy on the first content file according to the encryption key, the encryption parameters, and the encryption range to obtain the encryption request content; The encryption unit includes: The first unit is used to compress and encode the first content file to obtain a compressed and encoded file; The second unit is used to encrypt the first compressed encoded file of the compressed encoded file according to the encryption key to obtain the first encrypted file; The third unit is used to encrypt the second compressed encoded file of the compressed encoded file according to the encryption parameters to obtain the second encrypted file; The fourth unit is used to compress and decode the merged first and second encrypted files to obtain the encryption request content and the encryption sequence, wherein the encryption sequence includes the encryption range and the encryption start value.

7. A computer device, characterized in that, include: At least one processor, and a memory storing a computer program executable on the processor, wherein the processor executes the computer program to perform the encryption method of the CDN gateway according to any one of claims 1-5.

8. A non-volatile readable storage medium, characterized in that, The non-volatile readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it performs the encryption method of the CDN gateway according to any one of claims 1-5.

Images