Content delivery network processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a content distribution network processing method and device, electronic equipment and a storage medium, and relates to the technical field of network communication, and the method comprises the steps: constructing an authentication request, and transmitting the authentication request to an authentication server; if the authentication server passes verification of the authentication request, node information which is returned by the authentication server and aims at the authentication request is received, and the node information at least comprises target node addresses corresponding to a plurality of target Onion nodes; according to the embodiment of the invention, each target Onion node is accessed in sequence according to the address of the target node, if each target Onion node passes verification, the data server is accessed through the target Onion node, and the target content returned by the data server is received, so that the security of communication is ensured, the randomness of a communication path is ensured, and the communication efficiency is improved. And the probability that the communication path is analyzed and predicted is reduced.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a content delivery network processing method, a content delivery network processing apparatus, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Existing anti-hotlinking technologies rely on simple signature verification, IP whitelists, or timestamps, which are easily bypassed by attackers, leading to resource hotlinking problems. To improve security, anonymous communication technologies can be combined to prevent malicious users from identifying transmission paths and bypassing protection measures. However, conventional fixed communication nodes are easily analyzed, reducing the effectiveness of defenses. Summary of the Invention

[0003] The present invention provides a method, apparatus, electronic device, and computer-readable storage medium for processing content delivery networks, in order to solve or partially solve the problem that a single communication path is easily identifiable, resulting in weak security of the content delivery network.

[0004] This invention discloses a processing method for a content delivery network, comprising:

[0005] Construct an authentication request and send the authentication request to the authentication server;

[0006] If the authentication server verifies the authentication request, then the authentication server returns node information for the authentication request, the node information including at least several target node addresses corresponding to target Onion nodes.

[0007] According to the target node address, each target Onion node is accessed sequentially. If each target Onion node is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received.

[0008] This invention discloses a processing method for a content delivery network, comprising:

[0009] Receive authentication requests sent by the client;

[0010] If the authentication request is verified, the node information corresponding to the authentication request is determined;

[0011] The node information is returned to the client, and the node information includes at least several node addresses corresponding to the target Onion nodes.

[0012] This invention discloses a processing method for a content delivery network, comprising:

[0013] If the authentication server successfully authenticates the client, it receives a node access request sent by the client, which includes at least the client's MAC address and the current time.

[0014] Obtain the random number generator and the second seed information shared with the authentication server;

[0015] The second seed information, the MAC address, and the current time are input into the random number generator to generate a fourth random number for the client;

[0016] Obtain the target node address corresponding to the node access request;

[0017] Based on the verification result of the fourth random number on the target node address, verification information for the node access request is sent to the client.

[0018] This invention discloses a processing apparatus for a content delivery network, comprising:

[0019] The request construction module is used to construct an authentication request and send the authentication request to the authentication server.

[0020] The node information receiving module is used to receive node information returned by the authentication server for the authentication request if the authentication server verifies the authentication request. The node information includes at least several target node addresses corresponding to target Onion nodes.

[0021] The access module is used to access each of the target Onion nodes sequentially according to the target node address. If each of the target Onion nodes is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received.

[0022] This invention discloses a processing apparatus for a content delivery network, comprising:

[0023] The request receiving module is used to receive authentication requests sent by the client;

[0024] The node information determination module is used to determine the node information corresponding to the authentication request if the authentication request is verified.

[0025] The node information return module is used to return the node information to the client, wherein the node information includes at least several node addresses corresponding to target Onion nodes.

[0026] This invention discloses a processing apparatus for a content delivery network, comprising:

[0027] The request receiving module is used to receive a node access request sent by the client when the authentication server has successfully authenticated the client. The node access request includes at least the client's MAC address and the current time.

[0028] The information acquisition module is used to acquire the random number generator and the second seed information shared with the authentication server;

[0029] A random number generation module is used to input the second seed information, the MAC address and the current time into the random number generator to generate a fourth random number for the client;

[0030] The address acquisition module is used to acquire the target node address corresponding to the node access request;

[0031] The verification module is used to send verification information for the node access request to the client based on the verification result of the target node address using the fourth random number.

[0032] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0033] The memory is used to store computer programs;

[0034] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0035] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0036] The embodiments of the present invention have the following advantages:

[0037] In this embodiment of the invention, when a client requests corresponding data from a data server, a corresponding authentication request can be constructed first and sent to the authentication server. If the authentication server verifies the authentication request, the client can receive the node information returned by the authentication server for the authentication request. The node information includes at least the target node addresses corresponding to several target Onion nodes. Then, according to the target node addresses, each target Onion node is accessed sequentially. If each target Onion node is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received. Thus, during the client's access to the data server, the authentication server authenticates the client, ensuring the security of communication. At the same time, the node information returned by the authentication server ensures the randomness of the communication path, reduces the probability of the communication path being analyzed and predicted, and greatly increases the difficulty for attackers to obtain communication content or bypass protection by attacking intermediate nodes by introducing the Onion routing path, thereby improving the security of the anti-hotlinking system. Attached Figure Description

[0038] Figure 1 This is a flowchart of the steps of a content delivery network processing method provided in an embodiment of the present invention;

[0039] Figure 2 This is a flowchart of the steps of a content delivery network processing method provided in an embodiment of the present invention;

[0040] Figure 3 This is a flowchart of the steps of a content delivery network processing method provided in an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of the device communication architecture provided in an embodiment of the present invention;

