IP access control methods, devices, systems, storage media, and electronic devices

Abstract

This invention provides an IP access control method, apparatus, system, storage medium, and electronic device, belonging to the field of communication technology. In this embodiment, a preset number of terminal IPs that first access a target resource are stored in an IP whitelist, and target blocking information corresponding to the target resource is generated. In subsequent accesses to the target resource, if the target terminal IP is determined to be in the IP whitelist of the target blocking information, access to the target resource is allowed; if the target terminal IP is not determined to be in the IP whitelist of the target blocking information, access to the target resource is denied. Thus, by limiting the number of terminal IPs accessing the target resource, legitimate users can access the resource normally while effectively preventing unauthorized users from hotlinking user requests, thereby ensuring resource security and preventing the loss of user resources.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an IP access control method, apparatus, system, storage medium, and electronic device. Background Technology

[0002] A Content Delivery Network (CDN) is a distributed network interconnected by the internet, designed to provide fast and reliable content delivery services. By deploying edge nodes across multiple geographical locations, a CDN redirects data requests to the nearest edge node when a user requests data. This reduces data transmission distance and thus speeds up loading.

[0003] As CDNs handle a large number of user requests and customer businesses continue to migrate to edge nodes, the security of resource access to edge nodes is becoming increasingly important.

[0004] In related technologies, authentication policies are typically implemented to verify access requests in order to prevent resource theft. However, if the authentication policy is leaked or exploited by malicious users, critical resources can still be stolen, causing losses to the enterprise. Summary of the Invention

[0005] This invention provides an IP access control method, apparatus, system, storage medium, and electronic device to solve the problem that current IP access control methods are unable to guarantee the security of resource access.

[0006] To solve the above problems, the present invention adopts the following technical solution:

[0007] In a first aspect, embodiments of the present invention provide an IP access control method applicable to any edge node within a distributed network, the method comprising:

[0008] In response to an access request from a target terminal IP for a target resource, determine whether there is target blocking information corresponding to the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0009] If it is determined that target blocking information corresponding to the target resource exists, determine whether the target terminal IP is in the IP whitelist;

[0010] If the target terminal IP is determined to be in the IP whitelist, the access request is allowed;

[0011] If it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected.

[0012] In one embodiment of the present invention, the method further includes:

[0013] If it is determined that there is no target blocking information corresponding to the target resource, the access request of the target terminal IP is allowed, and the access log of the target terminal IP accessing the target resource is sent to the log cluster. So that the log cluster, based on the access logs of each edge node in the distributed network, determines that the number of terminal IPs that have accessed the target resource has reached the preset number, generates target blocking information corresponding to the target resource, and sends the target blocking information to each edge node in the distributed network.

[0014] In one embodiment of the present invention, sending the target blocking information to each edge node in the distributed network includes:

[0015] The target blocking information is sent to the configuration platform, so that the configuration platform can distribute the target blocking information to each edge node in the distributed network.

[0016] In one embodiment of the present invention, the target blocking information further includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0017] The method further includes:

[0018] If the current time exceeds the expiration time, the target blocking information will be lifted.

[0019] In one embodiment of the present invention, in response to an access request from a target terminal IP for the target resource, determining whether target blocking information corresponding to the target resource exists includes:

[0020] In response to an access request from a target terminal IP address for the target resource, determine whether the target terminal IP address is in a preset global IP whitelist;

[0021] If it is determined that the target terminal IP is in the global IP whitelist, the access request is allowed, and the target terminal IP is not added to the IP whitelist.

[0022] If it is determined that the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource.

[0023] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP;

[0024] The method further includes:

[0025] Based on the request granularity identifier information of the target terminal IP, the target blocking information corresponding to the target resource is determined; wherein, different request granularity identifier information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0026] Secondly, based on the same inventive concept, embodiments of the present invention provide an IP access control device, applicable to any edge node within a distributed network, the device comprising:

[0027] The information determination module is used to determine whether target blocking information corresponding to the target resource exists in response to the access request of the target terminal IP for the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0028] The list determination module is used to determine whether the target terminal IP is in the IP whitelist when it is determined that target blocking information corresponding to the target resource exists;

[0029] The request-to-allow module is used to allow the access request if it is determined that the target terminal IP is in the IP whitelist;

[0030] The request denial module is used to deny the access request if it is determined that the target terminal IP is not in the IP whitelist.

[0031] In one embodiment of the present invention, the IP access control device further includes:

[0032] The access log generation module is used to allow the access request of the target terminal IP when it is determined that there is no target blocking information corresponding to the target resource, and send the access log of the target terminal IP accessing the target resource to the log cluster, so that the log cluster, based on the access logs of each edge node in the distributed network, determines that the number of terminal IPs that have accessed the target resource has reached the preset number, generates target blocking information corresponding to the target resource, and sends the target blocking information to each edge node in the distributed network.

[0033] In one embodiment of the present invention, the target blocking information further includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0034] The IP access control device further includes:

[0035] The ban removal module is used to remove the target ban information if the current time exceeds the expiration time.

[0036] In one embodiment of the present invention, the information determination module includes:

[0037] The global list determination submodule is used to determine whether the target terminal IP is in a preset global IP whitelist in response to the target terminal IP's access request for the target resource;

[0038] The allow submodule is used to allow the access request and not add the target terminal IP to the IP whitelist if it is determined that the target terminal IP is in the global IP whitelist.

[0039] The blocking information determination submodule is used to determine whether there is target blocking information corresponding to the target resource when the target terminal IP is not in the global IP whitelist.

