Data access method, computer device and storage medium

Abstract

The application discloses a data access method, computer equipment and a storage medium, and relates to the technical field of content distribution networks, wherein the method comprises the following steps: a center node matches an original resource URL carried by a resource access request with a ban rule item in response to the resource access request sent by a client; if the matching is successful, the center node returns prompt information of prohibited access to the client; if the matching is not successful, the center node allocates a target edge service node corresponding to the resource access request, adds a device domain name and a legality verification parameter of the target edge service node to the original resource URL to obtain a target resource URL, and then sends the target resource URL to the client. In the application, the center node of the CDN system pre-stores the ban rule item, so that the system complexity is reduced, the ban can be implemented in the whole data access process without causing a burden to the CDN system, the ban is simple to implement, and the safety of data access is high.

Description

TECHNICAL FIELD

[0001] The present disclosure relates generally to the technical field of content delivery network, and in particular to a data access method, a computer device and a storage medium. BACKGROUND

[0002] In a content delivery network (CDN) system, a center node can assign a most suitable edge service node for a resource access request of a client to access a resource, but if the CDN system prohibits the client from accessing a certain resource (i.e., bans a corresponding uniform resource locator (URL) address), the access of the resource is usually prohibited on all edge devices, which not only requires each edge device to save and synchronize all URL addresses required to be banned by the client, but also requires the edge device that does not cache the resource to check whether there is a banned URL address every time the client accesses, so that the implementation complexity of the ban in the data access process is high, and the performance loss and storage loss of the edge device are also large in the case that there are a large number of banned URL addresses. SUMMARY

[0003] In view of the above defects or deficiencies in the prior art, it is desirable to provide a data access method, a computer device and a storage medium, by pre-storing ban rule items at a center node of a CDN system, to avoid the high implementation complexity of the ban in the data access process caused by the fact that all edge devices need to implement the ban function, to reduce system complexity, to solve the defects that the performance loss and storage loss of the edge device are large when a large number of edge devices implement the ban, and to ensure that only clients that pass the center node and are legal can access the edge device by adding a legality verification parameter, to improve the security of the edge device, so that the ban does not burden the CDN system in the entire data access process, the ban is simple to implement, and the security of data access is also high.

[0004] In a first aspect, the present application provides a data access method applied to a content delivery network system, wherein the content delivery network system includes a center node and a plurality of edge service nodes; the method includes:

[0005] The center node matches an original resource URL carried by a resource access request sent by a client with a ban rule item in response to the resource access request;

[0006] If the matching is successful, the center node returns a prompt information of prohibition of access to the client;

[0007] If no match is successful, a target edge service node corresponding to the resource access request is allocated, and a device domain name and a legitimacy verification parameter of the target edge service node are added to the original resource URL to obtain a target resource URL, and the target resource URL is sent to the client.

[0008] With reference to the first aspect, in a possible implementation manner, the adding of the device domain name and the legitimacy verification parameter of the target edge service node to the original resource URL to obtain a target resource URL comprises:

[0009] The original parameters carried in the original resource URL are sorted according to parameter ascii values to obtain a first resource URL.

[0010] In a case where the parameter ascii value of the legitimacy verification parameter is greater than the parameter ascii value of each original parameter, the device domain name is added to a header of the first resource URL, and the legitimacy verification parameter is added to a tail of the first resource URL to obtain the target resource URL.

[0011] With reference to the first aspect, in a possible implementation manner, the adding of the legitimacy verification parameter to the tail of the first resource URL comprises:

[0012] In a case where the legitimacy verification parameter comprises a time verification parameter and a signature verification parameter and the parameter ascii value of the signature verification parameter is greater than the parameter ascii value of the time verification parameter, the time verification parameter and the signature verification parameter are sequentially added to the tail of the first resource URL.

[0013] With reference to the first aspect, in a possible implementation manner, the determination process of the signature verification parameter comprises:

[0014] A first target key parameter used for this time of encryption calculation is determined.

[0015] Encryption calculation is performed according to the first resource URL, the time verification parameter, a host name of the target edge service node, and the first target key parameter to obtain the signature verification parameter.

[0016] Secondly, the application further provides a data access method applied to a target edge service node, and the method comprises:

[0017] receive a target resource URL sent by a client, wherein the target resource URL is obtained by adding a device domain name and a legality verification parameter of a target edge service node to an original resource URL by a center node, the target edge service node is an edge service node allocated by the center node for the resource allocation request corresponding to a resource access request sent by the client to the center node and carrying the original resource URL address, and the resource access request does not match a ban rule item;

[0018] remove the device domain name in the target resource URL to obtain a second resource URL;

[0019] determine whether the current access of the client passes through the center node based on the legality verification parameter carried in the second resource URL.

[0020] In a possible implementation manner of the second aspect, the determining whether the current access of the client passes through the center node based on the legality verification parameter carried in the second resource URL comprises:

[0021] in a case where the legality verification parameter comprises a time verification parameter and a signature verification parameter,

[0022] sort all parameters carried in the second resource URL according to parameter ASCII code values to obtain the time verification parameter with the second largest parameter ASCII code value and the signature verification parameter with the largest parameter ASCII code value;

[0023] if a time difference between the time verification parameter and a current time of the target edge service node is less than or equal to a preset time threshold, it is determined that the time verification parameter is a legal parameter, and it is further determined whether the current access of the client passes through the center node based on the second resource URL and the signature verification parameter;

[0024] if the time difference is greater than the preset time threshold, it is determined that the current access of the client does not pass through the center node.

[0025] In a possible implementation manner of the second aspect, the determining whether the current access of the client passes through the center node based on the second resource URL and the signature verification parameter comprises:

[0026] remove the signature verification parameter carried in the second resource URL to obtain a third resource URL;

[0027] splice the second target key parameter and a host name of the target edge service node into the third resource URL to obtain a fourth resource URL.

