Dynamic cloud password card data processing method, electronic device and storage medium

Abstract

The application provides a dynamic cloud password card data processing method, an electronic device and a storage medium. The method comprises the following steps: determining a total number of times per unit time and a total packet length per unit time; determining a first credential generation rate and a first credential storage upper limit according to the total number of times per unit time; determining a second credential generation rate and a second credential storage upper limit according to the total packet length per unit time and the total number of times per unit time; generating a first credential according to the first credential generation rate and the first credential storage upper limit; generating a second credential according to the second credential generation rate and the second credential storage upper limit; obtaining a password resource request; determining whether to allocate a credential for the password resource request according to the number of the first credential and the second credential; and sending the password resource request to a cloud password card to perform encryption and decryption. The application generates and allocates the first credential and the second credential dynamically, thereby effectively preventing other user service performance from being reduced or seriously stagnated due to sudden large encrypted traffic of a user.

Description

Technical Field

[0001] The present application relates to the field of flow control technology, and in particular to a dynamic cloud password card data processing method, electronic device, and storage medium. Background Art

[0002] With the development of cloud computing technology, more and more data needs to be encrypted and decrypted using cloud password cards in the cloud. However, traditional cloud password cards do not monitor or limit the number of password requests for cloud services. As a result, the cloud password card may suddenly receive a large number of password requests from a tenant, causing the cloud password card's password resources to be exhausted, making it impossible for other tenants to use password resources, resulting in serious business stagnation.

[0003] Existing technologies address the problem of password resource overload at both the business and cloud password card levels. The business-level solution involves directly restricting password requests through the service interface. The cloud password card level employs a static restriction strategy to limit password requests.

[0004] However, business-level solutions require comprehensive consideration of multiple factors, including interface characteristics, business logic, and user behavior. This makes the formulation and implementation of rate limiting policies relatively complex, leading to bloated upper-layer services, difficulty in maintenance, and poor rate limiting effectiveness. Rate limiting policies at the Cloud Password Card level are relatively fixed and difficult to adjust to business needs, resulting in limited flexibility. Summary of the Invention

[0005] The purpose of this application is to address the deficiencies in the above-mentioned prior art and provide a dynamic cloud password card data processing method, electronic device and storage medium to solve the problems of complex current limiting strategies and poor flexibility in the prior art.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0007] In a first aspect, the present application provides a method for processing data of a dynamic cloud password card, the method comprising:

[0008] Determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0009] Initiate a count monitor and a packet length monitor, wherein the count monitor determines a first credential generation rate and a first credential storage upper limit based on the total count per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit based on the total packet length per unit time and the total count per unit time;

[0010] The number monitor generates at least one first credential according to the first credential generation rate and the first credential storage upper limit, and the packet length monitor generates at least one second credential according to the second credential generation rate and the second credential storage upper limit;

[0011] Obtaining a password resource request sent by a user terminal device;

[0012] Determine whether to allocate a first credential and a second credential to the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the business call interface for encryption and decryption.

[0013] Optionally, the determining whether to allocate one first credential and one second credential to the cryptographic resource request according to the number of the first credentials and the number of the second credentials includes:

[0014] Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold;

[0015] If so, a first credential and a second credential are allocated to the cryptographic resource request.

[0016] Optionally, the method further includes:

[0017] If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, where the insufficient credentials policy includes rejecting the cryptographic resource request and delaying polling.

[0018] Optionally, the method further includes:

[0019] If the delayed polling strategy is executed, the number of polling times is counted;

[0020] Determine whether the polling number is greater than or equal to a number threshold; if so, send an alarm message to the user terminal device.

[0021] Optionally, determining the first credential generation rate and the first credential storage upper limit based on the total number of times per unit time includes:

[0022] Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient;

[0023] taking the product of the first quotient and a preset compensation coefficient as a first product;

[0024] The product of the first quotient and the first product is used as the first voucher generation rate;

[0025] The total number of times per unit time is used as the upper limit of first credential storage.

[0026] Optionally, determining the second credential generation rate and the second credential storage upper limit based on the total packet length per unit time and the total number of times per unit time includes:

[0027] The quotient of the total packet length per unit time and the total number of times per unit time is taken as the second quotient;

[0028] multiplying the second quotient by the preset encryption and decryption performance corresponding to the average packet length as the second credential generation rate;

[0029] multiplying the length of the unit time by the preset encryption and decryption performance corresponding to the average packet length as a second product;

[0030] The product of the total number of times per unit time and the second product is used as the upper limit of the second credential storage.

[0031] Optionally, determining the total number of times per unit time and the total packet length per unit time includes:

[0032] Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received;

[0033] If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0034] Optionally, determining the total number of times per unit time and the total packet length per unit time based on the acquired historical logs includes:

[0035] Extract features from the acquired historical logs to obtain traffic vectors;

[0036] The traffic vector is input into the traffic prediction model obtained by pre-training, and regression prediction is performed to output the total number of times per unit time and the total packet length per unit time.

