Message processing method, security protection system, device, medium and program product

Abstract

The application provides a message processing method, a security protection system, a device, a medium and a program product, and relates to computer network technology. The method comprises the following steps: for each request message received by a target protection node in a current synchronization period of the target protection node and a central control node, the target protection node calculates a first hash value of the request message; the target protection node counts the number of a target first hash value in the current synchronization period and sends the number to the central control node; the central control node calculates the sum of the number of the target first hash value in the current synchronization period and a first number of the target first hash value in a current counting period, and obtains a second number of the target first hash value in the current counting period; and the central control node triggers speed limiting processing of a to-be-speed-limited request message by multiple protection nodes based on the second number of the target first hash value in the current counting period. Therefore, the security of the network can be improved.

Description

Message processing methods, security protection systems, equipment, media and program products Technical Field

[0001] This application relates to computer network technology, and more particularly to a message processing method, security protection system, device, medium, and program product. Background Technology

[0002] Distributed Denial of Service (DDoS) is an attack method that uses a large number of computers, IoT devices, or botnets to send a massive number of requests to a target website, exhausting its server resources and preventing legitimate users from accessing the service. Layer 7 DDoS refers to application-layer distributed denial of service attacks.

[0003] Protection against Layer 7 DDoS attacks is crucial, directly determining network security. Figure 1 illustrates the basic principle of this protection. As shown in Figure 1, the basic principle of Layer 7 DDoS protection is as follows: Both legitimate users and attackers' Layer 7 Hypertext Transfer Protocol (HTTP) requests pass through a forwarding system. HTTP requests from legitimate users can be considered normal Layer 7 traffic, while HTTP requests from attackers can be considered attack traffic. The forwarding system forwards these HTTP requests to the security protection system. The security protection system can detect whether the HTTP request is attack traffic. If it is attack traffic, the security protection system can clean the attack traffic, i.e., notify the forwarding system that the HTTP request is attack traffic, and based on this, the forwarding system can block the HTTP request. If it is not attack traffic, the security protection system notifies the forwarding system that the HTTP request is normal traffic, and based on this, the forwarding system can redirect the HTTP request back to the origin server. Typically, security protection systems consist of multiple protection nodes. To ensure that the load on the security protection system is as balanced as possible, the forwarding system usually loads the HTTP hash onto the protection nodes based on the source Internet Protocol (IP) address and domain name of the HTTP request. Currently, the main method used is single-machine rate limiting to limit the attack traffic. If the attack fields of the attack traffic happen to match the fields involved in load balancing, such as the source IP address and domain name, then the attack traffic can be rate limited by using single-machine rate limiting.

[0004] However, in a Layer 7 DDoS attack scenario, there may be inconsistencies between the attack fields in the attack traffic and the fields involved in load balancing. For example, the attack fields may include specified fields in cookies, specified fields in HTTP headers, and multiple items in a query, which may not be consistent with the fields such as IP address and domain name involved in load balancing. In this case, single-machine rate limiting will cause a large amount of attack traffic to be passed through, resulting in poor network security. Summary of the Invention

[0005] This application provides a message processing method, a security protection system, an apparatus, a medium, and a program product, thereby improving network security.

[0006] In a first aspect, embodiments of this application provide a message processing method applied to a security protection system, the security protection system including: a central control node and multiple protection nodes; the method includes: for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node among the multiple protection nodes, the target protection node calculates a first hash value of the request message; the target protection node counts the number of target first hash values ​​among the multiple first hash values ​​within the current synchronization period, and sends first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period; the central control node calculates the number of target first hash values ​​within the current synchronization period and the sum of the first number of target first hash values ​​within the current statistical period, to obtain a second number of target first hash values ​​within the current statistical period; the central control node triggers the multiple protection nodes to perform rate-limiting processing on the rate-limiting request message based on the second number of target first hash values ​​within the current statistical period.

[0007] Secondly, embodiments of this application provide a message processing method applied to a target protection node. The method includes: calculating a first hash value of a request message for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node; counting the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period; and sending first synchronization data to the central control node, wherein the first synchronization data includes the number of target first hash values ​​within the current synchronization period.

[0008] Thirdly, embodiments of this application provide a message processing method applied to a central control node. The method includes: receiving first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; calculating the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period; and triggering multiple protection nodes to perform rate limiting processing on the rate limiting request message based on the second number of target first hash values ​​in the current statistical period.

[0009] Fourthly, embodiments of this application provide a message processing method applied to other protection nodes. The method includes: receiving a first rate limiting indication; taking a request message corresponding to a target first hash value as a rate-limiting request message based on the first rate limiting indication, and performing rate limiting processing on the rate-limiting request message.

[0010] Fifthly, embodiments of this application provide a security protection system, including: a central control node and multiple protection nodes; a target protection node among the multiple protection nodes is used to: calculate a first hash value of a request message for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node; count the number of target first hash values ​​among the multiple first hash values ​​within the current synchronization period, and send first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period; the central control node is used to: calculate the number of target first hash values ​​within the current synchronization period, and the sum of the first number of target first hash values ​​within the current statistical period, to obtain a second number of target first hash values ​​within the current statistical period; based on the second number of target first hash values ​​within the current statistical period, trigger the multiple protection nodes to perform rate-limiting processing on the rate-limiting request message.

[0011] In a sixth aspect, embodiments of this application provide a message processing apparatus, the apparatus comprising: a processing module, configured to: calculate a first hash value of a request message for each request message received by the message processing apparatus within the current synchronization period between the message processing apparatus and the central control node; count the number of target first hash values ​​among a plurality of first hash values ​​within the current synchronization period, and send first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period.

[0012] In a seventh aspect, embodiments of this application provide a message processing apparatus, comprising: a transceiver module and a processing module, wherein the transceiver module is configured to receive first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; the processing module is configured to: calculate the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period; and trigger multiple protection nodes to perform rate limiting processing on the rate limiting request message based on the second number of target first hash values ​​in the current statistical period.

[0013] Eighthly, embodiments of this application provide a message processing apparatus, which includes a transceiver module and a processing module, wherein the transceiver module is configured to receive a first rate limiting indication; and the processing module is configured to use a request message corresponding to a target first hash value as a rate-limiting request message based on the first rate limiting indication, and to perform rate limiting processing on the rate-limiting request message.

[0014] Ninthly, embodiments of this application provide an electronic device, including: a processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to perform the methods as described in the second to fourth aspects or their respective implementations.

[0015] In a tenth aspect, embodiments of this application provide a computer-readable storage medium for storing a computer program that causes a computer to perform the methods described in the second to fourth aspects or their respective implementations.

[0016] Eleventhly, embodiments of this application provide a computer program product including computer program instructions that cause a computer to perform the methods as described in the second to fourth aspects or their respective implementations.

[0017] In a twelfth aspect, embodiments of this application provide a computer program that causes a computer to perform the methods described in the second to fourth aspects or their respective implementations.

[0018] The technical solution provided in this application allows each protection node in the security protection system to calculate the first hash value of a request message. Each protection node can periodically synchronize the number of requests corresponding to the same first hash value within its local synchronization period to the central control node in the security protection system. This enables the central control node to calculate the global statistical value of the same first hash value within the current statistical period and trigger rate limiting processing by all protection nodes based on this global statistical value. Since attack traffic can be accurately determined based on the global statistical value, and all control nodes can comprehensively rate limit attack traffic, network security can be improved. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 is a schematic diagram of the basic principle of protection;

[0021] Figure 2 is a schematic diagram of a system architecture according to an embodiment of this application;

[0022] Figures 3 and 4 are configuration interface diagrams of the speed limiting strategy provided in the embodiments of this application;

[0023] Figure 5 is a flowchart of a message processing method provided in an embodiment of this application;

[0024] Figure 6 is a schematic diagram of the structure of a first synchronization data according to an embodiment of this application;

[0025] Figure 7 is a schematic diagram of the structure of a second synchronization data according to an embodiment of this application;

[0026] Figure 8 is a structural schematic diagram of a second speed limit indicator according to an embodiment of this application;

[0027] Figure 9 is a structural schematic diagram of a first speed limit indicator according to an embodiment of this application;

[0028] Figure 10 is a flowchart of another message processing method provided in an embodiment of this application;

[0029] Figure 11 is a flowchart of another message processing method provided in an embodiment of this application;

[0030] Figure 12 is a schematic diagram of a security protection system 1200 provided in an embodiment of this application;

[0031] Figure 13 is a schematic diagram of a message processing device 1300 provided in an embodiment of this application;

[0032] Figure 14 is a schematic diagram of a message processing device 1400 provided in an embodiment of this application;

[0033] Figure 15 is a schematic diagram of a message processing device 1500 provided in an embodiment of this application;

[0034] Figure 16 is a schematic block diagram of an electronic device 1600 provided in an embodiment of this application. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0037] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0038] Before introducing the technical solution of this application, the relevant knowledge of this application will be explained below:

[0039] I. DDoS is an attack method that uses a large number of computers, Internet of Things (IoT) terminals, or zombies to send a large number of requests to a target website, thereby exhausting its server resources and preventing normal users from accessing the service.

[0040] Second, Layer 7 DDoS refers to DDoS attacks targeting the seventh layer of the Open Systems Interconnection (OSI) model—the application layer.

[0041] Third, the single-machine rate limiting method refers to the rate limiting of attack traffic through a single protection node.

[0042] IV. Consistent Hashing is a special type of hash algorithm primarily used to solve problems related to data storage, load balancing, and data sharding in distributed systems. Its core idea is to map the entire hash value space as a virtual ring, and map storage nodes and data objects onto this ring. Data objects search for the nearest storage node clockwise based on their hash value, thus completing data storage and access. This algorithm minimizes changes to the existing mapping relationship between data objects and storage nodes when adding or removing nodes, exhibiting good fault tolerance and scalability.

