IP access control method, device and system, storage medium and electronic equipment

Abstract

The invention provides an IP access control method, device and system, a storage medium and electronic equipment, and belongs to the technical field of communication. According to the embodiment of the invention, the preset number of terminal IPs which firstly access the target resource are stored in the IP white list, and the target banning information corresponding to the target resource is generated, so that the target terminal IP is allowed to access the target resource if it is determined that the target terminal IP is located in the IP white list of the target banning information in the subsequent access of the target resource, and the access efficiency of the target resource is improved. And if it is determined that the target terminal IP is not located in the IP white list of the target banning information, refusing the target terminal IP to access the target resource. Thus, by limiting the number of the terminal IPs accessing the target resource, it can be ensured that a legal user normally accesses the resource, the user request is effectively prevented from being hotlinked by an illegal user, the resource security is ensured, and the loss of the user resource is avoided.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an IP access control method, device, system, storage medium and electronic equipment. Background Art

[0002] Content Delivery Network (CDN) is a distributed network interconnected by the Internet, designed to provide fast and reliable content distribution services. CDN deploys edge nodes in multiple geographical locations. When a user requests data, the system redirects the request to the nearest edge node, which can reduce the distance of data transmission and thus speed up loading.

[0003] Since CDN carries a large number of user requests and customer services are constantly migrating to edge nodes, resource access security at edge nodes is becoming increasingly important.

[0004] In related technologies, in order to prevent resources from being stolen, authentication policies are usually set to authenticate access requests. However, once the authentication policy is leaked or hotlinked by unfriendly users, important resources will still be stolen, causing losses to the enterprise. Summary of the invention

[0005] The present invention provides an IP access control method, device, system, storage medium and electronic equipment to solve the problem that the current IP access control method is difficult to ensure the access security of resources.

[0006] In order to solve the above problems, the present invention adopts the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides an IP access control method, which is applied to any edge node in a distributed network, and the method includes:

[0008] In response to an access request from a target terminal IP to a target resource, determining whether there is target blocking information corresponding to the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0009] In the case where it is determined that there is target blocking information corresponding to the target resource, determining whether the target terminal IP is in the IP whitelist;

[0010] If it is determined that the target terminal IP is in the IP whitelist, allowing the access request;

[0011] If it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected.

[0012] In one embodiment of the present invention, the method further includes:

[0013] When it is determined that there is no target ban information corresponding to the target resource, the access request of the target terminal IP is released, and the access log of the target terminal IP accessing the target resource is sent to the log cluster, so that the log cluster determines that the number of terminal IPs that have accessed the target resource reaches the preset number based on the access logs of each edge node in the distributed network, and generates the target ban information corresponding to the target resource, and sends the target ban information to each edge node in the distributed network.

[0014] In one embodiment of the present invention, sending the target blocking information to each edge node in the distributed network includes:

[0015] The target blocking information is sent to a configuration platform, so that the configuration platform sends the target blocking information to each edge node in the distributed network.

[0016] In one embodiment of the present invention, the target blocking information further includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0017] The method further comprises:

[0018] When the current time exceeds the expiration time, the target blocking information is released.

[0019] In one embodiment of the present invention, in response to an access request of a target terminal IP to the target resource, determining whether there is target blocking information corresponding to the target resource includes:

[0020] In response to an access request from a target terminal IP to the target resource, determining whether the target terminal IP is located in a preset global IP whitelist;

[0021] When it is determined that the target terminal IP is in the global IP whitelist, the access request is released, and the target terminal IP is not included in the IP whitelist;

[0022] When it is determined that the target terminal IP is not in the global IP whitelist, it is determined whether there is target blocking information corresponding to the target resource.

[0023] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP;

[0024] The method further comprises:

[0025] Based on the request granularity identification information of the target terminal IP, the target blocking information corresponding to the target resource is determined; wherein different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0026] In a second aspect, based on the same inventive concept, an embodiment of the present invention provides an IP access control device, which is applied to any edge node in a distributed network, and the device includes:

[0027] An information determination module, configured to determine whether there is target blocking information corresponding to the target resource in response to an access request of a target terminal IP to a target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0028] A list determination module, configured to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target blocking information corresponding to the target resource;

[0029] A request release module, used to release the access request when it is determined that the target terminal IP is in the IP whitelist;

[0030] The request rejection module is used to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

[0031] In one embodiment of the present invention, the IP access control device further includes:

[0032] An access log generation module is used to release the access request of the target terminal IP when it is determined that there is no target ban information corresponding to the target resource, and send the access log of the target terminal IP accessing the target resource to the log cluster, so that the log cluster can generate the target ban information corresponding to the target resource when it is determined based on the access logs of each edge node in the distributed network that the number of terminal IPs that have accessed the target resource reaches the preset number, and send the target ban information to each edge node in the distributed network.

[0033] In one embodiment of the present invention, the target blocking information further includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0034] The IP access control device also includes:

[0035] The blocking release module is used to release the target blocking information when the current time exceeds the expiration time.

[0036] In one embodiment of the present invention, the information determination module includes:

[0037] A global list determination submodule, configured to determine, in response to an access request from a target terminal IP to the target resource, whether the target terminal IP is located in a preset global IP whitelist;

[0038] A release submodule, used for releasing the access request and not counting the target terminal IP into the IP whitelist when it is determined that the target terminal IP is in the global IP whitelist;

[0039] The blocking information determination submodule is used to determine whether there is target blocking information corresponding to the target resource when it is determined that the target terminal IP is not in the global IP whitelist.