[0037] Optionally, the traffic prediction model is a random forest model;

[0038] The flow vector is input into a pre-trained flow prediction model to perform regression prediction and output the total number of times per unit time and the total packet length per unit time, including:

[0039] Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length;

[0040] The average value of the total number of times in the prediction results of all decision trees is used as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is used as the total packet length per unit time.

[0041] In a second aspect, the present application provides a dynamic cloud password card data processing device, the device comprising:

[0042] A first determination module is used to determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0043] a second determining module, configured to activate a times monitor and a packet length monitor, wherein the times monitor determines a first credential generation rate and a first credential storage upper limit based on the total times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit based on the total packet length per unit time and the total times per unit time;

[0044] a generation module, configured to generate, by the number monitor, at least one first credential according to the first credential generation rate and the first credential storage upper limit, and to generate, by the packet length monitor, at least one second credential according to the second credential generation rate and the second credential storage upper limit;

[0045] An acquisition module, used to obtain a password resource request sent by a user terminal device;

[0046] The allocation module is used to determine whether to allocate a first credential and a second credential to the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the business call interface for encryption and decryption.

[0047] In a third aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps described in the first aspect above.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps described in the first aspect are performed.

[0049] The beneficial effects of the present application are as follows: the number of times monitor and the package length monitor generate the first credential and the second credential according to the total number of times per unit time and the total package length per unit time, respectively. Thus, starting from the two perspectives of the total number of times per unit time for encryption and decryption and the total package length per unit time for encryption and decryption of the cloud password card, the first credential and the second credential are flexibly generated according to the processing performance of the cloud password card. On the basis of adapting to the hardware processing conditions of the cloud password card, compared with the existing technology of limiting the flow at the business interface layer, there is no need to consider factors such as interface characteristics, business logic and user behavior. The logic is simple and applicable to a variety of business scenarios and needs, realizing more refined dynamic flow control. When a password resource request sent by a user terminal device is received, it is determined whether to allocate the first credential and the second credential to the password resource request based on the number of the first credential and the number of the second credential, and the password resource request is sent to the cloud password card through the business call interface to perform encryption and decryption. This embodiment uses a count monitor and a packet length monitor to adjust the rate and upper limit for generating the first and second credentials in real time, and allocates the first and second credentials to cryptographic resource requests based on the number of credentials. This limits the data transmission rate through the generation and consumption of credentials, effectively preventing sudden excessive traffic from causing performance degradation or severe stagnation for other users' services during the encryption and decryption process. This allows for a more comprehensive assessment of traffic conditions and the development of more reasonable control decisions. Furthermore, this embodiment, applied at the software middle layer, can achieve traffic control for multiple cloud cryptographic cards without changing the underlying network hardware or upper-layer application protocols. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 This is a scenario diagram of a dynamic cloud password card data processing method provided by an embodiment of the present application;

[0052] Figure 2 This is a flow chart of a method for processing dynamic cloud password card data provided by an embodiment of the present application;

[0053] Figure 3 This is a flow chart of determining a first credential generation rate and a first credential storage upper limit provided by an embodiment of the present application;

[0054] Figure 4 This is a flow chart of determining a second credential generation rate and a second credential storage upper limit provided by an embodiment of the present application;

[0055] Figure 5 This is a technical architecture diagram of a dynamic cloud password card data processing method provided by an embodiment of the present application;

[0056] Figure 6 This is a flow chart of another method for processing dynamic cloud password card data provided by an embodiment of the present application;

[0057] Figure 7 This is a structural diagram of a dynamic cloud password card data processing device provided in an embodiment of the present application;

[0058] Figure 8 This is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of illustration and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowcharts can be implemented out of sequence, and steps without logical context can be reversed or implemented simultaneously. In addition, those skilled in the art, under the guidance of the contents of this application, can add one or more other operations to the flowchart, or remove one or more operations from the flowchart.

[0060] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0061] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0062] To avoid overloading password resources, existing technologies monitor and restrict password requests for cloud services at both the business and cloud password card levels. However, business-level solutions require comprehensive consideration of multiple factors, including user interface characteristics, business logic, and user behavior. This complicates the development and implementation of throttling strategies, leading to bloated upper-layer services, difficulty in maintenance, and poor throttling effectiveness. Throttling strategies at the cloud password card level are relatively fixed and difficult to adjust based on business needs, resulting in limited flexibility.

[0063] Based on this, the present application proposes a dynamic cloud password card data processing method. The method determines the first credential generation rate, the first credential storage limit, the second credential generation rate, and the second credential storage limit based on the determined total number of times per unit time and the total package length per unit time, thereby generating the first credential and the second credential. When a password resource request sent by a user terminal device is received, the password resource request is allocated credentials based on the number of first credentials and the number of second credentials, so that the cloud password card performs encryption and decryption based on the password resource request. The present application generates the first credential and the second credential with reference to the number of times the cloud password card is processed per unit time and the package length, thereby limiting the number of resource requests for a single user, avoiding the cloud password card from being overloaded with password resources due to a single user suddenly sending a large number of password resource requests. This can not only effectively improve the stability of the cloud password card, but also optimize the user experience of multi-tenant cloud services, solving the problem that traditional cloud password cards cannot solve the problem of password resource overload and dynamic peaks leading to decreased or even serious stagnation in business processing performance.

