Resource access control method and device, equipment and medium

Abstract

The invention provides a resource access control method, device and equipment and a medium, which are applied to a server and relate to the technical field of network security, the method comprises the following steps: receiving an access request sent by a client, the access request carrying access element information of the client; generating request resource identification information according to access element information in the access request; generating at least one dynamic access resource address according to the request resource identification information and the access time information of the current access request; each dynamic access address has an effective time period; sending the at least one dynamic access resource address to a client; receiving a resource access request sent by the client according to the at least one dynamic access resource address; and sending a target resource corresponding to the at least one dynamic access resource address to a client according to the resource access request. According to the scheme, the security of resource access can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a resource access control method, device, equipment and medium. Background Art

[0002] A CDN (Content Delivery Network) is a technology that efficiently delivers web content through a distributed server cluster. Its core purpose is to improve the speed, stability, and security of user access to websites or applications, making it particularly suitable for global user access. Existing technologies typically implement resource access through fixed URLs or static tokens (such as JWT), which suffer from the following drawbacks:

[0003] 1. Low security: Fixed addresses can be easily sniffed and reused by crawlers or malicious attackers.

[0004] 2. Insufficient flexibility: Static tokens cannot dynamically adjust permissions based on client behavior.

[0005] 3. Resource waste: Invalid requests (such as expired or illegal requests) will still occupy server computing resources. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a resource access control method, which solves the problem of low access security of network resources in the prior art.

[0007] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0008] In a first aspect, an embodiment of the present invention provides a resource access control method, comprising:

[0009] Receive an access request sent by a client, wherein the access request carries access factor information of the client;

[0010] Generate requested resource identification information according to the access element information in the access request;

[0011] Generate at least one dynamic access resource address based on the requested resource identification information and the access time information of the current access request; each dynamic access address has an effective time period;

[0012] Sending the at least one dynamic access resource address to the client;

[0013] receiving a resource access request sent by the client according to the at least one dynamic access resource address;

[0014] According to the resource access request, the target resource corresponding to the at least one dynamic access resource address is sent to the client.

[0015] Optionally, receiving an access request sent by a client includes:

[0016] Receive an access request sent by a client, including the client IP address, user identification information, and access operation information of an application program access interface.

[0017] Optionally, generating requested resource identification information according to the access factor information in the access request includes:

[0018] The client IP address, user identification information and access operation information of the application program access interface in the access request are combined to generate request resource identification information.

[0019] Optionally, generating at least one dynamic access resource address according to the requested resource identification information and access time information of the current access request includes:

[0020] Combine the requested resource identifier with the access time information of the current access request to obtain an intermediate processing result;

[0021] Encrypting the intermediate processing result to generate temporary request resource identification information;

[0022] Using the temporary request resource identifier as a key value of a database table, and storing the temporary request resource identifier information in the database;

[0023] At least one dynamic access resource address is generated according to the temporary request resource identification information in the database.

[0024] Optionally, generating at least one dynamic access resource address according to the temporary request resource identification information in the database includes:

[0025] Configuring at least one effective time period for each of the temporary request resource identification information in the database;

[0026] The combination of the temporary request resource identification information and an effective time period is used as a dynamic access resource address, and at least one dynamic access resource address is obtained according to the combination of the temporary request resource identification information and at least one effective time period.

[0027] Optionally, receiving a resource access request sent by the client according to the at least one dynamic access resource address includes:

[0028] receiving a first resource access request sent by a client according to a first dynamic access resource address among the at least one dynamic access resource address;

[0029] If the validity period corresponding to the first resource access request expires, a second resource access request sent by the client according to a second dynamic access resource address among the at least one dynamic access resource address is received.

[0030] Optionally, sending the target resource corresponding to the at least one dynamic access resource address to the client according to the resource access request includes:

[0031] The resource access request is verified for an effective time period. If the verification passes, the target resource corresponding to the at least one dynamic access resource address is sent to the client. Otherwise, an access result of access denial is fed back to the client.

