Dynamic cloud password card data processing method, electronic equipment and storage medium

Abstract

The invention provides a dynamic cloud password card data processing method, electronic equipment and a storage medium, and the method comprises the steps: determining the total number of times per unit time and the total packet length per unit time, determining a first voucher generation rate and a first voucher storage upper limit according to the total number of times per unit time, and determining a second voucher generation rate and a second voucher storage upper limit according to the total packet length per unit time and the total number of times per unit time; determining a second voucher generation rate and a second voucher storage upper limit, generating a first voucher according to the first voucher generation rate and the first voucher storage upper limit, generating a second voucher according to the second voucher generation rate and the second voucher storage upper limit, and obtaining a password resource request; and according to the number of the first vouchers and the number of the second vouchers, determining whether to allocate vouchers for the password resource request, and sending the password resource request to the cloud password card to execute encryption and decryption. By dynamically generating and distributing the first voucher and the second voucher, the service performance of other users is effectively prevented from being reduced or severely stagnated due to the fact that the user encryption traffic is suddenly too large.

Description

Technical Field

[0001] The present application relates to the field of flow control technology, and in particular to a dynamic cloud password card data processing method, electronic device and storage medium. Background Art

[0002] With the development of cloud computing technology, more and more data needs to be encrypted and decrypted through cloud password cards in the cloud. However, traditional cloud password cards do not monitor and limit the number of password requests for cloud services, which may cause the cloud password card to suddenly receive a large number of password requests from a tenant, resulting in the exhaustion of the cloud password card's password resources, and the remaining tenants cannot use the password resources, causing serious business stagnation.

[0003] In the prior art, the problem of password resource overload is solved from the business level and the cloud password card level. Among them, the solution at the business level is to limit password requests directly from the business interface. The cloud password card level uses a static restriction strategy to limit password requests.

[0004] However, the business-level solution needs to consider a variety of factors, including interface characteristics, business logic, and user behavior, making the formulation and implementation of the current limiting strategy relatively complex, resulting in bloated upper-level business, difficult maintenance, and poor limiting effect. The current limiting strategy at the cloud password card level is relatively fixed and difficult to flexibly adjust according to business needs, resulting in poor flexibility of the current limiting strategy. Summary of the invention

[0005] The purpose of this application is to provide a dynamic cloud password card data processing method, electronic device and storage medium to address the deficiencies in the above-mentioned prior art, so as to solve the problems of complex current limiting strategies and poor flexibility in the prior art.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0007] In a first aspect, the present application provides a method for processing data of a dynamic cloud password card, the method comprising:

[0008] Determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0009] Start a times monitor and a packet length monitor, wherein the times monitor determines a first credential generation rate and a first credential storage upper limit according to the total times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit according to the total packet length per unit time and the total times per unit time;

[0010] The number monitor generates at least one first credential according to the first credential generation rate and the first credential storage upper limit, and the packet length monitor generates at least one second credential according to the second credential generation rate and the second credential storage upper limit;

[0011] Obtaining a password resource request sent by a user terminal device;

[0012] Determine whether to allocate a first credential and a second credential to the cryptographic resource request according to the number of the first credentials and the number of the second credentials, and send the cryptographic resource request to the cloud cryptographic card through the business call interface for encryption and decryption.

[0013] Optionally, the determining whether to allocate a first credential and a second credential for the cryptographic resource request according to the number of the first credentials and the number of the second credentials includes:

[0014] Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold;

[0015] If so, a first credential and a second credential are allocated to the cryptographic resource request.

[0016] Optionally, the method further comprises:

[0017] If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, wherein the insufficient credentials policy includes rejecting the cryptographic resource request and a delayed polling policy.

[0018] Optionally, the method further comprises:

[0019] If the delayed polling strategy is executed, the number of polling times is counted;

[0020] Determine whether the polling number is greater than or equal to a number threshold, and if so, send an alarm message to the user terminal device.

[0021] Optionally, determining the first credential generation rate and the first credential storage upper limit according to the total number of times per unit time includes:

[0022] Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient;

[0023] Taking the product of the first quotient and the preset compensation coefficient as the first product;

[0024] The product of the first quotient and the first product is used as the first voucher generation rate;

[0025] The total number of times per unit time is used as the first credential storage upper limit.

[0026] Optionally, determining the second credential generation rate and the second credential storage upper limit according to the total packet length per unit time and the total number of times per unit time includes:

[0027] Taking the quotient of the total packet length per unit time and the total number of times per unit time as the second quotient;

[0028] The product of the second quotient and the preset encryption and decryption performance corresponding to the average packet length is used as the second credential generation rate;

[0029] The product of the length of the unit time and the preset encryption and decryption performance corresponding to the average packet length is taken as the second product;

[0030] The product of the total number of times per unit time and the second product is used as the second credential storage upper limit.