[0064] Before introducing the dynamic cloud password card data processing method, please refer to Figure 1 This paper introduces the application scenarios of the dynamic cloud password card data processing method. Figure 1 This is a scenario diagram of a dynamic cloud password card data processing method provided by an embodiment of the present application. Figure 1 As shown, the dynamic cloud password card data processing method is applied to an electronic device with computing capabilities. The electronic device is connected to a service call interface, which is connected to the cloud password card and the user terminal device. The user terminal device sends a password resource request to the electronic device through the service call interface. The electronic device determines whether two credentials are allocated for the password resource request and sends the password resource request and the two credentials to the service call interface. The service call interface determines whether the password resource request has two credentials. If so, it sends the password resource request to the cloud password card for encryption and decryption.

[0065] Next, refer to Figure 2 The specific steps of the dynamic cloud password card data processing method are introduced. Figure 2 This is a flow chart of a dynamic cloud password card data processing method provided in an embodiment of the present application.

[0066] S201. Determine the total number of times per unit time and the total packet length per unit time. The total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption per unit time. The total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card per unit time.

[0067] Optionally, the cloud password card is a password device based on a cloud computing environment, used to perform encryption and decryption operations in the cloud to ensure the security of cloud data during transmission and storage.

[0068] As an optional implementation, the total number of times per unit time and the total packet length per unit time can be user-defined. Specifically, the user transmits the customized total number of times per unit time and the total packet length per unit time to the electronic device via the service call interface via the user terminal device. As another optional implementation, the total number of times per unit time and the total packet length per unit time can be estimated and determined by the traffic prediction module.

[0069] Optionally, the length of the unit time can be preset by the user.

[0070] Optionally, the total number of times per unit time and the total packet length per unit time may be determined according to a preset period.

[0071] S202. Start the times monitor and the package length monitor. The times monitor determines the first credential generation rate and the first credential storage upper limit based on the total times per unit time. The package length monitor determines the second credential generation rate and the second credential storage upper limit based on the total package length per unit time and the total times per unit time.

[0072] Specifically, after the number monitor and the packet length monitor are started, the number monitor and the packet length monitor receive the total number of times per unit time and the total packet length per unit time.

[0073] The number monitor determines the first credential generation rate and the first credential storage upper limit based on the total number of times per unit time. The first credential generation rate is the rate at which the first credential is generated per unit time, and the first credential storage upper limit is the upper limit of the number of first credentials generated per unit time.

[0074] The package length monitor determines the second credential generation rate and the second credential storage limit based on the total number of times per unit time and the total package length per unit time. The second credential generation rate is the rate at which the second credential is generated per unit time, and the second credential storage limit is the upper limit of the number of second credentials generated per unit time.

[0075] Among them, the first certificate is a certificate generated by considering the number of encryption and decryption times per unit time of the cloud password card, and the second certificate is a certificate generated by considering the total encryption and decryption time per unit time of the cloud password card.

[0076] S203, generating at least one first credential by the number monitor according to the first credential generation rate and the first credential storage upper limit, and generating at least one second credential by the packet length monitor according to the second credential generation rate and the second credential storage upper limit.

[0077] Specifically, the number monitor generates at least one first credential according to the first credential generation rate until the number of first credentials reaches the first credential storage upper limit, and then stops generating first credentials. The packet length monitor generates at least one second credential according to the second credential generation rate until the number of second credentials reaches the second credential storage upper limit, and then stops generating second credentials.

[0078] As an optional implementation, at the end of each unit time, the first credentials and the second credentials are emptied, and the generation of the first credentials and the second credentials in the next unit time is started.

[0079] It is worth noting that after receiving the new total number of times in a unit time and the total packet length in a unit time, the new first credential generation rate, the first credential storage upper limit, the second credential generation rate, and the second credential storage upper limit are calculated, and the first credentials and the second credentials are generated according to the new first credential generation rate, the first credential storage upper limit, the second credential generation rate, and the second credential storage upper limit.

[0080] As an optional implementation, after generating the first credentials and the second credentials, the generated first credentials and second credentials are stored in the memory.

[0081] S204, obtaining a password resource request sent by a user terminal device.

[0082] Wherein, after the user terminal device sends the password resource request, the business calling interface receives the password resource request, the electronic device uses the probe background listening thread to capture the password resource request sent by the business calling interface, and sends the password resource request to the number monitor and the packet length monitor.

[0083] S205, determining whether to allocate a first credential and a second credential to the password resource request according to the number of first credentials and the number of second credentials, and sending the password resource request to the cloud password card through the business calling interface for execution of encryption and decryption.

[0084] As an optional implementation, if the number of first credentials and the number of second credentials are both not 0, a first credential and a second credential are allocated to the password resource request. It is worth noting that after the number monitor and the packet length monitor allocate a first credential and a second credential to the password resource request, the number monitor and the packet length monitor delete one first credential and one second credential, respectively.