[0028] performing an encryption calculation on the fourth resource URL, and determining whether the current access of the client passes through the center node based on a matching result of the encryption result and the signature verification parameter.

[0029] With reference to the second aspect, in a possible implementation manner, the determining whether the current access of the client passes through the center node based on the matching result of the encryption result and the signature verification parameter comprises:

[0030] in a case where the second target key parameter is an old key parameter without periodic update or a new key parameter obtained after the old key parameter is updated, determining whether the old key parameter is stored out of time;

[0031] if the storage is not out of time and the encryption result corresponding to the new key parameter matches the signature verification parameter successfully, determining that the current access of the client passes through the center node;

[0032] if the storage is not out of time and the encryption result corresponding to the new key parameter does not match the signature verification parameter successfully, determining whether the encryption result corresponding to the old key parameter matches the signature verification parameter, and determining whether the current access of the client passes through the center node according to a matching result;

[0033] if the storage is out of time, determining whether the current access of the client passes through the center node according to a matching result of the encryption result corresponding to the new key parameter and the signature verification parameter.

[0034] The data access method provided by the embodiment of the present application, by pre-storing the ban rule item in the center node of the CDN system, ensures that when the center node responds to the resource access request sent by the client, the original resource URL carried by the client can be quickly judged to be a URL address that needs to be banned by matching with each ban rule item, and when it is determined to be a banned URL address, the client is directly returned to prohibit access, or when it is determined to be a non-banned URL address, the device domain name and the legality verification parameter of the determined target edge device are added to the original resource URL and fed back to the client. In this way, the defect of high ban implementation complexity in the data access process caused by the fact that all edge devices need to implement the ban function is avoided, the system complexity is reduced, the defect that the performance loss and storage loss of the edge device are large when the edge device is numerous caused by the fact that the existing edge device implements the ban is solved, and by adding the legality verification parameter, it can also be ensured that only the client that has passed the center node and is legal can access the edge device, the security of the edge device is improved, so that the ban does not cause burden to the CDN system in the whole data access process, and the ban is simple to implement, and the security of data access is also high. BRIEF DESCRIPTION OF DRAWINGS

[0035] Other characteristics, objects and advantages of the present application will become more apparent from the following detailed description of non-restrictive embodiments, made with reference to the attached drawings:

[0036] Figure 1 A schematic diagram of a 302 scheduling process of an existing content distribution network system;

[0037] Figure 2 A schematic diagram of a data access method flowchart in one embodiment;

[0038] Figure 3 A schematic diagram of a data access method flowchart in one embodiment;

[0039] Figure 4 A schematic diagram of a data access method flowchart in one embodiment;

[0040] Figure 5 A schematic diagram of a data access method flowchart in one embodiment;

[0041] Figure 6 A schematic diagram of a data access method flowchart in one embodiment;

[0042] Figure 7 A schematic diagram of a data access method flowchart in one embodiment;

[0043] Figure 8 A schematic diagram of a data access method flowchart in one embodiment;

[0044] Figure 9 Structure block diagram of a data access device in one embodiment;

[0045] Figure 10 Structure block diagram of a data access device in one embodiment;

[0046] Figure 11 Internal structure diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] The application will be further described in details below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, but not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for the convenience of description.

[0048] It should be noted that the embodiments and features in the embodiments in the present application can be combined with each other without conflict. The present application will be described in details below with reference to the accompanying drawings and embodiments. In addition, the term “and / or” in this paper is only used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. The terms “first” and “second” in the specification and claims of the embodiments of the present application are used to distinguish different objects, but not to describe the specific order of the objects.

[0049] First, the related terms involved in the present application are explained and described:

[0050] Content distribution network: a technology that distributes data from a source server to edge service nodes close to users through the Internet to speed up content loading; it reduces data transmission distance and improves website response speed by caching content on edge service nodes close in geographical location.

[0051] 302 scheduling: based on the Hypertext Transfer Protocol (HTTP) protocol, the client first accesses the 302 scheduling server, the 302 scheduling server schedules according to the node state, load condition and client IP home location stored in the database, dynamically selects the optimal node and assembles the URL of the location field of the response header, the Location field points to the new location of the resource, and then further responds to the client with the new URL address through the state code 302, and then the client initiates a new resource access request to the new edge service node according to the new URL address.

[0052] Block: Prohibit access to a specific resource in the CDN system.

[0053] As is well known, in a CDN system, 302 redirection is a redirection strategy used to handle traffic distribution for client requests, thereby achieving more accurate traffic allocation. Furthermore, the 302 redirection server in a CDN system obtains the end user's real Internet Protocol (IP) address and content address, and can allocate the most suitable edge device for the client's access. When a client requests resources from the 302 redirection server, the 302 redirection server will determine whether the current edge service device stores a copy of the resource according to pre-configured rules. If it does not store it, it will send a 302 status code to the client and redirect the client to the origin server or other edge devices to obtain the required resource.

[0054] The 302 scheduling process in existing CDN systems can be as follows: Figure 1 As shown, in Figure 1 In the diagram, the different numbers in the arrowed lines represent the sequence numbers of different steps in executing the 302 schedule.

[0055] from Figure 1 As can be seen, once each edge device registers with the 302 scheduling server, the 302 scheduling server can receive information such as the node status reported by each edge device. Thus, when a client accesses the 302 scheduling server, the 302 scheduling server will return a new URL address to the client (this new URL address includes the domain name or IP address of the new edge device to which the client is redirected). The client can then access the edge device based on the new URL address.

[0056] For steps 1 and 4, when the client accesses the 302 scheduling server, the 302 scheduling server will return a new URL address to the client; in step 5, the client can access the edge device according to the new URL address.