[0031] Optionally, determining the total number of times per unit time and the total packet length per unit time includes:

[0032] Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received;

[0033] If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0034] Optionally, determining the total number of times per unit time and the total packet length per unit time according to the acquired historical logs includes:

[0035] Extract features from the acquired historical logs to obtain traffic vectors;

[0036] The traffic vector is input into the traffic prediction model obtained by pre-training, regression prediction is performed, and the total number of times per unit time and the total packet length per unit time are output.

[0037] Optionally, the traffic prediction model is a random forest model;

[0038] The method of inputting the traffic vector into a pre-trained traffic prediction model, performing regression prediction, and outputting the total number of times per unit time and the total packet length per unit time includes:

[0039] Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length;

[0040] The average value of the total number of times in the prediction results of all decision trees is taken as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is taken as the total packet length per unit time.

[0041] In a second aspect, the present application provides a dynamic cloud password card data processing device, the device comprising:

[0042] The first determination module is used to determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0043] A second determination module is used to start a number monitor and a packet length monitor, wherein the number monitor determines a first credential generation rate and a first credential storage upper limit according to the total number of times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit according to the total packet length per unit time and the total number of times per unit time;

[0044] a generating module, configured to generate at least one first credential by the number monitor according to the first credential generation rate and the first credential storage upper limit, and to generate at least one second credential by the packet length monitor according to the second credential generation rate and the second credential storage upper limit;

[0045] An acquisition module, used to acquire a password resource request sent by a user terminal device;

[0046] The allocation module is used to determine whether to allocate a first credential and a second credential to the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the business call interface to perform encryption and decryption.

[0047] In a third aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps described in the first aspect above.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps described in the first aspect are performed.

[0049] The beneficial effects of the present application are as follows: the number of times monitor and the package length monitor generate the first credential and the second credential according to the total number of times per unit time and the total package length per unit time, respectively, so as to flexibly generate the first credential and the second credential according to the processing performance of the cloud password card from the two perspectives of the total number of times per unit time for encryption and decryption and the total package length per unit time for encryption and decryption of the cloud password card, and on the basis of adapting to the hardware processing conditions of the cloud password card, compared with the current limiting of the business interface layer in the prior art, there is no need to consider factors such as interface characteristics, business logic and user behavior, the logic is simple, applicable to a variety of business scenarios and requirements, and more refined dynamic flow control is achieved. When a password resource request sent by a user terminal device is received, it is determined whether to allocate the first credential and the second credential for the password resource request according to the number of the first credential and the number of the second credential, and the password resource request is sent to the cloud password card through the business call interface to perform encryption and decryption. This embodiment adjusts the rate and upper limit of generating the first credential and the second credential in real time through the number monitor and the packet length monitor, and allocates the first credential and the second credential to the password resource request according to the number of credentials, thereby limiting the data transmission rate through the generation and consumption of credentials, effectively preventing the performance of other users' services from being degraded or seriously stagnant due to sudden excessive traffic during the encryption and decryption process, more comprehensively evaluating the traffic situation and making more reasonable control decisions. In addition, this embodiment is applied in the software middle layer, and can realize the traffic control of multiple cloud password cards without changing the underlying network hardware and the upper application protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 It is a scenario diagram of a dynamic cloud password card data processing method provided in an embodiment of the present application;

[0052] Figure 2 It is a flowchart of a dynamic cloud password card data processing method provided in an embodiment of the present application;

[0053] Figure 3 It is a schematic diagram of a process for determining a first credential generation rate and a first credential storage upper limit provided by an embodiment of the present application;

[0054] Figure 4 It is a schematic diagram of a process for determining a second credential generation rate and a second credential storage upper limit provided by an embodiment of the present application;

[0055] Figure 5 It is a technical architecture diagram of a dynamic cloud password card data processing method provided in an embodiment of the present application;

[0056] Figure 6 It is a flowchart of another dynamic cloud password card data processing method provided in an embodiment of the present application;

[0057] Figure 7 It is a structural schematic diagram of a dynamic cloud password card data processing device provided in an embodiment of the present application;

[0058] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0060] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0061] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0062] In the prior art, in order to avoid the problem of password resource overload, password requests for cloud services can be monitored and restricted at the business level and cloud password card level. However, the solution at the business level needs to comprehensively consider multiple factors, including the characteristics of the user-side interface, business logic, and user behavior, which makes the formulation and implementation of the current limiting strategy relatively complicated, resulting in bloated upper-level business, difficult maintenance, and poor limiting effect. The current limiting strategy at the cloud password card level is relatively fixed and difficult to flexibly adjust according to business needs, resulting in poor flexibility of the current limiting strategy.