[0040] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP; the IP access control device further includes:

[0041] The granularity identification module is used to determine the target blocking information corresponding to the target resource based on the request granularity identification information of the target terminal IP; wherein different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0042] In a third aspect, based on the same inventive concept, an embodiment of the present invention provides an IP access control system, the system comprising a configuration platform, a distributed network and a log cluster, the distributed network comprising at least one edge node; wherein,

[0043] Any of the edge nodes is used to determine, in response to an access request of a target terminal IP to a target resource, whether there is target blocking information corresponding to the target resource, wherein the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; and if it is determined that there is no target blocking information corresponding to the target resource, release the access request of the target terminal IP, and send an access log of the target terminal IP accessing the target resource to a log cluster;

[0044] The log cluster is used to generate target blocking information corresponding to the target resource when it is determined based on the access logs of each edge node in the distributed network that the number of terminal IPs that have accessed the target resource reaches the preset number, and send the target blocking information to the configuration platform;

[0045] The configuration platform is used to send the target blocking information to each edge node in the distributed network;

[0046] Any of the edge nodes is also used to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target ban information corresponding to the target resource; and to release the access request when it is determined that the target terminal IP is in the IP whitelist; and to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

[0047] In a fourth aspect, based on the same inventive concept, an embodiment of the present invention provides a computer-readable storage medium having an executable program stored thereon, and when the executable program is executed by a processor, the IP access control method proposed in the first aspect of the present invention is implemented.

[0048] In a fifth aspect, based on the same inventive concept, an embodiment of the present invention provides an electronic device, including:

[0049] A memory for storing an executable program;

[0050] processor;

[0051] When the executable program is executed by the processor, the IP access control method proposed in the first aspect of the present invention is implemented.

[0052] Compared with the prior art, the present invention has the following advantages:

[0053] An IP access control method provided by an embodiment of the present invention first responds to an access request of a target terminal IP to a target resource, determines whether there is target blocking information corresponding to the target resource, and the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; then, if it is determined that there is target blocking information corresponding to the target resource, determines whether the target terminal IP is in the IP whitelist; finally, if it is determined that the target terminal IP is in the IP whitelist, the access request is released, and if it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected. In the embodiment of the present invention, a preset number of terminal IPs that first access the target resource are stored in the IP whitelist, and target blocking information corresponding to the target resource is generated, so that in subsequent accesses to the target resource, the target terminal IP in the IP whitelist can be successfully accessed, while the target terminal IP that is not in the IP whitelist will be denied access. In this way, by limiting the number of terminal IPs that access the target resource, it is possible to ensure that legitimate users can access the resource normally while effectively preventing the user request from being hotlinked by illegal users, thereby ensuring resource security and avoiding the loss of user resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 It is a flowchart of the steps of an IP access control method in one embodiment of the present invention.

[0056] Figure 2 It is a flowchart of an IP access control method in one embodiment of the present invention.

[0057] Figure 3 It is a functional module diagram of an IP access control device in one embodiment of the present invention.

[0058] Figure 4 It is a structural diagram of an IP access control system in one embodiment of the present invention.

[0059] Figure 5 It is an interactive schematic diagram of an IP access control system in one embodiment of the present invention.

[0060] Figure 6 It is a schematic structural diagram of an electronic device in one embodiment of the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] It should be noted that CDN, as a technology to improve the user's Internet experience, can build a physical and virtual intelligent network based on the Internet by deploying edge nodes in the place closest to the user. Users can access the cache node closest to them, and CDN can optimize the return path and select the shortest return path for users, so that users can quickly obtain the required content, thereby avoiding network congestion, optimizing various data network factors that affect customer experience, and significantly improving various indicators such as data transmission speed and response time. At the same time, for content service providers, by filtering a large number of requests at CDN nodes, the proportion of repeated and homogeneous requests can be significantly reduced, and more computer resources can be used to serve unique requests, effectively reducing the pressure on the source station and reducing corporate costs. And when the service grows explosively, CDN can be used to quickly expand capacity to meet user needs.

[0063] Since CDN carries a large number of user requests, customer businesses are constantly migrating to edge nodes to a certain extent, and abnormal hotlink requests are becoming more and more frequent. Therefore, customers need stricter security policies to deal with illegal user access.

[0064] In related technologies, various enterprises will add some general or customized authentication strategies for resource access to prevent their resources from being stolen. The authentication strategies may include the following strategies:

[0065] ① Local authentication strategy.

[0066] The local authentication strategy may specifically include two strategies: requesting encryption or calculating digital signatures and requesting feature authentication.

[0067] Request encryption or calculation of digital signature: Requests are encrypted or signed to prevent them from being tampered with, and resource requests are made to expire after a period of time with an expiration timestamp to prevent them from being reused for a long time. However, if a request is hotlinked, it can still be misused within the time limit.

[0068] Request feature authentication: Authenticate the feature information carried in the request, such as the request header (such as user-agent, referer, etc.), the client request IP (release a specific IP, or block a specific IP, or block based on IP location, operator) and other information.

[0069] ②Remote authentication strategy.