[0057] If the ban is directly implemented on the 320 scheduling server (i.e.) Figure 1 If steps 2 and 3 in the middle achieve the blocking, then a complete blocking cannot be achieved; this is because some unauthorized clients can easily bypass the 302 dispatch server and directly access the edge device's IP address to obtain resources based on historical access records (i.e., the URL addresses returned by the 302 dispatch server in historical accesses). (That is, without executing...) Figure 1 Steps 1 to 4 in the process.

[0058] Therefore, if a client submits a request to block a certain URL, the URL can only be blocked on all edge devices. This increases the burden on the entire CDN system. The reason is that edge devices have limited storage space and are constantly updating and eviction of cached resources. As a result, edge devices cannot periodically report all the resources they cache. This means that the database in the 302 scheduling server cannot accurately store all resource information cached by edge devices. Therefore, when blocking, it is not possible to directly and accurately block on the edge devices that have cached the resource. Instead, access to the resource can only be blocked on every edge device. This approach results in a lot of performance waste and increased complexity in implementing blocking.

[0059] For example, firstly, each edge device needs to save and synchronize all the URLs that clients need to block. Considering the large number of edge devices and the fact that these edge devices are prone to shutdowns and restarts, the synchronization of blocking data is somewhat complex. Secondly, edge devices that do not cache the resource also need to check whether there is a block every time the client accesses it.

[0060] To address the aforementioned technical problems, this application provides a data access method, a computer device, and a storage medium, wherein the data access method is applied to a content delivery network system, which includes a central node and multiple edge service nodes.

[0061] To facilitate understanding of the data access method provided by the embodiments of the present invention, the following examples will provide a detailed description of the data access method provided by the present invention. It is understood that these examples can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0062] refer to Figure 2 This is one of the flowcharts illustrating the data access method provided in this embodiment of the invention, such as... Figure 2 As shown, the data access method includes the following steps 101 to 103.

[0063] Step 101: The central node responds to the resource access request sent by the client by matching the original resource URL carried in the resource access request with the blocking rule items.

[0064] It should be noted that in the CDN system provided in this embodiment of the invention, the central node can be a 302 scheduling server, and each edge service node is an edge device.

[0065] For example, each edge service node can specifically be a peer-to-peer content delivery network (PCDN) edge device.

[0066] In step 101, the original resource URL carried in the resource access request includes at least the path and domain name of the resource. For example, if the client needs to access the video resource a.mp4 on a certain platform, and the original resource URL carried in the corresponding generated resource access request is http: / / test.com / a.mp4?user=100&location=zhejiang, then test.com is the domain name, " / a.mp4" is the path of the video resource, and "user=100&location=zhejiang" is the parameter part in the original URL.

[0067] The core of this application is to implement blocking at the central node, but it needs to be so that clients cannot bypass it. Figure 1 Since steps 1 to 4 in the process directly access the edge service node, a blocking rule item can be added to the database of the central node first. The number of blocking rule items can be one or more, and there is no specific limitation here.

[0068] Each blocking rule can be a URL address that needs to be blocked.

[0069] In this way, when the central node receives a resource access request from the client and responds, it can query the various blocking rule items stored in the database based on the original resource URL carried in the resource access request to determine whether there are any blocking rule items that can be matched or hit for the original resource URL.

[0070] Step 102: If the match is successful, return an access denied message to the client.

[0071] In step 102, the central node determines that there is a blocking rule that matches the original resource URL carried in the resource access request by querying the blocking rule items stored in the database. That is, if the record of the original resource URL is found in the database, then it can be considered that the original resource URL accessed is blocked, and a message prohibiting access is directly returned to the client.

[0072] For example, assuming that the URL address to be blocked by the user is http: / / test.com / a.mp4 (assuming that the blocking value does not have parameters), and the blocking rule item of http: / / test.com / a.mp4 is added in advance in the database of the 302 dispatch server, at this time, if the original resource URL carried in the request of the client accessing the 302 dispatch server is http: / / test.com / a.mp4?user=100&location=zhejiang, then the 302 dispatch server can determine that it can match the blocking rule item of http: / / test.com / a.mp4 in the database, at this time, it can directly return the prohibition of access to the client.

[0073] Step 103, if no match is successful, a target edge service node is allocated for the resource access request, and the device domain name and the legitimacy verification parameter of the target edge service node are added to the original resource URL to obtain a target resource URL, and the target resource URL is sent to the client.

[0074] In step 103, the center node determines that the original resource URL carried by the resource access request does not hit any blocking rule item, or all blocking rule items do not match the original resource URL, that is, no record matching the original resource URL is found in the database, and it can be considered that it is a normal access, at this time, the most suitable target edge service node can be allocated for the resource access request by using steps 1 and 2 in the foregoing Figure 1 , and the device domain name and the legitimacy verification parameter of the target edge service node are added to the original resource URL to obtain a target resource URL, which is sent to the client in the form of a 302 status code.

[0075] It should be noted that, in order to prevent attackers from bypassing the 302 dispatch server to access the edge device, the 302 dispatch server can further determine the legitimacy verification parameter according to the determined target edge device, the legitimacy verification parameter is used to verify whether the client accessing the target edge device is legitimate, and the legitimacy verification can be performed through time verification and signature verification, the time verification can be used to verify whether the target resource URL is expired, and if it is expired, it can be determined that it is not passed through the 302 dispatch server and the current access is not legal; the signature verification can further verify whether the current access is passed through the 302 server and whether the current access is legal under the condition that it is not expired.