[0043] 5. UA is a characteristic string that contains detailed information about the user agent software (usually a browser) that initiated the HTTP request, such as application type, operating system, software developer, and version number.

[0044] 6. A cookie is a small piece of data sent by a server to a browser and stored locally. It is sent to the server again with the browser's next request to the same server. Cookies are mainly used for the following purposes:

[0045] State management: Servers can use cookies to detect and manage user state, such as user login status, shopping cart contents, etc.

[0046] Personalization: Based on the information in the cookie, the server can provide users with personalized content and services, such as recommending products and displaying user preferences.

[0047] Session management: In web applications, cookies are often used for session management to ensure that users remain logged in across multiple pages or requests.

[0048] 7. The query is a parameter part of the Uniform Resource Locator (URL) in an HTTP request. Queries are primarily used for the following purposes:

[0049] Information transmission: A query is a way for a client to transmit information to a server. For example, in a search engine, the keywords entered by the user are transmitted to the server via a query.

[0050] Implementing dynamic pages: Many websites use queries to implement dynamic page content. For example, a page displaying product details might dynamically generate content based on the product's identifier (ID), which is passed through a query.

[0051] Detection and statistics: Websites can use queries to detect information such as user origin and behavior in order to conduct data analysis.

[0052] 8. Origin site: refers to a server that provides specific information, services or resources that can be referenced, linked or used by other websites or users.

[0053] The technical problems to be solved, the inventive concept and the system architecture of the embodiments of this application will be described below:

[0054] As mentioned above, current methods primarily use single-machine rate limiting to manage attack traffic. If the attack fields in the attack traffic happen to match the fields involved in load balancing, such as source IP address and domain name, then single-machine rate limiting can effectively manage the attack traffic. However, in Layer 7 DDoS attack scenarios, there may be situations where the attack fields in the attack traffic are inconsistent with the fields involved in load balancing. For example, the attack fields may include specified fields in cookies, specified fields in HTTP headers, or multiple items in the query, which are inconsistent with the IP address and domain name fields involved in load balancing. In such cases, single-machine rate limiting will result in a large amount of attack traffic being passed through, leading to poor network security.

[0055] To address the aforementioned technical issues, this application proposes that each protection node in the security protection system can calculate the first hash value of the request message, and each protection node can periodically synchronize the number of requests corresponding to the same first hash value within its local synchronization period (i.e., the number of requests corresponding to the same first hash value) to the central control node in the security protection system. This allows the central control node to calculate the global statistical value of the same first hash value within the current statistical period, and trigger rate limiting processing by all protection nodes based on this global statistical value. Since attack traffic can be accurately determined based on the global statistical value, and all control nodes can comprehensively rate limit the attack traffic, network security can be improved.

[0056] For example, Figure 2 is a schematic diagram of a system architecture involved in an embodiment of this application, including: terminal device 210, forwarding system 220, security protection system 230 and source station 240, wherein the security protection system 230 includes: multiple protection nodes 2301, central control node 2302 and management node 2303.

[0057] In some possible implementations, the forwarding system 220 can be directly or indirectly connected to the terminal device 210, the protection node 2301, and the source station 240 via wired or wireless communication, and this application does not impose any restrictions on this.

[0058] In some possible implementations, the protection node 2301 can be directly or indirectly connected to the central control node 2302 and the management node 2303 via wired or wireless communication, and this application does not impose any restrictions on this.

[0059] In some implementations, the terminal device 210 may have a browser installed, allowing the user to send a request message to the origin server 240 by clicking a website link on the browser or entering the website's URL in the browser's input bar. It should be understood that this request message is a web page request; it can be an HTTP request or a request message based on other protocols, and this application embodiment does not impose any limitations on this.

[0060] It should be understood that a browser is a software application used to access the Internet, allowing users to obtain and display information on web pages by entering a Uniform Resource Locator (URL) or clicking a link.

[0061] It should be understood that terminal device 210 is often equipped with a display device to display web pages, etc.

[0062] It should be understood that display devices are also called monitors, displays, touch screens, etc., and touch screens are also called touch screens, touch panels, etc.

[0063] In some possible implementations, the terminal device 210 may be a desktop computer, laptop computer, handheld computer, tablet computer, smartphone, smartwatch, virtual reality (VR), augmented reality (AR), etc., but is not limited to these.

[0064] In some implementations, the forwarding system 220 can intercept request messages and, using load balancing, send the request messages to a protection node 2301. For each request message received by the protection node 2301 within its current synchronization period with the central control node 2302, the protection node 2301 calculates a first hash value for the request message; counts the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period, and sends first synchronization data to the central control node 2302. The first synchronization data includes: the number of target first hash values ​​within the current synchronization period; the central control node 2302 calculates... The first number of target first hash values ​​within the current synchronization period is calculated, and the sum of the first number of target first hash values ​​within the current statistical period is used to obtain the second number of target first hash values ​​within the current statistical period. Based on the second number of target first hash values ​​within the current statistical period, the central control node 2302 triggers multiple protection nodes 2301 to rate-limit the request messages to be rate-limited. For example, if a request message is a request message to be rate-limited, i.e., attack traffic, then the protection node 2301 notifies the forwarding system 220 that the request message is attack traffic. Based on this, the forwarding system 220 can block the request message, i.e., not send the request message to the origin server 240. If a request message is not a request message to be rate-limited, i.e., attack traffic, then the protection node 2301 notifies the forwarding system 220 that the request message is normal traffic. Based on this, the forwarding system 220 can send the request message back to the origin server 240.

[0065] In some implementation methods, the control node 2303 can issue rate limiting policies to the protection node 2301, such as rate limiting threshold, statistical period, rate limiting processing method, rate limiting processing period, and effective conditions of the rate limiting policy.

[0066] For example, Figures 3 and 4 show the configuration interface of the rate limiting policy provided in this application embodiment. As shown in Figure 3, the operation and maintenance platform can display the interface shown in Figure 3. Operation and maintenance personnel can select "Rate Limiting" on this interface to enter the configuration interface shown in Figure 4. Here, operation and maintenance personnel can configure the effective conditions of the rate limiting policy. As shown in Figure 4, the currently configured effective condition is: UA equals curl. Operation and maintenance personnel can also configure the rate limiting policy. As shown in Figure 4, the current rate limiting policy includes: rate limiting threshold of 100 times / 10 seconds, statistical period of 10 seconds, rate limiting processing period (i.e., processing duration of 30 seconds), and rate limiting processing method (i.e., processing method), which includes: interception, algorithm challenge, redirection, etc. Furthermore, as shown in Figure 4, the attack fields involved in this rate limiting policy include: the specified field test1 in cookies, query in URL query parameters, and the specified field test2 in HTTP headers. It is worth mentioning that operation and maintenance personnel can also configure other attack fields, such as JA3 fingerprints. Once the operations and maintenance personnel have configured the rate limiting policy, the control node in the background can obtain the rate limiting policy and then issue the rate limiting policy to the protection node 2301.

[0067] In some implementations, the forwarding system 220 may be deployed on one or more edge nodes, but is not limited to this. The forwarding system 220 may also be referred to as a forwarding cluster, but is not limited to this.

[0068] It should be understood that edge nodes are network nodes that have fewer intermediaries between themselves and the end user, as opposed to cloud computing data centers. These nodes can be a server room or a physical device, and they possess common capabilities such as real-time data analysis, local data storage, and real-time network connectivity at the edge.

[0069] It is worth mentioning that the network attack involved in the embodiments of this application can be a DDoS attack, but is not limited to this. For example, it can be a Layer 7 DDoS attack, or of course, other types of network attacks.

[0070] It should be understood that if the network attack involved in the embodiments of this application is a Layer 7 DDoS attack, then the forwarding system 220 can also be referred to as a Layer 7 forwarding system or a Layer 7 forwarding cluster, etc., and the embodiments of this application do not impose such limitations. Similarly, if the network attack involved in the embodiments of this application is a Layer 7 DDoS attack, then the security protection system 230 can also be referred to as a Layer 7 protection system, a Layer 7 protection cluster, a Layer 7 security protection system, a Layer 7 security protection cluster, etc., and the embodiments of this application do not impose such limitations.

[0071] In some implementations, the protection node 2301 may be deployed on one or more edge nodes, but is not limited to this. The protection node 2301 may also be referred to as a protection machine, protection service, or protection engine, but is not limited to this.

[0072] It should be understood that the protection node 2301 is used to rate-limit the request message to be rate-limited according to the rate-limiting policy. For example, the protection node 2301 can notify the forwarding system that the request message to be rate-limited is attack traffic. Based on this, the forwarding system can block the request message, that is, not send the request message to the origin server.

[0073] In some implementations, the central control node 2302 can be deployed on one or more edge nodes, but is not limited to this. The central control node 2302 can also be referred to as a central control service, but is not limited to this.

[0074] It should be understood that the central control node 2302, acting as the control center, is used to maintain the global statistical value of each request message. For example, the central control node 2302 can receive the number of target first hash values ​​sent by the target protection node within the current synchronization period, and calculate the sum of the number of target first hash values ​​within the current synchronization period and the first number of target first hash values ​​within the current statistical period to obtain the second number of target first hash values ​​within the current statistical period. Furthermore, the central control node 2302 can trigger multiple protection nodes to perform rate-limiting processing on the rate-limiting request messages based on the second number of target first hash values ​​within the current statistical period. Here, the second number of target first hash values ​​within the current statistical period can be understood as the global statistical value of the request message corresponding to that target first hash value.

[0075] In some implementations, the management node 2303 may be deployed on one or more edge nodes, but is not limited to this. The management node 2303 may also be referred to as a management service, but is not limited to this.

[0076] It should be understood that the control node 2303 is used to issue rate limiting policies to the protection node 2301, such as rate limiting threshold, statistical period, rate limiting processing method, rate limiting processing period, and effective conditions of the rate limiting policy.