[0063] Based on this, the present application proposes a dynamic cloud password card data processing method, which determines the first credential generation rate, the first credential storage upper limit, the second credential generation rate and the second credential storage upper limit based on the determined total number of times per unit time and the total package length per unit time to generate the first credential and the second credential, and when receiving the password resource request sent by the user terminal device, the password resource request is allocated with credentials according to the number of first credentials and the number of second credentials, so that the cloud password card performs encryption and decryption based on the password resource request. The present application generates the first credential and the second credential by referring to the number of processing times per unit time and the package length of the cloud password card, thereby limiting the number of resource requests of a single user, avoiding the cloud password card from being overloaded with password resources due to a single user suddenly sending a large number of password resource requests, which can not only effectively improve the stability of the cloud password card, but also optimize the user experience of multi-tenant cloud services, solving the problem that the traditional cloud password card cannot solve the problem of password resource overload and dynamic peak leading to decreased or even serious stagnation of business processing performance.

[0064] Before introducing the dynamic cloud password card data processing method, please refer to Figure 1 The application scenarios of the dynamic cloud password card data processing method are introduced. Figure 1 Schematic diagram of a scenario of a dynamic cloud password card data processing method provided in an embodiment of the present application. Figure 1 As shown, the dynamic cloud password card data processing method is applied to an electronic device with computing capability, the electronic device is connected to a service call interface, and the service call interface is connected to the cloud password card and the user terminal device respectively. The user terminal device sends a password resource request to the electronic device through the service call interface, the electronic device determines whether to allocate two credentials for the password resource request, and sends the password resource request and the two credentials to the service call interface, the service call interface determines whether the password resource request has two credentials, and if so, sends the password resource request to the cloud password card for encryption and decryption.

[0065] Next, refer to Figure 2 The specific steps of the dynamic cloud password card data processing method are introduced. Figure 2 It is a flow chart of a dynamic cloud password card data processing method provided in an embodiment of the present application.

[0066] S201. Determine the total number of times per unit time and the total package length per unit time. The total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption per unit time. The total package length per unit time is used to indicate the total package length of encryption and decryption performed by the cloud password card per unit time.

[0067] Optionally, the cloud password card is a password device based on a cloud computing environment, which is used to perform encryption and decryption operations in the cloud to ensure the security of cloud data during transmission and storage.

[0068] As an optional implementation, the total number of times per unit time and the total packet length per unit time can be user-defined. Specifically, the user sends the customized total number of times per unit time and the total packet length per unit time to the electronic device through the service call interface via the user terminal device. As another optional implementation, the total number of times per unit time and the total packet length per unit time can be estimated and determined by the traffic prediction module.

[0069] Optionally, the length of the unit time may be preset by the user.

[0070] Optionally, the total number of times per unit time and the total packet length per unit time may be determined according to a preset period.

[0071] S202, start the times monitor and the package length monitor, the times monitor determines the first credential generation rate and the first credential storage upper limit according to the total times per unit time, and the package length monitor determines the second credential generation rate and the second credential storage upper limit according to the total package length per unit time and the total times per unit time.

[0072] Specifically, after the number monitor and the packet length monitor are started, the number monitor and the packet length monitor receive the total number of times per unit time and the total packet length per unit time.

[0073] The frequency monitor determines the first credential generation rate and the first credential storage upper limit according to the total number of times per unit time, wherein the first credential generation rate is the rate of generating the first credential per unit time, and the first credential storage upper limit is the upper limit of the number of first credentials generated per unit time.

[0074] The package length monitor determines the second credential generation rate and the second credential storage upper limit according to the total number of times per unit time and the total package length per unit time. The second credential generation rate is the rate at which the second credential is generated per unit time, and the second credential storage upper limit is the upper limit of the number of second credentials generated per unit time.

[0075] Among them, the first certificate is a certificate generated by considering the number of encryption and decryption times per unit time of the cloud password card, and the second certificate is a certificate generated by considering the total encryption and decryption package length per unit time of the cloud password card.

[0076] S203, the number monitor generates at least one first credential according to the first credential generation rate and the first credential storage upper limit, and the packet length monitor generates at least one second credential according to the second credential generation rate and the second credential storage upper limit.

[0077] Specifically, the number monitor generates at least one first credential according to the first credential generation rate until the number of first credentials reaches the upper limit of the first credential storage, and then stops generating the first credential. The packet length monitor generates at least one second credential according to the second credential generation rate until the number of second credentials reaches the upper limit of the second credential storage, and then stops generating the second credential.

[0078] As an optional implementation, at the end of each unit time, the first credential and the second credential are cleared, and generation of the first credential and the second credential is started in the next unit time.

[0079] It is worth noting that after receiving the new total number of times per unit time and the total package length per unit time, the new first credential generation rate, the first credential storage upper limit, the second credential generation rate and the second credential storage upper limit are calculated, and the first credential and the second credential are generated according to the new first credential generation rate, the first credential storage upper limit, the second credential generation rate and the second credential storage upper limit.

[0080] As an optional implementation, after the first credential and the second credential are generated, the generated first credential and the second credential are stored in a memory.

[0081] S204: Obtain a cryptographic resource request sent by the user terminal device.

[0082] Among them, after the user-end device sends a password resource request, the service call interface receives the password resource request, the electronic device uses the probe background monitoring thread to capture the password resource request sent by the service call interface, and sends the password resource request to the number monitor and the packet length monitor.