[0076] The data access method provided by the embodiment of the present application ensures that when the center node of the CDN system responds to the resource access request sent by the client, the original resource URL carried by the client can be quickly judged to be a URL address that needs to be banned by matching with each ban rule item, and the client is directly returned to prohibit access when it is determined that the URL address is a banned URL address, or the device domain name and the legality verification parameter of the determined target edge device are added to the original resource URL and fed back to the client when it is determined that the URL address is not a banned URL address. In this way, the defect of high ban implementation complexity in the data access process caused by the fact that all edge devices need to implement the ban function is avoided, the system complexity is reduced, the defect that the performance loss and the storage loss of the edge devices are large when the edge devices are numerous caused by the fact that the edge devices implement the ban is solved, and the legality verification parameter is added to ensure that only the client that has passed the center node and is legal can access the edge device, the security of the edge device is improved, so that the ban does not cause burden to the CDN system in the whole data access process, the ban is simple to implement, and the security of data access is also high.

[0077] Based on the above Figure 2 As shown in the method, in an example embodiment, the device domain name and the legality verification parameter of the target edge service node are added to the original resource URL in step 103 to obtain a target resource URL. The specific process in this embodiment can be implemented by steps 201 and 202 as shown in the following. Figure 3

[0078] Step 201: The multiple original parameters carried in the original resource URL are sorted according to the parameter ascii code values to obtain a first resource URL.

[0079] Step 202: In the case where the parameter ascii code value of the legality verification parameter is greater than the parameter ascii code value of each original parameter, the device domain name is added to the head of the first resource URL, and the legality verification parameter is added to the tail of the first resource URL to obtain a target resource URL.

[0080] ​Specifically, considering that the original resource URL may contain various original parameters, in order to avoid name conflicts between the newly added validity verification parameters and each original parameter, the central node can first sort all the original parameters carried in the original resource URL according to the parameter ASSIC code value during processing. For example, when the original resource URL is http: / / test.com / a.mp4?user=100&location=zhejiang, the sorting result obtained after sorting according to the parameter ASSIC code value, that is, the first resource URL is http: / / test.com / a.mp4?location=zhejiang&user=100.

[0081] It should be noted that the ASSIC code value of the newly added validity check parameter should be greater than the ASSIC code value of each original parameter in the original resource URL or the first resource URL, to ensure that it does not conflict with any of the original parameters in the original resource URL. For example, if a string is appended to the parameter with the largest ASSIC code value, then its ASSIC code value will naturally be greater than that of each original parameter in the original resource URL, and therefore there will be no conflict.

[0082] For example, if the first resource URL is

[0083] The URL is http: / / test.com / a.mp4?location=zhejiang&user=100, the target edge device's domain name is 183.131.101.123, and the validity verification parameters are...

[0084] When user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092, by adding the device domain name to the header of the first resource URL and adding the validity verification parameters to the footer of the first resource URL, the resulting target resource URL is:

[0085] http: / / 183.131.101.123 / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092.

[0086] Based on the above Figure 3 In one example embodiment of the method shown, step 202 involves adding a validity verification parameter to the end of the first resource URL. The specific process of this embodiment can be implemented through the following steps.

[0087] In the case that the legality verification parameter includes the time verification parameter and the signature verification parameter and the parameter assic code value of the signature verification parameter is greater than the parameter assic code value of the time verification parameter, the time verification parameter and the signature verification parameter are sequentially added to the tail of the first resource URL.

[0088] Specifically, the center node adds two new internal parameters to each accessed first resource URL and returns to the client; one of the two added internal parameters is the time verification parameter and the other is the signature verification parameter, wherein the time verification parameter is the current time of the target edge service node assigned by the center node, and the signature verification parameter is obtained by concatenating and encrypting the first resource URL, the time verification parameter, the host name of the target edge service node and a periodically updated key string. In addition, the parameter assic code value of the time verification parameter is greater than the parameter assic code value of each original parameter in the first resource URL, and the parameter assic code value of the signature verification parameter is greater than the parameter assic code value of the time verification parameter.

[0089] In this way, for the first resource URL obtained after sorting, in addition to adding the device domain name of the target edge service node to the head of the first resource URL, the time verification parameter is added to the tail of the first resource URL, and the signature verification parameter is added to the first resource URL after the time verification parameter.

[0090] For example, for the first resource URL

[0091] http: / / test.com / a.mp4?location=zhejiang&user=100, if the device domain name of the target edge device is 183.131.101.123, the time verification parameter is user_time=1746948306, and the signature verification parameter is user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092,

[0092] user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092, by adding the device domain name to the head of the first resource URL, and sequentially adding the time verification parameter and the signature verification parameter to the tail of the first resource URL, the target resource URL obtained is

[0093] http: / / 183.131.101.123 / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092.

[0094] In an example embodiment, the signature verification parameter user_sign is obtained by concatenating and encrypting the first resource URL, the time verification parameter, the host name of the target edge service node and a periodically updated key string. The specific determination process in this embodiment can be implemented by steps 301 and 302 shown in the following. Figure 4

[0095] Step 301, determining a first target key parameter used for the current encryption calculation.

[0096] Step 302, performing encryption calculation according to the first resource URL, the time verification parameter, the host name of the target edge service node and the first target key parameter to obtain the signature verification parameter.

[0097] It should be noted that the first target key parameter required for the current encryption calculation can be the latest updated key parameter. In order to enhance security, the center node (i.e. the 302 dispatch server) needs to change the key parameter periodically, that is, an initial key parameter can be generated by using an existing key generation algorithm, and the initial key parameter can be saved for a preset time period and updated periodically. In this way, if the signature verification parameter needs to be generated at present, the latest updated key parameter can be first determined whether it reaches the update period, if it does not reach the update period, it is used as the first target key parameter, otherwise, if it has reached the update period, the latest updated key parameter is updated again, and the updated key parameter is used as the first target key parameter.

[0098] Specifically, the signature verification parameter user_sign can be determined by concatenating the first resource URL, the time signature parameter, the host name of the target edge device and the first target key parameter, and then encrypting, that is, the value obtained by encrypting the concatenation result of the first resource URL, the time verification parameter user_time, the host name and the first target key parameter is the signature verification parameter.