[0042] Figure 5 This is a schematic diagram of the data communication process provided in an embodiment of the present invention;

[0043] Figure 6 This is a structural block diagram of a content delivery network processing device provided in an embodiment of the present invention;

[0044] Figure 7 This is a structural block diagram of a content delivery network processing device provided in an embodiment of the present invention;

[0045] Figure 8 This is a structural block diagram of a content distribution network processing device provided in an embodiment of the present invention. Detailed Implementation

[0046] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] As an example, when a client requests data from a CDN (Content Delivery Network) data server, the CDN authentication and scheduling server authenticates the client and signs the URL, ensuring that the client can only access the data from the CDN data server if it possesses a valid signature. However, in this process, the single communication path is easily identifiable, allowing attackers to replay previous requests to obtain resources. Furthermore, the signed URL can still be shared with other users, making it vulnerable to theft.

[0048] In this invention, when a client requests data from a data server, an authentication request can be constructed first and sent to the authentication server. If the authentication server verifies the authentication request, the client can receive node information returned by the authentication server in response to the authentication request. The node information includes at least the target node addresses corresponding to several target Onion nodes. Then, each target Onion node is accessed sequentially according to its address. If each target Onion node is verified, the client accesses the data server through the target Onion node and receives the target content returned by the data server. Thus, during the client's access to the data server, the authentication server authenticates the client, ensuring communication security. At the same time, the node information returned by the authentication server ensures the randomness of the communication path, reducing the probability of the communication path being analyzed and predicted. Furthermore, by introducing Onion routing, the difficulty for attackers to obtain communication content or bypass protection by attacking intermediate nodes is greatly increased, thus improving the security of the anti-hotlinking system.

[0049] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, some technical features involved in the embodiments of the present invention are explained below:

[0050] CDN is an intelligent virtual network built on the existing network infrastructure. Relying on edge servers deployed in various locations, it enables users to obtain the content they need from the nearest location through the load balancing, content distribution, and scheduling functions of the central platform, thereby reducing network congestion and improving user access response speed and hit rate.

[0051] Onion routing is an anonymous communication technology that transmits data through multiple layers of encryption. Each layer can only decrypt the information of the previous layer, ensuring the privacy of the user's identity and the security of communication.

[0052] Obfuscating Onion routes allows for the dynamic and random selection of intermediate nodes and transmission paths for each communication, based on Onion routes, thus preventing the path from being tracked and identified.

[0053] A client can be a device or application that initiates the request, such as a live streaming application on a mobile device or a browser on a PC. Users can use the corresponding network services through the client.

[0054] An authentication server is responsible for verifying and authorizing the client's identity, and assigning the appropriate Onion node to the client. Through two-way authentication with the client, it ensures the security of data transmission.

[0055] A data server, in a data transmission scenario, is responsible for receiving data from clients and storing or forwarding the received data to enable real-time application and storage of the data. For example, in an audio / video streaming scenario, the data server can be a streaming server, which can receive audio / video stream data from clients and forward it to other clients or store it to enable real-time playback and storage of audio and video. This invention does not limit this.

[0056] Reference Figure 1 This diagram illustrates a flowchart of a content delivery network processing method provided in an embodiment of the present invention, applied to a client, and specifically includes the following steps:

[0057] Step 101: Construct an authentication request and send the authentication request to the authentication server;

[0058] In this embodiment of the invention, when a client wants to access a data server, it needs to authenticate with the authentication server first. After successful authentication, the authentication server can allocate a corresponding Onion route transmission path for the client so that the client can communicate with the data server through the Onion route.

[0059] During client authentication, the client can obtain a random number generator and its corresponding first seed information, as well as its MAC address and current time. It then inputs the first seed information, MAC address, and current time into the random number generator to generate a first random number. Finally, it integrates the MAC address, the first random number, and the current time to generate an authentication request, which is then sent to the authentication server. The authentication server then authenticates the client based on this request. Optionally, the random number generator and the first seed information can be shared with the authentication server. The client and server use the shared random number generator and first seed information to generate corresponding random numbers for two-way verification, ensuring the uniqueness and security of each communication, preventing forged requests, and improving resistance to attacks and hotlinking.

[0060] The random number generator can be a device or algorithm capable of generating random numbers. The client and the authentication server can generate corresponding random numbers through the random number generator. For example, the random number generator can be the RANDOM function. The first seed information can be the input value of the random number generator, which can be the starting point for the algorithm to start generating the random number sequence. For a specific random number generation algorithm, given the same seed, the same random number sequence can be generated each time it is run. Thus, the client and the authentication server perform bidirectional verification by generating corresponding random numbers through the shared random number generator and the first seed information, ensuring the uniqueness and security of each communication. Through the bidirectional verification mechanism, forged requests are prevented, and the system's resistance to attacks and anti-hotlinking capabilities are improved.

[0061] In addition, the MAC address can be the physical address or hardware address corresponding to the client, which can be used to identify the client. Different clients can correspond to different MAC addresses. Furthermore, adding the current time during the random number generation process can further improve the randomness of the generated random number, thereby further ensuring the uniqueness and security of each communication.

[0062] In one example, the client can use the RANDOM function, SEED (first seed information), device MAC address, and current system date shared between the client and the authentication server to generate a random number RA1, for example, as shown in the following formula:

[0063] RA1 = RANDOM(SEED, MAC, date)

[0064] Next, the client sends an authentication request to the authentication server. This authentication request may include: MAC address, username, password, RA1, current date, etc., but this invention does not impose any limitations on this.