[0083] S205: Determine whether to allocate a first credential and a second credential to the cryptographic resource request according to the number of the first credential and the number of the second credential, and send the cryptographic resource request to the cloud cryptographic card through the business call interface for encryption and decryption.

[0084] As an optional implementation, if the number of the first credential and the second credential are not 0, a first credential and a second credential are allocated to the cryptographic resource request. It is worth noting that after the number monitor and the packet length monitor allocate a first credential and a second credential to the cryptographic resource request, the number monitor and the packet length monitor delete a first credential and a second credential respectively.

[0085] Optionally, after a first credential and a second credential are allocated to a cryptographic resource request, the cryptographic resource request is sent to a business call interface, which verifies the first credential and the second credential in the cryptographic resource request and then sends the cryptographic resource request to a cloud cryptographic card for encryption and decryption.

[0086] It is worth noting that when the dynamic cloud password card data processing is initially executed, the first credential and the second credential are generated according to the preset credential quantity.

[0087] In this embodiment, the number of times monitor and the packet length monitor generate the first credential and the second credential according to the total number of times per unit time and the total packet length per unit time, respectively, so as to flexibly generate the first credential and the second credential according to the processing performance of the cloud password card from the two perspectives of the total number of times per unit time for encryption and decryption and the total packet length per unit time for encryption and decryption of the cloud password card. On the basis of adapting to the hardware processing conditions of the cloud password card, compared with the current limiting of the business interface layer in the prior art, there is no need to consider factors such as interface characteristics, business logic and user behavior, the logic is simple, applicable to a variety of business scenarios and requirements, and more refined dynamic flow control is achieved. When a password resource request sent by a user terminal device is received, it is determined whether to allocate the first credential and the second credential for the password resource request according to the number of the first credential and the number of the second credential, and the password resource request is sent to the cloud password card through the business call interface to perform encryption and decryption. This embodiment adjusts the rate and upper limit of generating the first credential and the second credential in real time through the number monitor and the packet length monitor, and allocates the first credential and the second credential to the password resource request according to the number of credentials, thereby limiting the data transmission rate through the generation and consumption of credentials, effectively preventing the performance of other users' services from being degraded or seriously stagnant due to sudden excessive traffic during the encryption and decryption process, more comprehensively evaluating the traffic situation and making more reasonable control decisions. In addition, this embodiment is applied in the software middle layer, and can realize the traffic control of multiple cloud password cards without changing the underlying network hardware and the upper application protocol.

[0088] Furthermore, the specific process of determining whether to allocate a first credential and a second credential to the cryptographic resource request according to the number of first credentials and the number of second credentials in the above step S205 is as follows:

[0089] Optionally, it is determined whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold.

[0090] The preset threshold value may be 0. When the preset threshold value is 0, this step is to determine whether the first credential and the second credential exist in the current storage.

[0091] Optionally, if so, a first credential and a second credential are allocated to the cryptographic resource request.

[0092] Specifically, if the number of first credentials is greater than a preset threshold and the number of second credentials is greater than a preset threshold, a first credential and a second credential are allocated to the cryptographic resource request, and a first credential and a second credential are deleted from the memory.

[0093] In this embodiment, by determining whether the number of first credentials and the number of second credentials are both greater than a preset threshold, the first credentials and the second credentials are allocated to the cryptographic resource request, thereby ensuring that the cloud cryptographic card is capable of processing the encryption and decryption tasks indicated by the cryptographic resource request.

[0094] As an optional implementation, if the number of the first credentials or the number of the second credentials is less than or equal to a preset threshold, an insufficient credentials policy is executed, and the insufficient credentials policy includes rejecting a cryptographic resource request and a delayed polling policy.

[0095] Optionally, if the number of first credentials or the number of second credentials currently stored in the memory is less than or equal to a preset threshold, an insufficient credentials strategy is executed, wherein the insufficient credentials strategy includes rejecting a password resource request and a delayed polling strategy.

[0096] Specifically, rejecting the password resource request specifically includes preventing the password resource request from being sent to the service call interface and sending a non-sending alarm to the user terminal device. The delayed polling strategy is to periodically determine whether the number of the first credentials and the number of the second credentials are greater than a preset threshold.

[0097] In this embodiment, if the number of first credentials or the number of second credentials is less than or equal to a preset threshold, the insufficient credentials strategy is executed to ensure the stability and reliability of the cloud password card in high concurrency scenarios.

[0098] As an optional implementation, if the delayed polling strategy is executed, the number of polling times is counted to determine whether the number of polling times is greater than or equal to the number threshold. If so, an alarm message is sent to the user terminal device.

[0099] Among them, the alarm information indicates that the cloud password card resources are overloaded.

[0100] As another optional implementation, the insufficient credentials strategy may also include a waiting strategy, specifically, a strategy that makes the current cryptographic resource request wait until the number of first credentials and the number of second credentials are greater than a preset threshold.