[0077] In some implementations, the origin server 240 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0078] It should be noted that Figure 2 is only a schematic diagram of a system architecture provided by an embodiment of this application. The system architecture involved in the embodiment of this application is not limited to the system architecture shown in Figure 2. For example, the system architecture shown in Figure 2 only includes one terminal device 210 and two protection nodes 2301. In fact, it may include multiple terminal devices 210 or other numbers of protection nodes 2301.

[0079] The technical solution of this application will be described in detail below:

[0080] Figure 5 is a flowchart of a message processing method provided in an embodiment of this application. This method is applied to a security protection system, which includes a central control node and multiple protection nodes. As shown in Figure 5, the method may include:

[0081] S510: For each request message received by the target protection node during the current synchronization period between the target protection node and the central control node, the target protection node calculates the first hash value of the request message;

[0082] It should be understood that the target protection node is any one of the plurality of protection nodes.

[0083] It should be understood that the current synchronization period refers to the period during which the target protection node and the central control node are currently synchronizing data. This current synchronization period is also known as the current synchronization window.

[0084] In some implementations, for each request message received by the target protection node within the current synchronization period, the request message may be an HTTP request or a request message based on other protocols, and this application embodiment does not impose any restrictions on this.

[0085] It should be understood that for each request message received by the target protection node within the current synchronization period, the first hash value of the request message is used to determine whether the request message is a request message to be rate-limited, that is, to determine whether the request message is attack traffic.

[0086] In some implementations, for each request message received by the target protection node within the current synchronization period, the target protection node can perform a hash calculation on at least one attack field of the request message to obtain a first hash value of the request message.

[0087] It should be understood that, for each request message received by the target protection node within the current synchronization period, the attack field of the request message refers to the field used by the attacker when carrying out a network attack.

[0088] In some implementations, for each request message received by the target protected node within the current synchronization period, the attack field of the request message includes at least one of the following, but is not limited to: a specified field of the cookie, a specified field of the HTTP header, and a query. For example, the specified field of the cookie could be test1 in the cookie, and the specified field of the HTTP header could be test2.

[0089] In some implementations, for each request message received by the target protection node within the current synchronization period, the target protection node calculates a first hash value for the request message, including: for each request message received by the target protection node within the current synchronization period, the target protection node directly calculates the first hash value for the request message.

[0090] In some implementations, for each request message received by the target protection node within the current synchronization period, the target protection node calculates a first hash value for the request message, including: for each request message received by the target protection node within the current synchronization period, the target protection node matches the request message with the effective conditions of the rate limiting policy; if the request message matches the effective conditions, the target protection node calculates the first hash value for the request message.

[0091] It should be understood that the difference between this implementation method and the previous one is that in this method, the target protection node needs to first match the request message with the effective conditions of the rate limiting policy. Only if the match is successful will the first hash value of the request message be calculated. This implementation method can better adapt to attack scenarios. For example, in a Layer 7 DDoS attack scenario, in addition to the attack fields mentioned above, the attack traffic also has the following characteristics: the User Agent (UA) field is equal to curl.

[0092] In some possible implementations, the rate limiting strategy may include one or more activation conditions, and the embodiments of this application do not impose any restrictions on this.

[0093] In some implementations, the security protection node includes a central control node.

[0094] In some implementations, the security protection system includes multiple central control nodes; correspondingly, for each request message received by the target protection node within the current synchronization period, before the target protection node calculates the first hash value of the request message, the system further includes: the target protection node selecting a central control node from among the multiple central control nodes using a consistent hashing algorithm. Therefore, the central control node referred to in the following embodiments of this application refers to the central control node selected by the target protection node.

[0095] It should be understood that the embodiments of this application can solve the problem of uneven distribution of synchronized data (i.e., the first synchronized data below) through the consistent hashing algorithm, thus achieving the purpose of load balancing. Furthermore, the central control node can be dynamically scaled up or down according to actual conditions, thereby improving the scalability and availability of the entire security protection system. For example, when a central control node fails, it can be replaced by another central control node; or, when the number of request messages increases dramatically, the central control node can be dynamically scaled up to meet the demand.

[0096] In some implementations, for each request message received by the target protection node within the current synchronization period, the first hash value of the request message can also be used to identify the request message.

[0097] It should be understood that, considering that different request messages may have the same first hash value, this application embodiment proposes to calculate the second hash value of the request message, and to determine the unique request message by combining the first hash value and the second hash value of the request message.

[0098] In some implementations, for each request message received by the target protection node within the current synchronization period, the target protection node can perform a hash calculation on at least one non-attack field of the request message to obtain a second hash value for the request message.

[0099] It should be understood that, for each request message received by the target protection node within the current synchronization period, the non-attack field of the request message refers to any field in the request message other than the attack field.

[0100] In some implementations, for each request message received by the target protection node within the current synchronization period, the non-attack field of the request message includes at least one of the following, but is not limited to: source IP address, destination IP address, source port number, destination port number, and domain name.

[0101] S520: The target protection node counts the number of the target's first hash value within the current synchronization period and sends the first synchronization data to the central control node. The first synchronization data includes the number of the target's first hash value within the current synchronization period.

[0102] It should be understood that for each request message received by the target protection node within the current synchronization period, the request message has a first hash value, and therefore the target protection node can obtain multiple first hash values.

[0103] It should be understood that the target first hash value is any one of the aforementioned first hash values.

[0104] It should be understood that the number of target first hash values ​​within the current synchronization period is equal to the number of request messages corresponding to that target first hash value received by the target protection node within the current synchronization period. Specifically, if the second hash value of the request message is not considered, then a request message corresponding to the target first hash value refers to a request message whose first hash value is equal to the target first hash value. If the second hash value of the request message is considered, then a request message corresponding to the target first hash value refers to a request message whose first hash value is equal to the target first hash value and corresponds to the same second hash value. Similarly, if the second hash value of the request message is considered, then the number of target first hash values ​​within the current synchronization period refers to the number of target first hash values ​​corresponding to the same second hash value within the current synchronization period. Likewise, if the second hash value of the request message is considered, then the number of target first hash values ​​within the current statistical period refers to the number of target first hash values ​​corresponding to the same second hash value within the current synchronization period.

[0105] In some implementations, the first synchronization data further includes at least one of the following: a statistical period and a rate limiting threshold; the message processing method further includes: if the central control node determines that the rate limiting strategy has changed based on at least one of the statistical period and the rate limiting threshold, the central control node resets the counter for the number of the target first hash value in the current statistical period to zero.

[0106] It should be understood that the statistical period refers to the statistical period for the global number of target first hash values.

[0107] It should be understood that the current statistical period refers to the current statistical period of the global number of target first hash values, which can also be referred to as the current statistical window.

[0108] It should be understood that the count counter for the target first hash value within the current statistical period is used to count the number of target first hash values ​​within the current statistical period.

[0109] It should be understood that each protection node, during each data synchronization with the central control node, can synchronize at least one of the statistical period and rate limiting threshold. The central control node stores at least one of the received statistical period and rate limiting threshold. Based on this, when the central control node receives at least one of the currently synchronized statistical period and rate limiting threshold from the target protection node, it can compare the currently synchronized statistical period and rate limiting threshold with its latest stored statistical period and rate limiting threshold. If at least one of the statistical period and rate limiting threshold has changed, it indicates a change in the rate limiting policy. Based on this, the central control node can reset the counter for the number of the target's first hash value within the current statistical period. By automatically resetting this timer, erroneous statistics on request messages can be avoided, thereby accurately determining attack traffic and improving network security.

[0110] For example, suppose the latest statistical period stored by the central control node is 10 seconds, while the statistical period it receives from the target protection node is 15 seconds. Then the central control node determines that the rate limiting policy has changed. Based on this, the central control node can reset the counter for the number of the first hash value of the target within the current statistical period to zero.

[0111] For example, suppose the latest rate limit threshold stored by the central control node is 100 times / 10 seconds, while the rate limit threshold it receives from the target protection node is 100 times / 15 seconds. Then the central control node determines that the rate limit policy has changed. Based on this, the central control node can reset the counter for the number of the target first hash value in the current statistical period to zero.

[0112] For example, suppose the latest statistical period stored by the central control node is 10 seconds and the rate limit threshold is 100 times / 10 seconds, while the statistical period it receives from the target protection node is 15 seconds and the rate limit threshold is 100 times / 15 seconds. Then the central control node determines that the rate limit policy has changed. Based on this, the central control node can reset the counter for the number of the first hash value of the target in the current statistical period to zero.

[0113] In some implementations, the first synchronization data further includes the start time of the current statistical period; correspondingly, the message processing method further includes: if the central control node determines, based on the start time of the current statistical period, that the current synchronization period exceeds the range of the current statistical period, then the central control node resets the counter for the number of target first hash values ​​within the current statistical period to zero. By automatically resetting this timer, erroneous statistics on request messages can be avoided, thereby accurately determining attack traffic and improving network security.

[0114] For example, suppose the start time of the current statistical period is t0, the statistical period is 10s, and the current synchronization period is [t0+600ms, t0+610ms]. Since the current synchronization period exceeds the current statistical period [t0, t0+600ms], the central control node can reset the counter for the number of the target first hash value within the current statistical period to zero.

[0115] In some implementations, the first synchronization data also includes a target first hash value. This allows the central control node to know the hash value of the global quantity to be counted, and to determine the request message based on the target first hash value.

[0116] In some implementations, the first synchronization data also includes a second hash value corresponding to the target first hash value of the request message. This allows the central control node to better determine the request message using the target first and second hash values.

[0117] In some implementations, the first synchronized data also includes: a public header.

[0118] In some implementations, the public header may include at least one of the following, but is not limited to: a timestamp, the data length of the first synchronized data, and a protocol version number. The central control node can use the timestamp to determine whether the first synchronized data is dirty data; if it is, it can discard the data. The protocol version number refers to the transmission protocol used by the target protection node and the central control node. This transmission protocol can be HTTP or other custom protocols; this application embodiment does not impose any limitations on this.