[0065] Step 102: If the authentication server verifies the authentication request, then receive the node information returned by the authentication server for the authentication request. The node information includes at least the target node addresses corresponding to several target Onion nodes.

[0066] For the authentication server, after receiving the authentication request sent by the client, it can authenticate the client based on the information contained in the authentication request. If the authentication is successful, it will select the corresponding target Onion node from the Onion routing network, construct the corresponding node information based on the target node address, and then return the node information to the client so that the client can access the target Onion node based on the node information. Thus, the client and the authentication server use a shared random number generator and first seed information to generate corresponding random numbers for bidirectional verification, ensuring the uniqueness and security of each communication. Through the bidirectional verification mechanism, it prevents forged requests and improves the system's resistance to attacks and anti-hotlinking capabilities.

[0067] In some feasible implementations, after the authentication server receives the authentication request sent by the client, it can parse the client's corresponding MAC address, current time, and the first random number generated by the client from the authentication request. Then, based on the random number generator shared with the client, the first seed information, the MAC address, and the current time, the authentication server generates a corresponding second random number so that the first random number and the second random number can be compared to authenticate the client.

[0068] It should be noted that since the client and the authentication server share the same random number generator and the same first seed information, and the authentication server combines the client's MAC address and the current time (which can be the time the client sent the data) when generating random numbers, under normal communication conditions, the client and the authentication server generate the same random number. However, in the event of communication anomalies (such as attacks or path theft), the client and the authentication server will generate different random numbers. Thus, the client and the authentication server use the shared random number generator and the first seed information to generate corresponding random numbers for two-way verification, ensuring the uniqueness and security of each communication. This two-way verification mechanism prevents forged requests and improves the system's resistance to attacks and its anti-hotlinking capabilities.

[0069] Optionally, the authentication server and the Onion router can share second seed information. The second seed information can be used to derive node selection parameters. After the authentication server generates the corresponding second random number, it can compare the first random number with the second random number. If the first random number and the second random number are the same, the authentication server can generate a third random number based on the random number generator, the second seed information, the MAC address, and the current time, and randomly select several target Onion nodes from the Onion router network. It can then obtain the target node address corresponding to each target Onion node, construct the corresponding node information based on the third random number and the target node address, and return the node information to the client so that the client can access the target Onion node based on the node information. Thus, the authentication server can randomly assign the corresponding Onion node to the client using the random number generation algorithm and the corresponding seed information, ensuring the randomness of each communication path and preventing the transmission path from being analyzed and predicted by attackers.

[0070] In some feasible implementations, after authentication is successful, the authentication server can first randomly select several target Onion nodes from the Onion routing network, obtain the initial node address corresponding to each target Onion node, and input the second seed information, the MAC address, and the current time into the random number generator to generate a third random number for the target Onion node. Then, it can obtain the extraction method for the third random number and, according to the extraction method and the number of target Onion nodes, extract the node number corresponding to each target Onion node from the third random number. Then, it adds the node number to the initial node address to obtain the corresponding target node address. Finally, based on each target node address, it generates node information corresponding to the authentication request. Thus, on the one hand, the authentication server can randomly assign corresponding Onion nodes to the client using a random number generation algorithm and corresponding seed information, ensuring the randomness of each communication path and preventing attackers from analyzing and predicting the transmission path. On the other hand, by optimizing the node address, subsequent Onion nodes can verify the client based on the processed node address, further improving anti-attack and anti-hotlinking capabilities.

[0071] It should be noted that the authentication server and Onion routing can agree on the extraction method. For the authentication server, it needs to extract the corresponding value from the third random number according to the extraction method, and use it as the node number of the Onion node's node address. For the Onion node, it needs to extract the corresponding value from the corresponding random number based on the same extraction method in order to verify the client.

[0072] In some examples, the extraction method can be to extract corresponding values ​​from random numbers according to a specific extraction order and the number of digits extracted. For example, assuming the third random number generated by the authentication server is 15764329, the extraction order is reversed, and the number of digits extracted is consistent with the number of target Onion nodes. For instance, the last three digits are extracted and used as the node numbers for target Onion nodes R1, R2, and R3, respectively. Assuming the node addresses corresponding to target Onion nodes R1, R2, and R3 are respectively:

[0073] IP_R1: 118.133.2; IP_R2: 118.133.2; IP_R3: 118.133.2.

[0074] After adding the corresponding node number, the target node address can be:

[0075] IP_R1: 118.133.2.3; IP_R2: 118.133.2.2; IP_R3: 118.133.2.9.

[0076] Optionally, in addition to extracting in reverse order, sequential extraction is also possible, as well as extracting the nth to n+m-1th digits from the random number (where n is the starting point for extraction from the nth value in the random number, and m is the number of nodes). Furthermore, during the extraction process, it is possible to limit the extraction to non-zero values ​​as node numbers, and when a 0 is encountered, it is skipped and the next digit is extracted. This invention does not impose any restrictions on this.

[0077] In other examples, after the authentication server receives an authentication request from the client, it can parse the corresponding MAC address and date from the request. Then, it uses the same RANDOM function, SEED, MAC address, and date as the client to generate a random number RA2, as shown in the following formula:

[0078] RA2 = RANDOM(SEED, MAC, date)

[0079] Assume that the calculated value of RA2 is 48913552 after substituting the corresponding parameters.