[0101] In this embodiment, when the polling times are greater than or equal to the times threshold, an alarm signal is sent to the user terminal device, thereby ensuring the stability and reliability of the cloud password card in high concurrency scenarios.

[0102] Next, refer to Figure 3The specific steps of determining the first credential generation rate and the first credential storage upper limit according to the total number of times per unit time in the above step S202 are introduced. Figure 3 It is a flowchart of determining a first credential generation rate and a first credential storage upper limit provided in an embodiment of the present application.

[0103] S301. Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient.

[0104] S302: taking the product of the first quotient and the preset compensation coefficient as the first product.

[0105] S303: Taking the product of the first quotient and the first product as the first voucher generation rate.

[0106] Specifically, the process of calculating the first credential generation rate can be shown as the following formula (1):

[0107] Rate T=(Total num / Static time)*α(1)

[0108] Among them, Rate T is the first voucher generation rate, Total num is the total number of times per unit time, Static time is the length of the unit time, and α is the preset compensation coefficient.

[0109] Among them, since the processor performance or the large packet length affects the time consumption of single packet encryption and decryption, the credential generation rate is far lower than the credential consumption efficiency, so it is impossible to smoothly process peak business, so it is necessary to use the preset compensation coefficient to offset the loss. Exemplarily, the processor performance takes the single-core performance score of i5-12500 as an example. When the single-core performance of the target platform is lower than that of i5-12500, the processor compensation coefficient is the quotient of the single-core score of i5-12500 and the single-core performance of the target platform. When the cloud password card processes a packet length of less than 8K bytes, the performance increases linearly and the time consumption is consistent. When the packet length exceeds 8K bytes, the performance has an inflection point and the time consumption increases exponentially. Therefore, when the packet length is greater than 8k bytes, the packet length compensation coefficient is the quotient of the current packet length and 8, and the product of 1024. Therefore, the preset compensation coefficient is the maximum value of the processor compensation coefficient and the packet length compensation coefficient.

[0110] S304: The total number of times per unit time is used as the upper limit of the first credential storage.

[0111] In this embodiment, the first credential generation rate and the first credential storage upper limit are calculated based on the total number of times per unit time, so as to determine the number of cryptographic resource requests that can be processed currently based on the total number of encryption and decryption times per unit time of the cloud cryptographic card, thereby achieving a more refined and personalized traffic control strategy.

[0112] Next, refer to Figure 4The specific steps for determining the second voucher generation rate and the second voucher storage upper limit according to the total packet length per unit time and the total number of times per unit time in the above step S202 are as follows. Figure 4 It is a flow chart of determining a second credential generation rate and a second credential storage upper limit provided in an embodiment of the present application.

[0113] S401. Taking the quotient of the total package length per unit time and the total number of times per unit time as the second quotient.

[0114] S402: The product of the second quotient and the preset encryption and decryption performance corresponding to the average packet length is used as the second credential generation rate.

[0115] Specifically, the process of calculating the second credential generation rate can be shown as the following formula (2):

[0116] Rate M=Mbps(Average len)*Average len(2)

[0117] Among them, Rate M is the second credential generation rate, Mbps (Average len) is the preset encryption and decryption performance corresponding to the average packet length, and Average len is the average packet length per unit time. Among them, the average packet length per unit time is the quotient of the total packet length per unit time and the total number of times per unit time. The preset encryption and decryption performance corresponding to the average packet length is the encryption and decryption performance corresponding to the average packet length per unit time.

[0118] It is worth mentioning that a mapping relationship table of multiple average packet lengths and preset encryption and decryption performances can be generated in advance according to the encryption and decryption performance of the cloud password card, and then the preset encryption and decryption performance corresponding to the current average packet length can be determined based on the current average packet length.

[0119] S403: The product of the length of the unit time and the preset encryption and decryption performance corresponding to the average packet length is taken as the second product.

[0120] S404: multiply the total number of times per unit time by the second product as the second voucher storage upper limit.

[0121] Specifically, the process of calculating the second credential storage upper limit can be shown as the following formula (3):

[0122] CM=(Total num)*(Static time*Mbps(Average len))(3)

[0123] Among them, CM is the upper limit of the second credential storage, Total num is the total number of times per unit time, Static time is the length of the unit time, and Mbps (Average len) is the product of the preset encryption and decryption performance corresponding to the average packet length.

[0124] In this embodiment, the second credential generation rate and the second credential storage upper limit are determined based on the total packet length per unit time and the total number of times per unit time, thereby determining the number of cryptographic resource requests that can currently be processed based on the total packet length of encryption and decryption per unit time of the cloud cryptographic card, thereby achieving a more refined and personalized traffic control strategy.

[0125] Next, the step of determining the total number of times per unit time and the total packet length per unit time in the above step S201 is introduced.

[0126] Optionally, it is determined whether the total number of times per unit time and the total packet length per unit time sent by the user terminal device are received.

[0127] Optionally, the user may input the total number of times per unit time and the total packet length per unit time in an interactive interface of the user terminal device.