[0070] The remote authentication strategy centralizes authentication on the client's authentication center server, reducing the possibility of authentication strategy leakage and facilitating unified control by the client. The remote authentication strategy mainly includes synchronous authentication strategy and asynchronous authentication strategy.

[0071] Synchronous authentication strategy: When requesting access to a CDN node, the CDN node synchronously requests the remote authentication server and decides whether to release the request after obtaining the authentication result.

[0072] Asynchronous authentication strategy: When a request is made to access a CDN node, the CDN node first passes the request and then simultaneously initiates an asynchronous request to authenticate the origin server. After obtaining the authentication result, it is cached locally. When the same request is made later, it is determined whether to pass the request based on the local authentication result.

[0073] Although the above authentication strategy can ensure resource security to a certain extent, if the authentication strategy is leaked or hotlinked by unfriendly users, important resources will still be stolen, causing corporate losses. At the same time, the authentication effect of remote authentication varies according to the authentication algorithm used by the authentication source station, but because each request will trigger an authentication request, the requirements for the authentication source station are extremely high. Under high concurrency, extremely high resource consumption is required, and some authentication requests may not be processed in time, resulting in authentication failure or affecting user service experience.

[0074] It should be noted that hotlinking refers to the act of illegally obtaining and using other people's website links, content or services without the authorization of the website or content owner. The resource access requests provided by the content service provider support access within a certain period of time, but it is impossible to distinguish which user initiated it. Therefore, after unfriendly customers hotlink, they can save resource requests, and even after the authentication algorithm is leaked, they can generate a batch of resource requests that can be accessed for a long time and resell resources as middlemen, causing losses to enterprises.

[0075] In view of the problem that the current IP access control method is difficult to ensure the access security of resources, the present invention aims to provide an IP access control method, which stores a preset number of terminal IPs that first access the target resource into an IP whitelist, and generates target blocking information corresponding to the target resource, so that in the subsequent access to the target resource, the target terminal IP in the IP whitelist can access smoothly, while the target terminal IP not in the IP whitelist will be denied access. In this way, by limiting the number of terminal IPs accessing the target resource, it is possible to effectively prevent user requests from being hotlinked while ensuring that legitimate users can access the resource normally, thereby ensuring resource security and avoiding the loss of user resources.

[0076] Reference Figure 1 , shows a flow chart of the steps of an IP access control method of the present invention, which is applied to any edge node in a distributed network, and the method may include the following steps:

[0077] S101: In response to an access request from a target terminal IP to a target resource, determining whether there is target blocking information corresponding to the target resource.

[0078] In this embodiment, the distributed network includes at least one edge node. When a user initiates an access request for a target resource through a target terminal IP, the distributed network will determine the edge node closest to the target terminal IP in at least one edge node, and use the edge node to receive the target terminal IP's access request for the target resource. Among them, the distributed network can be a CDN (content distribution network), and the edge node can be a CDN node in the CDN. It should be noted that this embodiment does not limit the specific types of distributed networks and edge nodes.

[0079] In this embodiment, after receiving the access request of the target terminal IP to the target resource, the edge node will determine whether there is target blocking information corresponding to the target resource locally.

[0080] It should be noted that the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource. In other words, the target blocking information is generated when the number of terminal IPs accessing the target resource reaches a preset number.

[0081] Specifically, if the edge node detects that there is no target blocking information corresponding to the target resource locally, it means that the number of terminal IPs that first access the target resource has not reached the preset number. At this time, the edge node will release the access request of the target terminal IP, so that the user can access the target resource normally.

[0082] Specifically, if the edge node detects that there is target blocking information corresponding to the target resource locally, it means that the number of terminal IPs that first access the target resource has reached the preset number. Since in normal user usage scenarios, the same resource request should not be initiated from a large number of different terminal IPs, it is necessary to authenticate the target terminal IP to prevent the target resource from being accessed by abnormal target terminal IPs.

[0083] S102: When it is determined that there is target blocking information corresponding to the target resource, determine whether the target terminal IP is in the IP whitelist.

[0084] In this embodiment, considering that when the target ban information exists, a preset number of terminal IPs have accessed the target resources, at this time, in order to prevent the target resources from being stolen by a large number of illegal users from different terminal IPs, the target terminal IP will be authenticated according to the IP whitelist in the target ban information.

[0085] In a specific implementation, the edge node will compare the target terminal IP with a preset number of terminal IPs in the IP whitelist one by one to determine whether the target terminal IP is in the IP whitelist.

[0086] S103: When it is determined that the target terminal IP is in the IP whitelist, the access request is allowed.

[0087] In this embodiment, if the edge node detects that the target terminal IP is already in the IP whitelist, it means that the target terminal IP is a legitimate IP that has first accessed the target resource. At this time, the access request will be released, and the target resource will be provided to the target terminal IP based on the access request, so that the user who initiates the access request through the target terminal IP can enjoy the resource service normally.

[0088] S104: If it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected.

[0089] In this embodiment, if the edge node detects that the target terminal IP is not in the IP whitelist, the target terminal IP's access request for the target resource may be an illegal request generated by an illegal user after deciphering the authentication algorithm. At this time, in order to ensure resource security, the edge node will reject the access request to prevent the target resource from being obtained by illegal users.