[0119] In some implementations, the first synchronization data also includes: the data type of the data, i.e., the synchronization type.

[0120] In some implementations, after each synchronization of the target first hash value to the central control node within the current synchronization period, the central control node can return the target first hash value within the current statistical period (i.e., the global count). The target protection node can then use a local counter to count the target first hash value within the current statistical period. Based on this, the target protection node can calculate the sum of the target first hash value within the current synchronization period and a third count to obtain the fourth count of the target first hash value within the current statistical period. The third count refers to the value of the local counter before accumulating the target first hash value within the current synchronization period. The fourth count refers to the value of the local counter after accumulating the target first hash value within the current synchronization period. In other words, the target protection node can also calculate the count of the target first hash value within the current statistical period.

[0121] It should be understood that the initial count value of the quantity counter on the target protection node's local machine is zero.

[0122] In some implementations, the first synchronization data also includes: the fourth number of target first hash values ​​within the current statistical period.

[0123] Figure 6 is a schematic diagram of the structure of a first synchronization data according to an embodiment of this application. As shown in Figure 6, the first synchronization data includes: a common header, a synchronization type, a target first hash value, a second hash value, the number of target first hash values ​​in the current synchronization period, the fourth number of target first hash values ​​in the current statistical period, a rate limit threshold, the start time of the current statistical period, and a statistical period.

[0124] S530: The central control node calculates the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period;

[0125] In some implementations, the central control node can count the quantity of the target first hash value within the current statistical period using a local counter. Here, the first quantity of the target first hash value within the current statistical period refers to the count value of the local counter on the central control node before accumulating the quantity of the target first hash value within the current synchronization period. The second quantity of the target first hash value within the current statistical period refers to the count value of the local counter on the central control node after accumulating the quantity of the target first hash value within the current synchronization period.

[0126] It should be understood that the initial count value of the quantity counter on the central control node is zero.

[0127] S540: The central control node triggers multiple protection nodes to rate-limit the pending rate-limiting request messages based on the second number of the target first hash value within the current statistical period.

[0128] In the embodiments of this application, S540 can be implemented in any of the following possible ways, but is not limited thereto:

[0129] In the first implementation, S540 may include:

[0130] S540-1A: The central control node sends second synchronization data to the target protection node, wherein the second synchronization data includes: the second quantity of the target first hash value in the current statistical period;

[0131] In some implementations, the second synchronization data also includes a public header.

[0132] In some implementations, the public header may include at least one of the following, but is not limited to: a timestamp, the data length of the second synchronization data, and a protocol version number. The target protection node can use the timestamp to determine whether the second synchronization data is dirty data; if it is, it can discard the data. The protocol version number refers to the transmission protocol used by the target protection node and the central control node. This transmission protocol can be HTTP or other custom protocols; this application embodiment does not impose any limitations on this.

[0133] In some implementations, the second synchronization data also includes: the data type of the data, i.e., the synchronization type.

[0134] In some implementations, the second synchronization data also includes a target first hash value. This allows the target protection node to know the hash value of the global quantity to be counted and to determine the request message based on the target first hash value.

[0135] In some implementations, the second synchronization data also includes a second hash value. This allows the target protection node to better determine the request message using the target's first and second hash values.

[0136] In some implementations, the second synchronization data also includes the start time of the current statistical period.

[0137] Figure 7 is a schematic diagram of the structure of a second synchronization data according to an embodiment of this application. As shown in Figure 7, the second synchronization data includes: a common header, a synchronization type, a target first hash value, a second hash value, a second quantity of the target first hash value in the current statistical period, and the start time of the current statistical period.

[0138] S540-2A: If the second number of the target first hash value in the current statistical period is greater than the rate limiting threshold, the target protection node will treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message.

[0139] In some implementation methods, the target protection node treats the request message corresponding to the target first hash value as the rate-limiting request message, including: the target protection node treats the request message corresponding to the target first hash value received by the target protection node in the current statistical period and the current rate-limiting processing period as the rate-limiting request message.

[0140] It should be understood that the current speed limit processing cycle refers to the current speed limit processing cycle, which is also known as the current handling cycle, but is not limited to this.

[0141] In some implementations, the start time of the current rate-limiting processing cycle can be the time when the target protection node determines that the second quantity is greater than the rate-limiting threshold, but it is not limited to this. Therefore, there may be an overlap between the current processing cycle and the current statistical cycle. For example, the current statistical cycle is [t0, t0+600ms], and the current processing cycle is [t0+400ms, t0+800ms].

[0142] In some implementation methods, the target protection node treats the request message corresponding to the target first hash value as the rate-limiting request message, including: the target protection node treats the request message corresponding to the target first hash value received by the target protection node within the current statistical period as the rate-limiting request message.

[0143] In some possible implementations, the target protection node treats the request message corresponding to the target first hash value as the rate-limiting request message, including: the target protection node treats the request message corresponding to the target first hash value received by the target protection node within the current rate-limiting processing cycle as the rate-limiting request message.

[0144] In some implementation methods, the target protection node performs rate-limiting processing on the rate-limiting request message, including: interception, algorithm challenge, and redirection of the rate-limiting request message. Taking the interception of the rate-limiting request message as an example, the target protection node can notify the forwarding system that the rate-limiting request message is attack traffic. Based on this, the forwarding system can block the request message, that is, not send the request message to the origin server.

[0145] S540-3A: The target protection node sends the first speed limit instruction to other protection nodes through the central control node;

[0146] It should be understood that the first rate limit indication is used to process the rate limit request message.

[0147] In some possible implementations, the target protection node sends a first speed limit instruction to other protection nodes through the central control node, including: the target protection node sending a second speed limit instruction to the central control node; the central control node generating a first speed limit instruction based on the second speed limit instruction; and the central control node sending the first speed limit instruction to other protection nodes.

[0148] It should be understood that the second speed limit indication is used to instruct the speed limit request message to be processed for speed limit.

[0149] In some implementations, the second rate-limiting indication includes a target first hash value, which enables the central control node to determine the request message using the target first hash value.

[0150] In some implementations, the second rate-limiting indicator also includes a second hash value, which allows the central control node to better determine the request message using the target first and second hash values.

[0151] In some implementations, the second speed limit indicator may also include: the data type of the second speed limit indicator, i.e., the synchronization type.

[0152] In some implementations, the second speed limit indicator also includes a public header.

[0153] In some implementations, the public header may include at least one of the following, but is not limited to: a timestamp, the data length of the second rate limit indication, and a protocol version number. The central control node can use the timestamp to determine whether the second rate limit indication is dirty data; if it is, it can discard the data. The protocol version number refers to the transmission protocol used by the target protection node and the central control node. This transmission protocol can be HTTP or other custom protocols; this application embodiment does not impose any limitations on this.

[0154] In some implementations, the second rate limiting indication also includes the start time of the current rate limiting processing cycle, so that the central control node can know the start time of the current rate limiting processing cycle and then notify other protection nodes of the start time, so that all protection nodes can process the rate limiting request message in the current rate limiting processing cycle.

[0155] In some implementations, the second rate limiting indicator also includes a rate limiting processing cycle, which allows the central control node to know the rate limiting processing cycle and compare the most recently stored rate limiting processing cycle with the rate limiting processing cycle carried by the second rate limiting indicator. If they are different, it is determined that the rate limiting policy has changed, and the central control node resets the counter for the number of the target first hash value in the current statistical period to zero.

[0156] Figure 8 is a schematic diagram of the structure of a second rate limiting indicator according to an embodiment of this application. As shown in Figure 8, the second rate limiting indicator includes: a common header, a data type of the second rate limiting indicator, namely, a synchronization type, a target first hash value, a second hash value, the start time of the current rate limiting processing cycle, and a rate limiting processing cycle.

[0157] In some possible implementations, the first speed limit indication and the second speed limit indication may be the same or different, and the embodiments of this application do not impose any restrictions on this.

[0158] For example, Figure 9 is a schematic diagram of the structure of a first rate limiting indicator according to an embodiment of this application. As shown in Figure 9, the first rate limiting indicator includes: a common header, a data type of the second rate limiting indicator (i.e., synchronization type), a target first hash value, a second hash value, and the start time of the current rate limiting processing cycle. Therefore, it can be seen that the first rate limiting indicator shown in Figure 9 is different from the second rate limiting indicator shown in Figure 8.

[0159] S540-4A: Other protection nodes, based on the first rate limiting indication, treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message.

[0160] In some possible implementations, other protection nodes treat request messages corresponding to the target first hash value as rate-limiting request messages, including: other protection nodes treating request messages corresponding to the target first hash value received by other protection nodes during the current statistical period and the current rate-limiting processing period as rate-limiting request messages.

[0161] In some possible implementations, other protection nodes treat request messages corresponding to the target first hash value as rate-limiting request messages, including: other protection nodes treating request messages corresponding to the target first hash value received by other protection nodes within the current statistical period as rate-limiting request messages.

[0162] In some possible implementations, other protection nodes treat request messages corresponding to the target first hash value as rate-limiting request messages, including: other protection nodes treating request messages corresponding to the target first hash value received by other protection nodes within the current rate-limiting processing cycle as rate-limiting request messages.

[0163] In some feasible implementations, other protection nodes perform rate-limiting processing on the rate-limiting request message, including: interception, algorithm challenge, and redirection of the rate-limiting request message. Taking the interception of the rate-limiting request message as an example, other protection nodes can notify the forwarding system that the rate-limiting request message is attack traffic. Based on this, the forwarding system can block the request message, that is, not send the request message to the origin server.

[0164] Alternatively, in the second implementation, S540 may include:

[0165] S540-1B: If the second number of the target first hash value in the current statistical period is greater than the rate limit threshold, the central control node sends a fourth rate limit instruction to each protection node.

[0166] It should be understood that the fourth rate limit indication is used to process the rate limit request message.