[0080] Next, the authentication server can verify whether RA1 and RA2 are consistent. If the verification is successful, the authentication server can calculate the three allocated Onion nodes R1, R2, and R3 based on the SEED_Onion (second seed information) shared with the Onion nodes (optionally, the number of Onion routing nodes is at least 9; 3 is used as an example here) and calculate the corresponding third random number RA3, as follows:

[0081] RA3 = RANDOM(SEED_Onion, MAC, Date)

[0082] Assume SEED_Onion: 65398765

[0083] MAC: 00:E5:3A:A1:D2:6E

[0084] Date: 2024-05-01

[0085] After substituting the values ​​into the calculation, the third random number RA3 is found to be 15764329.

[0086] Then, the authentication server can take the last three non-zero digits of the third random number RA3, which is 329. The corresponding node numbers for the three Onion nodes can be:

[0087] R1: Node number 3

[0088] R2: Node number 2

[0089] R3: Node number 9

[0090] Furthermore, the authentication server selects the corresponding IP address from the node pool and then returns it to the client:

[0091] IP_R1: 118.133.2.3

[0092] IP_R2: 118.133.2.2

[0093] IP_R3: 118.133.2.9

[0094] Through the above process, by introducing a dynamic node selection method that obfuscates Onion routing, the randomness and unpredictability of nodes and their order during each communication are ensured, making it difficult for attackers to launch attacks through fixed path analysis, thereby improving communication concealment and security.

[0095] Step 103: According to the target node address, access each of the target Onion nodes in sequence. If each of the target Onion nodes is verified, access the data server through the target Onion node and receive the target content returned by the data server.

[0096] Based on the node information returned by the authentication server, the client can parse the target node address corresponding to each target Onion node from the node information. Then, according to the corresponding access order, the client accesses each target Onion node in turn according to the target node address. During the access process, each target Onion node can verify the client. If the client is successfully verified by each target Onion node, the client can access the data server through the target Onion node and receive the target content returned by the data server. Thus, during the client's access to the data server, the authentication server authenticates the client, ensuring the security of communication. At the same time, the node information returned by the authentication server ensures the randomness of the communication path, reducing the probability of the communication path being analyzed and predicted. Furthermore, by introducing Onion routing, the difficulty for attackers to obtain communication content or bypass protection by attacking intermediate nodes is greatly increased, thus improving the security of the anti-hotlinking system.

[0097] In some feasible implementations, taking the client's access to one of the target Onion nodes as an example, during the access process, the client can obtain the client's MAC address and current time, as well as the access order corresponding to each target Onion node. Then, based on the MAC address, current time, and access order, a node access request is generated for the target Onion node. Next, the node access request is sent to the target Onion node according to the target node address, and the verification information returned by the target Onion node is received.

[0098] The verification information includes both successful and failed verification information. The verification information is generated by the target Onion node based on the second seed information, MAC address, and current date, and then verifies the target node address based on the fourth random number and access order. By introducing a node verification mechanism into the Onion routing, each Onion node can be matched and verified according to the generated random number, ensuring the legitimacy of the node, preventing the addition of forged nodes, and further improving the security and stability of the anti-hotlinking system.

[0099] As previously mentioned, during the node verification process for Onion nodes, since the Onion nodes and the authentication server agree on the same extraction method, after the target Onion node generates the corresponding fourth random number, the access order corresponding to the target Onion node can be obtained. The fourth random number is then extracted according to the preset extraction method and access order to obtain the target value corresponding to the access order. The target value is then compared with the corresponding node number. If the target value matches the node number, a verification pass message is sent to the client; if the target value does not match the node number, a verification failure message is sent to the client, and the client's access to the data server is rejected, marking the node access request as an abnormal request. Thus, by introducing a node verification mechanism in the Onion routing, each Onion node can be matched and verified according to the generated random number, ensuring the legitimacy of the node, preventing the addition of forged nodes, and further improving the security and stability of the anti-hotlinking system.

[0100] In some examples, after receiving the node information assigned by the authentication server, the client accesses each target Onion node in the order of R1, R2, and R3. During the access process, Onion data packets can be generated based on MAC, date, HTTP request, etc.

[0101] For each target Onion node, RA4 is calculated according to the following formula:

[0102] RA4 = RANDOM(SEED_Onion, MAC, Date)

[0103] Next, the target Onion node can match the x-th decimal digit from the end of RA4 with the last digit of the node ID to verify the consistency of the node's identity. Here, x can represent the access order.

[0104] If the last digit of R1's number matches the third-to-last decimal digit, then the verification passes.

[0105] The same verification was performed on R2 and R3.

[0106] After successful verification, the client communicates normally with the server through these three Onion routing nodes, and the server pushes content to the client normally.

[0107] In the above process, by introducing a node verification mechanism into the Onion routing, each Onion node can be matched and verified based on the generated random number, ensuring the legitimacy of the node, preventing the addition of fake nodes, and further improving the security and stability of the anti-hotlinking system.

[0108] Furthermore, if at least one of the target Onion nodes returns a verification failure message, an access failure message for the data server is output. For example, if at least one target Onion node among R1, R2, and R3 fails verification, the client's request can be marked as potential hotlinking, the client's request can be rejected, and detailed logs can be recorded.

[0109] Furthermore, the second seed information shared between the authentication server and the Onion node can be updated periodically according to a preset method. By obtaining the update information for the second seed information and updating the second seed information according to the update information when an update is triggered, the second seed information can be regenerated. This can be used to change the order of Onion routing nodes, ensuring that the random path and node selection are different every day, increasing communication security and randomness. In addition, to improve compatibility, the date range can be compatible with up to 2 days, etc. This invention does not limit this.

