Resource access method

Abstract

The invention provides a resource access method, which is applied to the technical field of computers. The resource access method is applied to first electronic equipment, and comprises the following steps: in response to a received first access request with a first identifier, configuring an object of the first access request to have a second identifier under the condition that the first access request meets a first preset condition; in response to a received second access request with a second identifier, returning first query information under the condition that the second access request meets a second preset condition; wherein the identifier represents the access authority of the resource expected to be matched with the access request by the object, and the access authority of the first identifier is greater than the access authority of the second identifier.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a resource access method. Background Art

[0002] With the rapid development of Internet technology, network security has received more and more attention. At present, the main means of endangering network service security include web crawlers, which simulate real users to visit websites. Under the interference of web crawlers, it is not easy for website servers to distinguish between web crawlers and normal users, and it is easy to make wrong judgments and make wrong responses. Summary of the invention

[0003] In view of this, the present disclosure provides a resource access method.

[0004] According to a first aspect of the present disclosure, a resource access method is provided, which is applied to a first electronic device, and the method includes: in response to receiving a first access request with a first identifier, if the first access request satisfies a first preset condition, configuring the object of the first access request to have a second identifier; in response to receiving a second access request with a second identifier, if the second access request satisfies a second preset condition, returning first query information; wherein the identifier represents the access rights of the object to a resource that matches the access request, and the access rights of the first identifier are greater than the access rights of the second identifier.

[0005] According to an embodiment of the present disclosure, when a first access request satisfies a first preset condition, a second identifier of the object of the first access request is configured, including: determining a first level of the first access request according to a request parameter of the first access request; and configuring a second identifier according to the first level; wherein the first preset condition represents the degree of abnormality of the access request, and the first preset condition includes multiple levels, and the levels represent the access rights of resources that actually match the access request.

[0006] According to an embodiment of the present disclosure, the method further includes: when the second access request satisfies the first preset condition, configuring the object of the second access request to have a target identifier, and the access rights of the target identifier are less than the access rights of the second identifier.

[0007] According to an embodiment of the present disclosure, the method also includes: in a case where the second access request satisfies a first preset condition, determining a second level of the second access request based on request parameters of the second access request, the second level of abnormality being less than the first level of abnormality; in a case where the difference between the level of abnormality of the second access request and the level of abnormality of the first access request is greater than a preset threshold, configuring the object to have a third identifier based on the first level and the second level; wherein the access rights of the third identifier are greater than the access rights of the second identifier and less than the access rights of the first identifier.

[0008] According to an embodiment of the present disclosure, the method also includes: when the second access request satisfies the first preset condition, determining the third level of the second access request based on the request parameters of the second access request, and the abnormality degree of the third level is greater than the abnormality degree of the first level; when the difference between the abnormality degree of the second access request and the abnormality degree of the first access request is greater than a preset threshold, configuring the object to have a fourth identifier based on the first level and the third level; wherein the access rights of the fourth identifier are less than the access rights of the second identifier and less than the access rights of the target identifier.

[0009] According to an embodiment of the present disclosure, the method also includes: in response to receiving a second access request with a second identifier, if the second access request satisfies a third preset condition, configuring the object to have a minimum access permission identifier and stopping responding to the second access request.

[0010] According to an embodiment of the present disclosure, the method also includes: in response to receiving a second access request with a second identifier, when the second access request satisfies a third preset condition, configuring the object to have a minimum access permission identifier, determining second query information corresponding to the second access request, and the amount of valid information contained in the second query information is less than the amount of valid information contained in the first query information.

[0011] According to an embodiment of the present disclosure, determining second query information corresponding to a second access request includes: in response to receiving a second access request with a minimum access permission identifier, encrypting target data in the first query information to obtain second query information, wherein the target data is sensitive information to the object with the minimum access permission identifier.

[0012] According to an embodiment of the present disclosure, the method also includes: the first identifier corresponds to a first computing resource access right, the second identifier corresponds to a second computing resource access right, and the resource amount of the second computing resource is less than the resource amount of the first computing resource.

[0013] A second aspect of the present disclosure provides a resource access method, which is applied to a second electronic device, and the method includes: generating a first access request in response to a target input of an object, the first access request including a first identifier; sending the first access request to the first electronic device; generating a second access request according to the target input in response to receiving a second identifier sent by the first electronic device; sending the second access request; wherein the access rights of the object regarding the resource in the second identifier are less than the access rights of the object regarding the resource in the first identifier.