[0032] In a second aspect, an embodiment of the present invention further provides a resource access control device, comprising:

[0033] The transceiver module is used to receive an access request sent by a client, wherein the access request carries the access factor information of the client;

[0034] A first processing module, configured to generate requested resource identification information according to the access element information in the access request;

[0035] A second processing module is configured to generate at least one dynamic access resource address according to the requested resource identification information and the access time information of the current access request; each dynamic access address has an effective time period;

[0036] The transceiver module is also used to send the at least one dynamic access resource address to the client; receive the resource access request sent by the client based on the at least one dynamic access resource address; and send the target resource corresponding to the at least one dynamic access resource address to the client based on the resource access request.

[0037] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the resource access control method as described in the first aspect are implemented.

[0038] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented to perform the steps of the resource access control method described above when executed by a processor.

[0039] The above solution of the present invention includes at least the following beneficial effects:

[0040] According to the above-mentioned solution of the present invention, the server receives an access request sent by the client, and the access request carries the access factor information of the client; generates request resource identification information based on the access factor information in the access request; generates at least one dynamic access resource address based on the request resource identification information and the access time information of the current access request; each dynamic access address has an effective time period; sends the at least one dynamic access resource address to the client; receives the resource access request sent by the client based on the at least one dynamic access resource address, and sends the target resource corresponding to the at least one dynamic access resource address to the client based on the resource access request; reduces the risk of resource leakage, and reduces the interference of illegal requests through timeliness control and a one-time return mechanism for multiple addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of an embodiment of a resource access control method of the present invention;

[0042] Figure 2 It is a schematic diagram of an application scenario of a resource access control method of the present invention;

[0043] Figure 3 This is a schematic structural diagram of an embodiment of a resource access control device of the present invention;

[0044] Figure 4 It is a schematic diagram of the structure of an electronic device embodiment of the present invention. DETAILED DESCRIPTION

[0045] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0046] like Figure 1 As shown, an embodiment of the present invention provides a resource access control method, including:

[0047] Step 1: Receive an access request from a client. The access request carries the client's access factor information. The client's access factor information includes the client's IP address, user identification information, and the access operation information of the application programming interface (API). The access operation information of the API may include multiple operation information, such as multiple API operation methods for requesting different resources.

[0048] Step 2: Generate requested resource identification information based on the access element information in the access request;

[0049] Step 3: Generate at least one dynamic access resource address based on the requested resource identification information and the access time information of the current access request; each dynamic access address has an effective time period;

[0050] Step 4: Send the at least one dynamic access resource address to the client;

[0051] Step 5: receiving a resource access request sent by the client according to the at least one dynamic access resource address;

[0052] Step 6: Send the target resource corresponding to the at least one dynamic access resource address to the client according to the resource access request.

[0053] In this embodiment of the present invention, the server generates request resource identification information based on the access factor information in the access request; generates at least one dynamic access resource address based on the request resource identification information and the access time information of the current access request; each dynamic access address has an effective time period; reduces the interference of illegal requests through timeliness control; sends the at least one dynamic access resource address to the client; receives the resource access request sent by the client based on the at least one dynamic access resource address, and sends the target resource corresponding to the at least one dynamic access resource address to the client based on the resource access request; reduces the risk of resource leakage, and uses a one-time return mechanism for multiple addresses to reduce the interference of illegal requests. This achieves dynamic permission adjustment without the client's awareness, improving system security.

[0054] In some optional embodiments, step 1, receiving an access request from a client, includes receiving an access request from the client that includes the client's IP address, user identification information, and access operation information for an application program access interface. Here, the client first accesses the server through an initialization address, which may be a fixed access address of the server or the access address of the client's server; and the access request is sent to the server based on the initialization address.

[0055] In some optional embodiments, in step 2, generating the requested resource identification information according to the access factor information in the access request includes:

[0056] Step 21: Combine the client IP address, user identification information, and access operation information of the application program access interface in the access request to generate request resource identification information.

[0057] As an example, the client IP address, user identification information, and access operation information of the application program access interface can be concatenated to obtain the request resource identification information. For example, the client IP address can be 192.168.1.100, the user identification information can be user:12345, the application program access interface can be / api / v1 / orders, and the access operation information can be GET (or related information such as POST, PUT, or DELETE). The request resource identification information can be: 192.168.1.100:user:12345: / api / v1 / orders:GET.