[0040] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP; the IP access control device further includes:

[0041] The granularity identification module is used to determine the target blocking information corresponding to the target resource based on the request granularity identification information of the target terminal IP; wherein, different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0042] Thirdly, based on the same inventive concept, embodiments of the present invention provide an IP access control system, the system comprising a configuration platform, a distributed network, and a log cluster, wherein the distributed network includes at least one edge node; wherein...

[0043] Any of the aforementioned edge nodes is configured to, in response to an access request from a target terminal IP for a target resource, determine whether there is target blocking information corresponding to the target resource, wherein the target blocking information includes an IP whitelist of a preset number of terminal IPs that have accessed the target resource first; and if it is determined that there is no target blocking information corresponding to the target resource, allow the access request from the target terminal IP and send the access log of the target terminal IP accessing the target resource to the log cluster;

[0044] The log cluster is used to generate target blocking information corresponding to the target resource when the number of terminal IPs that have accessed the target resource reaches the preset number based on the access logs of each edge node in the distributed network, and then send the target blocking information to the configuration platform.

[0045] The configuration platform is used to distribute the target blocking information to each edge node in the distributed network;

[0046] Any of the aforementioned edge nodes is further configured to, if it is determined that target blocking information corresponding to the target resource exists, determine whether the target terminal IP is in the IP whitelist; and if it is determined that the target terminal IP is in the IP whitelist, allow the access request, and if it is determined that the target terminal IP is not in the IP whitelist, reject the access request.

[0047] Fourthly, based on the same inventive concept, embodiments of the present invention provide a computer-readable storage medium having an executable program stored thereon, wherein the executable program, when executed by a processor, implements the IP access control method proposed in the first aspect of the present invention.

[0048] Fifthly, based on the same inventive concept, embodiments of the present invention provide an electronic device, comprising:

[0049] Memory, used to store executable programs;

[0050] processor;

[0051] When the executable program is executed by the processor, the IP access control method proposed in the first aspect of the present invention is implemented.

[0052] Compared with the prior art, the present invention has the following advantages:

[0053] This invention provides an IP access control method that, in response to an access request from a target terminal IP for a target resource, first determines whether target blocking information corresponding to the target resource exists. The target blocking information includes a whitelist of IPs belonging to a preset number of terminal IPs that have previously accessed the target resource. Then, if target blocking information exists, it determines whether the target terminal IP is in the IP whitelist. Finally, if the target terminal IP is in the IP whitelist, the access request is allowed; otherwise, the access request is denied. This invention stores a preset number of terminal IPs that have previously accessed the target resource in an IP whitelist and generates target blocking information corresponding to the target resource. This ensures that in subsequent accesses to the target resource, target terminal IPs in the IP whitelist can access the resource successfully, while those not in the whitelist are denied access. By limiting the number of terminal IPs that can access the target resource, this invention effectively prevents unauthorized users from accessing the resource while ensuring legitimate users can access it normally, thus guaranteeing resource security and preventing the loss of user resources. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart of the steps of an IP access control method according to an embodiment of the present invention.

[0056] Figure 2 This is a flowchart illustrating an IP access control method according to an embodiment of the present invention.

[0057] Figure 3 This is a schematic diagram of the functional modules of an IP access control device according to an embodiment of the present invention.

[0058] Figure 4 This is a schematic diagram of the structure of an IP access control system according to an embodiment of the present invention.

[0059] Figure 5 This is an interactive schematic diagram of an IP access control system according to an embodiment of the present invention.

[0060] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] It's important to note that CDN, as a technology to improve the user's online experience, constructs a physical and virtual intelligent network layer built on top of the internet by deploying edge nodes as close to users as possible. Users can access the nearest cache node, and CDN can optimize the origin pull path, selecting the shortest route for users to quickly obtain the content they need. This avoids network congestion, optimizes various data network factors that affect customer experience, and significantly improves data transmission speed, response time, and other metrics. For content service providers, filtering a large number of requests through CDN nodes significantly reduces the proportion of duplicate and homogeneous requests, allocating more computing resources to unique requests, effectively reducing pressure on the origin server and lowering costs. Furthermore, during periods of explosive service growth, CDN can be used for rapid capacity expansion to meet user demand.

[0063] As CDNs handle a large number of user requests and customer businesses are migrating to edge nodes to some extent, abnormal hotlinking requests are occurring more and more frequently. Therefore, customers need stricter security strategies to deal with unauthorized access.

[0064] In related technologies, various enterprises, in order to prevent their resources from being stolen, will add general or customized authentication policies to resource access. Specific authentication policies may include the following:

[0065] ① Local authentication strategy.

[0066] Local authentication strategies can specifically include two types: requesting encryption or computation of digital signatures and requesting feature authentication.

[0067] Encrypting or calculating a digital signature for a request prevents its tampering and adds an expiration timestamp, causing the resource request to expire after a certain period and preventing long-term reuse. However, if a request is hotlinked, it can still be stolen before its expiration period.

[0068] Request feature authentication: Authentication is performed on the feature information carried in the request, such as the request header (e.g., user-agent, referer, etc.) and the client's request IP (allowing specific IPs, blocking specific IPs, or blocking based on IP location and carrier).

[0069] ② Remote authentication strategy.

[0070] Remote authentication policies centralize authentication at the client's authentication center server, reducing the possibility of authentication policy leakage and facilitating unified control by the client. Remote authentication policies mainly include synchronous authentication policies and asynchronous authentication policies.

[0071] Synchronous authentication strategy: When a request is made to access a CDN node, the CDN node synchronously requests a remote authentication server, obtains the authentication result, and then decides whether to allow the request.