[0110] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0111] In this embodiment of the invention, when a client requests corresponding data from a data server, a corresponding authentication request can be constructed first and sent to the authentication server. If the authentication server verifies the authentication request, the client can receive the node information returned by the authentication server for the authentication request. The node information includes at least the target node addresses corresponding to several target Onion nodes. Then, according to the target node addresses, each target Onion node is accessed sequentially. If each target Onion node is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received. Thus, during the client's access to the data server, the authentication server authenticates the client, ensuring the security of communication. At the same time, the node information returned by the authentication server ensures the randomness of the communication path, reduces the probability of the communication path being analyzed and predicted, and greatly increases the difficulty for attackers to obtain communication content or bypass protection by attacking intermediate nodes by introducing the Onion routing path, thereby improving the security of the anti-hotlinking system.

[0112] Reference Figure 2 This diagram illustrates a flowchart of a content delivery network processing method provided in an embodiment of the present invention, applied to an authentication server, and specifically includes the following steps:

[0113] Step 201: Receive the authentication request sent by the client;

[0114] Step 202: If the authentication request is verified, determine the node information corresponding to the authentication request;

[0115] Step 203: Return the node information to the client. The node information includes at least the node addresses corresponding to several target Onion nodes.

[0116] In some feasible implementations, the authentication request includes at least the client's MAC address, a first random number generated by the client, and the current time. Determining the node information corresponding to the authentication request includes:

[0117] Obtain the random number generator and its corresponding first seed information;

[0118] The first seed information, the MAC address, and the current time are input into the random number generator to generate a corresponding second random number;

[0119] If the first random number is the same as the second random number, then node information corresponding to the authentication request is generated based on the MAC address and the current time.

[0120] In some feasible implementations, the authentication server shares second seed information with the Onion routing network. This second seed information is used to derive node selection parameters. The step of generating node information corresponding to the authentication request based on the MAC address and the current time includes:

[0121] Randomly select several target Onion nodes from the Onion routing network, and obtain the initial node address corresponding to each target Onion node.

[0122] The second seed information, the MAC address, and the current time are input into the random number generator to generate a third random number for the target Onion node;

[0123] Obtain the extraction method for the third random number;

[0124] According to the extraction method and the number of target Onion nodes, extract the node number corresponding to each target Onion node from the third random number;

[0125] Add the node number to the initial node address to obtain the corresponding target node address;

[0126] Based on the addresses of each target node, node information corresponding to the authentication request is generated.

[0127] Among some feasible implementation methods are:

[0128] Obtain updated information regarding the second seed information;

[0129] If an update is triggered, the second seed information is updated according to the update information.

[0130] Reference Figure 3 This diagram illustrates a flowchart of a content delivery network processing method provided in an embodiment of the present invention, applied to an Onion node, and specifically includes the following steps:

[0131] Step 301: If the authentication server successfully authenticates the client, it receives a node access request sent by the client. The node access request includes at least the client's MAC address and the current time.

[0132] Step 302: Obtain the random number generator and the second seed information shared with the authentication server;

[0133] Step 303: Input the second seed information, the MAC address, and the current time into the random number generator to generate a fourth random number for the client;

[0134] Step 304: Obtain the target node address corresponding to the node access request;

[0135] Step 305: Based on the verification result of the target node address using the fourth random number, send verification information for the node access request to the client.

[0136] In some feasible implementations, the target node address includes a node number, and the step of sending verification information for the node access request to the client based on the verification result of the target node address using the fourth random number includes:

[0137] Obtain the access order corresponding to the target Onion node;

[0138] The fourth random number is extracted according to the preset extraction method and the access order to obtain the target value corresponding to the access order;

[0139] If the target value matches the node number, then a verification pass message is sent to the client;

[0140] If the target value does not match the node number, a verification failure message is sent to the client, and the client's access to the data server is denied, marking the node access request as an abnormal request.

[0141] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are provided for illustrative purposes:

[0142] As an example, refer to Figure 4 This diagram illustrates the device communication architecture provided in this embodiment of the invention. The CDN authentication and scheduling server (hereinafter referred to as the server) is responsible for verifying and authorizing client requests and dynamically allocating Onion routing transmission paths based on the requests. An algorithm randomly selects several Onion nodes (such as R1, R2, R3, etc.) to ensure the Onion routing path is random. The obfuscated Onion routing, as a core component of anti-leeching, uses at least nine nodes (R1 to R9, etc.) for random dynamic selection and multi-layered encrypted transmission, and verifies the legitimacy of the random path.

[0143] Accordingly, refer to Figure 5 This illustration shows a schematic diagram of the data communication process provided in an embodiment of the present invention. Taking the client obtaining push data from the CDN push server as an example, the CDN anti-hotlinking process based on obfuscated Onion routing may include:

[0144] Step 1: The client constructs an authentication request

[0145] Device MAC address: 00:E5:3A:A1:D2:6E

[0146] Current date: 2024-05-01

[0147] RANDOM function: It is assumed that the RANDOM function shared by the client and server is a pseudo-random number generator (PRNG).

[0148] SEED: The shared seed value is 11065735.

[0149] The client generates a random number RA1 using the following formula:

[0150] RA1 = RANDOM(SEED, MAC, date)

[0151] The value generated by RA1 is 48913552.