[0014] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0016] Figure 1 The application scenario diagram of the resource access method according to the embodiment of the present disclosure is schematically shown;

[0017] Figure 2 One of the flow charts of the resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device;

[0018] Figure 3 A second flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device;

[0019] Figure 4 A third flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device;

[0020] Figure 5 A fourth flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device;

[0021] Figure 6 A fifth flow chart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device;

[0022] Figure 7 A sixth flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a second electronic device;

[0023] Figure 8 The principle diagram of the resource access method according to the embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] The embodiment of the present disclosure provides a resource access method. Before introducing the technical solution provided by the embodiment of the present disclosure, the related technologies involved in the present disclosure are first described.

[0029] With the rapid development of Internet technology, network security has received more and more attention. At present, the main means of endangering network service security include web crawlers, which simulate real users to visit websites. Under the interference of web crawlers, it is not easy for website servers to distinguish between web crawlers and normal users, and it is easy to make wrong judgments and make wrong responses.

[0030] For example, in an information management system based on the WEB (World Wide Web), illegal crawling of data is a common problem. WEB applications are divided into the front end and the back end. The front end runs in the user's browser, and the back end runs in the service provider's server. Every time the browser sends a request to the server, the server cannot remember the browser's previous request and status. Therefore, every time the front end accesses the back end, it must bring a token representing the user's identity. Once the token is stolen, an illegal user can imitate the behavior of a normal user and obtain the user's private data. In order to protect the security of the data, the back end usually detects the access request of the front end to prevent illegal access.

[0031] In order to prevent illegal access, the backend determines whether the request sent by the frontend is abnormal based on the IP address of the access request source, the browser model used, traffic and other characteristics. Currently, it is easy to make mistakes when detecting illegal access. Once a normal access is misjudged as an abnormal access, a pop-up window will appear on the front-end page or the returned data will be encrypted, resulting in poor application availability and thus reducing user experience.

[0032] The embodiment of the present disclosure provides a resource access method, which is applied to a first electronic device, and the method includes: in response to receiving a first access request with a first identifier, if the first access request satisfies a first preset condition, configuring the object of the first access request to have a second identifier; in response to receiving a second access request with a second identifier, if the second access request satisfies a second preset condition, returning first query information; wherein the identifier represents the access rights of the object to the resource that the object expects to match the access request, and the access rights of the first identifier are greater than the access rights of the second identifier. In the case where the access request abnormality cannot be fully confirmed, the embodiment of the present disclosure limits the access rights of the access request to the resource by reducing the identifier of the scope of the authority range, so that in the case of a misjudgment of abnormal access, partial query information can be returned for the access request, thereby ensuring the smoothness of access to data, improving the availability of the application, and enhancing the user experience.

[0033] Figure 1 The application scenario diagram of the resource access method according to the embodiment of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to send access requests or receive returned data, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (for example, resources such as web pages, information, and data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the resource access method applied to the first electronic device provided in the embodiment of the present disclosure can generally be executed by the server 105. Correspondingly, the resource access method applied to the second electronic device provided in the embodiment of the present disclosure can generally be executed by the first terminal device 101 or the second terminal device 102 or the third terminal device 103. The resource access method applied to the first electronic device provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the resource access method applied to the second electronic device provided in the embodiment of the present disclosure can also be executed by a terminal device, a control system, etc. that is different from the first terminal device 101, the second terminal device 102, the third terminal device 103 and can communicate with the server 105.

[0039] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The resource access method applied to the first electronic device according to an embodiment of the present disclosure is described in detail.

[0041] Figure 2 One of the flow charts of the resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device.

[0042] Exemplarily, the first electronic device may be a computing node for receiving a resource access request. The first electronic device may locally process the received resource access request based on the received resource access request, and return the requested resource to the request initiator; the first electronic device may also forward the received resource access request to other resource devices based on the received resource access request, and forward the received requested resource returned by other resource devices to the request initiator. For example, the first electronic device may be a server, a virtual machine, a gateway device, an edge computing device, etc.

[0043] Among them, resources can be any hardware, software, data or service that is managed and utilized to support system operation, perform tasks or provide services. For example, resources can be hardware resources, such as network cards, Wi-Fi modules, hard disks, etc.; resources can also be software resources, such as Windows, browsers, Web development frameworks, etc.; resources can also be data resources, such as pictures, videos, documents, etc.; resources can also be service resources, such as database services, computing resources, APIs, etc.

[0044] The embodiment of the present disclosure is described by taking the first electronic device as a server.

[0045] like Figure 2 As shown, the resource access method of this embodiment includes operations S210 to S220.