[0072] Asynchronous authentication strategy: When a request is made to access a CDN node, the CDN node first allows the request, and then simultaneously initiates an asynchronous request to authenticate the origin server. After obtaining the authentication result, it is cached locally. Subsequent identical requests are then evaluated based on the local authentication result to determine whether to allow the request.

[0073] While the aforementioned authentication strategies can guarantee resource security to a certain extent, if these strategies are leaked or malicious users hotlink them, critical resources can still be misused, causing losses to the enterprise. Furthermore, the effectiveness of remote authentication varies depending on the authentication algorithm used by the origin server. However, because each request triggers an authentication request, the requirements for the origin server are extremely high. Under high concurrency, this requires very high resource consumption and may lead to some authentication requests not being processed in a timely manner, resulting in authentication failure or impacting the user experience.

[0074] It's important to clarify that hotlinking refers to the act of illegally obtaining and using links to other websites, content, or services without authorization from the website or content owner. Content service providers offer resource access requests that are supported for a certain period, but they cannot distinguish which user initiated the request. Therefore, unfriendly customers who hotlink can save these resource requests, and even if the authentication algorithm is leaked, they can generate a batch of resource requests that are accessible for an extended period and resell the resources as intermediaries, thus causing losses to the company.

[0075] To address the issue that current IP access control methods struggle to guarantee resource access security, this invention aims to provide an IP access control method. This method involves storing a preset number of terminal IPs that initially access a target resource in an IP whitelist and generating corresponding target blocking information. This ensures that subsequent accesses to the target resource are only permitted to be made by terminal IPs on the whitelist, while those not on the whitelist are denied access. By limiting the number of terminal IPs that can access the target resource, legitimate users can access the resource normally while effectively preventing hotlinking of user requests, thus ensuring resource security and preventing the loss of user resources.

[0076] Reference Figure 1 The diagram illustrates a flowchart of an IP access control method according to the present invention. This method is applied to any edge node within a distributed network and may include the following steps:

[0077] S101: In response to the target terminal IP's access request for the target resource, determine whether there is target blocking information corresponding to the target resource.

[0078] In this embodiment, the distributed network includes at least one edge node. When a user initiates an access request for a target resource via a target terminal IP address, the distributed network determines the edge node closest to the location of the target terminal IP address among the at least one edge node, and uses that edge node to receive the access request for the target resource from the target terminal IP address. The distributed network can be a CDN (Content Delivery Network), and the edge node can be a CDN node within the CDN. It should be noted that this embodiment does not limit the specific types of the distributed network and edge nodes.

[0079] In this embodiment, after receiving an access request from a target terminal IP address for a target resource, the edge node will determine whether there is target blocking information corresponding to the target resource on its local machine.

[0080] It should be noted that the target blocking information includes a whitelist of IPs representing a preset number of terminal IPs that have accessed the target resource first. In other words, the target blocking information is generated when the number of terminal IPs accessing the target resource reaches the preset number.

[0081] Specifically, if an edge node detects that there is no target blocking information for the target resource locally, it means that the number of terminal IPs that have initially accessed the target resource has not yet reached the preset number. In this case, the edge node will allow the access request from the target terminal IP, enabling the user to access the target resource normally.

[0082] Specifically, if an edge node detects target blocking information for a target resource on its local machine, it indicates that the number of terminal IPs that have accessed the target resource has reached a preset limit. Since it's undesirable for a large number of different terminal IPs to initiate the same resource request under normal user conditions, it's necessary to authenticate the target terminal IPs to prevent access to the target resource from abnormal terminal IPs.

[0083] S102: If it is determined that there is target blocking information corresponding to the target resource, determine whether the target terminal IP is in the IP whitelist.

[0084] In this embodiment, considering that a preset number of terminal IPs have already accessed the target resource when the target blocking information exists, in order to prevent the target resource from being stolen by a large number of illegal users from different terminal IPs, the target terminal IP will be authenticated according to the IP whitelist in the target blocking information.

[0085] In practice, the edge node compares the target terminal IP with a preset number of terminal IPs in the IP whitelist to determine if the target terminal IP is in the IP whitelist.

[0086] S103: If the target terminal IP is determined to be in the IP whitelist, allow the access request.

[0087] In this implementation, if the edge node detects that the target terminal IP is already in the IP whitelist, it means that the target terminal IP is a legitimate IP that has already accessed the target resource. At this time, the access request will be allowed, and the target resource will be provided to the target terminal IP according to the access request, so that the user who initiates the access request through the target terminal IP can enjoy the resource service normally.

[0088] S104: If the target terminal IP is not in the IP whitelist, the access request is denied.

[0089] In this implementation, if an edge node detects that the target terminal's IP address is not on the IP whitelist, the access request from that target terminal's IP address to the target resource may be an illegal request generated by an unauthorized user after cracking the authentication algorithm. In this case, to ensure resource security, the edge node will reject the access request to prevent the target resource from being obtained by an unauthorized user.

[0090] This application embodiment stores a preset number of terminal IPs that first access the target resource in an IP whitelist and generates target blocking information corresponding to the target resource. This ensures that in subsequent accesses to the target resource, target terminal IPs in the IP whitelist can access it successfully, while target terminal IPs not in the IP whitelist will be denied access. Thus, by limiting the number of terminal IPs accessing the target resource, it ensures that legitimate users can access the target resource first, while effectively preventing hotlinking. Even if authentication policies and keys are leaked, it can still effectively prevent the target resource from being accessed by a large number of unauthorized users, thereby maximizing resource security and preventing the loss of user resources.