[0099] For example, assuming that the first resource URL is

[0100] ​http: / / test.com / a.mp4?location=zhejiang&user=100, the time verification parameter user_time is 1746948306, and the hostname is...

[0101] Given hostname=edge_1055 and the first target key parameter is sk=yoyun_secret, then the concatenation result is...

[0102] The MD5 hash of http: / / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&hostname=edge_1055&sk=yoyun_secret yields the signature verification parameter 49EEE3AABF9D68BD8BAF63DAB4C08092; where the time verification parameter is the current time obtained from the central scheduling server.

[0103] It's important to note that by using the first resource URL plus a time verification parameter, the hostname of the selected target edge device, and the first target key parameter for encryption, even if the target key parameter is leaked, it's difficult for an attacker to construct the first resource URL and the two verification parameters to bypass the 302 redirection server and access the target edge device. This is because the hostname of each edge device is filled in during registration, making it difficult for attackers to steal. Thus, adding the hostname to the signature verification parameters prevents clients from accessing any edge device without the 302 redirection server's permission (which is also a form of DDoS attack), and also prevents attackers from accessing other edge devices.

[0104] Understandably, for security reasons, target edge devices also need to verify the legitimacy of accessing clients, that is, to verify whether the client bypasses the 302 redirect server before accessing itself. Therefore, target edge devices also need to verify the URL address sent by the client. Based on this, the data access method provided by this invention can also be applied to target edge service nodes in a CDN system.

[0105] refer to Figure 5 This is a second flowchart illustrating the data access method provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the data access method includes the following steps 401 to 403.

[0106] Step 401, receiving a target resource URL sent by a client, wherein the target resource URL is obtained by adding a device domain name of a target edge service node and a legality verification parameter to an original resource URL by a center node, the target edge service node is an edge service node allocated by the center node for a resource allocation request in a case that the original resource URL carried in a resource access request sent by the client to the center node does not match the ban rule item, and the resource access request carries the original resource URL address.

[0107] Step 402, removing the device domain name in the target resource URL to obtain a second resource URL.

[0108] Step 403, judging whether the current access of the client is through the center node based on the legality verification parameter carried in the second resource URL.

[0109] It should be noted that for steps 401-403, when the client accesses the target edge service node using the target resource URL, the target edge service node first removes its own device domain name contained therein to obtain a second resource URL without the device domain name. The specific determination process of the target resource URL can refer to the foregoing embodiments. Herein, no further description is given.

[0110] For example, when the target resource URL is

[0111] http: / / 183.131.101.123 / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092 and the device domain name is 183.131.101.123, the obtained second resource URL is

[0112] http: / / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092.

[0113] Further, the target edge service node further judges whether the current access of the client is through the center node from the legality verification parameter carried in the second resource URL; in this way, it can be ensured that only the access through the center node can normally access the resource of the edge device, and the access of the malicious client using the resource URL before the ban to the edge service node is avoided.

[0114] The data access method provided by the embodiment of the present application avoids the possibility that the client bypasses the 302 dispatch server to directly access the edge device, ensures that the current access of the client passes through the 302 dispatch server, and thus improves the security of the edge device.

[0115] Based on the method shown in the above Figure 5 In an example embodiment, the step of judging whether the current access of the client passes through the center node based on the legality verification parameter carried in the second resource URL in step 403 can be implemented by steps 501 to 503 shown in the following. Figure 6

[0116] In step 501, when the legality verification parameter includes the time verification parameter and the signature verification parameter, all the parameters carried in the second resource URL are sorted according to the parameter ascii code value to obtain the time verification parameter with the second largest parameter ascii code value and the signature verification parameter with the largest parameter ascii code value.

[0117] In step 502, if the time difference between the time verification parameter and the current time of the target edge service node is less than or equal to the preset time threshold, it is determined that the time verification parameter is a legal parameter, and then whether the current access of the client passes through the center node is judged based on the second resource URL and the signature verification parameter.

[0118] In step 503, if the time difference is greater than the preset time threshold, it is determined that the current access of the client does not pass through the center node.

[0119] ​It should be noted that for steps 501-503, the target edge device first checks the parameters of the second resource URL, first sorts all the parameters contained therein in ascending order according to the parameter assi code value, and determines the last two parameters as the two check parameters added by the center node, that is, the time check parameter with the second largest parameter assi code value and the signature check parameter with the largest parameter assi code value, and then checks the legality of the two check parameters. Specifically, the legality of the time check parameter is checked first, and it is checked whether the time check parameter is within the set time threshold, so as to avoid that a malicious client uses a resource URL before the ban to access the edge device; if the time difference between the time check parameter and the current time is greater than the preset time threshold, it is determined that the time check parameter is illegal, and it can be considered that the client is illegal to access the target edge device; otherwise, if the time difference is less than or equal to the preset time threshold, it is determined that the time check parameter is legal, and further combined with the second resource URL and the signature check parameter to determine whether the client access this time is through the 302 dispatch server; the preset time threshold can be the maximum allowed time deviation threshold.

[0120] For example, if the time check parameter is 1746948306 and the maximum allowed time deviation threshold is 10 seconds, then the local time of the target edge device within the range of 1746948296-1746948316 can be considered as a legal time check parameter; if the time check parameter passes the check, then the signature check parameter is checked.

[0121] It should be noted that for the scenario that does not pass through the 302 dispatch server, the client directly accesses a certain edge device without passing through the 302 dispatch server, and carries the resource URL "http: / / 183.131.101.123 / test.com / a.mp4?location=zhejiang&user=100"; the edge device sorts the parameters to obtain location and user, and checks the two parameters as time check parameters and signature check parameters. Obviously, it cannot pass the check, so it is determined to be illegal access and is directly prohibited.