[0046] In operation S210, in response to receiving a first access request having a first identifier, if the first access request satisfies a first preset condition, an object of the first access request is configured to have a second identifier.

[0047] In operation S220, in response to receiving a second access request with a second identifier, if the second access request satisfies a second preset condition, first query information is returned.

[0048] The identifier represents the access rights of the resource that the object expects to match the access request, and the access rights of the first identifier are greater than the access rights of the second identifier.

[0049] Exemplarily, the object may be a requester who initiates an access request, a user, a program, or a smart device.

[0050] The access request may include request content and an identifier. The request content refers to the content part of the access request, and the identifier refers to the authority of the access request to access the resource.

[0051] An identifier can be a key used for authentication and authorization. An identifier can be a string returned by the system when a requester requests access to a resource. The string can contain encrypted information to prove the identity of the requester and authorize the scope of access to the resource. Different identifiers correspond to different identity information and the scope of access to resources corresponding to the identity information.

[0052] For example, in the case where the access request is a database access request, the first identifier may indicate that the requester has a first scope of authority regarding the use of the database. For example, the first scope of authority corresponding to the first identifier corresponds to databases 1-10, and the requester with the first identifier expects to be able to access all data information in databases 1-10. The second identifier may indicate that the requester has a second scope of authority regarding the use of the database. For example, the second scope of authority corresponding to the second identifier corresponds to databases 1-5, and the requester with the second identifier expects to be able to access all data information in databases 1-5.

[0053] Whether an access request is abnormal can be determined by analyzing and judging the IP address, request frequency, URL path, request header or traffic analysis of the access request through a preset algorithm. The preset algorithm can judge whether the request is abnormal by completely determining that the access request is abnormal, determining that the access request is normal, and not completely determining that the access request is abnormal.

[0054] The first preset condition may be that it cannot be completely determined that the access request is abnormal, that is, the access request is a suspicious abnormal request. The second preset condition may be that it is determined that the access request is normal.

[0055] The query information is the result corresponding to the access request with the corresponding identifier. For example, if the access request is to query the target image, when the access request is normal, the query information corresponding to the access request is the target image.

[0056] It should be noted that the requester expects to obtain the first permission scope corresponding to the first identifier when initiating the first access request with the first identifier. However, after receiving the first access request with the first identifier, the server will determine whether the first access request is abnormal. If the first access request is normal, the requester can access databases 1-10 corresponding to the first permission scope. If the first access request is abnormal (including complete abnormality and incomplete abnormality), the requester's database usage authority can be reduced, and the requester can access databases 1-5 corresponding to the second permission scope. That is, the resource access permission scope expected by the requester and the actual resource access permission scope can be the same or different.

[0057] In one example, after receiving a first access request with a first identifier (expecting to access database 1-10), the server determines whether the first access request is abnormal. If it is not completely determined that the access request is abnormal (satisfies the first preset condition), the second identifier (expecting to access database 1-5) is reconfigured for the request content of the first access request to obtain a second access request with a second identifier. After receiving a second access request with a second identifier, the server determines whether the second access request is abnormal. If it is determined that the second access request is normal, the first query information (data related to the content of the access request in the corresponding database 1-5) is returned.

[0058] It is understandable that when it is not possible to fully confirm that an access request is abnormal, the access rights of the access request to resources can be limited by lowering the identification of the permission range. In this way, in the event of a misjudgment of abnormal access, partial query information can be returned for the access request, thereby ensuring smooth access to data, improving application availability, and enhancing user experience.

[0059] As described above, in operation S210, when the first access request satisfies the first preset condition, a second identifier of the object of the first access request is configured. In an achievable manner, the operation may further include: determining a first level of the first access request according to a request parameter of the first access request; and configuring a second identifier according to the first level; wherein the first preset condition represents the abnormality of the access request, and the first preset condition includes multiple levels, and the levels represent the access rights of the resources that actually match the access request.

[0060] Exemplarily, the level can be the degree of incomplete abnormality of the access request. The identifiers corresponding to access requests of different abnormality levels are different, and the access rights to resources are also different. For example, the degree of incomplete abnormality of the access request can be divided into 30% (fourth level), 50% (third level), 70% (second level), 90% (first level), etc. Continuing to use the above database resources as an example, the first level corresponds to database 1, the second level corresponds to databases 1-2, the third level corresponds to databases 1-3, and the fourth level corresponds to databases 1-4.