[0090] The embodiment of the present application stores a preset number of terminal IPs that first access the target resource into an IP whitelist, and generates target blocking information corresponding to the target resource, so that in subsequent accesses to the target resource, the target terminal IPs in the IP whitelist can access smoothly, while the target terminal IPs that are not in the IP whitelist will be denied access. In this way, by limiting the number of terminal IPs that access the target resource, it can ensure that normal users can access the target resource first, and effectively prevent the occurrence of hotlinking. Even if the authentication policy and key are leaked, it can still effectively prevent the target resource from being accessed by a large number of illegal users, thereby ensuring resource security to the greatest extent and avoiding the loss of user resources.

[0091] In a feasible implementation manner, the IP access control method may further include the following steps:

[0092] S201: When it is determined that there is no target ban information corresponding to the target resource, the access request of the target terminal IP is released, and the access log of the target terminal IP accessing the target resource is sent to the log cluster, so that the log cluster can generate the target ban information corresponding to the target resource when it is determined based on the access logs of each edge node in the distributed network that the number of terminal IPs that have accessed the target resource reaches a preset number, and send the target ban information to each edge node in the distributed network.

[0093] In this embodiment, if the edge node detects that there is no target blocking information corresponding to the target resource locally, it means that the number of terminal IPs that first access the target resource has not reached the preset number. At this time, the edge node will release the access request of the target terminal IP and send the access log of the target terminal IP accessing the target resource to the log cluster.

[0094] In this embodiment, the log cluster can obtain the access logs of each edge node in the distributed network in a streaming log collection manner. Among them, streaming log collection refers to the process of real-time and continuous collection and processing of access logs. This collection method is particularly suitable for scenarios that require real-time monitoring and analysis of log data. In other words, after any edge node generates an access log, the access log can be immediately captured and processed by the log cluster.

[0095] It should be noted that the log cluster is a server cluster that specializes in processing disk files. The disk file can be used to store the access logs of each edge node and the ban information of each resource. The log cluster can count the log information of one or more edge nodes in the distributed network by node or range according to the actual configuration requirements.

[0096] In this embodiment, the log cluster can collect the access logs of each edge node in real time or periodically, and then timely count the number of terminal IPs that first access the target resource, and when it is detected that the number of terminal IPs that have accessed the target resource reaches a preset number, generate the target ban information corresponding to the target resource, and send the target ban information to each edge node in the distributed network. Based on the interactive relationship between the edge node and the log cluster, it can reduce the dependence on computing resources while ensuring the availability of the ban in the case of large concurrent user requests. Compared with the request interactive relationship between the edge node and the authentication center required for remote authentication, it can ensure the user's access speed, thereby avoiding affecting the service effect of the user's request.

[0097] In this embodiment, in order to achieve uniform distribution of target ban information to each edge node, the log cluster may send the target ban information to the configuration platform, so that the configuration platform sends the target ban information to each edge node in the distributed network.

[0098] In the specific implementation, after generating the target ban information, the log cluster can call the configuration platform interface to pass the ban information to the configuration platform. After obtaining the target ban information, the configuration platform can send the target ban information to the edge nodes of the entire network by calling the ban information interface provided by the edge node. Among them, the target ban information can include the request unique identifier and the IP whitelist.

[0099] It should be noted that the unique identifier of the request is used to distinguish whether the request is the same request, and can be configured by the edge node according to the customer business. For example, if two access requests carry the same unique identifiers such as user ID, device ID, digital signature, etc., they can be considered to be the same request initiated by a certain user; for another example, a user accesses a fixed video through an APP (application) and initiates access at different times. Each time, it will carry a different expiration timestamp based on the current time and carry the user's characteristic information. At this time, based on the different expiration timestamps, the access requests initiated at different times can be regarded as different requests.

[0100] In this embodiment, by setting up a log cluster, timely collection of access logs of each edge node in the distributed network can be achieved, and corresponding target ban information can be generated; by setting up a configuration platform, unified distribution of target ban information in the entire network can be achieved.

[0101] In a feasible implementation, the target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time; and the IP access control method may further include the following steps:

[0102] S301: When the current time exceeds the expiration time, the target blocking information is released.

[0103] In this implementation, the log cluster will count a preset number of terminal IPs that first access the target resource in the current statistical period according to a preset statistical period, and calculate the expiration time after sending the target ban information according to the statistical period.

[0104] Exemplarily, when the statistical period is set to 24h, the preset number is set to 5, and the log cluster starts statistics at 12:00 on November 20, 2024, the expiration time is calculated to be 12:00 on the 21st. Then, within the 24 hours between 12:00 on the 20th and 12:00 on the 21st, only a maximum of 5 terminal IPs are allowed to access the target resources, and after the current time exceeds 12:00 on the 21st, the target ban information is lifted and the next statistical period is entered.

[0105] It should be noted that the lifting of target blocking information means that each edge node in the distributed network invalidates the target blocking information, that is, the target blocking information corresponding to the target resource will no longer exist locally. In this way, after the current time exceeds the expiration time, a preset number of terminal IPs will be allowed to access the target resource again in the next statistical period, and when the number of terminal IPs accessing the target resource reaches the preset number, new target blocking information will be generated.

[0106] In this embodiment, by setting an expiration time in the target ban information, not only can the dynamic ban of the terminal IP accessing the target resource be achieved, but also the availability of the target resource can be improved while ensuring resource security, so that normal users can successfully access the target resource at different times.