[0085] Optionally, after a first credential and a second credential are allocated to the password resource request, the password resource request is sent to the business call interface. After the business call interface verifies the first credential and the second credential in the password resource request, the password resource request is sent to the cloud password card for encryption and decryption.

[0086] It is worth noting that when the dynamic cloud password card data processing is initially executed, the first credential and the second credential are generated according to the preset number of credentials.

[0087] In this embodiment, the pass count monitor and the packet length monitor generate the first and second credentials based on the total number of times per unit time and the total packet length per unit time, respectively. This allows for flexible generation of the first and second credentials based on the cloud password card's processing performance, taking into account the total number of encryption and decryption times per unit time and the total packet length per unit time. This adapts to the cloud password card's hardware processing conditions and, compared to existing techniques for limiting traffic at the service interface layer, eliminates the need to consider factors such as interface characteristics, service logic, and user behavior. This simple logic makes it applicable to a variety of service scenarios and requirements, enabling more refined dynamic traffic control. Upon receiving a cryptographic resource request from a user-end device, the system determines whether to allocate the first and second credentials based on the number of first and second credentials. The cryptographic resource request is then sent to the cloud password card via the service call interface for encryption and decryption. This embodiment uses a count monitor and a packet length monitor to adjust the rate and upper limit for generating the first and second credentials in real time, and allocates the first and second credentials to cryptographic resource requests based on the number of credentials. This limits the data transmission rate through the generation and consumption of credentials, effectively preventing sudden excessive traffic from causing performance degradation or severe stagnation for other users' services during the encryption and decryption process. This allows for a more comprehensive assessment of traffic conditions and the development of more reasonable control decisions. Furthermore, this embodiment, applied at the software middle layer, can achieve traffic control for multiple cloud cryptographic cards without changing the underlying network hardware or upper-layer application protocols.

[0088] Furthermore, the specific process of determining whether to allocate one first credential and one second credential to the cryptographic resource request according to the number of first credentials and the number of second credentials in the above step S205 is as follows:

[0089] Optionally, it is determined whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold.

[0090] The preset threshold value may be 0. When the preset threshold value is 0, this step is to determine whether the first credential and the second credential exist in the current storage.

[0091] Optionally, if yes, a first credential and a second credential are allocated to the cryptographic resource request.

[0092] Specifically, if the number of first credentials is greater than a preset threshold and the number of second credentials is greater than a preset threshold, a first credential and a second credential are allocated to the cryptographic resource request, and a first credential and a second credential are deleted from the memory.

[0093] In this embodiment, by determining whether the number of first credentials and the number of second credentials are both greater than a preset threshold, the first credentials and the second credentials are allocated to the cryptographic resource request, ensuring that the cloud cryptographic card is capable of processing the encryption and decryption tasks indicated by the cryptographic resource request.

[0094] As an optional implementation, if the number of the first credentials or the number of the second credentials is less than or equal to a preset threshold, an insufficient credentials policy is executed, where the insufficient credentials policy includes rejecting the cryptographic resource request and delaying the polling policy.

[0095] Optionally, if the number of first credentials or the number of second credentials currently stored in the memory is less than or equal to a preset threshold, an insufficient credentials policy is executed, wherein the insufficient credentials policy includes rejecting the password resource request and delaying the polling policy.

[0096] Specifically, rejecting the password resource request specifically includes preventing the password resource request from being sent to the service call interface and sending a non-sending alarm to the user terminal device. The delayed polling strategy is to periodically determine whether the number of the first credentials and the number of the second credentials are greater than a preset threshold.

[0097] In this embodiment, if the number of first credentials or the number of second credentials is less than or equal to a preset threshold, the insufficient credentials policy is executed, thereby ensuring the stability and reliability of the cloud password card in high concurrency scenarios.

[0098] As an optional implementation, if the delayed polling strategy is executed, the number of polling times is counted to determine whether the number of polling times is greater than or equal to a number threshold. If so, an alarm message is sent to the user terminal device.

[0099] Among them, the alarm information indicates that the cloud password card resources are overloaded.

[0100] As another optional implementation, the insufficient credentials policy may further include a waiting policy, specifically, a policy that causes the current cryptographic resource request to wait until the number of first credentials and the number of second credentials are greater than a preset threshold.

[0101] In this embodiment, when the polling number is greater than or equal to the number threshold, an alarm signal is sent to the user terminal device, thereby ensuring the stability and reliability of the cloud password card in high concurrency scenarios.

[0102] Next, refer to Figure 3The specific steps of determining the first voucher generation rate and the first voucher storage upper limit according to the total number of times per unit time in step S202 are introduced. Among them, Figure 3 is a flowchart of determining the first voucher generation rate and the first voucher storage upper limit provided by the embodiment of the application.

[0103] S301, the quotient of the total number of times per unit time and the length of the unit time is taken as the first quotient.

[0104] S302, the product of the first quotient and the preset compensation coefficient is taken as the first product.

[0105] S303, the product of the first quotient and the first product is taken as the first voucher generation rate.