[0061] The identifier corresponding to the resource access permission can be configured for the next access request based on the abnormality level of the current access request. The higher the abnormality level of the access request, the smaller the scope of the access permission corresponding to the configured identifier. For example, if the abnormality level of the first access request of the first identifier (expecting to access database 1-10) is 90% (first level), the second identifier (expecting to access database 1) can be configured. If the abnormality level of the first access request of the first identifier (expecting to access database 1-10) is 70% (second level), the third identifier (expecting to access database 1-2) can be configured. If the abnormality level of the first access request of the first identifier (expecting to access database 1-10) is 30% (second level), the third identifier (expecting to access database 1-4) can be configured.

[0062] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 90% (first level). Then, the server reconfigures the second identifier (expected access to database 1) for the request content of the first access request to obtain a second access request with a second identifier. After receiving the second access request with the second identifier, the server determines whether the second access request is abnormal. If it is determined that the second access request is normal, the server returns the first query information (corresponding to the data in database 1 related to the content of the access request).

[0063] It should be noted that the embodiment of the present disclosure does not impose any specific limitation on the number of abnormal levels of access requests and the access rights corresponding to each level, and they can be set according to actual application requirements.

[0064] Figure 3 A second flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device.

[0065] As mentioned above, if Figure 3 As shown, the resource access method of this embodiment may further include operations S310 to S330.

[0066] In operation S310, it is determined whether a preset condition satisfied by the second access request.

[0067] In operation S320, when the second access request satisfies the first preset condition, the object configuring the second access request has a target identifier, and the access rights of the target identifier are less than the access rights of the second identifier.

[0068] In operation S330, if the second access request satisfies the second preset condition, the first query information is returned.

[0069] Exemplarily, the target identifier may be the identity information corresponding to the object with the minimum resource access rights. The target identifier may also be the identity information corresponding to the object with the resource access rights less than the second identifier.

[0070] The object of the first access request and the object of the second access request may be the same or different. In the case where the object of the first access request and the object of the second access request are different, the first access request may be initiated by a different object than the second access request, but the request content is the same.

[0071] In the process of determining the abnormality of the second access request, if it is still not completely determined that the second access request is abnormal, the identifier of the minimum access permission (target identifier) ​​can be directly configured for the object of the second access request. This can be understood as directly configuring the identifier of the minimum access permission when the access request is still not completely determined to be abnormal after two determinations.

[0072] In the process of determining the abnormality of the second access request, if it is still not completely determined that the second access request is abnormal, an identifier (target identifier) ​​less than the second access permission can be directly configured for the object of the second access request. This can be understood as, if the abnormality of the access request is still not completely determined after multiple determinations, the access permission of the configured identifier is reduced in sequence.

[0073] When the number of access request configuration identifiers reaches a preset threshold, it can be determined that the access is completely abnormal, and the access request can be stopped from being responded to. In the embodiment of the present disclosure, the preset threshold can be set to 2 or 3, etc. The embodiment of the present disclosure does not specifically limit the size of the preset threshold, and it can be set according to actual needs.

[0074] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 70% (second level). Then, the second identifier (expected access to databases 1-2) is reconfigured for the request content of the first access request, and a second access request with a second identifier is obtained. After receiving the second access request with the second identifier, the server determines whether the second access request is abnormal. If it is determined that the second access request is normal, the first query information (data related to the content of the access request in the corresponding database 1) is returned. If it is determined that the abnormality of the second access request is 50% (third level), the target identifier (expected access to 1-3) is reconfigured for the request content of the second access request, and a third access request with a target identifier is obtained. After receiving the third access request with the target identifier, if the server determines that the abnormality of the third access request is 50% (third level), the response to the third access request is directly stopped.

[0075] As described above, the resource access method of this embodiment may further include: when the second access request satisfies the first preset condition, determining the second level of the second access request based on the request parameters of the second access request, and the abnormality degree of the second level is less than the abnormality degree of the first level; when the difference between the abnormality degree of the second access request and the abnormality degree of the first access request is greater than a preset threshold, configuring the object to have a third identifier based on the first level and the second level; wherein the access permission of the third identifier is greater than the access permission of the second identifier and less than the access permission of the first identifier.

[0076] Request parameters may include IP address, request frequency, URL path, request header, or traffic analysis.

[0077] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 70% of the first level (corresponding to the second level mentioned above). Then the second identifier (expected access to databases 1-2) is reconfigured for the request content of the first access request to obtain a second access request with a second identifier. After receiving the second access request with a second identifier, the server determines whether the second access request is abnormal. If it is determined that the abnormality of the second access request is 30% of the second level (corresponding to the fourth level mentioned above). The abnormality of the second access request is reduced compared to the abnormality of the first access request. And the difference between the abnormality of the first access request and the abnormality of the second access request is 40% (greater than the preset threshold of 30%). Then the third identifier (expected access 1-5) is reconfigured for the request content of the second access request to obtain a third access request with a target identifier. The present disclosure embodiment does not specifically limit the preset threshold, and it can be set according to actual needs. The first level and the third level here are different from the above levels. For ease of understanding, the above levels are used as the standard for description.