[0128] Optionally, if not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0129] Specifically, if the user does not set the total number of times per unit time and the total packet length per unit time, the electronic device determines the total number of times per unit time and the total packet length per unit time based on the history log.

[0130] The history log is recorded by a times monitor and a packet length monitor respectively. Specifically, the times monitor records the number of cryptographic resource requests and other data, and the packet length monitor records the packet length corresponding to each cryptographic resource request and other data.

[0131] In this embodiment, it is determined whether the total number of times per unit time and the total packet length per unit time sent by the user-end device are received. If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs, so as to dynamically adjust the flow control strategy based on the historical encryption and decryption status of the cloud password card, the hardware performance and the real-time business access volume, so that the generation of the first credential and the second credential is flexible and configurable, and can be adjusted and optimized according to different business scenarios and needs.

[0132] Furthermore, in the above method, the specific steps of determining the total number of times per unit time and the total packet length per unit time according to the acquired historical logs are as follows:

[0133] Optionally, features in the acquired historical logs are extracted to obtain a traffic vector.

[0134] Optionally, the features in the history log may include time features and flow features, wherein the time features may be, for example, hours, days, and weeks, and the flow features may be, for example, average flow values ​​and maximum flow values.

[0135] Optionally, a feature vector is obtained based on feature embedding transformation in the historical log.

[0136] Optionally, the traffic vector is input into a pre-trained traffic prediction model to perform regression prediction, and the total number of times per unit time and the total packet length per unit time are output.

[0137] Optionally, the traffic prediction model predicts future business load conditions according to the traffic vector, and the business load conditions include the total number of times per unit time and the total packet length per unit time.

[0138] In this embodiment, the traffic vector is determined by extracting historical logs, and the traffic vector is input into the traffic prediction model for regression prediction to obtain the total number of times per unit time and the total package length per unit time, so as to adjust the first credential generation rate, the first credential storage upper limit, the second credential generation rate and the second credential storage upper limit in advance according to the total number of times per unit time and the total package length per unit time, thereby improving the accuracy and efficiency of traffic control, ensuring the stability and reliability of the cloud password card in high concurrency scenarios, and reducing the risk of business stagnation caused by sudden traffic changes.

[0139] As an optional implementation, the traffic prediction model is a random forest model.

[0140] In the above steps, the traffic vector is input into the pre-trained traffic prediction model, and regression prediction is performed to output the total number of times per unit time and the total packet length per unit time. The specific process is as follows:

[0141] Optionally, the traffic vector is input into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length.

[0142] Specifically, the construction process of the traffic prediction model is as follows: pre-acquire the feature vector data set, the number of decision trees, the maximum depth of the decision tree, the minimum number of samples required for internal node re-division, the minimum number of samples required for leaf nodes, and the number of features to be considered when finding the best split. First, initialize the random forest to an empty set. For each decision tree, first obtain a data subset from the feature vector data set with replacement sampling, and then execute the process of building the decision tree, which is as follows: first initialize the current decision tree as the root node, and stop splitting when the current node meets any of the following conditions: reaching the maximum depth of the decision tree, the number of samples contained in the current node is less than the minimum number of samples required for internal node re-division, the number of samples contained in the current node is less than the minimum number of samples required for leaf nodes, and all samples of the current node belong to the same category. If the current node does not meet all of the above conditions, the number of features to be considered when finding the best split is randomly selected from the samples of the current node. It is worth mentioning that if the number of features to be considered when finding the best split is not obtained in advance, all features are selected. After the split is completed, find the best split point in the selected feature to split and generate left and right child nodes, and recursively perform the steps of splitting nodes and generating left and right nodes on the left and right child nodes. After successfully building a decision tree, add it to the random forest until all decision trees are added to the random forest. From then on, the construction of the random forest model is completed.

[0143] Optionally, the result list of each decision tree is initialized to be empty, and then the traffic vector is input into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, and the prediction result is added to the result list. The prediction result includes: the total number of times and the total packet length.

[0144] Optionally, the average value of the total number of times in the prediction results of all decision trees is taken as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is taken as the total packet length per unit time.

[0145] Optionally, the decision tree output results are regressed, that is, the total number of times and the total packet length output by all decision trees are averaged to obtain the total number of times per unit time and the total packet length per unit time.

[0146] In this embodiment, the traffic vector is input into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, and the average value of the prediction result is used as the total number of times per unit time and the total packet length per unit time, thereby improving the accuracy and efficiency of traffic control, ensuring the stability and reliability of the cloud password card in high concurrency scenarios, and reducing the risk of business stagnation caused by traffic mutations.

[0147] As an optional implementation, Figure 5It is a technical architecture diagram of a dynamic cloud password card data processing method provided in an embodiment of the present application.