[0107] In a feasible implementation, S101 may specifically include the following sub-steps:

[0108] S101 - 1 : In response to an access request from a target terminal IP to a target resource, determining whether the target terminal IP is located in a preset global IP whitelist.

[0109] In this embodiment, the global IP whitelist is stored in each edge node in the distributed network. The global IP whitelist includes one or more preset terminal IPs, and the global IP whitelists stored in different edge nodes may be the same or different.

[0110] It should be noted that the global IP whitelist does not have an expiration time. Each edge node can configure a global IP whitelist of different granularities according to user needs, such as configuring a global IP whitelist at the domain name granularity. At this time, the preset terminal IP in the global IP whitelist can directly access the target resource indicated by the domain name.

[0111] In a specific implementation, after receiving an access request from a target terminal IP for a target resource, the edge node will first compare the target terminal IP with each preset terminal IP in a locally stored global IP whitelist to determine whether the target terminal IP is in the preset global IP whitelist.

[0112] S101 - 2 : When it is determined that the target terminal IP is in the global IP whitelist, the access request is allowed, and the target terminal IP is not included in the IP whitelist.

[0113] In this embodiment, if the edge node detects that the target terminal IP is in the global IP whitelist, it directly releases the access request and does not count the target terminal IP into the IP whitelist. In other words, the preset terminal IP in the global IP whitelist does not occupy the quota in the IP whitelist.

[0114] S101 - 3 : When it is determined that the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource.

[0115] In this embodiment, if the edge node detects that the target terminal IP is not in the global IP whitelist, it is necessary to further authenticate the target terminal IP, and then determine whether the target terminal IP is in the IP whitelist in the target ban information by obtaining the target ban information corresponding to the target resource.

[0116] For ease of understanding, the following combination Figure 2 The IP access control method provided by the embodiment of the present invention is explained. Figure 2 , shows a flow chart of the IP access control method provided by an embodiment of the present invention.

[0117] like Figure 2 As shown, after receiving the access request initiated by the user for the target resource through the target terminal IP, the edge node will first determine whether the target terminal IP is in the global IP whitelist. If it is in the global IP whitelist, the request will be released and the service will be provided normally; if it is not in the global IP whitelist, the blocking information will be extracted from the shared memory. If it is detected that there is no blocking information, the request will be released and the service will be provided normally; if it is detected that there is blocking information, it will further determine whether the target terminal IP is in the IP whitelist in the blocking information. If it is in the IP whitelist, the request will be released and the service will be provided normally; if it is not in the IP whitelist, the request will be rejected.

[0118] In this embodiment, no matter whether the edge node releases the request or rejects the request, it will generate corresponding log data and write the log data to the disk in the log cluster. If the log cluster determines that the number of terminal IPs that have accessed the target resource has reached a preset number based on the access logs of each edge node in the distributed network stored in the disk, it will generate an IP whitelist, calculate the expiration time based on the statistical period, and then generate blocking information including the IP whitelist and the expiration time, and call the configuration platform interface to pass the blocking information to the configuration platform. The configuration platform will send the blocking information to the shared memory of each edge node in the distributed network through the blocking interface of each edge node, so as to realize the local storage of the blocking information, and when the current time exceeds the expiration time, the blocking information is released by initializing the blocking information.

[0119] It should be noted that edge nodes refer to any virtual nodes or physical nodes that can access user requests and are responsible for security policies, which may include but are not limited to CDN nodes; the logs of edge nodes are not limited to the specific description of the access logs of access requests, but are string records of the request feature information and the landing disk files of the required ban information; the log cluster is a server cluster that specializes in processing these disk files; the configuration platform refers to a server cluster that interacts with all edge nodes in a unified manner and issues ban information instructions.

[0120] In a feasible implementation manner, the access request further includes request granularity identification information of the target terminal IP; the IP access control method may further include the following steps:

[0121] S401: Determine target blocking information corresponding to a target resource based on request granularity identification information of a target terminal IP.

[0122] In this embodiment, the edge node can flexibly adjust the blocking granularity by identifying the request granularity identification information of the target terminal IP in the access request, thereby realizing blocking management of different granularities. The request granularity identification information can be configured according to business needs.

[0123] It should be noted that different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities. In other words, the log cluster can simultaneously count the number of terminal IPs with different request granularity identification information, and then generate target blocking information of different granularities.

[0124] In one example, the target resource is a video resource, and the request granularity identification information can be configured as a membership level, and the higher the membership level, the larger the preset number. In this way, users with higher membership levels can be allowed to access video resources on more terminal devices and through more terminal IPs.

[0125] In another example, the target resource is an enterprise file, and the request granularity identification information can be configured as a department ID, and different department IDs can be configured with different preset numbers. In this way, the preset number can be flexibly adjusted according to the number of people and / or security requirements of different departments. For example, a department with a larger number of people can be allowed to access enterprise files on more terminal devices and through more terminal IPs; or, for a department with higher confidentiality requirements, a smaller preset number can be set so that only a few terminal IPs in the department can access enterprise files, thereby avoiding leakage of enterprise files.