[0058] In some optional embodiments, in step 3, generating at least one dynamic access resource address according to the requested resource identification information and the access time information of the current access request includes:

[0059] Step 31, combining the requested resource identifier with the access time information of the current access request to obtain an intermediate processing result;

[0060] Step 32: encrypt the intermediate processing result to generate temporary request resource identification information;

[0061] Step 33, using the temporary request resource identifier as a key value of a database table, and storing the temporary request resource identifier information in the database;

[0062] Step 34: Generate at least one dynamic access resource address according to the temporary request resource identification information in the database.

[0063] Still taking the above example, the access time information of the current access request may be 2025-01-01-13:00, then the intermediate processing result may be:

[0064] 192.168.1.100:user:12345: / api / v1 / orders:GET2025-01-01-13:00.

[0065] As an example, the database may be a Redis database. When the temporary resource request identification information is stored as a key in the Redis database, the validity period of the key may be set. For example, two different validity periods of 10 minutes and 20 minutes may be set for the temporary resource request identification information. Accordingly, the value may be set to the resource corresponding to the temporary resource request identification information.

[0066] In this embodiment, the above-mentioned request resource identifier is combined with the access time information of the current access request, and irreversibly encrypted through an encryption algorithm. The encryption algorithm here can be an MD5 encryption algorithm or hash encryption, and a temporary request resource identifier is generated again. By setting multiple different validity periods for the temporary request resource identifier, multiple dynamic access resource addresses can be generated. Users can only access within the validity period, which can prevent hotlinks such as crawlers, improve resource security, and avoid the risk of resource leakage.

[0067] Furthermore, the intermediate processing result may be encrypted using the MD5 encryption algorithm or a hash function. Still taking the above example, the temporary request resource identification information obtained by encrypting the hash function is as follows:

[0068] 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0.

[0069] In some optional embodiments, step 34, generating at least one dynamic access resource address according to the temporary request resource identification information in the database, includes:

[0070] Step 341, configuring at least one effective time period for each of the temporary request resource identification information in the database;

[0071] Step 342: The combination of the temporary request resource identification information and an effective time period is used as a dynamic access resource address, and at least one dynamic access resource address is obtained based on the combination of the temporary request resource identification information and at least one effective time period.

[0072] Still taking the above example, two different valid time periods of 10 minutes and 20 minutes are set for the temporary request resource identification information. Then, the dynamic access resource addresses can be 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b010 and 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b020. Alternatively, the dynamic access resource address may be 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0t=2025-01-01-13:0010,4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b020.

[0073] In this embodiment, multiple effective time periods are configured for temporary request resource identification information, thereby obtaining multiple dynamic access resource addresses, and then accessing resources through the dynamic access resource addresses. If the effective time period expires, access will be denied, preventing the addresses obtained by crawlers from being denied due to IP mismatch or expiration, thereby improving the legitimacy and security of resource access.

[0074] For example, if a dynamic access resource address expires, the server will automatically delete it without occupying server computing resources.

[0075] Still taking the above example, in step 4, multiple dynamic access resource addresses are sent to the client, that is, the dynamic access resource addresses 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b010 and 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b020 are sent to the client.

[0076] In this embodiment, if the API operation method requested by the user is a single operation, the server will only generate one dynamic resource access address for it; if the API operation method requested by the user is multiple (for example, requesting a page), the server will generate multiple corresponding dynamic access resource addresses for a period of time.

[0077] Furthermore, the server can return the dynamic access resource address to the client at one time, thereby reducing the interference of illegal requests.

[0078] In some optional embodiments, in step 5, receiving a resource access request sent by the client according to the at least one dynamic access resource address includes:

[0079] Step 51: receiving a first resource access request sent by a client according to a first dynamic access resource address among the at least one dynamic access resource address;

[0080] Step 52: If the validity period corresponding to the first resource access request expires, receive a second resource access request sent by the client according to a second dynamic access resource address among the at least one dynamic access resource address.