[0091] In one feasible implementation, the IP access control method may further include the following steps:

[0092] S201: If it is determined that there is no target blocking information corresponding to the target resource, the access request of the target terminal IP is allowed, and the access log of the target terminal IP accessing the target resource is sent to the log cluster. This allows the log cluster to generate target blocking information corresponding to the target resource when the number of terminal IPs that have accessed the target resource reaches a preset number based on the access logs of each edge node in the distributed network. The target blocking information is then sent to each edge node in the distributed network.

[0093] In this implementation, if an edge node detects that there is no target blocking information corresponding to the target resource locally, it means that the number of terminal IPs that have accessed the target resource has not yet reached the preset number. At this time, while allowing the access request of the target terminal IP, the edge node will also send the access log of the target terminal IP accessing the target resource to the log cluster.

[0094] In this embodiment, the log cluster can acquire access logs from various edge nodes within the distributed network using streaming log collection. Streaming log collection refers to the real-time, continuous collection and processing of access logs, a method particularly suitable for scenarios requiring real-time monitoring and analysis of log data. In other words, once any edge node generates an access log, that log can be immediately captured and processed by the log cluster.

[0095] It should be noted that the log cluster is a server cluster specifically designed for processing disk files. These disk files can be used to store access logs from various edge nodes and blocking information for various resources. The log cluster can, according to actual configuration requirements, statistically analyze the log information of one or more edge nodes in the distributed network, segmented by node and range.

[0096] In this implementation, the log cluster can collect access logs from each edge node in real time or periodically, thereby promptly counting the number of terminal IPs that first access the target resource. When the number of terminal IPs accessing the target resource reaches a preset threshold, target blocking information corresponding to the target resource is generated and sent to each edge node in the distributed network. Based on the interaction between the edge nodes and the log cluster, the availability of blocking can be guaranteed while reducing dependence on computing resources under high-concurrency user requests. Compared to the request interaction between edge nodes and the authentication center required for remote authentication, this approach ensures user access speed and avoids impacting the service effect of user requests.

[0097] In this embodiment, in order to achieve the same distribution of target blocking information to each edge node, the log cluster can send the target blocking information to the configuration platform, so that the configuration platform can distribute the target blocking information to each edge node in the distributed network.

[0098] In the implementation, after generating the target blocking information, the log cluster can call the configuration platform interface to pass the blocking information to the configuration platform. After obtaining the target blocking information, the configuration platform can then call the blocking information interface provided by the edge nodes to distribute the target blocking information to all edge nodes in the network. The target blocking information may include a unique request identifier and an IP whitelist.

[0099] It should be noted that the unique request identifier is used to distinguish whether requests are the same, and can be configured by the edge nodes according to the customer's business. For example, if two access requests carry the same unique identifiers such as user ID, device ID, and digital signature, they can be considered as the same request initiated by the same user. As another example, if a user accesses a fixed video through an APP (application) and initiates access at different times, each time it will carry a different expiration timestamp based on the current time, along with the user's characteristic information. In this case, based on the different expiration timestamps, access requests initiated at different times can be regarded as different requests.

[0100] In this embodiment, by setting up a log cluster, the access logs of each edge node in the distributed network can be collected in a timely manner, and corresponding target blocking information can be generated; by setting up a configuration platform, the target blocking information can be uniformly distributed throughout the network.

[0101] In one feasible implementation, the target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time; the IP access control method may further include the following steps:

[0102] S301: If the current time has exceeded the expiration time, remove the target blocking information.

[0103] In this implementation, the log cluster will count the preset number of terminal IPs that first access the target resource within the current statistical period according to the preset statistical period, and calculate the expiration time after sending the target blocking information according to the statistical period.

[0104] For example, if the statistical period is set to 24 hours and the preset number is set to 5, and the log cluster starts statistics at 12:00 on November 20, 2024, then the expiration time is calculated to be 12:00 on November 21. In the 24 hours from 12:00 on November 20 to 12:00 on November 21, only a maximum of 5 terminal IPs are allowed to access the target resource. After the current time exceeds 12:00 on November 21, the target blocking information will be lifted and the next statistical period will begin.

[0105] It should be noted that removing the target blocking information means that each edge node in the distributed network invalidates the target blocking information, meaning that the target blocking information corresponding to the target resource no longer exists locally. Thus, after the current time expires, a preset number of terminal IPs will be allowed to access the target resource again in the next statistical period. Once the number of terminal IPs accessing the target resource reaches the preset number, new target blocking information will be generated.

[0106] In this embodiment, by setting an expiration time for the target blocking information, not only can the terminal IPs accessing the target resources be dynamically blocked, but the availability of the target resources can also be improved while ensuring resource security, so that normal users can access the target resources smoothly at different times.

[0107] In one feasible implementation, S101 may specifically include the following sub-steps:

[0108] S101-1: In response to the target terminal IP's access request for the target resource, determine whether the target terminal IP is in the preset global IP whitelist.

[0109] In this embodiment, the global IP whitelist is stored on various edge nodes within the distributed network. This global IP whitelist includes one or more preset terminal IPs, and the global IP whitelists stored on different edge nodes can be the same or different.

[0110] It should be noted that the global IP whitelist does not have an expiration time. Each edge node can configure a global IP whitelist with different granularities according to user needs. For example, it can be configured as a global IP whitelist at the domain level. In this case, the preset terminal IPs located in the global IP whitelist can directly access the target resources indicated by the domain name.

[0111] In the specific implementation, after receiving an access request from the target terminal IP for the target resource, the edge node will first compare the target terminal IP with each preset terminal IP in the locally stored global IP whitelist to determine whether the target terminal IP is in the preset global IP whitelist.