[0148] like Figure 5 As shown, the technical architecture of the dynamic cloud password card data processing method includes a dual flow monitor, a custom current limiting module, a flow prediction model, an alarm module and a probe, wherein the dual flow monitor includes a number monitor and a package length monitor, and the number monitor and the package length monitor respectively include a credential calculation unit, a credential management unit and a request log unit. The probe is used to capture the password resource request sent by the user-end device received by the service call interface in real time, as well as the custom total number of times per unit time and the total length per unit time. The custom current limiting module is used to send the user-defined total number of times per unit time and the total length per unit time to the credential calculation unit in the dual flow monitor for calculation. The flow prediction model is used to obtain historical logs from the dual flow monitor, and to predict based on the historical logs, and output the total number of times per unit time and the total package length per unit time. The credential calculation unit in the number monitor and the package length monitor is used to generate a first credential generation rate, a first credential storage upper limit, a second credential generation rate and a second credential storage upper limit according to the total number of times per unit time and the total package length per unit time. The credential management unit is used to generate a first credential and a second credential, and allocate the first credential and the second credential to the password resource request, and delete a first credential and a second credential after allocating the first credential and the second credential to the password resource request. The request log unit is used to record the call log of the cloud password card resources used by the business. The alarm module is used to generate and report an alarm signal when the password resource request polling exceeds a preset number of times.

[0149] As an optional implementation, Figure 6 It is a flow chart of another dynamic cloud password card data processing method provided in an embodiment of the present application.

[0150] like Figure 6 As shown, the number monitor and the packet length monitor are started to determine whether the total number of times per unit time and the total packet length per unit time sent by the user terminal device are received. If not, the total number of times per unit time and the total packet length per unit time are determined based on the historical log through the traffic prediction model. After determining the total number of times per unit time and the total packet length per unit time, the number monitor calculates the first credential generation rate and the first credential storage upper limit based on the total number of times per unit time, and generates multiple first credentials based on the first credential generation rate and the first credential storage upper limit. The packet length monitor generates the second credential generation rate and the second credential storage upper limit based on the total number of times per unit time and the total packet length per unit time, and generates multiple second credentials based on the second credential generation rate and the second credential storage upper limit.

[0151] The probe determines whether it monitors the password resource request received by the service call interface. If so, it determines whether the number of the first credential and the number of the second credential are both greater than the preset threshold. If so, it allocates a first credential and a second credential to the password resource request, deletes a first credential and a second credential, and records a log. The password resource request is returned to the probe, and the probe sends the password resource request to the cloud password card through the service call interface for encryption and decryption. If the number of the first credential or the number of the second credential is equal to or less than the preset threshold, the insufficient credential strategy is executed, that is, the password resource request is rejected, or the delayed polling strategy is executed. If the number of polling times is greater than or equal to the number threshold, an alarm message is sent to the user terminal device.

[0152] Based on the same inventive concept, a dynamic cloud password card data processing device corresponding to the dynamic cloud password card data processing method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned dynamic cloud password card data processing method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0153] Reference Figure 7 FIG. 1 is a schematic diagram of a structure of a dynamic cloud password card data processing device provided in an embodiment of the present application, wherein the device comprises:

[0154] The first determination module 701 is used to determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0155] The second determination module 702 is used to start a number monitor and a packet length monitor, wherein the number monitor determines a first credential generation rate and a first credential storage upper limit according to the total number of times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit according to the total packet length per unit time and the total number of times per unit time;

[0156] A generating module 703, configured to generate at least one first voucher by the number monitor according to the first voucher generation rate and the first voucher storage upper limit, and to generate at least one second voucher by the packet length monitor according to the second voucher generation rate and the second voucher storage upper limit;

[0157] The acquisition module 704 is used to acquire the password resource request sent by the user terminal device;

[0158] The allocation module 705 is used to determine whether to allocate a first credential and a second credential for the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the business call interface to perform encryption and decryption.

[0159] Optionally, the allocation module 705 is specifically configured to:

[0160] Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold;

[0161] If so, a first credential and a second credential are allocated to the cryptographic resource request.

[0162] Optionally, the allocation module 705 is further configured to:

[0163] If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, wherein the insufficient credentials policy includes rejecting the cryptographic resource request and a delayed polling policy.

[0164] Optionally, the allocation module 705 is further configured to:

[0165] If the delayed polling strategy is executed, the number of polling times is counted;

[0166] Determine whether the polling number is greater than or equal to a number threshold, and if so, send an alarm message to the user terminal device.

[0167] Optionally, the second determining module 702 is specifically configured to:

[0168] Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient;

[0169] Taking the product of the first quotient and the preset compensation coefficient as the first product;

[0170] The product of the first quotient and the first product is used as the first voucher generation rate;

[0171] The total number of times per unit time is used as the first credential storage upper limit.

[0172] Optionally, the generating module 703 is specifically configured to:

[0173] Taking the quotient of the total packet length per unit time and the total number of times per unit time as the second quotient;

[0174] The product of the second quotient and the preset encryption and decryption performance corresponding to the average packet length is used as the second credential generation rate;

[0175] The product of the length of the unit time and the preset encryption and decryption performance corresponding to the average packet length is taken as the second product;

[0176] The product of the total number of times per unit time and the second product is used as the second credential storage upper limit.