[0081] In this embodiment, the client successfully obtains the target resource using the first resource access request. If the first resource access request expires and the second resource access request is made after the expiration date, the client can still obtain the target resource through the second resource access request if the validity period of the second resource access request has not expired. This achieves dynamic permission adjustment without the client's awareness, improving system security.

[0082] For example, if the first dynamic access resource address received by the server at 2025-01-01-13:15 is 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b010, then the first dynamic access resource address has expired and has been automatically deleted by the server. Therefore, it is an illegal access and the server returns an access failure message. After receiving the access failure message, the client sends the second dynamic access resource address 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b010 to the server.

[0083] In some optional embodiments, in step 6, sending the target resource corresponding to the at least one dynamic access resource address to the client according to the resource access request includes:

[0084] Step 61 : Verify the effective time period of the resource access request. If the verification is successful, send the target resource corresponding to the at least one dynamic access resource address to the client. Otherwise, feed back an access denial result to the client.

[0085] In this embodiment, the server verifies the effective time period of the resource access request and returns the resource or rejects the request, thereby reducing interference from illegal requests.

[0086] Taking the above example again, if at 2025-01-01-13:15, the server receives the dynamic access resource address: 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b020, after parsing, it obtains the temporary request resource identification information 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0 and the validity period 20 (minutes), and further uses the MD5 algorithm or hash decryption algorithm to decrypt the above dynamic access resource address to obtain 192.168.1.100: user:12345: / api / v1 / orders:GET2025-01-01-13:00 (i.e., the intermediate processing result), and then obtain the first access time of the dynamic access resource address 2025-01-01-13:00. Combined with the time 2025-01-01-13:15 when the server received the dynamic access resource address, it is determined that 15 minutes have passed since the first access time. Therefore, the dynamic access resource address is still within the validity period of 20 minutes. The verification is passed. Based on the application access interface in the dynamic access resource address, such as / api / v1 / orders, and the access operation information, such as GET, the target resource corresponding to the at least one dynamic access resource address is sent to the client. If the effective time period expires, the access request will be rejected, thereby ensuring that the client obtains the target resource while reducing the interference of illegal requests.

[0087] Taking the above example again, because the server will automatically delete expired dynamic access resource addresses, if at time 2025-01-01-13:15, the server receives the dynamic access resource address: 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b020, and after parsing, obtains the temporary request resource identification information 4a3b2c1d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0, directly matches the temporary request resource identification information with the key in the database, and if the match is successful, the verification is successful.

[0088] refer to Figure 2 As an example, in an application scenario, a complete access process can refer to:

[0089] (1) Initialization request: The client accesses the server for the first time through the initialization address.

[0090] (2) Dynamic analysis: The server combines the IP address requested by the client, the unique ID registered by the user in the system, and the API operation method requested by the user to generate a unique request resource identifier for the first time.

[0091] (3) Generate dynamic address: The server combines the unique request resource generated above with the current timestamp, performs irreversible encryption through the MD5 algorithm, and generates a temporary request resource identifier again.

[0092] (3) The server stores the temporary resource identifier as a unique KEY in Redis and sets a reasonable validity period for it. In addition, if the API operation method requested by the user is a single operation, the server will only generate one dynamic access resource address for it; if the user requests multiple API operations (for example, requesting a page), the server will generate multiple corresponding dynamic access resource addresses for it.

[0093] Alternatively, the temporary request resource identifier is concatenated with a reasonable validity period set for it and irreversibly encrypted using the MD5 algorithm to obtain a dynamic access resource address, which is then stored in Redis as a unique key.

[0094] (4) Returning the dynamic access resource address: The server returns the dynamic access resource address to the client at one time.

[0095] (5) Accessing a dynamic access resource address: The client directly accesses a dynamic access resource address.

[0096] (6) Return resource: The server verifies the validity and returns the resource or rejects the request.

[0097] (7) Expiration processing: If the address is invalid, the client re-triggers the initialization process.

[0098] The above embodiment of the present invention is used in the following scenario: a video website prevents crawlers from hotlinking.