[0106] Specifically, the process of calculating the first voucher generation rate can be shown in the following formula (1):

[0107] Rate T=(Total num / Static time)*α(1)

[0108] Wherein, Rate T is the first voucher generation rate, Total num is the total number of times per unit time, Static time is the length of the unit time, and α is the preset compensation coefficient.

[0109] Wherein, due to the influence of processor performance or large packet length on single packet encryption and decryption time, the voucher generation rate is far lower than the voucher consumption efficiency, so it is impossible to smooth the peak service, so the preset compensation coefficient is needed to offset the loss. For example, the processor performance is taken as the single-core performance score of i5-12500. When the target platform single-core performance is lower than i5-12500, the processor compensation coefficient is the quotient of the single-core performance score of i5-12500 and the target platform single-core performance. When the packet length of the cloud password card is within 8K bytes, the performance increases linearly, and the time consumption is consistent. When the packet length exceeds 8K bytes, the performance appears inflection point, and the time consumption increases exponentially. Therefore, when the packet length is greater than 8k bytes, the packet length compensation coefficient is the quotient of the current packet length and 8, and the product of 1024. Therefore, the preset compensation coefficient is the maximum value of the processor compensation coefficient and the packet length compensation coefficient.

[0110] S304, the total number of times per unit time is taken as the first voucher storage upper limit.

[0111] In this embodiment, the first voucher generation rate and the first voucher storage upper limit are calculated based on the total number of times per unit time, so that the number of password resource requests that can be processed at present is determined from the perspective of the total number of cloud password card encryption and decryption per unit time, thereby realizing more fine and more personalized traffic control strategy.

[0112] Next, refer to Figure 4The specific steps for determining the second voucher generation rate and the second voucher storage upper limit according to the total packet length per unit time and the total number of times per unit time in step S202 are as follows. Figure 4 This is a flow chart of determining a second credential generation rate and a second credential storage upper limit provided by an embodiment of the present application.

[0113] S401: The quotient of the total package length per unit time and the total number of times per unit time is taken as the second quotient.

[0114] S402: The product of the second quotient and the preset encryption and decryption performance corresponding to the average packet length is used as the second credential generation rate.

[0115] Specifically, the process of calculating the second credential generation rate can be shown as the following formula (2):

[0116] Rate M=Mbps(Average len)*Average len(2)

[0117] Wherein, Rate M is the second credential generation rate, Mbps (Average len) is the preset encryption and decryption performance corresponding to the average packet length, and Average len is the average packet length per unit time. The average packet length per unit time is the quotient of the total packet length per unit time and the total number of times per unit time. The preset encryption and decryption performance corresponding to the average packet length is the encryption and decryption performance corresponding to the average packet length per unit time.

[0118] It is worth mentioning that a mapping relationship table of multiple average packet lengths and preset encryption and decryption performances can be generated in advance based on the encryption and decryption performance of the cloud password card, and then the preset encryption and decryption performance corresponding to the current average packet length can be determined based on the current average packet length.

[0119] S403: Multiply the length of the unit time by the preset encryption / decryption performance corresponding to the average packet length, as a second product.

[0120] S404: Multiply the total number of times per unit time by the second product as the upper limit of the second voucher storage.

[0121] Specifically, the process of calculating the upper limit of the second credential storage capacity can be shown as the following formula (3):

[0122] CM=(Total num)*(Static time*Mbps(Average len))(3)

[0123] Where CM is the upper limit of the second credential storage, Total num is the total number of times per unit time, Static time is the length of the unit time, and Mbps (Average len) is the product of the preset encryption and decryption performance corresponding to the average packet length.

[0124] In this embodiment, the second credential generation rate and the second credential storage upper limit are determined based on the total packet length per unit time and the total number of times per unit time, thereby determining the number of cryptographic resource requests that can currently be processed based on the total packet length of encryption and decryption per unit time of the cloud cryptographic card, thereby achieving a more refined and personalized traffic control strategy.

[0125] Next, the step of determining the total number of times per unit time and the total packet length per unit time in the above step S201 is introduced.

[0126] Optionally, it is determined whether the total number of times per unit time and the total packet length per unit time sent by the user terminal device are received.

[0127] Optionally, the user may input the total number of times per unit time and the total packet length per unit time in an interactive interface of the user terminal device.

[0128] Optionally, if not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0129] Specifically, if the user does not set the total number of times per unit time and the total packet length per unit time, the electronic device determines the total number of times per unit time and the total packet length per unit time based on the history log.

[0130] The history log is recorded by a times monitor and a packet length monitor. Specifically, the times monitor records the number of cryptographic resource requests and other data, and the packet length monitor records the packet length corresponding to each cryptographic resource request and other data.

[0131] In this embodiment, it is determined whether the total number of times per unit time and the total packet length per unit time sent by the user terminal device are received. If not, the total number of times per unit time and the total packet length per unit time are determined based on the historical logs obtained, so as to dynamically adjust the flow control strategy based on the historical encryption and decryption status of the cloud password card, hardware performance and real-time business access volume, so that the generation of the first credential and the second credential is flexible and configurable, and can be adjusted and optimized according to different business scenarios and needs.