[0126] An IP access control method provided by an embodiment of the present invention has the following beneficial effects:

[0127] (1) It is possible to customize the request characteristics, IP restriction number, statistical period and other information of the access request. The request characteristics may include a unique request identifier to distinguish whether the request is the same access request, and then only allow terminal IPs within the restricted number to access the target resource within the statistical period. After the number of terminal IPs that have accessed reaches the preset number, the blocking information containing the IP whitelist, blocking expiration time and request characteristic information is automatically generated and sent to each edge node globally to achieve global automatic blocking triggered by customer requests, effectively preventing the occurrence of hotlinking. Even if the authentication policy and key are leaked, if a large number of different terminal IPs are identified to initiate the same request for the target resource, they will all be rejected, which can still effectively prevent the target resource from being accessed by a large number of illegal users, thereby ensuring resource security to the greatest extent and avoiding the loss of user resources.

[0128] (2) The edge node is responsible for blocking user requests and storing logs on disk. The log cluster collects log files stored on disk, counts blocking information and reports it. The configuration platform is responsible for issuing blocking instructions. Based on the interactive relationship between the configuration platform, log cluster and edge nodes, blocking information can be issued to the entire network, and the scope of issuance can be flexibly determined based on the node and range statistics of the log cluster, achieving flexible and adjustable blocking granularity, that is, it can achieve network-wide blocking, cluster-based blocking or node-based blocking. Compared with the http request interactive relationship between the edge node and the authentication center required for remote authentication, it can effectively optimize the interaction and processing flow, avoid the occurrence of authentication failure due to insufficient computing resources in large concurrency, and reduce the dependence on computing resources while ensuring the availability of the ban, thereby avoiding affecting the service effect of user requests.

[0129] (3) The edge node can execute multiple blocking policies on the same service based on business needs. For example, if the log carries multiple types of request information, each log message can count two or more blocking information. The blocked request feature information, number of IP whitelists, and blocking time can be the same or different, thereby achieving blocking at different request granularities.

[0130] In the second aspect, based on the same inventive concept, refer to Figure 3 The embodiment of the present invention provides an IP access control device 300, which is applied to any edge node in a distributed network. The IP access control device 300 includes:

[0131] The information determination module 301 is used to determine whether there is target blocking information corresponding to the target resource in response to the target terminal IP's access request to the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0132] A list determination module 302 is used to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target blocking information corresponding to the target resource;

[0133] The request release module 303 is used to release the access request when it is determined that the target terminal IP is in the IP whitelist;

[0134] The request rejection module 304 is used to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

[0135] In one embodiment of the present invention, the IP access control device 300 further includes:

[0136] The access log generation module is used to release the access request of the target terminal IP when it is determined that there is no target ban information corresponding to the target resource, and send the access log of the target terminal IP accessing the target resource to the log cluster, so that the log cluster can generate the target ban information corresponding to the target resource when it is determined based on the access logs of each edge node in the distributed network that the number of terminal IPs that have accessed the target resource reaches a preset number, and send the target ban information to each edge node in the distributed network.

[0137] In one embodiment of the present invention, the target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0138] The IP access control device 300 further includes:

[0139] The ban release module is used to release the target ban information when the current time exceeds the expiration time.

[0140] In one embodiment of the present invention, the information determination module 301 includes:

[0141] A global list determination submodule, for determining whether the target terminal IP is in a preset global IP whitelist in response to an access request of the target terminal IP to the target resource;

[0142] The release submodule is used to release the access request when it is determined that the target terminal IP is in the global IP whitelist, and not count the target terminal IP into the IP whitelist;

[0143] The blocking information determination submodule is used to determine whether there is target blocking information corresponding to the target resource when it is determined that the target terminal IP is not in the global IP whitelist.

[0144] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP; the IP access control device 300 further includes:

[0145] The granularity identification module is used to determine the target blocking information corresponding to the target resource based on the request granularity identification information of the target terminal IP; wherein different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0146] It should be noted that the specific implementation of an IP access control device 300 in an embodiment of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the above-mentioned embodiment of the present invention, and will not be repeated here.

[0147] Thirdly, refer to Figure 4Based on the same inventive concept, an embodiment of the present invention provides an IP access control system 400, the IP access control system 400 includes a configuration platform 401, a distributed network 402 and a log cluster 403, and the distributed network 402 includes at least one edge node 4021.

[0148] Any edge node 4021 is used to respond to the target terminal IP's access request for the target resource, determine whether there is target blocking information corresponding to the target resource, the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; and if it is determined that there is no target blocking information corresponding to the target resource, release the access request of the target terminal IP, and send the access log of the target terminal IP accessing the target resource to the log cluster 403;

[0149] The log cluster 403 is used to generate target blocking information corresponding to the target resource when it is determined that the number of terminal IPs that have accessed the target resource reaches a preset number based on the access logs of each edge node 4021 in the distributed network 402, and send the target blocking information to the configuration platform 401;

[0150] Configuration platform 401, used to send target blocking information to each edge node 4021 in distributed network 402;

[0151] Any edge node 4021 is also used to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target blocking information corresponding to the target resource; and to release the access request when it is determined that the target terminal IP is in the IP whitelist; and to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

[0152] The specific implementation of the IP access control system 400 of the embodiment of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the embodiment of the present invention, which will not be repeated here.