[0167] It should be understood that the format of this fourth speed limit indication can be the same as that of the first speed limit indication mentioned above. Therefore, the explanation of the fourth speed limit indication can refer to the explanation of the first speed limit indication above. It is worth mentioning that the speed limit indication in this feasible method is called the fourth speed limit indication because the time when the second quantity determined by the central control node exceeds the speed limit threshold can be different from the time when the second quantity determined by the target protection node exceeds the speed limit threshold. In other words, the start time of the current speed limit processing cycle determined by the central control node and the start time of the current speed limit processing cycle determined by the target protection node can be different.

[0168] S540-2B: Each protection node, based on the fourth rate limiting indication, treats the request message corresponding to the target first hash value as a rate-limiting request message and performs rate limiting processing on the rate-limiting request message.

[0169] In some implementations, for each protection node, the protection node uses request messages corresponding to the target first hash value as rate-limiting request messages based on a fourth rate-limiting indication. This includes: the protection node using request messages corresponding to the target first hash value received by the protection node within the current statistical period and the current rate-limiting processing period as rate-limiting request messages. The current rate-limiting processing period can be determined based on the fourth rate-limiting indication. For example, the fourth rate-limiting indication can indicate the start time of the current rate-limiting processing period, and since the protection node has been configured with a rate-limiting processing period, the protection node can determine the current rate-limiting processing period based on the start time and the rate-limiting processing period.

[0170] In some implementations, for each protection node, the protection node uses the request message corresponding to the target first hash value as the rate-limiting request message based on the fourth rate-limiting indication, including: the protection node responds to the fourth rate-limiting indication by using the request message corresponding to the target first hash value received by the protection node in the current statistical period as the rate-limiting request message.

[0171] In some implementations, for each protection node, the protection node uses request messages corresponding to the target first hash value as rate-limiting request messages based on a fourth rate-limiting indication. This includes: the protection node using request messages corresponding to the target first hash value received by the protection node within the current rate-limiting processing cycle as rate-limiting request messages. The current rate-limiting processing cycle can be determined based on the fourth rate-limiting indication. For example, the fourth rate-limiting indication can indicate the start time of the current rate-limiting processing cycle, and since the protection node has been configured with a rate-limiting processing cycle, the protection node can determine the current rate-limiting processing cycle based on the start time and the rate-limiting processing cycle.

[0172] In some implementations, for each protection node, the protection node performs rate-limiting processing on the rate-limiting request message, including: intercepting the rate-limiting request message, performing algorithm challenges, redirecting, etc. Taking the interception of the rate-limiting request message as an example, the protection node can notify the forwarding system that the rate-limiting request message is attack traffic. Based on this, the forwarding system can block the request message, that is, not send the request message to the origin server.

[0173] Option 3 can be implemented, and S540 may include:

[0174] S540-1C: The central control node sends second synchronization data to each protection node, wherein the second synchronization data includes: the second number of target first hash values ​​in the current statistical period;

[0175] It should be understood that the explanation of the second synchronization data can be found above, and will not be repeated in the embodiments of this application.

[0176] S540-2C: For each protection node, if the second number of the target first hash value in the current statistical period is greater than the rate limiting threshold, then the protection node will treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message.

[0177] In some implementations, for each protection node, the protection node takes the request message corresponding to the target first hash value as the rate-limiting request message, including: the protection node takes the request message corresponding to the target first hash value received by the protection node in the current statistical period and the current rate-limiting processing period as the rate-limiting request message.

[0178] In some implementations, for each protection node, the protection node treats the request message corresponding to the target first hash value as the rate-limiting request message, including: the protection node treats the request message corresponding to the target first hash value received by the protection node in the current statistical period as the rate-limiting request message.

[0179] In some implementations, for each protection node, the protection node treats the request message corresponding to the target first hash value as the rate-limiting request message, including: the protection node treats the request message corresponding to the target first hash value received by the protection node during the current rate-limiting processing cycle as the rate-limiting request message.

[0180] In some implementations, for each protection node, the protection node performs rate-limiting processing on the rate-limiting request message, including: intercepting the rate-limiting request message, performing algorithm challenges, redirecting, etc. Taking the interception of the rate-limiting request message as an example, the protection node can notify the forwarding system that the rate-limiting request message is attack traffic. Based on this, the forwarding system can block the request message, that is, not send the request message to the origin server.

[0181] In some implementation methods, if the target protection node determines that the number of target first hash values ​​in the current statistical period and the next statistical period is greater than the rate limiting threshold, the target protection node extends the rate limiting processing period for request messages corresponding to the target first hash value, thereby improving the protection effect.

[0182] For example, the original rate limiting processing cycle configured by the operations and maintenance personnel is 10 seconds. However, if the number of times the target first hash value is greater than the rate limiting threshold in the current statistical period, and the number is still greater than the rate limiting threshold in the next statistical period, the target protection node can extend the original rate limiting processing cycle to 15 seconds for request messages corresponding to the target first hash value.

[0183] The message processing method provided in this application embodiment is illustrated below by way of an example:

[0184] Figure 10 is a flowchart of another message processing method provided in an embodiment of this application. Assume M represents the quantity of a certain first hash value within the synchronization period, P represents the quantity of the first hash value within the statistical period, the synchronization period is 10ms, the statistical period is 35ms, the rate limiting processing period is 10ms, and the rate limiting threshold is 100 times / 35ms. As shown in Figure 10, the data synchronized by the protection node 1 to the central control node for the first time includes: M = 1, meaning the protection node 1 synchronizes the quantity of the first hash value within the current synchronization period to the central control node as 1. Then, since the central control node receives the quantity of the first hash value within the synchronization period for the first time within the current statistical period, it can calculate the sum of the quantity of the first hash value within the synchronization period (1) and the quantity of the first hash value within the current statistical period (0), obtaining that the quantity of the first hash value within the current statistical period is 1. It can then synchronize data to the protection node 1: P = 1. The protection node 1 determines that the quantity of the first hash value within the current statistical period is not greater than the rate limiting threshold and does not perform any processing. Furthermore, the data that the protection node 2 synchronizes to the central control node for the first time includes: M = 10, that is, the number of the first hash value synchronized by the protection node 2 to the central control node in the current synchronization period is 10. Then, the central control node can calculate the sum of the number of the first hash value in the synchronization period (10) and the number of the first hash value in the current statistical period (1), and obtain the number of the first hash value in the current statistical period as 11. It can then synchronize the data to the protection node 2: P = 11. The protection node 2 determines that the number of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing. Furthermore, the data synchronized by protection node 1 to the central control node for the second time includes: M = 20, that is, the number of the first hash value synchronized by protection node 1 to the central control node in the current synchronization period is 20. Then, the central control node can calculate the sum of the number of the first hash value in the synchronization period (20) and the number of the first hash value in the current statistical period (11), and obtain the number of the first hash value in the current statistical period as 31. It can then synchronize the data to protection node 1: P = 31. Protection node 1 determines that the number of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing. Furthermore, the data synchronized by protection node 2 to the central control node for the second time includes: M = 20, that is, the number of the first hash value synchronized by protection node 2 to the central control node in the current synchronization period is 20. Then, the central control node can calculate the sum of the number of the first hash value in the synchronization period (20) and the number of the first hash value in the current statistical period (31), and obtain that the number of the first hash value in the current statistical period is 51. It can then synchronize the data to protection node 2: P = 51. Protection node 2 determines that the number of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing.Furthermore, the data synchronized by protection node 1 to the central control node for the third time includes: M = 50, meaning that protection node 1 synchronizes 50 of the first hash value within the current synchronization period to the central control node. Then, the central control node can calculate the sum of the first hash value's quantity (50) within the synchronization period and its quantity (51) within the current statistical period, obtaining a quantity of 101 for the first hash value within the current statistical period. It can then synchronize data to protection node 1: P = 101. Protection node 1 determines that the quantity of the first hash value within the current statistical period is greater than the rate-limiting threshold. In this case, protection node 1 can treat the request message corresponding to the first hash value as a rate-limiting request message, perform rate-limiting processing on the rate-limiting request message, and send a second rate-limiting instruction to the central control node. The central control node sends a first rate-limiting instruction to other protection nodes, and the other protection nodes, based on the first rate-limiting instruction, treat the request message corresponding to the first hash value as a rate-limiting request message and perform rate-limiting processing on the rate-limiting request message.

[0185] This application provides a message processing method applied to a security protection system, which includes a central control node and multiple protection nodes. The method includes: for each request message received by a target protection node within the current synchronization period between the target protection node and the central control node, the target protection node calculates a first hash value for the request message; the target protection node counts the number of target first hash values ​​among the multiple first hash values ​​within the current synchronization period and sends first synchronization data to the central control node, wherein the first synchronization data includes the number of target first hash values ​​within the current synchronization period; the central control node calculates the sum of the number of target first hash values ​​within the current synchronization period and a first count of target first hash values ​​within the current statistical period to obtain a second count of target first hash values ​​within the current statistical period; the central control node triggers multiple protection nodes to perform rate-limiting processing on the rate-limiting request messages based on the second count of target first hash values ​​within the current statistical period. This allows each protection node to periodically synchronize the number of the same first hash value within its local synchronization period to the central control node, enabling the central control node to calculate a global statistical value of the same first hash value within the current statistical period and trigger rate-limiting processing on all protection nodes using this global statistical value. Since attack traffic can be accurately determined based on global statistics, and all defense nodes can comprehensively rate-limit attack traffic, network security can be improved. Furthermore, the message processing method provided in this application is applicable to extreme scenarios, such as those with a large number of request messages and / or numerous attack fields; in such scenarios, the protection accuracy can reach 80%.

[0186] In some implementation methods, before the central control node calculates the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period, the message processing method further includes: the target protection node calculating the number of target first hash values ​​in the current synchronization period and the sum of the third number of target first hash values ​​in the current statistical period to obtain the fourth number of target first hash values ​​in the current statistical period, wherein the first synchronization data further includes: the fourth number of target first hash values ​​in the current statistical period; correspondingly, the central control node calculating the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period includes: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the rate limiting threshold, then the central control node calculates the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period.