[0112] S101-2: If it is determined that the target terminal IP is in the global IP whitelist, allow the access request and do not add the target terminal IP to the IP whitelist.

[0113] In this implementation, if an edge node detects that the target terminal IP is in the global IP whitelist, it will directly allow the access request and will not add the target terminal IP to the IP whitelist. In other words, the preset terminal IP in the global IP whitelist will not occupy a slot in the IP whitelist.

[0114] S101-3: If it is determined that the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource.

[0115] In this embodiment, if the edge node detects that the target terminal IP is not in the global IP whitelist, it needs to perform further authentication on the target terminal IP. Then, by obtaining the target blocking information corresponding to the target resource, it can determine whether the target terminal IP is in the IP whitelist in the target blocking information.

[0116] For ease of understanding, the following is combined with Figure 2 The IP access control method provided in the embodiments of the present invention will be explained. (Refer to...) Figure 2 The diagram shows a flowchart of the IP access control method provided in an embodiment of the present invention.

[0117] like Figure 2 As shown, when an edge node receives an access request from a user targeting a specific resource via the target terminal's IP address, it first checks whether the target terminal's IP address is in the global IP whitelist. If it is, the request is allowed, and service is provided normally. If it is not in the global IP whitelist, the node retrieves blocking information from shared memory. If no blocking information is detected, the request is allowed, and service is provided normally. If blocking information is detected, the node further checks whether the target terminal's IP address is in the IP whitelist within the blocking information. If it is in the IP whitelist, the request is allowed, and service is provided normally. If it is not in the IP whitelist, the request is rejected.

[0118] In this implementation, edge nodes generate corresponding log data for both allowing and denying requests, and write the log data to the disk in the log cluster. If the log cluster determines, based on the access logs of each edge node in the distributed network stored on the disk, that the number of terminal IPs that have accessed the target resource has reached a preset number, it will generate an IP whitelist, calculate the expiration time according to the statistical period, and then generate blocking information containing the IP whitelist and the expiration time. It will then call the configuration platform interface to pass the blocking information to the configuration platform. The configuration platform will then distribute the blocking information to the shared memory of each edge node in the distributed network through the blocking interface of each edge node, thus realizing the local writing of the blocking information to the disk. When the current time exceeds the expiration time, the blocking information will be released by initializing the blocking information.

[0119] It should be noted that edge nodes refer to any virtual or physical node that can access user requests and is responsible for security policies, including but not limited to CDN nodes; edge node logs are not limited to specific descriptions of access request logs, but rather to string records of request characteristic information and the blocking information required for implementation on disk files; the log cluster is a server cluster specifically for processing these disk files; and the configuration platform refers to a server cluster that uniformly interacts with all edge nodes and issues blocking information commands.

[0120] In one feasible implementation, the access request also includes request granularity identification information of the target terminal IP; the IP access control method may further include the following steps:

[0121] S401: Based on the request granularity identification information of the target terminal IP, determine the target blocking information corresponding to the target resource.

[0122] In this embodiment, edge nodes can flexibly adjust the blocking granularity by identifying the request granularity identifier information of the target terminal IP in the access request, thereby achieving blocking management at different granularities. The request granularity identifier information can be configured according to business requirements.

[0123] It should be noted that different request granularity identifiers correspond to different blocking information, and different blocking information corresponds to different preset quantities. In other words, the log cluster can simultaneously count the number of terminal IPs with different request granularity identifiers, and then generate target blocking information of different granularities.

[0124] In one example, the target resource is a video resource, and the request granularity identifier can be configured as a membership level, with higher membership levels resulting in a larger preset quantity. This allows users with higher membership levels to access video resources on more terminal devices through more terminal IPs.

[0125] In another example, the target resource is an enterprise file, and the request granularity identifier can be configured as a department identifier. Different department identifiers can be configured with different preset quantities. This allows for flexible adjustment of the preset quantities based on the number of employees and / or security needs of different departments. For example, departments with more employees can be allowed to access enterprise files on more terminal devices through more terminal IPs; or, for departments with higher confidentiality requirements, a smaller preset quantity can be set, ensuring that only a few terminal IPs in that department can access the enterprise files, thereby preventing the leakage of enterprise files.

[0126] The IP access control method provided in this embodiment of the invention has the following beneficial effects:

[0127] (1) It can customize access request characteristics, IP limit quantity, statistical period, and other information. Request characteristics can include a unique request identifier to distinguish whether requests are identical. Within the statistical period, only a limited number of terminal IPs are allowed to access the target resource. Once the number of accessed terminal IPs reaches a preset limit, it automatically generates a blocking message containing an IP whitelist, blocking expiration time, and request characteristics, and globally distributes it to all edge nodes. This achieves globally automated blocking triggered by client requests, effectively preventing hotlinking. Even if authentication policies and keys are leaked, if a large number of different terminal IPs initiate identical requests to the target resource, all will be rejected, effectively preventing the target resource from being accessed by a large number of unauthorized users, thus maximizing resource security and preventing the loss of user resources.

[0128] (2) Edge nodes are responsible for blocking user requests and writing logs to disk. The log cluster collects the written log files, compiles and reports blocking information, and the configuration platform is responsible for issuing blocking commands. Based on the interaction between the configuration platform, the log cluster, and the edge nodes, blocking information can be distributed across the entire network. The distribution scope can be flexibly determined according to the node-specific and range-specific statistics of the log cluster, achieving flexible and adjustable blocking granularity. This means that blocking can be implemented across the entire network, or by cluster or node. Compared to the HTTP request interaction between edge nodes and the authentication center required for remote authentication, this effectively optimizes the interaction and processing flow, avoiding authentication failures due to insufficient computing resources under high concurrency. While ensuring the availability of blocking, it reduces the dependence on computing resources, thereby avoiding the impact on the service effect of user requests.