[0153] In this embodiment, based on the interactive relationship between the configuration platform 401, the log cluster 403 and each edge node 4021 of the distributed network 402, when the number of terminal IPs that first access the target resource reaches a preset number, the ban information can be sent to the entire network, thereby effectively preventing user requests from being hotlinked, thereby ensuring resource security and avoiding the loss of user resources.

[0154] In a feasible implementation, the distributed network may be a CDN, and the edge node may be a CDN node. Figure 5 , showing an interactive schematic diagram of an IP access control system based on a CDN network.

[0155] In this embodiment, the configuration platform can issue a ban instruction containing ban information to multiple CDN nodes in the entire network by calling the ban information interface provided by the CDN node, where the ban information includes a request unique identifier (which can be represented by a key), an IP whitelist list, and an expiration time. The following is an example of the data structure of the ban information issued by the ban information interface:

[0156]

[0157]

[0158] It should be noted that in the above examples, host represents the restricted host domain name; url represents the specific URL path restricted under the host; whitelist represents the IP whitelist list that is allowed to access the above URL; expire_ts represents the timestamp of the expiration time in seconds. The timestamp represents the UTC time, and the specific date and time can be obtained by conversion.

[0159] In this implementation, the CDN node can query the blocking information through a blocking information query interface. A possible example of the blocking information query interface is shown below:

[0160] GET / block_url_ip / get

[0161] GET / block_url_ip / status

[0162] Query the limited number of URLs:

[0163] GEThttp: / / xxx.xxxx.com / block_url_ip / status. This interface is used to query the number of restricted URLs in the system. When a GET request is sent to this URL, the system will return the number of currently restricted URLs.

[0164] Query a piece of information: Specify the cache key:

[0165] GEThttp: / / xxx.xxxx.com / block_url_ip / get? cachekey=escape_cachekey. This interface is used to query the ban information corresponding to a specific cache key. By specifying cachekey in the query parameter of the request, whose value is the specific cache key to be queried, the system will return the ban information associated with the cache key.

[0166] Return all information:

[0167] GEThttp: / / xxx.xxxx.com / block_url_ip / get. This interface is used to return a complete list of all restricted URLs and IP addresses in the system. When you send a GET request to this URL, the system will return a list of all blocked information.

[0168] In this embodiment, if the user wants to obtain the global IP whitelist issued globally while obtaining the whitelist normally, so as not to be blocked, the query can be performed through the following file path:

[0169] File path: / usr / local / openresty / nginx / conf / xxx / domain_whitelist.conf

[0170] In this implementation, each item in the global IP whitelist includes a domain name and a corresponding terminal IP address, which are separated by |. The following is an example of the file format of the global IP whitelist:

[0171] test.com|127.0.0.1

[0172] a.com|8.8.8.8

[0173] b.com|2400:da00::6666

[0174] It should be noted that in the above-mentioned global IP whitelist, it is indicated that the latter terminal IP address is allowed to access the resources pointed to by the former domain name.

[0175] After issuing the global IP whitelist, you can load the content by executing the following command:

[0176] / shmtable_oper write domain_whitelist 1domain_whitelist.conf

[0177] It should be noted that this instruction is used to load the contents of the global IP whitelist into shared memory so that CDN nodes can read and use these configurations. Here, shmtable_oper is a tool used to operate shared memory tables. write is a command of the tool used to write data. domain_whitelist is the name of the shared memory table, 1 is the index or ID of the table, and domain_whitelist.conf is the file path containing the global IP whitelist. After executing this instruction, the CDN node will be able to allow or deny terminal IP access requests to target resources based on the global IP whitelist defined in the domain_whitelist.conf file.

[0178] In this implementation, the CDN node can be configured by the following code:

[0179] plugin_lua_functionup_rewritemdd_block_url_ip{

[0180] - (Read operation) index of [API sent URL-IP list]. (Consistent with the interface agreement for sending log statistics).

[0181] - Determine whether the request is the same request identifier

[0182] cache_key="host.￥accid￥uri￥arg_sign",

[0183] - (Read operation) index of [Global IP Whitelist] (the content control interface is issued according to this rule).

[0184] - The content is consistent with the file content format of the IP global whitelist

[0185] whitelist_index="￥host|￥remote_addr",

[0186] --When the ban occurs, the status code returned to the user

[0187] forbidden_code=403,

[0188] }

[0189] It should be noted that the above code indicates that when the CDN node processes the request, it determines whether the request should be allowed or denied based on the URL-IP list and the global IP whitelist. If the requested terminal IP is not in the global IP whitelist, and the requested URL and IP combination is in the banned list, the CDN node will return a 403 status code to the user to inform that access is denied.

[0190] In this implementation, the log cluster can obtain IP whitelist information by counting the following field information and report it to the configuration platform:

[0191] Log field 1: Preset number, i.e. the number of IP whitelist restrictions. For example, the actual value is 2, which means that 2 terminal IPs are restricted to access. If the actual value is empty, 0 or other values, the log is not included in the statistics. If the key is the same but the number of restrictions is different, the first one shall prevail.

[0192] Log field 2: Statistical period (unit: h). If the actual value is 2, for example, it will expire after 2 hours. Re-statistics will be performed and the expiration time after the ban is issued will be calculated.

[0193] Log field 3: URL part of the key, actual value is as follows:

[0194] / vttbucket / 7EFiN1KG_2502395753_uhd.mp4?ts=1574212728&rid=f17f3fb4b9d3028236f2ad1a6c913d30&rl=2&rs=0158a45cc97f41&sign=5c32125b0b1b61adefd1763decab584e.