[0187] It should be understood that the explanation of the third and fourth quantities of the target first hash value within the current statistical period can be found above, and will not be repeated in this application embodiment.

[0188] It should be understood that in this feasible approach, for the current synchronization period, before receiving the second number of the target first hash value in the current statistical period, the target protection node first calculates the global number of the target first hash value in the current statistical period, i.e., the fourth number, and synchronizes the fourth number to the central control node. The central control node can compare the fourth number with the rate limiting threshold. Only when the fourth number is less than or equal to the rate limiting threshold will the central control node calculate the global number of the target first hash value in the current statistical period, i.e., the second number, and trigger multiple protection nodes to rate limit the rate limiting request message based on the second number of the target first hash value in the current statistical period.

[0189] In some implementation methods, if the fourth number of the target first hash value in the current statistical period is greater than the rate limiting threshold, the target protection node will treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message; the target protection node will send a third rate limiting instruction to other protection nodes through the central control node; the other protection nodes will treat the request message corresponding to the target first hash value as a rate-limiting request message based on the third rate limiting instruction and perform rate limiting processing on the rate-limiting request message.

[0190] It should be understood that in this feasible approach, if the fourth quantity is greater than the rate-limiting threshold, the target protection node can directly perform rate-limiting processing without waiting for the central control node to return the second quantity of the target's first hash value within the current statistical period, and then compare the second quantity with the rate-limiting threshold, thereby improving protection efficiency.

[0191] In some possible implementations, the method for determining the rate-limiting request message and the rate-limiting processing method can be referred to the above, and will not be repeated in the embodiments of this application.

[0192] It should be understood that the format of this third speed limit indication can be the same as that of the first speed limit indication mentioned above. Therefore, the explanation of the third speed limit indication can refer to the explanation of the first speed limit indication above. It is worth mentioning that the speed limit indication in this implementation method is called the third speed limit indication because the start time of the current speed limit processing cycle determined by the target protection node can be different in the two implementation methods.

[0193] In some implementation methods, if the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, the central control node sends third synchronization data to other protection nodes. The third synchronization data includes the fourth number of the target first hash value in the current statistical period. If the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, other protection nodes stop synchronizing data with the central control node.

[0194] In some implementations, the format of the third synchronization data can be the same as that of the second synchronization data. Therefore, for an explanation of the third synchronization data, please refer to the explanation of the second synchronization data above.

[0195] It should be understood that, after receiving the fourth quantity, other protection nodes can compare the fourth quantity with the rate limit threshold. When the fourth quantity is greater than the rate limit threshold, other protection nodes can stop synchronizing data with the central control node, thereby reducing the network resource overhead between other protection nodes and the central control node.

[0196] The message processing method provided in this application embodiment is illustrated below by way of an example:

[0197] Figure 11 is a flowchart of another message processing method provided in the embodiment of this application. It is assumed that M represents the number of a certain first hash value in the synchronization period, N represents the number of the first hash value calculated by the protection node in the statistical period, P represents the number of the first hash value calculated by the central control node in the statistical period, the synchronization period is 10ms, the statistical period is 35ms, the rate limiting processing period is 10ms, and the rate limiting threshold is 80 times / 35ms. As shown in Figure 11, the data synchronized by protection node 1 to the central control node for the first time includes: M=1, N=1, that is, protection node 1 synchronizes the quantity of the first hash value in the current synchronization period to the central control node as 1, and synchronizes the quantity of the first hash value in the current statistical period as 1. Then, the central control node can compare N with the rate limit threshold. Since N is less than the rate limit threshold, and the central control node receives the quantity of the first hash value in the synchronization period for the first time in the current statistical period, the central control node can calculate the sum of the quantity of the first hash value in the synchronization period as 1 and the quantity of the first hash value in the current statistical period as 0, and obtain that the quantity of the first hash value in the current statistical period is 1. It can synchronize data to protection node 1: P=1. Protection node 1 determines that the quantity of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing. Furthermore, the data that protection node 2 synchronizes to the central control node for the first time includes: M=10, N=10, that is, protection node 2 synchronizes to the central control node that the quantity of the first hash value in the current synchronization period is 10, and synchronizes that the quantity of the first hash value in the current statistical period is 10. Then, the central control node can compare N with the rate limit threshold. Since N is less than the rate limit threshold, the central control node can then calculate the sum of the quantity of the first hash value in the synchronization period (10) and the quantity of the first hash value in the current statistical period (1), and obtain that the quantity of the first hash value in the current statistical period is 11. It can then synchronize the data to protection node 2: P=11. Protection node 2 determines that the quantity of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing. Furthermore, the data synchronized by protection node 1 to the central control node for the second time includes: M=20, N=21, that is, protection node 1 synchronizes to the central control node that the quantity of the first hash value in the current synchronization period is 20, and synchronizes that the quantity of the first hash value in the current statistical period is 21. Then, the central control node can compare N with the rate limit threshold. Since N is less than the rate limit threshold, the central control node can then calculate the sum of the quantity of the first hash value in the synchronization period (20) and the quantity of the first hash value in the current statistical period (11), and obtain that the quantity of the first hash value in the current statistical period is 31. It can then synchronize the data to protection node 1: P=31. Protection node 1 determines that the quantity of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing.Furthermore, the data synchronized by protection node 2 to the central control node for the second time includes: M=20, N=31. That is, protection node 2 synchronizes to the central control node that the quantity of the first hash value in the current synchronization period is 20, and synchronizes that the quantity of the first hash value in the current statistical period is 31. Then, the central control node can compare N with the rate limit threshold. Since N is less than the rate limit threshold, the central control node can then calculate the sum of the quantity of the first hash value in the synchronization period (20) and the quantity of the first hash value in the current statistical period (31), and obtain that the quantity of the first hash value in the current statistical period is 51. It can then synchronize the data to protection node 2: P=51. Protection node 2 determines that the quantity of the first hash value in the current statistical period is not greater than the rate limit threshold, and does not perform any processing. Furthermore, the data synchronized by protection node 1 to the central control node for the third time includes: M = 50, N = 81. This means that protection node 1 synchronizes 50 instances of the first hash value to the central control node within the current synchronization period. Protection node 1 compares N with the rate-limiting threshold. Since N is greater than the rate-limiting threshold, protection node 1 can treat request messages corresponding to the first hash value as rate-limiting request messages and perform rate-limiting processing on these messages, sending a second rate-limiting instruction to the central control node. The central control node sends a first rate-limiting instruction to other protection nodes. These other protection nodes, based on the first rate-limiting instruction, treat request messages corresponding to the first hash value as rate-limiting request messages and perform rate-limiting processing on them. Furthermore, the central control node determines that N is greater than the rate-limiting threshold; therefore, it no longer accumulates the number of first hash values ​​within the current statistical period, nor does it return the number of first hash values ​​within the current statistical period to protection node 1.

[0198] In this embodiment, the target protection node can first calculate the global number of the target first hash value in the current statistical period for the current synchronization period, and compare the global number with the rate limiting threshold. If the rate limiting threshold is greater than the rate limiting threshold, the target protection node can directly perform rate limiting without waiting for the central control node to return the second number of the target first hash value in the current statistical period and then compare the second number with the rate limiting threshold, thereby improving protection efficiency.

[0199] The preferred embodiments of this application have been described in detail above with reference to the accompanying drawings. However, this application is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this application, various simple modifications can be made to the technical solutions of this application, and these simple modifications all fall within the protection scope of this application. For example, the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this application will not describe the various possible combinations separately. Furthermore, various different embodiments of this application can also be arbitrarily combined, as long as they do not violate the spirit of this application, they should also be considered as the content disclosed in this application.

[0200] It should also be understood that, in the various method embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0201] The methods provided in the embodiments of this application have been described above. The message processing system and apparatus provided in the embodiments of this application will be described below.

[0202] Figure 12 is a schematic diagram of a security protection system 1200 provided in an embodiment of this application. As shown in Figure 12, it includes a central control node 1210 and multiple protection nodes 1220.

[0203] Among them, the target protection nodes in multiple protection nodes 1220 are used for:

[0204] For each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, calculate the first hash value of the request message;

[0205] The number of target first hash values ​​among multiple first hash values ​​within the current synchronization period is counted, and the first synchronization data is sent to the central control node. The first synchronization data includes the number of target first hash values ​​within the current synchronization period.

[0206] Central control node 1210 is used for:

[0207] Calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period;

[0208] Based on the second number of the target first hash value within the current statistical period, multiple protection nodes are triggered to rate-limit the message to be rate-limited.

[0209] In some implementations, the central control node 1210 is used to send second synchronization data to the target protection node, wherein the second synchronization data includes: a second number of target first hash values ​​in the current statistical period; if the second number of target first hash values ​​in the current statistical period is greater than the rate limiting threshold, the target protection node is used to treat the request message corresponding to the target first hash value as a rate-limiting request message and to perform rate limiting processing on the rate-limiting request message; the target protection node is used to send a first rate limiting indication to other protection nodes through the central control node 1210; other protection nodes are used to treat the request message corresponding to the target first hash value as a rate-limiting request message based on the first rate limiting indication and to perform rate limiting processing on the rate-limiting request message.

[0210] In some implementations, the target protection node is specifically used to treat the request messages corresponding to the target first hash value received by the target protection node within the current statistical period and the current rate limiting processing period as rate limiting request messages.

[0211] In some implementations, other protection nodes are specifically used to treat request messages corresponding to the target first hash value received by other protection nodes during the current statistical period and the current rate limiting processing period as rate limiting request messages.

[0212] In some implementations, the target protection node is used to send a second speed limit indication to the central control node 1210; the central control node 1210 is used to generate a first speed limit indication based on the second speed limit indication; and the central control node 1210 is used to send the first speed limit indication to other protection nodes.