[0078] It should be noted here that when judging the abnormality of the second access request, if the difference between the abnormality degree of the second access request and the first access request is greater than the preset threshold, the third identifier is no longer configured according to the abnormality degree of the second access request (fourth level: database 1-4). Instead, the third identifier with a larger authority range than that corresponding to the fourth level (database 1-5) is reconfigured. However, the scope of the access rights of the third identifier is always smaller than the scope of the access rights of the first identifier.

[0079] As described above, the resource access method of this embodiment may further include: when the second access request satisfies the first preset condition, determining the third level of the second access request based on the request parameters of the second access request, and the abnormality degree of the third level is greater than the abnormality degree of the first level; when the difference between the abnormality degree of the second access request and the abnormality degree of the first access request is greater than a preset threshold, configuring the object to have a fourth identifier based on the first level and the third level; wherein the access rights of the fourth identifier are less than the access rights of the second identifier and less than the access rights of the target identifier.

[0080] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 70% of the first level (corresponding to the second level). Then the second identifier (expected access to databases 1-2) is reconfigured for the request content of the first access request to obtain a second access request with a second identifier. After receiving a second access request with a second identifier, the server determines whether the second access request is abnormal. If it is determined that the abnormality of the second access request is 90% of the third level (corresponding to the first level). The abnormality of the second access request is greater than that of the first access request. And the difference between the abnormality of the first access request and the abnormality of the second access request is 20% (greater than the preset threshold of 10%). Then the fourth identifier (expected access 0) is reconfigured for the request content of the second access request to obtain a third access request with a target identifier. The present disclosure embodiment does not specifically limit the preset threshold, and it can be set according to actual needs. The first level and the third level here are different from the above-mentioned levels. For ease of understanding, the above-mentioned levels are used as the standard for description.

[0081] It should be noted here that when judging the abnormality of the second access request, if the difference between the abnormality degree of the second access request and the first access request is greater than the preset threshold, the third identifier is no longer configured according to the abnormality degree of the second access request (first level: database 1). Instead, the fourth identifier with a smaller permission range than the first level (database 0) is reconfigured. However, the access permission range of the fourth identifier is smaller than the access permission of the second identifier, and also smaller than the lowest access permission.

[0082] It can be understood that according to the relationship between the difference in the degree of abnormality of two adjacent access requests and the preset threshold, the access permission scope of the next access request can be dynamically adjusted, and the corresponding access permissions can be granted in time according to the actual needs and role changes of the user, thereby being able to adapt to complex and changing environments, which not only enhances security, but also improves the management efficiency and flexibility of the system.

[0083] Figure 4A third flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device.

[0084] According to an embodiment of the present disclosure, the resource access method of this embodiment may further include: in response to receiving a second access request with a second identifier, when the second access request satisfies a third preset condition, configuring the object to have a minimum access permission identifier and stopping responding to the second access request.

[0085] Exemplarily, the third preset condition may be that the request is completely determined to be abnormal. In the case where the request is determined to be completely abnormal, the response to the access request may be directly stopped.

[0086] In one example, if Figure 4 As shown, the resource access method of this embodiment may further include operations S410 to S440.

[0087] In operation S410, it is determined whether a preset condition satisfied by the second access request.

[0088] In operation S420, when the second access request satisfies the first preset condition, the object configuring the second access request has a target identifier, and the access rights of the target identifier are less than the access rights of the second identifier.

[0089] In operation S430, if the second access request satisfies the second preset condition, the first query information is returned.

[0090] In operation S440, if the second access request satisfies the third preset condition, stop responding to the second access request.

[0091] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 70% (second level). Then, the second identifier (expected access to databases 1-2) is reconfigured for the request content of the first access request, and a second access request with a second identifier is obtained. After receiving the second access request with the second identifier, the server determines whether the second access request is abnormal. If it is determined that the second access request is normal (satisfies the second preset condition), the first query information (corresponding to the data related to the content of the access request in database 1) is returned. If it is determined that the abnormality of the second access request is 50% (satisfies the first preset condition), the target identifier (expected access to 1-3) is reconfigured for the request content of the second access request, and a third access request with a target identifier is obtained. If it is determined that the second access request is completely abnormal (satisfies the third preset condition), the server stops responding to the third access request.