[0177] Optionally, the first determining module 701 is specifically configured to:

[0178] Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received;

[0179] If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0180] Optionally, the first determining module 701 is specifically configured to:

[0181] Extract features from the acquired historical logs to obtain traffic vectors;

[0182] The traffic vector is input into the traffic prediction model obtained by pre-training, regression prediction is performed, and the total number of times per unit time and the total packet length per unit time are output.

[0183] Optionally, the first determining module 701 is specifically configured to:

[0184] The method of inputting the traffic vector into a pre-trained traffic prediction model, performing regression prediction, and outputting the total number of times per unit time and the total packet length per unit time includes:

[0185] Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length;

[0186] The average value of the total number of times in the prediction results of all decision trees is taken as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is taken as the total packet length per unit time.

[0187] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0188] The present application also provides an electronic device, such as Figure 8 801, a memory 802 and a bus. The memory 802 stores machine-readable instructions executable by the processor 801 (for example, Figure 7The first determination module 701, the second determination module 702, the generation module 703, the acquisition module 704 and the execution instructions corresponding to the allocation module 705 in the device, etc.), when the computer device is running, the processor 801 communicates with the memory 802 through a bus, and when the machine-readable instructions are executed by the processor 801, the above-mentioned dynamic cloud password card data processing method is executed.

[0189] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned dynamic cloud password card data processing method are executed.

[0190] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0191] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0192] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A dynamic cloud password card data processing method, characterized in that: The method comprises: Determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time; Start a times monitor and a packet length monitor, wherein the times monitor determines a first credential generation rate and a first credential storage upper limit according to the total times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit according to the total packet length per unit time and the total times per unit time; The number monitor generates at least one first credential according to the first credential generation rate and the first credential storage upper limit, and the packet length monitor generates at least one second credential according to the second credential generation rate and the second credential storage upper limit; Obtaining a password resource request sent by a user terminal device; Determine whether to allocate a first credential and a second credential to the cryptographic resource request according to the number of the first credentials and the number of the second credentials, and send the cryptographic resource request to the cloud cryptographic card through the business call interface for encryption and decryption.

2. The dynamic cloud password card data processing method according to claim 1 is characterized in that: The determining whether to allocate a first credential and a second credential to the cryptographic resource request according to the number of the first credential and the number of the second credential includes: Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold; If so, a first credential and a second credential are allocated to the cryptographic resource request.

3. The dynamic cloud password card data processing method according to claim 2 is characterized in that: The method further comprises: If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, wherein the insufficient credentials policy includes rejecting the cryptographic resource request and a delayed polling policy.

4. The dynamic cloud password card data processing method according to claim 3 is characterized in that: The method further comprises: If the delayed polling strategy is executed, the number of polling times is counted; Determine whether the polling number is greater than or equal to a number threshold, and if so, send an alarm message to the user terminal device.

5. The dynamic cloud password card data processing method according to claim 1 is characterized in that: The determining, according to the total number of times per unit time, a first credential generation rate and a first credential storage upper limit includes: Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient; Taking the product of the first quotient and the preset compensation coefficient as the first product; The product of the first quotient and the first product is used as the first voucher generation rate; The total number of times per unit time is used as the upper limit of the first credential storage.

6. The dynamic cloud password card data processing method according to claim 1 is characterized in that: The determining, according to the total packet length per unit time and the total number of times per unit time, a second credential generation rate and a second credential storage upper limit includes: Taking the quotient of the total packet length per unit time and the total number of times per unit time as the second quotient; The product of the second quotient and the preset encryption and decryption performance corresponding to the average packet length is used as the second credential generation rate; The product of the length of the unit time and the preset encryption and decryption performance corresponding to the average packet length is taken as the second product; The product of the total number of times per unit time and the second product is used as the second credential storage upper limit.

7. The dynamic cloud password card data processing method according to claim 1 is characterized in that: Determining the total number of times per unit time and the total package length per unit time includes: Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received; If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

8. The dynamic cloud password card data processing method according to claim 7 is characterized in that: Determining the total number of times per unit time and the total packet length per unit time according to the acquired historical logs includes: Extract features from the acquired historical logs to obtain traffic vectors; The traffic vector is input into the traffic prediction model obtained by pre-training, regression prediction is performed, and the total number of times per unit time and the total packet length per unit time are output.

9. The dynamic cloud password card data processing method according to claim 8, characterized in that: The traffic prediction model is a random forest model; The method of inputting the traffic vector into a pre-trained traffic prediction model, performing regression prediction, and outputting the total number of times per unit time and the total packet length per unit time includes: Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length; The average value of the total number of times in the prediction results of all decision trees is taken as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is taken as the total packet length per unit time.

10. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-readable instructions to perform the steps of the dynamic cloud password card data processing method as described in any one of claims 1 to 9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the dynamic cloud password card data processing method as described in any one of claims 1 to 9 are executed.

Images