[0129] (3) Edge nodes can execute multiple blocking strategies on the same service according to business needs. For example, logs carry multiple types of request information, and each log information can count two or more blocking information. The blocking request characteristics, number of IP whitelists, and blocking time can be the same or different, thereby achieving blocking at different request granularities.

[0130] Secondly, based on the same inventive concept, and referring to... Figure 3 This invention provides an IP access control device 300, applicable to any edge node within a distributed network. The IP access control device 300 includes:

[0131] The information determination module 301 is used to determine whether there is target blocking information corresponding to the target resource in response to the access request of the target terminal IP for the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource;

[0132] The list determination module 302 is used to determine whether the target terminal IP is in the IP whitelist when it is determined that there is target blocking information corresponding to the target resource;

[0133] The request to allow module 303 is used to allow access requests if it is determined that the target terminal IP is in the IP whitelist;

[0134] The request denial module 304 is used to deny access requests if it is determined that the target terminal IP is not in the IP whitelist.

[0135] In one embodiment of the present invention, the IP access control device 300 further includes:

[0136] The access log generation module is used to allow access requests from target terminal IPs when it is determined that no target blocking information corresponding to the target resource exists, and to send access logs of target terminal IPs accessing the target resource to the log cluster. This allows the log cluster to generate target blocking information corresponding to the target resource when it determines that the number of terminal IPs that have accessed the target resource has reached a preset number based on the access logs of each edge node in the distributed network, and then send the target blocking information to each edge node in the distributed network.

[0137] In one embodiment of the present invention, the target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time;

[0138] The IP access control device 300 also includes:

[0139] The ban removal module is used to remove target ban information if the current time has exceeded the expiration time.

[0140] In one embodiment of the present invention, the information determination module 301 includes:

[0141] The global list determination submodule is used to determine whether the target terminal IP is in the preset global IP whitelist in response to the target terminal IP's access request for the target resource;

[0142] The Allow submodule is used to allow access requests and not add the target terminal IP to the IP whitelist if it is determined that the target terminal IP is in the global IP whitelist.

[0143] The blocking information determination submodule is used to determine whether there is a target blocking information corresponding to the target resource when the target terminal IP is not in the global IP whitelist.

[0144] In one embodiment of the present invention, the access request further includes request granularity identification information of the target terminal IP; the IP access control device 300 further includes:

[0145] The granularity identification module is used to determine the target blocking information corresponding to the target resource based on the request granularity identification information of the target terminal IP. Different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

[0146] It should be noted that the specific implementation of the IP access control device 300 of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the present invention, and will not be repeated here.

[0147] Thirdly, referring to Figure 4Based on the same inventive concept, an embodiment of the present invention is shown to provide an IP access control system 400, which includes a configuration platform 401, a distributed network 402 and a log cluster 403. The distributed network 402 includes at least one edge node 4021.

[0148] Any edge node 4021 is used to respond to the access request of the target terminal IP for the target resource, determine whether there is target blocking information corresponding to the target resource, the target blocking information includes the IP whitelist of a preset number of terminal IPs that first access the target resource; and if it is determined that there is no target blocking information corresponding to the target resource, allow the access request of the target terminal IP, and send the access log of the target terminal IP accessing the target resource to the log cluster 403.

[0149] Log cluster 403 is used to generate target blocking information corresponding to the target resource when the number of terminal IPs that have accessed the target resource reaches a preset number, based on the access logs of each edge node 4021 in the distributed network 402, and send the target blocking information to the configuration platform 401.

[0150] The configuration platform 401 is used to distribute target blocking information to each edge node 4021 in the distributed network 402;

[0151] Any edge node 4021 is also used to determine whether the target terminal IP is in the IP whitelist if the target blocking information corresponding to the target resource exists; and if the target terminal IP is in the IP whitelist, to allow the access request, and to deny the access request if the target terminal IP is not in the IP whitelist.

[0152] The specific implementation of the IP access control system 400 of this invention refers to the specific implementation of the IP access control method proposed in the first aspect of the present invention, and will not be repeated here.

[0153] In this embodiment, based on the interaction relationship between the configuration platform 401, the log cluster 403, and the various edge nodes 4021 of the distributed network 402, when the number of terminal IPs that first access the target resource reaches a preset number, the blocking information can be distributed across the entire network, thereby effectively preventing user requests from being stolen, ensuring resource security, and preventing the loss of user resources.

[0154] In one feasible implementation, the distributed network can be a CDN, and the edge nodes can be CDN nodes, see reference. Figure 5 This diagram illustrates the interaction of an IP access control system based on a CDN network.

[0155] In this implementation, the configuration platform can send blocking commands containing blocking information to multiple CDN nodes across the network by calling the blocking information interface provided by the CDN nodes. This blocking information includes a unique request identifier (which can be represented by a key), an IP whitelist, and an expiration time. The following is an example of the data structure of the blocking information sent by the blocking information interface:

[0156]

[0157]

[0158] It should be noted that in the above example, host represents the restricted host domain name; url represents the specific URL path under the host that is restricted; whitelist represents the whitelist of IPs that are allowed to access the above URL; expire_ts represents the timestamp of the expiration time in seconds. This timestamp represents UTC time, which can be converted to obtain the specific date and time.