[0132] Furthermore, in the above method, the specific steps of determining the total number of times per unit time and the total packet length per unit time based on the acquired historical logs are as follows:

[0133] Optionally, features in the acquired historical logs are extracted to obtain a traffic vector.

[0134] Optionally, the features in the historical log may include time features and flow features, wherein the time features may be, for example, hours, days, and weeks, and the flow features may be, for example, average and maximum flow rates.

[0135] Optionally, the feature vector is obtained based on the feature embedding conversion of the historical log.

[0136] Optionally, the flow vector is input into the pre-trained flow prediction model to perform regression prediction, and the total number of times per unit time and the total packet length per unit time are output.

[0137] Optionally, the flow prediction model predicts future service load conditions according to the flow vector, and the service load conditions include the total number of times per unit time and the total packet length per unit time.

[0138] In the embodiment, the flow vector is determined by extracting the historical log, and the flow vector is input into the flow prediction model to perform regression prediction, and the total number of times per unit time and the total packet length per unit time are obtained. Therefore, the first credential generation rate, the first credential storage upper limit, the second credential generation rate, and the second credential storage upper limit are adjusted in advance according to the total number of times per unit time and the total packet length per unit time, thereby improving the accuracy and efficiency of flow control, ensuring the stability and reliability of the cloud password card in a high-concurrency scenario, and reducing the risk of service stagnation caused by flow mutation.

[0139] As an optional implementation, the flow prediction model is a random forest model.

[0140] The specific process of inputting the flow vector into the pre-trained flow prediction model to perform regression prediction and outputting the total number of times per unit time and the total packet length per unit time in the above steps is as follows:

[0141] Optionally, the flow vector is input into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the flow vector. The prediction result includes the total number of times and the total packet length.

[0142] Specifically, the traffic prediction model construction process is as follows: The feature vector dataset, the number of decision trees, the maximum depth of the decision trees, the minimum number of samples required for internal node repartitioning, the minimum number of samples required for leaf nodes, and the number of features to consider when finding the optimal split are pre-obtained. The random forest is initialized to an empty set. For each decision tree, a data subset is obtained by sampling with replacement from the feature vector dataset. The decision tree construction process is then performed as follows: The current decision tree is initialized as the root node. Splitting is terminated when the current node meets any of the following conditions: the maximum depth of the decision tree is reached, the number of samples in the current node is less than the minimum number of samples required for internal node repartitioning, the number of samples in the current node is less than the minimum number of samples required for leaf nodes, or all samples at the current node belong to the same category. If the current node does not meet all of the above conditions, the number of features to consider when finding the optimal split is randomly selected from the samples at the current node. It is worth noting that if the number of features required for finding the optimal split is not pre-obtained, all features are selected. After the split is completed, the optimal split point is found among the selected features and the left and right child nodes are generated. The node splitting and left and right node generation steps are recursively repeated for the left and right child nodes. After successfully building a decision tree, add it to the random forest until all decision trees are added to the random forest. This completes the construction of the random forest model.

[0143] Optionally, the result lists of each decision tree are initialized to empty, and then the traffic vector is input into each decision tree in the random forest model. Each decision tree then predicts a result based on the traffic vector and adds the predicted result to the result list. The predicted result includes the total number of times and the total packet length.

[0144] Optionally, the average value of the total number of times in the prediction results of all decision trees is used as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is used as the total packet length per unit time.

[0145] Optionally, the decision tree output results are regressed, that is, the total number of times and the total packet length output by all decision trees are averaged to obtain the total number of times per unit time and the total packet length per unit time.

[0146] In this embodiment, by inputting the traffic vector into each decision tree in the random forest model, each decision tree predicts a prediction result based on the traffic vector, and the average value of the prediction result is used as the total number of times per unit time and the total packet length per unit time, thereby improving the accuracy and efficiency of traffic control, ensuring the stability and reliability of the cloud password card in high concurrency scenarios, and reducing the risk of business stagnation caused by traffic mutations.

[0147] As an optional implementation, Figure 5This is a technical architecture diagram of a dynamic cloud password card data processing method provided in an embodiment of the present application.

[0148] like Figure 5 As shown, the technical architecture of the dynamic cloud password card data processing method includes a dual traffic monitor, a custom flow limiting module, a traffic prediction model, an alarm module, and a probe. The dual traffic monitor includes a count monitor and a packet length monitor, each of which includes a credential calculation unit, a credential management unit, and a request log unit. The probe is used to capture, in real time, cryptographic resource requests sent by user-end devices and the custom total count per unit time and total length per unit time received by the service call interface. The custom flow limiting module is used to send the user-defined total count per unit time and total length per unit time to the credential calculation unit in the dual traffic monitor for calculation. The traffic prediction model is used to obtain historical logs from the dual traffic monitor and make predictions based on the historical logs, outputting the total count per unit time and total packet length per unit time. The credential calculation units in the count monitor and packet length monitor are used to generate a first credential generation rate, a first credential storage limit, a second credential generation rate, and a second credential storage limit based on the total count per unit time and total packet length per unit time. The credential management unit is used to generate a first credential and a second credential, allocate the first credential and the second credential to a cryptographic resource request, and delete the first credential and the second credential after allocating the first credential and the second credential to the cryptographic resource request. The request log unit is used to record the call log of the business using the cloud cryptographic card resources. The alarm module is used to generate and report an alarm signal when the password resource request polling exceeds a preset number of times.