[0152] The client sends this authentication request to the authentication server.

[0153] Step 2: The server verifies the request and generates Onion node allocations.

[0154] After receiving the request, the server generates a random number RA2 using the same RANDOM function, SEED, MAC address, and date, as shown in the following formula:

[0155] RA2 = RANDOM(SEED, MAC, date)

[0156] After substituting, the value of RA2 is 48913552. The server verifies that RA1 and RA2 are consistent, and the verification passes.

[0157] The server calculates the three allocated Onion nodes R1, R2, R3 (the number of Onion routing nodes is at least 9) and RA3 based on the SEED_Onion shared with the Onion nodes, using the following formula:

[0158] RA3 = RANDOM(SEED_Onion, MAC, Date)

[0159] SEED_Onion: 65398765

[0160] MAC: 00:E5:3A:A1:D2:6E

[0161] Date: 2024-05-01

[0162] After substituting the values ​​into the calculation, the value of RA3 is 15764329.

[0163] The server takes the last three non-zero digits of RA3, which is 329, corresponding to the three Onion routing node numbers:

[0164] R1: Node number 3

[0165] R2: Node number 2

[0166] R3: Node number 9

[0167] The server selects the corresponding IP address from the node pool and returns it to the client:

[0168] IP_R1: 118.133.2.3

[0169] IP_R2: 118.133.2.2

[0170] IP_R3: 118.133.2.9

[0171] Step 3: The client accesses the Onion routing node.

[0172] After receiving the IP addresses of R1, R2, and R3, the client generates Onion packets and accesses these Onion routing nodes in sequence.

[0173] Onion routing node verification process:

[0174] (1) Verification of node R1 (node ​​number 3):

[0175] The client generates RA4 based on the MAC address 00:E5:3A:A1:D2:6E, the current date 2024-5-1, and SEED_Onion:

[0176] RA4 = RANDOM(SEED_Onion, MAC, Date)

[0177] The value of RA4 is 15764329. Taking the third-to-last digit of RA4, we get 3, which matches the last digit of the R1 node number, so the verification is successful.

[0178] (2) Verification of R2 node (node ​​number 2):

[0179] Similarly, RA4 is generated based on MAC and date. The second to last digit is 2, which matches the last digit 2 of the R2 node number, so the verification is successful.

[0180] (3) Verification of R3 node (node ​​number 9):

[0181] Using the same RA4 value, the last digit is 9, which matches the last digit 9 of the R3 node number, so the verification is successful.

[0182] 3.1 After successful verification, the client communicates normally with the server through these 3 Onion routing nodes, and the server pushes content to the client normally.

[0183] 3.2 Onion routes perform the corresponding relay operations.

[0184] Step 4: Update SEED_Onion

[0185] At a fixed time each day (e.g., 3 AM), the system regenerates SEED_Onion to update the order of Onion routing nodes, ensuring the randomness of communication paths and nodes. For example, if the generated SEED_Onion for the next day is 13255713, the updated allocation algorithm will be based on the new SEED_Onion. The system allows for compatibility within two days; for example, requests initiated on May 1, 2024, or May 2, 2024, can be verified using the current Onion routing mechanism.

[0186] In the aforementioned process, by introducing dynamic node selection technology that obfuscates Onion routing, the randomness and unpredictability of nodes and their order during each communication are ensured, making it difficult for attackers to launch attacks through fixed path analysis, thus improving communication concealment and security. Furthermore, by introducing a node verification mechanism into Onion routing, each target Onion node is matched and verified against a generated random number, ensuring node legitimacy and preventing the addition of forged nodes, further enhancing the security and stability of the anti-hotlinking system. Additionally, by dynamically updating SEED_Onion, the communication path and node selection change daily, ensuring the system's dynamic security. This mechanism significantly improves the system's resistance to long-term monitoring and attacks, effectively reducing the risk of long-term attacks. Furthermore, by combining multi-layered encryption of Onion routing with the anti-hotlinking mechanism, each layer of communication is encrypted and verified, improving data transmission security, preventing resource hijacking or tampering during transmission, and ensuring data integrity and security.

[0187] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0188] Reference Figure 6 This diagram illustrates a structural block diagram of a content delivery network processing device provided in an embodiment of the present invention. Applied to a client, it may specifically include the following modules:

[0189] The request construction module 601 is used to construct an authentication request and send the authentication request to the authentication server.

[0190] The node information receiving module 602 is used to receive node information returned by the authentication server for the authentication request if the authentication server verifies the authentication request. The node information includes at least several target node addresses corresponding to target Onion nodes.

[0191] The access module 603 is used to access each of the target Onion nodes sequentially according to the target node address. If each of the target Onion nodes is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received.

[0192] In some feasible implementations, the request construction module 601 is specifically used for:

[0193] Obtain the random number generator and its corresponding first seed information;

[0194] Get the client's MAC address and current time;

[0195] The first seed information, the MAC address, and the current time are input into the random number generator to generate a corresponding first random number.

[0196] The MAC address, the first random number, and the current time are integrated to generate a corresponding authentication request.

[0197] In some feasible implementations, the authentication request includes at least the client's MAC address, a first random number, and the current time, and the node information receiving module 602 is specifically used for:

[0198] If the first random number is the same as the second random number, then the node information returned by the authentication server in response to the authentication request is received.

[0199] The second random number is generated by the authentication server based on a random number generator shared with the client, the first seed information corresponding to the random number generator, the MAC address, and the current time.