[0159] In this implementation, CDN nodes can query blocking information through a blocking information query interface. The following shows a possible example of the blocking information query interface:

[0160] GET / block_url_ip / get

[0161] GET / block_url_ip / status

[0162] The number of URLs that can be queried is limited.

[0163] The `GET http: / / xxx.xxxx.com / block_url_ip / status` API is used to query the number of URLs restricted by the system. When a GET request is sent to this URL, the system returns the number of currently restricted URLs.

[0164] Query a specific message: specify the cache key:

[0165] The API call `GET http: / / xxx.xxxx.com / block_url_ip / get?cachekey=escape_cachekey` retrieves blocking information associated with a specific cache key. By specifying `cachekey` as a query parameter in the request, with its value being the desired cache key, the system will return the blocking information associated with that cache key.

[0166] Return all information:

[0167] The GET request to http: / / xxx.xxxx.com / block_url_ip / get API is used to return a complete list of all restricted URLs and IP addresses in the system. When you send a GET request to this URL, the system will return a list of all blocked information.

[0168] In this implementation, if a user wishes to obtain both the normally obtained whitelist and the globally distributed global IP whitelist to avoid being blocked, they can query the following file path:

[0169] File path: / usr / local / openresty / nginx / conf / xxx / domain_whitelist.conf

[0170] In this implementation, each entry in the global IP whitelist contains a domain name and a corresponding terminal IP address, separated by a "|". The following is an example of the global IP whitelist file format:

[0171] test.com|127.0.0.1

[0172] a.com|8.8.8.8

[0173] b.com|2400:da00::6666

[0174] It should be noted that in the above global IP whitelist, it means that the latter terminal IP address is allowed to access the resources pointed to by the former domain name.

[0175] After the global IP whitelist is distributed, the content can be loaded by executing the following command:

[0176] / shmtable_oper write domain_whitelist 1domain_whitelist.conf

[0177] It's important to note that this command loads the global IP whitelist into shared memory so that CDN nodes can read and use these configurations. Here, `shmtable_oper` is a tool used to manipulate the shared memory table. `write` is a command within this tool used to write data. `domain_whitelist` is the name of the shared memory table, 1 is the table's index or ID, and `domain_whitelist.conf` is the file path containing the global IP whitelist. After executing this command, the CDN node will be able to allow or deny access requests from endpoint IPs for target resources based on the global IP whitelist defined in the `domain_whitelist.conf` file.

[0178] In this implementation, CDN nodes can be configured using the following code:

[0179] plugin_lua_functionup_rewritemdd_block_url_ip{

[0180] -- Index of (read operations) for [API distribution URL-IP list]. (Consistent with the interface convention for log statistics distribution).

[0181] -- An identifier to determine whether the requests are from the same person

[0182] cache_key="host.￥accid￥uri￥arg_sign",

[0183] -- Index of (read operations) of [Global IP Whitelist] (Content control interface is issued according to this rule).

[0184] --The content should be in the same format as the IP global whitelist file.

[0185] whitelist_index="￥host|￥remote_addr",

[0186] --The status code returned to the user when the account is blocked.

[0187] forbidden_code=403,

[0188] }

[0189] It should be noted that the code above indicates that when processing a request, the CDN node determines whether the request should be allowed or denied based on the URL-IP list and the global IP whitelist. If the requesting endpoint IP is not in the global IP whitelist, and the requested URL and IP combination is in the blocked list, the CDN node will return a 403 status code to the user to indicate that access has been denied.

[0190] In this implementation, the log cluster can obtain IP whitelist information by statistically analyzing the following fields and then report it to the configuration platform:

[0191] Log field 1: Preset quantity, which is the limit on the number of IPs in the whitelist. For example, a value of 2 restricts access by 2 terminal IPs. An empty value, 0, or any other value will not be included in the statistics. If the key is the same but the limit is different, the first record will prevail.

[0192] Log field 2: Statistical period (unit: h). For example, a value of 2 means that the data will expire in 2 hours, and the statistics will be recalculated and the expiration time after the ban is issued will be calculated.

[0193] Log field 3: The URL part of the key, the actual value is as follows:

[0194] / vttbucket / 7EFiN1KG_2502395753_uhd.mp4? ts=1574212728&rid=f17f3fb4b9d3028236f2ad1a6c913d30&rl=2&rs=0158a45cc97f41&sign=5c32125b0b1b61adefd1763decab584e.

[0195] Log field 4: Domain name, which can be an overlapping domain name. For example, the actual value could be:

[0196] test.com.test.com.fafdrfwer234234sdfs

[0197] In this implementation, the above configuration enables CDN nodes to handle blocking user requests and writing logs to disk; the log cluster can collect the written log files, compile blocking information, and report it; and the configuration platform can issue blocking commands. This allows for dynamic limiting of the number of terminal IPs accessing the target resource, achieving globally automated blocking.

[0198] Fourthly, based on the same inventive concept, embodiments of the present invention provide a computer-readable storage medium having an executable program stored thereon, wherein the executable program, when executed by a processor, implements the IP access control method proposed in the first aspect of the present invention.

[0199] It should be noted that the specific implementation of the computer-readable storage medium in the embodiments of the present invention refers to the specific implementation of the IP access control method proposed in the first aspect of the embodiments of the present invention, and will not be repeated here.

[0200] Fifthly, refer to Figure 6 Based on the same inventive concept, embodiments of the present invention provide an electronic device 600, comprising:

[0201] Memory 601 is used to store executable programs;

[0202] Processor 602;

[0203] When the executable program is executed by the processor 602, the IP access control method proposed in the first aspect of the present invention is implemented.