[0213] In some implementation methods, before the central control node 1210 calculates the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period, the target protection node is also used to calculate the number of target first hash values ​​in the current synchronization period and the sum of the third number of target first hash values ​​in the current statistical period to obtain the fourth number of target first hash values ​​in the current statistical period. The first synchronization data also includes the fourth number of target first hash values ​​in the current statistical period. Accordingly, the central control node 1210 is specifically used to: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the rate limiting threshold, calculate the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period.

[0214] In some implementation methods, if the fourth number of the target first hash value in the current statistical period is greater than the rate limiting threshold, the target protection node is also used to treat the request message corresponding to the target first hash value as a rate-limiting request message and to perform rate limiting processing on the rate-limiting request message; the target protection node is also used to send a third rate limiting indication to other protection nodes through the central control node 1210; other protection nodes are also used to treat the request message corresponding to the target first hash value as a rate-limiting request message based on the third rate limiting indication and to perform rate limiting processing on the rate-limiting request message.

[0215] In some implementation methods, if the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, the central control node 1210 is also used to send third synchronization data to other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; if the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, other protection nodes are also used to stop synchronizing data to the central control node 1210.

[0216] In some implementations, if the target protection node determines that the number of target first hash values ​​in both the current statistical period and the next statistical period is greater than the rate limiting threshold, the target protection node is also used to extend the rate limiting processing period for request messages corresponding to the target first hash value.

[0217] In some implementations, the first synchronization data also includes at least one of the following: a statistical period and a rate limit threshold; the central control node 1210 is also used to: if the central control node 1210 determines that the rate limit policy has changed based on at least one of the statistical period and the rate limit threshold, then reset the counter for the number of the target first hash value in the current statistical period to zero.

[0218] In some implementations, the first synchronization data also includes: the start time of the current statistical period; the central control node 1210 is also used to: if the central control node 1210 determines that the current synchronization period exceeds the range of the current statistical period based on the start time of the current statistical period, then the counter for the number of the target first hash value in the current statistical period is cleared.

[0219] In some implementations, the first synchronization data also includes: a second hash value corresponding to the request message of the target first hash value.

[0220] In some implementations, the security protection system includes multiple central control nodes 1210; for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node 1210 among the multiple protection nodes, before the target protection node calculates the first hash value of the request message, the target protection node is also used to select a central control node 1210 among the multiple central control nodes 1210 using a consistent hashing algorithm.

[0221] In some implementations, the target protection node is specifically used to: match the request message with the effective conditions of the rate limiting policy for each request message received by the target protection node within the current synchronization cycle; if the request message matches the effective conditions, then calculate the first hash value of the request message.

[0222] It should be understood that the system embodiments and the method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, further details will not be provided here.

[0223] Figure 13 is a schematic diagram of a message processing device 1300 provided in an embodiment of this application. As shown in Figure 13, the device 1300 includes: a processing module 1310, used for:

[0224] For each request message received by the message processing device within the current synchronization period between the message processing device and the central control node, calculate the first hash value of the request message;

[0225] The number of target first hash values ​​among multiple first hash values ​​within the current synchronization period is counted, and the first synchronization data is sent to the central control node. The first synchronization data includes the number of target first hash values ​​within the current synchronization period.

[0226] In some implementations, the message processing device 1300 further includes: a transceiver module 1320, configured to receive second synchronization data sent by the central control node, wherein the second synchronization data includes: a second quantity of the target first hash value within the current statistical period; the processing module 1310 is further configured to: if the second quantity of the target first hash value within the current statistical period is greater than the rate limiting threshold, then treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message; the transceiver module 1320 is further configured to send a first rate limiting indication to other protection nodes through the central control node; so that other protection nodes, based on the first rate limiting indication, treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message.

[0227] In some implementations, the processing module 1310 is specifically used to: take the request message corresponding to the target first hash value received by the message processing device within the current statistical period and the current rate limiting processing period as the rate limiting request message.

[0228] In some implementations, the transceiver module 1320 is specifically used to: send a second speed limit indication to the central control node; enable the central control node to generate a first speed limit indication based on the second speed limit indication; and send the first speed limit indication to other protection nodes.

[0229] In some implementations, the processing module 1310 is further configured to: calculate the sum of the number of target first hash values ​​in the current synchronization period and the third number of target first hash values ​​in the current statistical period to obtain the fourth number of target first hash values ​​in the current statistical period, wherein the first synchronization data further includes the fourth number of target first hash values ​​in the current statistical period.

[0230] In some implementations, the processing module 1310 is further configured to: if the fourth number of the target first hash value in the current statistical period is greater than the rate limiting threshold, then treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message; send a third rate limiting instruction to other protection nodes through the central control node, so that other protection nodes treat the request message corresponding to the target first hash value as a rate-limiting request message based on the third rate limiting instruction and perform rate limiting processing on the rate-limiting request message.

[0231] In some implementations, the processing module 1310 is further configured to: if it is determined that the number of target first hash values ​​in the current statistical period and the next statistical period is greater than the rate limiting threshold, then extend the rate limiting processing period for request messages corresponding to the target first hash value.

[0232] In some implementations, the first synchronization data also includes: a second hash value corresponding to the request message of the target first hash value.

[0233] In some implementations, the security protection system includes multiple central control nodes; the processing module 1310 is also used to: select one central control node from the multiple central control nodes using a consistent hashing algorithm.

[0234] In some implementations, the processing module 1310 is specifically used to: match the request message with the effective conditions of the rate limiting policy for each request message received by the message processing device within the current synchronization period; if the request message matches the effective conditions, calculate the first hash value of the request message.

[0235] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, they will not be repeated here. Specifically, the device 1300 shown in FIG13 can execute the method embodiment corresponding to the target protection node, and the foregoing and other operations and / or functions of each module in the device 1300 are respectively for implementing the corresponding processes in each method corresponding to the target protection node. For the sake of brevity, they will not be repeated here.

[0236] The apparatus 1300 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly embodied as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above method embodiments.

[0237] Figure 14 is a schematic diagram of a message processing device 1400 provided in an embodiment of this application. As shown in Figure 14, the device 1400 includes:

[0238] The transceiver module 1410 is used to receive first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period;

[0239] Processing module 1420 is used for:

[0240] Calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period to obtain the second number of target first hash values ​​in the current statistical period;

[0241] Based on the second number of the target first hash value within the current statistical period, multiple protection nodes are triggered to rate-limit the message to be rate-limited.

[0242] In some implementations, the transceiver module 1410 is used to send second synchronization data to the target protection node, wherein the second synchronization data includes: the second quantity of the target first hash value within the current statistical period.

[0243] In some implementations, the transceiver module 1410 is used to receive the second speed limit indication; the processing module 1420 is used to: generate a first speed limit indication based on the second speed limit indication; and the transceiver module 1410 is used to send the first speed limit indication to other protection nodes.

[0244] In some implementations, the first synchronization data further includes: a fourth number of target first hash values ​​in the current statistical period; the processing module 1420 is specifically used to: if the fourth number of target first hash values ​​in the current statistical period is less than or equal to the rate limit threshold, calculate the number of target first hash values ​​in the current synchronization period, and the sum of the first number of target first hash values ​​in the current statistical period, to obtain a second number of target first hash values ​​in the current statistical period.

[0245] In some implementations, the transceiver module 1410 is further configured to: if the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, send third synchronization data to other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period.

[0246] In some implementations, the first synchronization data further includes at least one of the following: a statistical period and a rate limiting threshold; the processing module 1420 is also configured to: if it is determined that the rate limiting strategy has changed based on at least one of the statistical period and the rate limiting threshold, then reset the counter for the number of the target first hash value in the current statistical period to zero.

[0247] In some implementations, the first synchronization data also includes: the start time of the current statistical period; the processing module 1420 is further configured to: if it is determined based on the start time of the current statistical period that the current synchronization period exceeds the range of the current statistical period, then reset the counter for the number of the target first hash value within the current statistical period to zero.

[0248] In some implementations, the first synchronization data also includes: a second hash value corresponding to the request message of the target first hash value.

[0249] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, they will not be repeated here. Specifically, the device 1400 shown in FIG14 can execute the method embodiment corresponding to the central control node, and the foregoing and other operations and / or functions of each module in the device 1400 are respectively for implementing the corresponding processes in each method corresponding to the central control node. For the sake of brevity, they will not be repeated here.

[0250] The apparatus 1400 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly embodied as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above method embodiments.

[0251] Figure 15 is a schematic diagram of a message processing device 1500 provided in an embodiment of this application. As shown in Figure 15, the device 1500 includes:

[0252] Transceiver module 1510 is used to receive the first speed limit indication;

[0253] The processing module 1520 is used to treat the request message corresponding to the target first hash value as a request message to be rate-limited based on the first rate-limiting indication, and to perform rate-limiting processing on the request message to be rate-limited.

[0254] In some implementations, the processing module 1520 is specifically used to: take the request messages corresponding to the target first hash value received by other protection nodes in the current statistical period and the current rate limiting processing period as rate limiting request messages.

[0255] In some implementations, the transceiver module 1510 is further configured to receive a third rate limiting indication; the processing module 1520 is further configured to use the request message corresponding to the target first hash value as a rate-limiting request message based on the third rate limiting indication, and to perform rate limiting processing on the rate-limiting request message.

[0256] In some implementations, the transceiver module 1510 is also used to receive third synchronization data, wherein the third synchronization data includes: the fourth number of target first hash values ​​in the current statistical period; the transceiver module 1510 is also used to: if the fourth number of target first hash values ​​in the current statistical period is greater than the rate limit threshold, then stop synchronizing data to the central control node.

[0257] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, they will not be repeated here. Specifically, the device 1500 shown in FIG15 can execute the method embodiments corresponding to other protection nodes, and the foregoing and other operations and / or functions of each module in the device 1500 are respectively for implementing the corresponding processes in the various methods corresponding to other protection nodes. For the sake of brevity, they will not be repeated here.