[0149] As an optional implementation, Figure 6 This is a flow chart of another dynamic cloud password card data processing method provided in an embodiment of the present application.

[0150] like Figure 6 As shown, the number monitor and the packet length monitor are activated to determine whether the total number of times per unit time and the total packet length per unit time inputted by the user-end device have been received. If not, the total number of times per unit time and the total packet length per unit time are determined based on historical logs using a traffic prediction model. After determining the total number of times per unit time and the total packet length per unit time, the number monitor calculates a first credential generation rate and a first credential storage upper limit based on the total number of times per unit time, and generates multiple first credentials based on the first credential generation rate and the first credential storage upper limit. The packet length monitor generates a second credential generation rate and a second credential storage upper limit based on the total number of times per unit time and the total packet length per unit time, and generates multiple second credentials based on the second credential generation rate and the second credential storage upper limit.

[0151] The probe determines whether it has monitored the password resource request received by the service call interface. If so, it determines whether the number of first credentials and the number of second credentials are both greater than the preset threshold. If so, it allocates a first credential and a second credential to the password resource request, deletes a first credential and a second credential, and records the log. The password resource request is returned to the probe, and the probe sends the password resource request to the cloud password card through the service call interface for encryption and decryption. If the number of first credentials or the number of second credentials is equal to or less than the preset threshold, the insufficient credential strategy is executed, that is, the password resource request is rejected, or the delayed polling strategy is executed. If the number of polling times is greater than or equal to the threshold, an alarm message is sent to the user terminal device.

[0152] Based on the same inventive concept, the embodiment of the present application also provides a dynamic cloud password card data processing device corresponding to the dynamic cloud password card data processing method. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned dynamic cloud password card data processing method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0153] Reference Figure 7 FIG. 1 is a schematic diagram of a structure of a dynamic cloud password card data processing device provided in an embodiment of the present application, wherein the device includes:

[0154] The first determining module 701 is used to determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time indicates the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time indicates the total packet length of encryption and decryption performed by the cloud password card within a unit time;

[0155] a second determining module 702 configured to activate a times monitor and a packet length monitor, wherein the times monitor determines a first credential generation rate and a first credential storage upper limit based on the total times per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit based on the total packet length per unit time and the total times per unit time;

[0156] a generating module 703 configured to generate, by the number monitor, at least one first credential according to the first credential generation rate and the first credential storage upper limit, and to generate, by the packet length monitor, at least one second credential according to the second credential generation rate and the second credential storage upper limit;

[0157] The acquisition module 704 is used to obtain the password resource request sent by the user terminal device;

[0158] The allocation module 705 is used to determine whether to allocate a first credential and a second credential to the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the business call interface for encryption and decryption.

[0159] Optionally, the allocation module 705 is specifically configured to:

[0160] Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold;

[0161] If so, a first credential and a second credential are allocated to the cryptographic resource request.

[0162] Optionally, the allocation module 705 is further configured to:

[0163] If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, where the insufficient credentials policy includes rejecting the cryptographic resource request and delaying polling.

[0164] Optionally, the allocation module 705 is further configured to:

[0165] If the delayed polling strategy is executed, the number of polling times is counted;

[0166] Determine whether the polling number is greater than or equal to a number threshold; if so, send an alarm message to the user terminal device.

[0167] Optionally, the second determining module 702 is specifically configured to:

[0168] Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient;

[0169] taking the product of the first quotient and a preset compensation coefficient as a first product;

[0170] The product of the first quotient and the first product is used as the first voucher generation rate;

[0171] The total number of times per unit time is used as the upper limit of first credential storage.

[0172] Optionally, the generating module 703 is specifically configured to:

[0173] The quotient of the total packet length per unit time and the total number of times per unit time is taken as the second quotient;

[0174] multiplying the second quotient by the preset encryption and decryption performance corresponding to the average packet length as the second credential generation rate;

[0175] multiplying the length of the unit time by the preset encryption and decryption performance corresponding to the average packet length as a second product;

[0176] The product of the total number of times per unit time and the second product is used as the upper limit of the second credential storage.

[0177] Optionally, the first determining module 701 is specifically configured to:

[0178] Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received;

[0179] If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

[0180] Optionally, the first determining module 701 is specifically configured to:

[0181] Extract features from the acquired historical logs to obtain traffic vectors;

[0182] The traffic vector is input into the traffic prediction model obtained by pre-training, and regression prediction is performed to output the total number of times per unit time and the total packet length per unit time.

[0183] Optionally, the first determining module 701 is specifically configured to:

[0184] The flow vector is input into a pre-trained flow prediction model to perform regression prediction and output the total number of times per unit time and the total packet length per unit time, including:

[0185] Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length;

[0186] The average value of the total number of times in the prediction results of all decision trees is used as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is used as the total packet length per unit time.