[0122] Based on the above Figure 6 In an example embodiment, the step 502 of determining whether the client access this time passes through the center node based on the second resource URL and the signature check parameter can be implemented by the steps 601-603 shown in the method. Figure 7

[0123] Step 601: Remove the signature check parameter carried in the second resource URL to obtain a third resource URL. ​

[0124] Step 602, splice the second target key parameter and the hostname of the target edge service node into the third resource URL to obtain a fourth resource URL.

[0125] Step 603, perform encryption calculation on the fourth resource URL, and determine whether the current access of the client passes through the center node based on a matching result of the encryption result and the signature verification parameter.

[0126] It should be noted that for steps 601-603, the target edge device first removes the signature verification parameter in the second resource URL, and then splices the second target key parameter and the hostname of the target edge device to splice a complete string, which is the fourth resource URL. At this time, the encryption result is obtained by performing encryption calculation on the fourth resource URL, and it is determined whether the encryption result is equal to the value of the signature verification parameter. If they are equal, it is considered that the current access of the client is legal, that is, it passes through the 302 dispatch server. Otherwise, if they are not equal, it is considered that the current access of the client is not legal, that is, it does not pass through the 302 dispatch server. In this way, it can be ensured that only the access passing through the 302 dispatch server can normally access the resources in the edge device.

[0127] For example, if the second resource URL is

[0128] http: / / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&user_sign=49EEE3AABF9D68BD8BAF63DAB4C08092, the signature verification parameter is 49EEE3AABF9D68BD8BAF63DAB4C08092, the second target key parameter is yoyun_secret, and the hostname of the target edge device is edge_1055, then the fourth resource URL is

[0129] http: / / test.com / a.mp4?location=zhejiang&user=100&user_tm=1746948306&sk=yoyun_secret&hostname=edge_1055, and the encryption result obtained by performing MD5 encryption calculation is 49EEE3AABF9D68BD8BAF63DAB4C08092, which is consistent with the value of the signature verification parameter carried in the received target resource URL. At this time, it can be considered that the current access of the client passes through the 302 dispatch server and is legal.

[0130] It should be noted that the determination process of the second target key parameter can refer to the determination process of the aforementioned first target key parameter; this will not be described again.

[0131] Based on the above Figure 7 As shown in the method, in an example embodiment, in step 703, based on the matching result of the encryption result and the signature verification parameter, it is determined whether the current access of the client is through the center node, and the specific process in this embodiment can be achieved by Figure 8 As shown in steps 701 to 704.

[0132] Step 701, in the case that the second target key parameter is an old key parameter without periodic update or a new key parameter obtained after updating the old key parameter, it is determined whether the old key parameter is stored out of time;

[0133] Step 702, if the storage is not out of time and the encryption result corresponding to the new key parameter matches the signature verification parameter successfully, it is determined that the current access of the client is through the center node;

[0134] Step 703, if the storage is not out of time and the encryption result corresponding to the new key parameter does not match the signature verification parameter successfully, it is determined whether the encryption result corresponding to the old key parameter matches the signature verification parameter, and according to the matching result, it is determined whether the current access of the client is through the center node.

[0135] Step 704, if the storage is out of time, according to the matching result of the encryption result corresponding to the new key parameter and the signature verification parameter, it is determined whether the current access of the client is through the center node.

[0136] It should be noted that in order to enhance security, each edge device in the CDN system needs to replace the key parameter periodically, and the updating method can adopt a double key mode, that is, the recently updated key parameter is an old key parameter and it can be stored for a certain time, and the old key parameter can be deleted only after the new key parameter obtained by updating the old key parameter is verified successfully; if the value calculated by the new key parameter does not match, the old key parameter is used for calculation and checking whether it matches. In this way, when the 302 dispatch server key parameter is replaced, the situation that the 302 dispatch server key value is different from the key value of the edge device for a short time, resulting in verification failure, can be avoided.

[0137] Therefore, for steps 701 to 704, the target edge device first determines whether the old key parameter without updating is stored out of time.

[0138] If the old key parameter storage is not expired, first, the new key parameter, the hostname of the target service device and the third resource URL are spliced, then the encryption result 1 is obtained by encryption, and then it is determined whether the encryption result 1 is equal to the signature check parameter. At this time, it is considered that the current access of the client passes through the 302 dispatch server and is legal. On the contrary, if the encryption result 1 is not equal to the signature check parameter, the old key parameter, the hostname of the target service device and the third resource URL are spliced, then the encryption result 2 is obtained by encryption, and then it is determined whether the encryption result 2 is equal to the signature check parameter. It can be considered that the current access of the client passes through the 302 dispatch server and is legal.

[0139] If the old key parameter storage is not expired, first, the new key parameter, the hostname of the target service device and the third resource URL are spliced, then the encryption result 1 is obtained by encryption, and then it is determined whether the encryption result 1 is equal to the signature check parameter. At this time, it is considered that the current access of the client passes through the 302 dispatch server and is legal. On the contrary, if the encryption result 1 is not equal to the signature check parameter, the old key parameter, the hostname of the target service device and the third resource URL are spliced, then the encryption result 2 is obtained by encryption, and then it is determined whether the encryption result 2 is equal to the signature check parameter. It can be considered that the current access of the client passes through the 302 dispatch server and is legal.

[0140] It should be noted that although the operations of the methods of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in that particular order, or that all of the illustrated operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowcharts can change the order of execution. Additionally or alternatively, some steps can be omitted, combined into one step, and / or divided into multiple steps.

[0141] In one embodiment, the present application also provides a data access device applied to a content distribution network system, the content distribution network system comprising a center node and a plurality of edge service nodes; as shown in the figure, the data access device comprises a ban judgment unit 901, a forbidden access unit 902 and an address redirection unit 903. Figure 9 The ban judgment unit 901 is configured to match the original resource URL carried by the resource access request with the ban rule item in response to the resource access request sent by the client.