[0195] Log field 4: Domain name, which can be an overlapping domain name. The actual value is, for example:

[0196] test.com.test.com.fafdrfwer234234sdfs

[0197] In this embodiment, through the above configuration, the CDN node can be responsible for the blocking of user requests and the storage of logs; the log cluster can collect the log files stored on the disk, and count the blocking information and report it; the configuration platform can complete the issuance of blocking instructions. In this way, it is possible to dynamically limit the number of terminal IPs accessing the target resources and achieve global automatic blocking.

[0198] In a fourth aspect, based on the same inventive concept, an embodiment of the present invention provides a computer-readable storage medium having an executable program stored thereon, which, when executed by a processor, implements the IP access control method proposed in the first aspect of the present invention.

[0199] It should be noted that the specific implementation of the computer-readable storage medium in the embodiment of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the embodiment of the present invention, and will not be repeated here.

[0200] Fifth, refer to Figure 6 Based on the same inventive concept, an embodiment of the present invention provides an electronic device 600, including:

[0201] Memory 601, used for storing executable programs;

[0202] Processor 602;

[0203] When the executable program is executed by the processor 602, the IP access control method proposed in the first aspect of the present invention is implemented.

[0204] It should be noted that the specific implementation of the electronic device 600 in the embodiment of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the embodiment of the present invention, which will not be repeated here.

[0205] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0206] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0207] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0209] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0210] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0211] The above is a detailed introduction to an IP access control method, device, system, storage medium and electronic device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An IP access control method, characterized in that: Applied to any edge node in a distributed network, the method includes: In response to an access request from a target terminal IP to a target resource, determining whether there is target blocking information corresponding to the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; In the case where it is determined that there is target blocking information corresponding to the target resource, determining whether the target terminal IP is in the IP whitelist; If it is determined that the target terminal IP is in the IP whitelist, allowing the access request; If it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected.

2. The IP access control method according to claim 1, characterized in that: The method further comprises: When it is determined that there is no target ban information corresponding to the target resource, the access request of the target terminal IP is released, and the access log of the target terminal IP accessing the target resource is sent to the log cluster, so that the log cluster determines that the number of terminal IPs that have accessed the target resource reaches the preset number based on the access logs of each edge node in the distributed network, and generates the target ban information corresponding to the target resource, and sends the target ban information to each edge node in the distributed network.

3. The IP access control method according to claim 2, characterized in that: Sending the target blocking information to each edge node in the distributed network includes: The target blocking information is sent to a configuration platform, so that the configuration platform sends the target blocking information to each edge node in the distributed network.

4. The IP access control method according to claim 1, characterized in that: The target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time; The method further comprises: When the current time exceeds the expiration time, the target blocking information is released.

5. The IP access control method according to claim 1, characterized in that: In response to an access request from a target terminal IP to the target resource, determining whether there is target blocking information corresponding to the target resource includes: In response to an access request from a target terminal IP to the target resource, determining whether the target terminal IP is located in a preset global IP whitelist; When it is determined that the target terminal IP is in the global IP whitelist, the access request is released, and the target terminal IP is not included in the IP whitelist; When it is determined that the target terminal IP is not in the global IP whitelist, it is determined whether there is target blocking information corresponding to the target resource.

6. The IP access control method according to claim 1, characterized in that: The access request also includes request granularity identification information of the target terminal IP; The method further comprises: Based on the request granularity identification information of the target terminal IP, the target blocking information corresponding to the target resource is determined; wherein different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

7. An IP access control device, characterized in that: Applied to any edge node in a distributed network, the device comprises: An information determination module, configured to determine whether there is target blocking information corresponding to the target resource in response to an access request of a target terminal IP to a target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; A list determination module, configured to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target blocking information corresponding to the target resource; A request release module, used to release the access request when it is determined that the target terminal IP is in the IP whitelist; The request rejection module is used to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

8. An IP access control system, characterized in that: The system includes a configuration platform, a distributed network and a log cluster, wherein the distributed network includes at least one edge node; wherein, Any of the edge nodes is used to determine, in response to an access request of a target terminal IP to a target resource, whether there is target blocking information corresponding to the target resource, wherein the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; and if it is determined that there is no target blocking information corresponding to the target resource, release the access request of the target terminal IP, and send an access log of the target terminal IP accessing the target resource to a log cluster; The log cluster is used to generate target blocking information corresponding to the target resource when it is determined based on the access logs of each edge node in the distributed network that the number of terminal IPs that have accessed the target resource reaches the preset number, and send the target blocking information to the configuration platform; The configuration platform is used to send the target blocking information to each edge node in the distributed network; Any of the edge nodes is also used to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target ban information corresponding to the target resource; and to release the access request when it is determined that the target terminal IP is in the IP whitelist; and to reject the access request when it is determined that the target terminal IP is not in the IP whitelist.

9. A computer-readable storage medium having an executable program stored thereon, characterized in that: When the executable program is executed by the processor, the IP access control method according to any one of claims 1 to 6 is implemented.

10. An electronic device, characterized in that: include: A memory for storing an executable program; processor; When the executable program is executed by the processor, the IP access control method according to any one of claims 1 to 6 is implemented.

Images