[0092] Figure 5A fourth flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a first electronic device.

[0093] According to an embodiment of the present disclosure, the resource access method of this embodiment may further include: in response to receiving a second access request with a second identifier, when the second access request satisfies a third preset condition, configuring the object to have a minimum access permission identifier, determining second query information corresponding to the second access request, and the amount of valid information contained in the second query information is less than the amount of valid information contained in the first query information.

[0094] Exemplarily, the third preset condition may be that it is completely determined that the request is abnormal. In the case where it is determined that the request is completely abnormal, query information may still be directly returned for the second access request.

[0095] Here, if the second access request is normal (satisfies the second preset condition), it corresponds to the first query information. The second access request has a second identifier. The access permission range of the second identifier may be greater than the minimum access permission range.

[0096] The effective information volume can be the content contained in the query information that is highly associated with the access request. It can be understood that the query information with more effective information volume has higher readability. For example, when requesting to obtain user information, the amount of user sensitive information contained in the first query information is greater than the amount of user sensitive information contained in the second query information.

[0097] In one example, if Figure 5 As shown, the resource access method of this embodiment may further include operations S510 to S540.

[0098] In operation S510, it is determined whether a preset condition satisfied by the second access request.

[0099] In operation S520, when the second access request satisfies the first preset condition, the object configuring the second access request has a target identifier, and the access rights of the target identifier are less than the access rights of the second identifier.

[0100] In operation S530, if the second access request satisfies the second preset condition, the first query information is returned.

[0101] In operation S540, when the second access request satisfies the third preset condition, the configuration object has a minimum access permission identifier, and second query information corresponding to the second access request is determined, and the amount of valid information included in the second query information is less than the amount of valid information included in the first query information.

[0102] In one example, after receiving a first access request with a first identifier (expected access to databases 1-10), the server determines that the abnormality of the first access request is 70% (second level). Then, the second identifier (expected access to databases 1-2) is reconfigured for the request content of the first access request, and a second access request with a second identifier is obtained. After receiving the second access request with a second identifier, the server determines whether the second access request is abnormal. If it is determined that the second access request is normal (satisfies the second preset condition), the first query information (corresponding to the data related to the content of the access request in database 1) is returned. If it is determined that the abnormality of the second access request is 50% (satisfies the first preset condition), the target identifier (expected access 1-3) is reconfigured for the request content of the second access request, and a third access request with a target identifier is obtained. If it is determined that the second access request is completely abnormal (satisfies the third preset condition), the minimum access permission 1 is reconfigured for the request content of the second access request, and a third access request with the minimum access permission is obtained. When the server receives the third access request with the minimum access permission, the server returns the second query information for the third access request with the minimum access permission.

[0103] It is understandable that, when the second access request is still not completely abnormal, second query information with less valid information can be returned for the second access request, which can ensure data security on the one hand, and provide feedback on the request on the other hand, which can also improve the user experience.

[0104] As described above, in operation S540, second query information corresponding to the second access request is determined. In one achievable manner, the operation may further include: in response to receiving the second access request with the lowest access permission identifier, encrypting the target data in the first query information to obtain the second query information, wherein the target data is sensitive information to the object with the lowest access permission identifier.

[0105] In one example, if the second access request with the second identifier is normal (satisfies the second preset condition), it corresponds to the first query information. The access permission range corresponding to the second identifier may be greater than the minimum access permission range. If it is determined that the second access request is completely abnormal (satisfies the third preset condition), the minimum access permission is reconfigured for the request content of the second access request to obtain a second access request with the minimum access permission. When the server receives the second access request with the minimum access permission, it can convert the content (target data) in the first query information that the user with the minimum access permission has no right to access to into "*".

[0106] In other embodiments, the encryption process may also be to replace words in the sensitive information so that the sensitive information in the query information cannot be easily obtained.

[0107] As described above, the resource access method of this embodiment may further include: the first identifier corresponds to the first computing resource access permission, the second identifier corresponds to the second computing resource access permission, and the resource amount of the second computing resource is less than the resource amount of the first computing resource.

[0108] The computing resources may be computing data used to generate query information. For example, different computing resources may be model algorithms with different computing precisions, different cache spaces, different bandwidths, and the like.