[0200] In some feasible implementations, the authentication server shares second seed information with the Onion routing network. The second seed information is used to derive node selection parameters. The node information is generated by the authentication server based on a third random number generated by the random number generator, the second seed information, the MAC address, and the current time, and by randomly selecting several target Onion nodes from the Onion routing network, obtaining the target node address corresponding to each target Onion node, and then generating information based on the third random number and the target node address.

[0201] In some feasible implementations, the access module 603 is specifically used for:

[0202] Get the client's MAC address and current time;

[0203] Obtain the access order corresponding to each of the target Onion nodes;

[0204] Based on the MAC address, the current time, and the access order, a node access request is generated for the target Onion node;

[0205] According to the target node address, send the node access request to the target Onion node and receive the verification information returned by the target Onion node;

[0206] The verification information includes verification success information and verification failure information. The verification information is generated by the target Onion node after verifying the target node address based on the fourth random number generated by the target Onion node according to the second seed information, the MAC address and the current date, and the access order.

[0207] Among some feasible implementation methods are:

[0208] The information output module is used to output access failure information for the data server if it receives verification failure information returned by at least one of the target Onion nodes.

[0209] Reference Figure 7 This diagram illustrates a structural block diagram of a content distribution network processing device provided in an embodiment of the present invention. Applied to an authentication server, it may specifically include the following modules:

[0210] The request receiving module 701 is used to receive authentication requests sent by the client;

[0211] The node information determination module 702 is used to determine the node information corresponding to the authentication request if the authentication request is verified.

[0212] The node information return module 703 is used to return the node information to the client, wherein the node information includes at least a number of node addresses corresponding to target Onion nodes.

[0213] In some feasible implementations, the authentication request includes at least the client's MAC address, a first random number generated by the client, and the current time. The node information determination module 702 is specifically used for:

[0214] Obtain the random number generator and its corresponding first seed information;

[0215] The first seed information, the MAC address, and the current time are input into the random number generator to generate a corresponding second random number;

[0216] If the first random number is the same as the second random number, then node information corresponding to the authentication request is generated based on the MAC address and the current time.

[0217] In some feasible implementations, the authentication server shares second seed information with the Onion routing network. This second seed information is used to derive node selection parameters. The node information determination module 702 is specifically used for:

[0218] Randomly select several target Onion nodes from the Onion routing network, and obtain the initial node address corresponding to each target Onion node;

[0219] The second seed information, the MAC address, and the current time are input into the random number generator to generate a third random number for the target Onion node;

[0220] Obtain the extraction method for the third random number;

[0221] According to the extraction method and the number of target Onion nodes, extract the node number corresponding to each target Onion node from the third random number;

[0222] Add the node number to the initial node address to obtain the corresponding target node address;

[0223] Based on the addresses of each target node, node information corresponding to the authentication request is generated.

[0224] Among some feasible implementation methods are:

[0225] The update information acquisition module is used to acquire update information for the second seed information;

[0226] An update module is used to update the second seed information according to the update information when an update is triggered.

[0227] Reference Figure 8 This diagram illustrates a structural block diagram of a content delivery network processing device provided in an embodiment of the present invention, applied to an Onion node, and specifically may include the following modules:

[0228] The request receiving module 801 is used to receive a node access request sent by the client when the authentication server has successfully authenticated the client. The node access request includes at least the client's MAC address and the current time.

[0229] Information acquisition module 802 is used to acquire random number generator and second seed information shared with the authentication server;

[0230] The random number generation module 803 is used to input the second seed information, the MAC address and the current time into the random number generator to generate a fourth random number for the client;

[0231] Address acquisition module 804 is used to acquire the target node address corresponding to the node access request;

[0232] The verification module 805 is used to send verification information for the node access request to the client based on the verification result of the target node address using the fourth random number.

[0233] In some feasible implementations, the target node address includes a node number, and the verification module 805 is specifically used for:

[0234] Obtain the access order corresponding to the target Onion node;

[0235] The fourth random number is extracted according to the preset extraction method and the access order to obtain the target value corresponding to the access order;

[0236] If the target value matches the node number, then a verification pass message is sent to the client;

[0237] If the target value does not match the node number, a verification failure message is sent to the client, and the client's access to the data server is denied, marking the node access request as an abnormal request.

[0238] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0239] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described content delivery network processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0240] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described content delivery network processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0241] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0242] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, EEPROM, Flash, and eMMC, etc.) containing computer-usable program code.

[0243] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0244] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0245] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0246] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0247] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0248] The above provides a detailed description of a content delivery network processing method and a content delivery network processing device provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A processing method for a content delivery network, characterized in that, include: Construct an authentication request and send the authentication request to the authentication server; If the authentication server verifies the authentication request, then the authentication server returns node information for the authentication request, the node information including at least several target node addresses corresponding to target Onion nodes. According to the target node address, each target Onion node is accessed sequentially. If each target Onion node is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received.

2. The method according to claim 1, characterized in that, The construction of the authentication request includes: Obtain the random number generator and its corresponding first seed information; Get the client's MAC address and current time; The first seed information, the MAC address, and the current time are input into the random number generator to generate a corresponding first random number. The MAC address, the first random number, and the current time are integrated to generate a corresponding authentication request.