[0142] The ban judgment unit 901 is configured to match the original resource URL carried by the resource access request with the ban rule item in response to the resource access request sent by the client.

[0143] The forbidden access unit 902 is configured to return the prompt information of forbidden access to the client if the matching is successful.

[0144] The address redirection unit 903 is configured to allocate the target edge service node corresponding to the resource access request, add the device domain name and the legitimacy check parameter of the target edge service node to the original resource URL to obtain the target resource URL, and then send the target resource URL to the client if the matching is not successful.

[0145] Optionally, in an embodiment, the address re-directing unit 903 is specifically configured to sort the original parameters carried in the original resource URL according to the parameterassic code values, to obtain a first resource URL; in a case where the parameterassic code value of the legality verification parameter is greater than the parameterassic code value of each original parameter, add the device domain name to the header of the first resource URL and add the legality verification parameter to the tail of the first resource URL, to obtain the target resource URL.

[0146] Optionally, in an embodiment, the address re-directing unit 903 is specifically configured to, in a case where the legality verification parameter includes a time verification parameter and a signature verification parameter and the parameterassic code value of the signature verification parameter is greater than the parameterassic code value of the time verification parameter, sequentially add the time verification parameter and the signature verification parameter to the tail of the first resource URL.

[0147] Optionally, in an embodiment, the address re-directing unit 903 is specifically configured to determine a first target key parameter used for the current encryption calculation; and perform encryption calculation according to the first resource URL, the time verification parameter, the host name of the target edge service node and the first target key parameter, to obtain the signature verification parameter.

[0148] In an embodiment, the embodiment of the present application further provides another data access device, which is applied to a target edge service node in a content distribution network system; as shown in the figure, the data access device comprises an address receiving unit 1001, a domain name eliminating unit 1002 and a legality judging unit 1003. Figure 10

[0149] The address receiving unit 1001 is configured to receive a target resource URL sent by a client, wherein the target resource URL is obtained by adding a device domain name and a legality verification parameter of a center node to an original resource URL, the target edge service node is an edge service node allocated by the center node for a resource allocation request in a case where the original resource URL carried in the resource access request sent by the client to the center node does not match the ban rule item, and the resource access request carries the original resource URL address.

[0150] The domain name eliminating unit 1002 is configured to eliminate the device domain name in the target resource URL, to obtain a second resource URL.

[0151] The legality judging unit 1003 is configured to judge whether the current access of the client is through the center node based on the legality verification parameter carried in the second resource URL.

[0152] ​Optionally, in an embodiment, the legality judging unit 1003 is specifically configured to sort all parameters carried in the second resource URL according to the parameter ascii code values to obtain a time verification parameter with the second largest parameter ascii code value and a signature verification parameter with the largest parameter ascii code value in the case that the legality verification parameter includes the time verification parameter and the signature verification parameter; if a time difference between the time verification parameter and the current time of the target edge service node is less than or equal to a preset time threshold, it is determined that the time verification parameter is a legal parameter, and then it is determined whether the current access of the client passes through the center node based on the second resource URL and the signature verification parameter; if the time difference is greater than the preset time threshold, it is determined that the current access of the client does not pass through the center node.

[0153] Optionally, in an embodiment, the legality judging unit 1003 is specifically configured to remove the signature verification parameter carried in the second resource URL to obtain a third resource URL; splice the second target key parameter and the host name of the target edge service node with the third resource URL to obtain a fourth resource URL; and determine whether the current access of the client passes through the center node based on a matching result of the encryption result and the signature verification parameter.

[0154] Optionally, in an embodiment, the legality judging unit 1003 is specifically configured to determine whether the old key parameter is stored out of time in the case that the target key parameter is an old key parameter without periodic update or a new key parameter obtained after the old key parameter is updated; if the storage is not out of time and the encryption result corresponding to the new key parameter matches the signature verification parameter successfully, it is determined that the current access of the client passes through the center node; if the storage is not out of time and the encryption result corresponding to the new key parameter does not match the signature verification parameter successfully, it is determined whether the encryption result corresponding to the old key parameter matches the signature verification parameter, and whether the current access of the client passes through the center node is determined according to the matching result; if the storage is out of time, whether the current access of the client passes through the center node is determined according to the matching result of the encryption result corresponding to the new key parameter and the signature verification parameter.

[0155] It should be understood that the units described in the above data access device correspond to the respective steps in the methods described above. Therefore, the operations and features described above for the methods also apply to the data access device and the units contained therein, and will not be described here again. The data access device can be pre- implemented in the browser or other security application of the computer device, or can be loaded into the browser or security application thereof of the computer device through downloading or the like. The corresponding units in the data access device can cooperate with the units in the computer device to realize the schemes of the embodiments of the present application. Figure 2 and Figure 5 The operations and features described above for the methods also apply to the data access device and the units contained therein, and will not be described here again. The data access device can be pre- implemented in the browser or other security application of the computer device, or can be loaded into the browser or security application thereof of the computer device through downloading or the like. The corresponding units in the data access device can cooperate with the units in the computer device to realize the schemes of the embodiments of the present application.

[0156] The following is for reference. Figure 11 It shows a schematic diagram of the structure of a computer system 1100 suitable for implementing computer devices or servers in the embodiments of this application.

[0157] like Figure 11 As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1102 or a program loaded from storage portion 1108 into random access memory (RAM) 1103. The RAM 1103 also stores various programs and data required for the operation of the computer system 1100. The CPU 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0158] The following components are connected to the input / output (I / O) interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the input / output (I / O) interface 1105 as needed. A removable medium 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1110 as needed so that computer programs read from it can be installed into the storage section 1108 as needed.