[0109] In one example, the permissions opened to users by the big prediction model are model 1, model 2, and model 3, and the algorithms corresponding to the three models are different. Among them, the query performance of model 1 is greater than the query performance of model 2, which is greater than the query performance of model 3. Then the accuracy of the query results of model 1 for the problem is greater than model 2 and greater than model 3. User A wants to query question 1 through the big language model. User A initiates a first access request with a first identifier (used to describe question 1), and the first identifier corresponds to model 2 (first computing resource). When it is determined that the first access request is not completely abnormal, the second identifier is configured to reduce the access rights, and the second identifier corresponds to model 1. The second identifier corresponds to model 1 (second computing resource). Then the second computing resource is less than the first computing resource.

[0110] It is understandable that when access rights decrease, in order to maintain data security or rationality of resource allocation, the available computing resources are reduced accordingly to ensure that access requests with different permissions use computing resources that are adapted to them.

[0111] In order to facilitate the understanding of the resource access method applied to the first electronic device, the following is combined with Figure 6 Give an example.

[0112] like Figure 6 In an example, the resource access method of this embodiment may include operations S610 to S680.

[0113] In operation S610, it is determined whether a preset condition satisfied by the first access request.

[0114] In operation S620, when the first access request satisfies the first preset condition, the object of the first access request is configured to have a second identifier.

[0115] In operation S630, if the second access request satisfies the second preset condition, third query information is returned.

[0116] In operation S640, if the second access request satisfies the third preset condition, the first access request is stopped from being responded to.

[0117] In operation S650, it is determined whether a preset condition satisfied by the second access request.

[0118] In operation S660, when the second access request satisfies the first preset condition, the object of configuring the second access request has a target identifier.

[0119] In operation S670, if the second access request satisfies the second preset condition, the first query information is returned.

[0120] In operation S680, when the second access request satisfies the third preset condition, the configuration object has a minimum access permission identifier, and second query information corresponding to the second access request is determined.

[0121] After receiving the first access request with the first identifier, the server determines whether the first access request is abnormal. If it is not completely determined that the access request is abnormal (meets the first preset condition), the second identifier is reconfigured for the request content of the first access request to obtain a second access request with the second identifier. If the access request is normal (meets the second preset condition), the third query information (corresponding to the data of the first access permission) for the first access request is returned. If it is completely determined that the access request is abnormal (meets the third preset condition), the response to the first access request is stopped.

[0122] After receiving the second access request with the second identifier, the server determines whether the second access request is abnormal. If it is not completely determined that the access request is abnormal (meets the first preset condition), the target identifier (less than the access right or the minimum access right of the second identifier) ​​is reconfigured for the request content of the first access request to obtain a third access request with the target identifier. If the access request is normal (meets the second preset condition), the first query information (corresponding to the data of the second access right) for the second access request is returned. If it is completely determined that the access request is abnormal (meets the third preset condition), the response to the second access request is stopped.

[0123] After receiving the third access request with the third identifier, the server may directly return the fourth query information (data corresponding to the third access permission) for the third access request. If it is still not completely determined that the third access request is abnormal (the number of times 3 is greater than the preset threshold number of times 2), the third access request is regarded as a completely abnormal request and the third access request is stopped from being responded to.

[0124] Figure 7 A sixth flowchart of a resource access method according to an embodiment of the present disclosure is schematically shown, wherein the method is applied to a second electronic device.

[0125] Exemplarily, the second electronic device may be a terminal for initiating a resource access request, and may be a mobile phone, a tablet, a laptop, a smart watch, a smart TV, etc.

[0126] like Figure 7 As shown, the resource access method of this embodiment includes operations S710 to S740.

[0127] In operation S710 , in response to a target input of an object, a first access request is generated, where the first access request includes a first identifier.

[0128] In operation S720, a first access request is sent to the first electronic device.

[0129] In operation S730, in response to receiving the second identifier sent by the first electronic device, a second access request is generated according to the target input.

[0130] In operation S740, a second access request is sent.

[0131] The access rights of the object in the second identification regarding the resource are less than the access rights of the object in the first identification regarding the resource.

[0132] For example, the target input can be the behavior content of the object. The predetermined goal or request of a process, operation or service in the system or application. The target input can be an instruction from the user, input data of the program, or a condition that the system needs to meet. The target input can be data, events, etc.

[0133] For the description of the first and second identifiers, please refer to Figure 1 The instructions in the article will not be repeated here.

[0134] The access rights to resources may include the access rights to data resources and the access rights to computing resources. The details can be referred to above and will not be repeated here.

[0135] In one example, a user enters a query question (a first access request with a first identifier) ​​in a browser of a computer (a second electronic device), and the computer sends the query question to a server (a first electronic device). The server makes an abnormality judgment on the first access request, and if it is not completely sure that the access request is abnormal (satisfies the first preset condition), it generates a second identifier and sends it to the computer. Based on the second identifier and the query question, the computer regenerates a second access request with a second identifier, and sends the second access request to the server.