[0099] 1. The first access request sent by the user is POST / api / audit / log HTTP / 1.1

[0100] Host:example1.com

[0101] Content-Type:application / json

[0102] X-Forwarded-For:203.0.113.45#Client IP

[0103] Authorization: Bearer...adQssw5c#User identity (JWT token)

[0104] {"timestamp":"2024-07-20T14:35:22Z",#Access time (ISO 8601 format)

[0105] "actions":[#Multiple action information (resource request sequence)

[0106] {"method":"GET",

[0107] "path":" / api / products / 123",

[0108] "query":"?fields=name,price",

[0109] "status":200}]}

[0110] 2. The server generates two dynamic resource access addresses (e.g., / res / abc123?t=5 and / res / def456?t=10) based on the client's access factor information carried in the access request. These addresses are valid for 5 and 10 minutes, respectively. This approach combines client characteristics with timeliness to generate dynamic resource access addresses, making them difficult to predict and forge, and automatically invalidating them upon expiration.

[0111] 3. The client successfully obtains the video resource using the first address; if it tries the second dynamic resource access address after it expires, it can still access it. By setting multiple dynamic resource access addresses and establishing a multi-address redundancy mechanism, multiple dynamic resource access addresses can be returned at once, supporting failover or load balancing, as well as quickly verifying the legitimacy of requests through key-value pairs stored in Redis. Without requiring session persistence, the client can also adjust resource permissions in real time (for example, if the client sets resource permissions to be valid for 5 minutes, then a dynamic resource access address with a validity period of 5 minutes will be used to request resources).

[0112] 4. The crawler obtains the first dynamic resource access address / res / abc123?t=5 and sends an access request: Host:example2.com

[0113] Content-Type:application / json

[0114] X-Forwarded-For:200.0.000.00#Crawler IP

[0115] Authorization: Bearer......00000c#User identity (JWT token)

[0116] {"timestamp":"2025-07-20T15:00:00Z",#Access time (ISO 8601 format)

[0117] "actions":[#Multiple action information (resource request sequence)

[0118] / res / abc123?t=5]}

[0119] The crawler's resource access request will be rejected because the crawler IP does not match the client IP or the dynamic resource access address has expired, so that illegal requests are intercepted at the outer layer of the server and the computing load is reduced.

[0120] Figure 3 This is a schematic diagram of the structure of an embodiment of a resource access control device of the present invention, comprising:

[0121] The transceiver module 301 is configured to receive an access request sent by a client, wherein the access request carries access factor information of the client;

[0122] A first processing module 302 is configured to generate requested resource identification information based on the access element information in the access request;

[0123] The second processing module 303 is configured to generate at least one dynamic access resource address according to the requested resource identification information and the access time information of the current access request; each dynamic access address has an effective time period;

[0124] The transceiver module 301 is also used to send the at least one dynamic access resource address to the client; receive the resource access request sent by the client based on the at least one dynamic access resource address; and send the target resource corresponding to the at least one dynamic access resource address to the client based on the resource access request.

[0125] Optionally, the transceiver module 301 is specifically configured to receive an access request sent by a client, which includes the client IP address, user identification information, and access operation information of an application program access interface.

[0126] Optionally, the first processing module 302 is specifically configured to combine the client IP address, user identification information, and access operation information of the application program access interface in the access request to generate request resource identification information.

[0127] Optionally, the second processing module 303 is specifically used to: concatenate and combine the request resource identifier with the access time information of the current access request to obtain an intermediate processing result; encrypt the intermediate processing result to generate temporary request resource identifier information; use the temporary request resource identifier as the key value of the database table, and store the temporary request resource identifier information in the database; and generate at least one dynamic access resource address based on the temporary request resource identifier information in the database.

[0128] Optionally, the second processing module 303 is specifically configured to:

[0129] Configuring at least one effective time period for each of the temporary request resource identification information in the database;

[0130] The combination of the temporary request resource identification information and an effective time period is used as a dynamic access resource address, and at least one dynamic access resource address is obtained according to the combination of the temporary request resource identification information and at least one effective time period.

[0131] Optionally, the transceiver module 301 is specifically configured to:

[0132] receiving a first resource access request sent by a client according to a first dynamic access resource address among the at least one dynamic access resource address;

[0133] If the validity period corresponding to the first resource access request expires, a second resource access request sent by the client according to a second dynamic access resource address among the at least one dynamic access resource address is received.