[0258] The apparatus 1500 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly embodied as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above method embodiments.

[0259] Figure 16 is a schematic block diagram of an electronic device 1600 provided in an embodiment of this application. The electronic device 1600 may be the aforementioned target protection node, central control node, or other protection node, but is not limited thereto. As shown in Figure 16, the electronic device 1600 may include:

[0260] The system includes a memory 1610 and a processor 1620. The memory 1610 stores a computer program 1630 and transfers the computer program 1630 to the processor 1620. In other words, the processor 1620 can retrieve and run the computer program 1630 from the memory 1610 to implement the methods described in the embodiments of this application.

[0261] For example, the processor 1620 can be used to execute the steps in the above method according to the instructions in the computer program 1630.

[0262] In some embodiments of this application, the processor 1620 may include, but is not limited to:

[0263] General-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0264] In some embodiments of this application, the memory 1610 includes, but is not limited to:

[0265] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0266] In some embodiments of this application, the computer program 1630 may be divided into one or more modules, which are stored in the memory 1610 and executed by the processor 1620 to perform the method provided in this application. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 1630 in the electronic device.

[0267] As shown in Figure 16, the electronic device 1600 may further include:

[0268] Transceiver 1640, which can be connected to processor 1620 or memory 1610.

[0269] The processor 1620 can control the transceiver 1640 to communicate with other devices; specifically, it can send information or data to other devices or receive information or data sent by other devices. The transceiver 1640 may include a transmitter and a receiver. The transceiver 1640 may further include antennas, and the number of antennas may be one or more.

[0270] It should be understood that the various components in the electronic device 1600 are connected through a bus system, which includes a data bus, a power bus, a control bus, and a status signal bus.

[0271] According to one aspect of this application, a computer storage medium is provided that stores a computer program thereon, which, when executed by a computer, enables the computer to perform the methods of the above-described method embodiments. Alternatively, embodiments of this application also provide a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods of the above-described method embodiments.

[0272] According to another aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described in the above-described method embodiments.

[0273] In other words, when implemented using software, it can be implemented wholly or partially in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital video disc (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0274] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0275] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0276] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs. For example, the functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0277] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A message processing method, characterized in that, The method is applied to a security protection system, which includes a central control node and multiple protection nodes. The method includes: for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, the target protection node calculates a first hash value for the request message; the target protection node counts the number of target first hash values ​​among the multiple first hash values ​​within the current synchronization period and sends first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period; the central control node calculates the number of target first hash values ​​within the current synchronization period, and the sum of the first number of target first hash values ​​within the current statistical period, to obtain a second number of target first hash values ​​within the current statistical period; based on the second number of target first hash values ​​within the current statistical period, the central control node triggers the multiple protection nodes to perform rate-limiting processing on the rate-limiting request messages.

2. The method according to claim 1, characterized in that, The central control node triggers the plurality of protection nodes to rate-limit the request messages to be rate-limited based on the second quantity of the target first hash value within the current statistical period. This includes: the central control node sending second synchronization data to the target protection node, wherein the second synchronization data includes: the second quantity of the target first hash value within the current statistical period; if the second quantity of the target first hash value within the current statistical period is greater than the rate-limiting threshold, the target protection node treats the request message corresponding to the target first hash value as a request message to be rate-limited and performs rate-limiting processing on the request message to be rate-limited; the target protection node sends a first rate-limiting instruction to other protection nodes through the central control node; the other protection nodes treat the request message corresponding to the target first hash value as a request message to be rate-limited based on the first rate-limiting instruction and perform rate-limiting processing on the request message to be rate-limited.

3. The method according to claim 2, characterized in that, The target protection node uses the request message corresponding to the target first hash value as the rate-limiting request message, including: the target protection node uses the request message corresponding to the target first hash value received by the target protection node during the current statistical period and the current rate-limiting processing period as the rate-limiting request message.

4. The method according to claim 2, characterized in that, The other protection nodes, based on the first rate limiting indication, treat request messages corresponding to the target first hash value as rate-limiting request messages, including: the other protection nodes treating request messages corresponding to the target first hash value received by the other protection nodes within the current statistical period and the current rate limiting processing period as rate-limiting request messages.

5. The method according to claim 2, characterized in that, The target protection node sends a first speed limit instruction to other protection nodes through the central control node, including: the target protection node sending a second speed limit instruction to the central control node; the central control node generating the first speed limit instruction based on the second speed limit instruction; and the central control node sending the first speed limit instruction to the other protection nodes.

6. The method according to any one of claims 1-5, characterized in that, Before the central control node calculates the number of the target first hash value in the current synchronization period and the sum of the first number of the target first hash value in the current statistical period to obtain the second number of the target first hash value in the current statistical period, the method further includes: the target protection node calculating the number of the target first hash value in the current synchronization period and the sum of the third number of the target first hash value in the current statistical period to obtain the fourth number of the target first hash value in the current statistical period, wherein the first synchronization data further includes: the fourth number of the target first hash value in the current statistical period; the central control node calculating the number of the target first hash value in the current synchronization period and the sum of the first number of the target first hash value in the current statistical period to obtain the second number of the target first hash value in the current statistical period includes: if the fourth number of the target first hash value in the current statistical period is less than or equal to the speed limit threshold, then the central control node calculates the number of the target first hash value in the current synchronization period and the sum of the first number of the target first hash value in the current statistical period to obtain the second number of the target first hash value in the current statistical period.

7. The method according to claim 6, characterized in that, Also includes: If the fourth number of the target first hash value in the current statistical period is greater than the rate limiting threshold, then the target protection node will treat the request message corresponding to the target first hash value as a rate-limiting request message and perform rate limiting processing on the rate-limiting request message; the target protection node will send a third rate limiting instruction to other protection nodes through the central control node; the other protection nodes will treat the request message corresponding to the target first hash value as a rate-limiting request message based on the third rate limiting instruction and perform rate limiting processing on the rate-limiting request message.

8. The method according to claim 7, characterized in that, Also includes: If the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, the central control node sends third synchronization data to the other protection nodes, wherein the third synchronization data includes: the fourth number of the target first hash value in the current statistical period; if the fourth number of the target first hash value in the current statistical period is greater than the rate limit threshold, the other protection nodes stop synchronizing data to the central control node.

9. The method according to any one of claims 1-5, characterized in that, Also includes: If the target protection node determines that the number of the target first hash value in both the current statistical period and the next statistical period is greater than the rate limiting threshold, then the target protection node extends the rate limiting processing period for request messages corresponding to the target first hash value.

10. The method according to any one of claims 1-5, characterized in that, The first synchronization data further includes at least one of the following: a statistical period and a speed limit threshold; the method further includes: if the central control node determines that the speed limit policy has changed based on at least one of the statistical period and the speed limit threshold, the central control node resets the counter for the number of the target first hash value in the current statistical period to zero.

11. The method according to claim 10, characterized in that, The first synchronization data further includes: the start time of the current statistical period; the method further includes: if the central control node determines that the current synchronization period exceeds the range of the current statistical period based on the start time of the current statistical period, then the central control node resets the counter for the number of the target first hash value within the current statistical period to zero.

12. The method according to any one of claims 1-5, characterized in that, The first synchronization data also includes: a second hash value of the request message corresponding to the first hash value of the target.

13. The method according to any one of claims 1-5, characterized in that, The security protection system includes multiple central control nodes; before the target protection node calculates the first hash value of each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, the system further includes: the target protection node selecting a central control node from the multiple central control nodes using a consistent hashing algorithm.

14. The method according to any one of claims 1-5, characterized in that, For each request message received by the target protection node within the current synchronization period between the target protection node and the central control node among the plurality of protection nodes, the target protection node calculates a first hash value of the request message, including: for each request message received by the target protection node within the current synchronization period, the target protection node matches the request message with the effective conditions of the rate limiting policy; if the request message matches the effective conditions, the target protection node calculates a first hash value of the request message.

15. A message processing method, characterized in that, The method is applied to a target protection node, and the method includes: for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node, calculating a first hash value of the request message; counting the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period, and sending first synchronization data to the central control node, wherein the first synchronization data includes: the number of target first hash values ​​within the current synchronization period.

16. A message processing method, characterized in that, The method is applied to a central control node. The method includes: receiving first synchronization data, wherein the first synchronization data includes: the number of target first hash values ​​in the current synchronization period; calculating the number of target first hash values ​​in the current synchronization period and the sum of the first number of target first hash values ​​in the current statistical period to obtain a second number of target first hash values ​​in the current statistical period; and triggering multiple protection nodes to perform rate limiting processing on the rate limiting request message based on the second number of target first hash values ​​in the current statistical period.

17. A security protection system, characterized in that, include: A central control node and multiple protection nodes; the target protection node among the multiple protection nodes is used to: calculate a first hash value of the request message for each request message received by the target protection node within the current synchronization period between the target protection node and the central control node; The system counts the number of target first hash values ​​among multiple first hash values ​​within the current synchronization period and sends first synchronization data to the central control node. The first synchronization data includes the number of target first hash values ​​within the current synchronization period. The central control node is configured to: calculate the number of target first hash values ​​within the current synchronization period, and the sum of the first number of target first hash values ​​within the current statistical period, to obtain a second number of target first hash values ​​within the current statistical period; based on the second number of target first hash values ​​within the current statistical period, trigger the multiple protection nodes to perform rate-limiting processing on the rate-limiting request message.

18. An electronic device, characterized in that, include: A processor and a memory, the memory being used to store a computer program, the processor being used to invoke and run the computer program stored in the memory to perform the method of claim 15 or 16.

19. A computer-readable storage medium, characterized in that, Used to store computer programs that cause a computer to perform the method as described in claim 15 or 16.

20. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in claim 15 or 16.

Images