[0136] In order to facilitate the understanding of the resource access method implemented by the first electronic device and the second electronic device, the following will be combined with Figure 8 Provide explanation.

[0137] Figure 8 The principle diagram of the resource access method according to the embodiment of the present disclosure is schematically shown.

[0138] like Figure 8 As shown, the user enters the query question (the first access request with the first identifier) ​​in the browser of the mobile phone (the second electronic device, the front end), and the mobile phone sends the query question to the server (the first electronic device, the back end). The server makes an abnormal judgment on the first access request. If it is completely determined that the first access request is abnormal, it can stop responding to the first access request. If it is determined that the first access request is normal, the third query information (data corresponding to the first access right) can be returned. If it is not completely determined that the access request is abnormal (satisfies the first preset condition), a second identifier is generated and sent to the computer. The computer regenerates the second access request with the second identifier based on the second identifier and the query question, and sends the second access request to the server. After receiving the second access request with the second identifier, the server can encrypt the target data (content that the object of the second access right has no right to access) in the third query information (data corresponding to the second permission range of the first identifier) ​​and return the first query information (data corresponding to the second permission range of the second identifier).

[0139] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0140] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0141] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0142] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A resource access method, applied to a first electronic device, the method comprising: In response to receiving a first access request with a first identifier, if the first access request satisfies a first preset condition, configuring an object of the first access request with a second identifier; In response to receiving a second access request with the second identifier, returning first query information if the second access request satisfies a second preset condition; The identifier represents the access rights of the resource that the object expects to match the access request, and the access rights of the first identifier are greater than the access rights of the second identifier.

2. The method according to claim 1, wherein, when the first access request satisfies a first preset condition, configuring a second identifier of the object of the first access request comprises: determining a first level of the first access request according to a request parameter of the first access request; According to the first level, configuring the second identifier; The first preset condition represents the abnormality degree of the access request, and the first preset condition includes multiple levels, and the levels represent the access rights of resources that actually match the access request.

3. The method according to claim 1 or 2, further comprising: In the case where the second access request satisfies the first preset condition, the object configuring the second access request has a target identifier, and the access authority of the target identifier is less than the access authority of the second identifier.

4. The method according to claim 2, further comprising: In a case where the second access request satisfies the first preset condition, determining a second level of the second access request according to the request parameter of the second access request, the abnormality degree of the second level being less than the abnormality degree of the first level; When the difference between the abnormality degree of the second access request and the abnormality degree of the first access request is greater than a preset threshold, configuring the object with a third identifier according to the first level and the second level; The access rights of the third identifier are greater than the access rights of the second identifier and less than the access rights of the first identifier.

5. The method according to claim 2, further comprising: In a case where the second access request satisfies the first preset condition, determining a third level of the second access request according to the request parameter of the second access request, wherein the abnormality degree of the third level is greater than the abnormality degree of the first level; When the difference between the abnormality degree of the second access request and the abnormality degree of the first access request is greater than a preset threshold, configuring the object with a fourth identification according to the first level and the third level; The access rights of the fourth identifier are smaller than the access rights of the second identifier and smaller than the access rights of the target identifier.

6. The method according to claim 1, further comprising: In response to receiving a second access request with the second identifier, if the second access request satisfies a third preset condition, configuring the object to have a minimum access permission identifier and stopping responding to the second access request.

7. The method according to claim 1, further comprising: In response to receiving a second access request with the second identifier, when the second access request satisfies a third preset condition, the object is configured to have a minimum access permission identifier, and second query information corresponding to the second access request is determined, and the amount of valid information contained in the second query information is less than the amount of valid information contained in the first query information.

8. The method according to claim 7, determining second query information corresponding to the second access request, comprising: In response to receiving the second access request with the minimum access permission identifier, encrypting the target data in the first query information to obtain the second query information, the target data being sensitive information to the object with the minimum access permission identifier.

9. The method according to claim 1, further comprising: The first identifier corresponds to a first computing resource access permission, the second identifier corresponds to a second computing resource access permission, and the resource amount of the second computing resource is less than the resource amount of the first computing resource.

10. A resource access method, applied to a second electronic device, the method comprising: In response to a target input of the object, generating a first access request, the first access request including a first identifier; Sending the first access request to a first electronic device; In response to receiving the second identifier sent by the first electronic device, generating a second access request according to the target input; sending the second access request; The access rights of the object in the second identifier to the resource are less than the access rights of the object in the first identifier to the resource.

Images