[0187] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference can be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0188] The present application also provides an electronic device, such as Figure 8 FIG. 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, comprising: a processor 801, a memory 802 and a bus. The memory 802 stores machine-readable instructions executable by the processor 801 (for example, Figure 7The first determination module 701, the second determination module 702, the generation module 703, the acquisition module 704 and the execution instructions corresponding to the allocation module 705 in the device, etc.), when the computer device is running, the processor 801 communicates with the memory 802 through a bus, and when the machine-readable instructions are executed by the processor 801, the above-mentioned dynamic cloud password card data processing method is performed.

[0189] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned dynamic cloud password card data processing method are executed.

[0190] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0191] In addition, the functional units in the various embodiments of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0192] The above is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the protection scope of the present application.

Claims

1. A dynamic cloud password card data processing method, characterized in that: The method comprises: Determine the total number of times per unit time and the total packet length per unit time, wherein the total number of times per unit time is used to indicate the total number of times the cloud password card performs encryption and decryption within a unit time, and the total packet length per unit time is used to indicate the total packet length of encryption and decryption performed by the cloud password card within a unit time; Initiate a count monitor and a packet length monitor, wherein the count monitor determines a first credential generation rate and a first credential storage upper limit based on the total count per unit time, and the packet length monitor determines a second credential generation rate and a second credential storage upper limit based on the total packet length per unit time and the total count per unit time; The number monitor generates at least one first credential according to the first credential generation rate and the first credential storage upper limit, and the packet length monitor generates at least one second credential according to the second credential generation rate and the second credential storage upper limit; Obtaining a password resource request sent by a user terminal device; Determine whether to allocate a first credential and a second credential to the password resource request according to the number of the first credentials and the number of the second credentials, and send the password resource request to the cloud password card through the service call interface for encryption and decryption; The determining, based on the total number of times per unit time, a first credential generation rate and a first credential storage upper limit includes: Taking the quotient of the total number of times per unit time and the length of the unit time as the first quotient; taking the product of the first quotient and a preset compensation coefficient as a first product; The product of the first quotient and the first product is used as the first voucher generation rate; Using the total number of times per unit time as the upper limit of first credential storage; The determining, based on the total packet length per unit time and the total number of times per unit time, a second credential generation rate and a second credential storage upper limit includes: The quotient of the total packet length per unit time and the total number of times per unit time is taken as the second quotient; multiplying the second quotient by the preset encryption and decryption performance corresponding to the average packet length as the second credential generation rate; multiplying the length of the unit time by the preset encryption and decryption performance corresponding to the average packet length as a second product; The product of the total number of times per unit time and the second product is used as the upper limit of the second credential storage.

2. The dynamic cloud password card data processing method according to claim 1, characterized in that: The determining, according to the number of the first credentials and the number of the second credentials, whether to allocate a first credential and a second credential to the cryptographic resource request includes: Determining whether the number of the first credentials and the number of the second credentials are both greater than a preset threshold; If so, a first credential and a second credential are allocated to the cryptographic resource request.

3. The dynamic cloud password card data processing method according to claim 2, characterized in that: The method further comprises: If the number of the first credentials or the number of the second credentials is less than or equal to the preset threshold, an insufficient credentials policy is executed, where the insufficient credentials policy includes rejecting the cryptographic resource request and delaying polling.

4. The dynamic cloud password card data processing method according to claim 3 is characterized in that: The method further comprises: If the delayed polling strategy is executed, the number of polling times is counted; Determine whether the polling number is greater than or equal to a number threshold; if so, send an alarm message to the user terminal device.

5. The dynamic cloud password card data processing method according to claim 1, characterized in that: Determining the total number of times per unit time and the total package length per unit time includes: Determine whether the total number of times per unit time and the total packet length per unit time inputted by the user terminal device are received; If not, the total number of times per unit time and the total packet length per unit time are determined based on the acquired historical logs.

6. The dynamic cloud password card data processing method according to claim 5, characterized in that: Determining the total number of times per unit time and the total packet length per unit time based on the acquired historical logs includes: Extract features from the acquired historical logs to obtain traffic vectors; The traffic vector is input into the traffic prediction model obtained by pre-training, and regression prediction is performed to output the total number of times per unit time and the total packet length per unit time.

7. The dynamic cloud password card data processing method according to claim 6, characterized in that: The traffic prediction model is a random forest model; The flow vector is input into a pre-trained flow prediction model to perform regression prediction and output the total number of times per unit time and the total packet length per unit time, including: Input the traffic vector into each decision tree in the random forest model, and each decision tree predicts a prediction result based on the traffic vector, wherein the prediction result includes: the total number of times and the total packet length; The average value of the total number of times in the prediction results of all decision trees is used as the total number of times per unit time, and the average value of the total packet lengths in the prediction results of all decision trees is used as the total packet length per unit time.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor executes the machine-readable instructions to perform the steps of the dynamic cloud password card data processing method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the dynamic cloud password card data processing method according to any one of claims 1 to 7.

Images