[0134] Optionally, the transceiver module 301 is specifically configured to:

[0135] The resource access request is verified for an effective time period. If the verification passes, the target resource corresponding to the at least one dynamic access resource address is sent to the client. Otherwise, an access result of access denial is fed back to the client.

[0136] It should be noted that the device is a device corresponding to the above method, and all implementation methods in the above method embodiments are applicable to the embodiments of the device and can achieve the same technical effects.

[0137] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call logic instructions in the memory 430 to execute the resource access control method described above.

[0138] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0139] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute a resource access control method provided in the above embodiments.

[0140] The device embodiments described above are merely illustrative. Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0141] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A resource access control method, characterized in that: Applied to the server, the method includes: Receive an access request sent by a client, wherein the access request carries access factor information of the client; Generate requested resource identification information according to the access element information in the access request; Generate at least one dynamic access resource address based on the requested resource identification information and the access time information of the current access request; each dynamic resource access address has an effective time period; Sending the at least one dynamic access resource address to the client; receiving a resource access request sent by the client according to the at least one dynamic access resource address; According to the resource access request, the target resource corresponding to the at least one dynamic access resource address is sent to the client.

2. The resource access control method according to claim 1, characterized in that: Receive access requests sent by clients, including: Receive an access request sent by a client, including the client IP address, user identification information, and access operation information of an application program access interface.

3. The resource access control method according to claim 2, characterized in that: Generate requested resource identification information based on the access element information in the access request, including: The client IP address, user identification information and access operation information of the application program access interface in the access request are combined to generate request resource identification information.

4. The resource access control method according to claim 1, wherein: Generating at least one dynamic access resource address according to the requested resource identification information and the access time information of the current access request, including: Combine the requested resource identifier with the access time information of the current access request to obtain an intermediate processing result; Encrypting the intermediate processing result to generate temporary request resource identification information; Using the temporary request resource identifier as a key value of a database table, and storing the temporary request resource identifier information in the database; At least one dynamic access resource address is generated according to the temporary request resource identification information in the database.

5. The resource access control method according to claim 4, characterized in that: Generating at least one dynamic access resource address according to the temporary request resource identification information in the database, including: Configuring at least one effective time period for each of the temporary request resource identification information in the database; The combination of the temporary request resource identification information and an effective time period is used as a dynamic access resource address, and at least one dynamic access resource address is obtained according to the combination of the temporary request resource identification information and at least one effective time period.

6. The resource access control method according to claim 1, characterized in that: Receiving a resource access request sent by the client according to the at least one dynamic access resource address includes: receiving a first resource access request sent by a client according to a first dynamic access resource address among the at least one dynamic access resource address; If the validity period corresponding to the first resource access request expires, a second resource access request sent by the client according to a second dynamic access resource address among the at least one dynamic access resource address is received.

7. The resource access control method according to claim 1, characterized in that: Sending, according to the resource access request, a target resource corresponding to the at least one dynamic access resource address to the client, comprising: The resource access request is verified for an effective time period. If the verification passes, the target resource corresponding to the at least one dynamic access resource address is sent to the client. Otherwise, an access result of access denial is fed back to the client.

8. A resource access control device, characterized in that: Applied to the server, including: The transceiver module is used to receive an access request sent by a client, wherein the access request carries the access factor information of the client; A first processing module, configured to generate requested resource identification information according to the access element information in the access request; A second processing module is configured to generate at least one dynamic access resource address according to the requested resource identification information and the access time information of the current access request; each dynamic access address has an effective time period; The transceiver module is also used to send the at least one dynamic access resource address to the client; receive the resource access request sent by the client based on the at least one dynamic access resource address; and send the target resource corresponding to the at least one dynamic access resource address to the client based on the resource access request.

9. An electronic device, characterized in that: include: A processor, a memory, and a bus, wherein the processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the steps of the resource access control method according to any one of claims 1 to 7 by calling the program instructions.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program is implemented to perform the steps of the resource access control method according to any one of claims 1 to 7.

Images