[0204] It should be noted that the specific implementation of the electronic device 600 in this embodiment refers to the specific implementation of the IP access control method proposed in the first aspect of the present invention, and will not be repeated here.

[0205] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0206] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0207] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0209] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0210] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the element.

[0211] The above provides a detailed description of the IP access control method, apparatus, system, storage medium, and electronic device provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An IP access control method, characterized in that, The method, applicable to any edge node within a distributed network, includes: In response to an access request from a target terminal IP for a target resource, determine whether there is target blocking information corresponding to the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; If it is determined that target blocking information corresponding to the target resource exists, determine whether the target terminal IP is in the IP whitelist; If the target terminal IP is determined to be in the IP whitelist, the access request is allowed; If it is determined that the target terminal IP is not in the IP whitelist, the access request is rejected; If it is determined that there is no target blocking information corresponding to the target resource, the access request of the target terminal IP is allowed, and the access log of the target terminal IP accessing the target resource is sent to the log cluster. If the log cluster determines that the number of terminal IPs that have accessed the target resource has reached the preset number based on the access logs of each edge node in the distributed network, the target blocking information corresponding to the target resource is generated and the target blocking information is sent to each edge node in the distributed network. The step of responding to an access request from a target terminal IP address for the target resource and determining whether target blocking information exists for the target resource includes: In response to an access request from a target terminal IP address for the target resource, determine whether the target terminal IP address is in a preset global IP whitelist; If it is determined that the target terminal IP is in the global IP whitelist, the access request is allowed, and the target terminal IP is not added to the IP whitelist. If it is determined that the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource.

2. The IP access control method according to claim 1, characterized in that, Sending the target blocking information to each edge node in the distributed network includes: The target blocking information is sent to the configuration platform, so that the configuration platform can distribute the target blocking information to each edge node in the distributed network.

3. The IP access control method according to claim 1, characterized in that, The target blocking information also includes an expiration time; the IP whitelist includes a preset number of terminal IPs that first accessed the target resource before the expiration time; The method further includes: If the current time exceeds the expiration time, the target blocking information will be lifted.

4. The IP access control method according to claim 1, characterized in that, The access request also includes request granularity identification information of the target terminal IP; The method further includes: Based on the request granularity identification information of the target terminal IP, the target blocking information corresponding to the target resource is determined; wherein, different request granularity identification information corresponds to different blocking information, and different blocking information corresponds to different preset quantities.

5. An IP access control device, characterized in that, The device, applicable to any edge node within a distributed network, comprises: The information determination module is used to determine whether target blocking information corresponding to the target resource exists in response to the access request of the target terminal IP for the target resource; the target blocking information includes an IP whitelist of a preset number of terminal IPs that first access the target resource; The list determination module is used to determine whether the target terminal IP is in the IP whitelist when it is determined that target blocking information corresponding to the target resource exists; The request-to-allow module is used to allow the access request if it is determined that the target terminal IP is in the IP whitelist; The request denial module is used to deny the access request if it is determined that the target terminal IP is not in the IP whitelist; If it is determined that there is no target blocking information corresponding to the target resource, the access request of the target terminal IP is allowed, and the access log of the target terminal IP accessing the target resource is sent to the log cluster. If the log cluster determines that the number of terminal IPs that have accessed the target resource has reached the preset number based on the access logs of each edge node in the distributed network, the target blocking information corresponding to the target resource is generated and the target blocking information is sent to each edge node in the distributed network. The step of responding to an access request from a target terminal IP address for the target resource and determining whether target blocking information exists for the target resource includes: In response to an access request from a target terminal IP address for the target resource, determine whether the target terminal IP address is in a preset global IP whitelist; If it is determined that the target terminal IP is in the global IP whitelist, the access request is allowed, and the target terminal IP is not added to the IP whitelist. If it is determined that the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource.

6. An IP access control system, characterized in that, The system includes a configuration platform, a distributed network, and a log cluster, wherein the distributed network includes at least one edge node; wherein... Any of the aforementioned edge nodes is configured to, in response to an access request from a target terminal IP for a target resource, determine whether the target terminal IP is in a preset global IP whitelist; if the target terminal IP is in the global IP whitelist, allow the access request and do not add the target terminal IP to the IP whitelist; if the target terminal IP is not in the global IP whitelist, determine whether there is target blocking information corresponding to the target resource, the target blocking information including a whitelist of IPs of a preset number of terminal IPs that first accessed the target resource; and if there is no target blocking information corresponding to the target resource, allow the access request from the target terminal IP and send the access log of the target terminal IP accessing the target resource to the log cluster. The log cluster is used to generate target blocking information corresponding to the target resource when the number of terminal IPs that have accessed the target resource reaches the preset number based on the access logs of each edge node in the distributed network, and then send the target blocking information to the configuration platform. The configuration platform is used to distribute the target blocking information to each edge node in the distributed network; Any of the aforementioned edge nodes is further configured to, if it is determined that target blocking information corresponding to the target resource exists, determine whether the target terminal IP is in the IP whitelist; and if it is determined that the target terminal IP is in the IP whitelist, allow the access request, and if it is determined that the target terminal IP is not in the IP whitelist, reject the access request.

7. A computer-readable storage medium having an executable program stored thereon, characterized in that, When the executable program is executed by the processor, it implements the IP access control method as described in any one of claims 1-4.

8. An electronic device, characterized in that, include: Memory, used to store executable programs; processor; When the executable program is executed by the processor, the IP access control method as described in any one of claims 1-4 is implemented.

Images