3. The method according to claim 1, characterized in that, The authentication request includes at least the client's MAC address, a first random number, and the current time. If the authentication server verifies the authentication request successfully, then the system receives node information returned by the authentication server regarding the authentication request, including: If the first random number is the same as the second random number, then the node information returned by the authentication server in response to the authentication request is received. The second random number is generated by the authentication server based on a random number generator shared with the client, the first seed information corresponding to the random number generator, the MAC address, and the current time.

4. The method according to claim 2 or 3, characterized in that, The authentication server shares second seed information with the Onion routing network. The second seed information is used to derive node selection parameters. The node information is generated by the authentication server based on the third random number generated by the random number generator, the second seed information, the MAC address, and the current time, and by randomly selecting several target Onion nodes from the Onion routing network, obtaining the target node address corresponding to each target Onion node, and then generating information based on the third random number and the target node address.

5. The method according to claim 1, characterized in that, The step of accessing each of the target Onion nodes sequentially according to the target node address includes: Get the client's MAC address and current time; Obtain the access order corresponding to each of the target Onion nodes; Based on the MAC address, the current time, and the access order, a node access request is generated for the target Onion node; According to the target node address, send the node access request to the target Onion node and receive the verification information returned by the target Onion node; The verification information includes verification success information and verification failure information. The verification information is generated by the target Onion node after verifying the target node address based on the fourth random number generated by the target Onion node according to the second seed information, the MAC address and the current date, and the access order.

6. The method according to claim 5, characterized in that, Also includes: If at least one of the target Onion nodes returns a verification failure message, then an access failure message for the data server is output.

7. A processing method for a content delivery network, characterized in that, include: Receive authentication requests sent by the client; If the authentication request is verified, the node information corresponding to the authentication request is determined; The node information is returned to the client, and the node information includes at least several node addresses corresponding to the target Onion nodes.

8. The method according to claim 7, characterized in that, The authentication request includes at least the client's MAC address, a first random number generated by the client, and the current time. Determining the node information corresponding to the authentication request includes: Obtain the random number generator and its corresponding first seed information; The first seed information, the MAC address, and the current time are input into the random number generator to generate a corresponding second random number; If the first random number is the same as the second random number, then node information corresponding to the authentication request is generated based on the MAC address and the current time.

9. The method according to claim 8, characterized in that, The authentication server shares second seed information with the Onion routing network. This second seed information is used to derive node selection parameters. The step of generating node information corresponding to the authentication request based on the MAC address and the current time includes: Randomly select several target Onion nodes from the Onion routing network, and obtain the initial node address corresponding to each target Onion node; The second seed information, the MAC address, and the current time are input into the random number generator to generate a third random number for the target Onion node; Obtain the extraction method for the third random number; According to the extraction method and the number of target Onion nodes, extract the node number corresponding to each target Onion node from the third random number; Add the node number to the initial node address to obtain the corresponding target node address; Based on the addresses of each target node, node information corresponding to the authentication request is generated.

10. The method according to claim 9, characterized in that, Also includes: Obtain updated information regarding the second seed information; If an update is triggered, the second seed information is updated according to the update information.

11. A processing method for a content delivery network, characterized in that, include: If the authentication server successfully authenticates the client, it receives a node access request sent by the client, which includes at least the client's MAC address and the current time. Obtain the random number generator and the second seed information shared with the authentication server; The second seed information, the MAC address, and the current time are input into the random number generator to generate a fourth random number for the client; Obtain the target node address corresponding to the node access request; Based on the verification result of the fourth random number on the target node address, verification information for the node access request is sent to the client.

12. The method according to claim 11, characterized in that, The target node address includes a node number. The step of sending verification information for the node access request to the client based on the verification result of the target node address using the fourth random number includes: Obtain the access order corresponding to the target Onion node; The fourth random number is extracted according to the preset extraction method and the access order to obtain the target value corresponding to the access order; If the target value matches the node number, then a verification pass message is sent to the client; If the target value does not match the node number, a verification failure message is sent to the client, and the client's access to the data server is denied, marking the node access request as an abnormal request.

13. A processing apparatus for a content delivery network, characterized in that, include: The request construction module is used to construct an authentication request and send the authentication request to the authentication server. The node information receiving module is used to receive node information returned by the authentication server for the authentication request if the authentication server verifies the authentication request. The node information includes at least several target node addresses corresponding to target Onion nodes. The access module is used to access each of the target Onion nodes sequentially according to the target node address. If each of the target Onion nodes is verified, the data server is accessed through the target Onion node, and the target content returned by the data server is received.

14. A processing apparatus for a content delivery network, characterized in that, include: The request receiving module is used to receive authentication requests sent by the client; The node information determination module is used to determine the node information corresponding to the authentication request if the authentication request is verified. The node information return module is used to return the node information to the client, wherein the node information includes at least several node addresses corresponding to target Onion nodes.

15. A processing apparatus for a content delivery network, characterized in that, include: The request receiving module is used to receive a node access request sent by the client when the authentication server has successfully authenticated the client. The node access request includes at least the client's MAC address and the current time. The information acquisition module is used to acquire the random number generator and the second seed information shared with the authentication server; A random number generation module is used to input the second seed information, the MAC address and the current time into the random number generator to generate a fourth random number for the client; The address acquisition module is used to acquire the target node address corresponding to the node access request; The verification module is used to send verification information for the node access request to the client based on the verification result of the target node address using the fourth random number.

16. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes a program stored in the memory, it implements the method as described in any one of claims 1-12.

17. A computer-readable storage medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1-12.

Images