[0159] Specifically, according to embodiments of this application, the above references Figure 2 and Figure 5 The described process can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing instructions for performing... Figure 2 and Figure 5 The program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable media 1111.

[0160] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0161] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0162] The units or modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. The units or modules described can also be arranged in a processor. In some cases, the names of the units or modules do not constitute a limitation on the units or modules themselves.

[0163] As another aspect, the present application also provides a computer readable storage medium, which can be included in the computer device described in the above embodiments, or can exist separately and not be assembled into the computer device. The computer readable storage medium stores one or more programs, when the programs are used by one or more processors to execute the methods described in the present application. For example, the computer readable storage medium can execute Figure 1 each step of the method.

[0164] The embodiments of the present application provide a computer program product, which includes instructions that, when executed, cause the method described in the embodiments of the present application to be performed. For example, the computer program product can execute Figure 2 and Figure 5 each step of the method.

[0165] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0166] The above description is merely preferred embodiments of the present application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and also covers other technical solutions formed by any combination of the above technical features or equivalent features without departing from the inventive concept. For example, the above features can be replaced with technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A data access method, characterized by, The method is applied to a content distribution network system, the content distribution network system comprising a center node and a plurality of edge service nodes; the method comprises: The center node matches an original resource URL carried by a resource access request sent by a client with a ban rule item in response to the resource access request; the original resource URL comprises at least a path and a domain name of the resource, and the number of the ban rule items is at least one, each of the ban rule items being a URL address that needs to be banned; If the matching is successful, prompt information of prohibition of access is returned to the client; If the matching is not successful, a target edge service node is allocated for the resource access request, a device domain name of the target edge service node and a legality verification parameter are added to the original resource URL to obtain a target resource URL, and the target resource URL is sent to the client; the legality verification parameter is used to verify whether the client accessing the target edge service node is legal; The device domain name of the target edge service node and the legality verification parameter are added to the original resource URL to obtain the target resource URL, comprising: A plurality of original parameters carried in the original resource URL are sorted according to parameter ascii values to obtain a first resource URL; In a case where a parameter ascii value of the legality verification parameter is greater than a parameter ascii value of each of the original parameters, the device domain name is added to a head of the first resource URL, and the legality verification parameter is added to a tail of the first resource URL to obtain the target resource URL; In a case where the legality verification parameter comprises a time verification parameter and a signature verification parameter and a parameter ascii value of the signature verification parameter is greater than a parameter ascii value of the time verification parameter, the time verification parameter and the signature verification parameter are sequentially added to the tail of the first resource URL; The determination process of the signature verification parameter comprises: A first target key parameter used for this time of encryption calculation is determined; the first target key parameter is a key parameter updated for the last time when an update cycle is not reached or a key parameter updated again for the last time when the update cycle is reached; The first resource URL, the time verification parameter, a host name of the target edge service node and the first target key parameter are spliced first and then subjected to encryption calculation to obtain the signature verification parameter. The method is applied to a target edge service node, the method comprising:

2. A data access method, characterized by, ​ receiving a target resource URL sent by a client, wherein the target resource URL is obtained by adding a device domain name of a target edge service node and a legality verification parameter to an original resource URL by a center node, the target edge service node is an edge service node allocated by the center node for a resource access request in a case where the original resource URL carried by the resource access request and a ban rule item do not match successfully, the resource access request is sent by the client to the center node and carries the original resource URL, the original resource URL at least includes a path and a domain name of a resource, the number of the ban rule items is at least one, each ban rule item is a URL address that needs to be banned, and the legality verification parameter is used to verify whether the client accessing the target edge service node this time is legal; removing the device domain name in the target resource URL to obtain a second resource URL; judging whether the client this time accesses the center node based on the legality verification parameter carried in the second resource URL; wherein the target resource URL is obtained by adding the device domain name of the target edge service node and the legality verification parameter to the original resource URL by the center node, and includes: sorting a plurality of original parameters carried in the original resource URL according to parameter ascii code values to obtain a first resource URL; in a case where the parameter ascii code value of the legality verification parameter is greater than the parameter ascii code value of each original parameter, adding the device domain name to a header of the first resource URL and adding the legality verification parameter to a tail of the first resource URL to obtain the target resource URL; wherein the adding of the legality verification parameter to the tail of the first resource URL includes: in a case where the legality verification parameter includes a time verification parameter and a signature verification parameter and the parameter ascii code value of the signature verification parameter is greater than the parameter ascii code value of the time verification parameter, adding the time verification parameter and the signature verification parameter to the tail of the first resource URL in sequence; the determination process of the signature verification parameter includes: determining a first target key parameter used for this time of encryption calculation, the first target key parameter being a key parameter updated most recently when an update period is not reached or a key parameter updated again after the key parameter updated most recently when the update period is reached; splicing the first resource URL, the time verification parameter, a host name of the target edge service node, and the first target key parameter in sequence and then performing encryption calculation to obtain the signature verification parameter.

3. The method of claim 2, wherein, the judging whether the client this time accesses the center node based on the legality verification parameter carried in the second resource URL includes: in a case where the legality verification parameter includes a time verification parameter and a signature verification parameter, Sort all parameters carried in the second resource URL according to parameter assic code values, to obtain a time verification parameter with a second largest parameter assic code value and a signature verification parameter with a largest parameter assic code value; If a time difference between the time verification parameter and a current time of the target edge service node is less than or equal to a preset time threshold, it is determined that the time verification parameter is a legal parameter, and then it is judged whether the current access of the client passes through the center node based on the second resource URL and the signature verification parameter; If the time difference is greater than the preset time threshold, it is determined that the current access of the client does not pass through the center node.

4. The method of claim 3, wherein, The judgment whether the current access of the client passes through the center node based on the second resource URL and the signature verification parameter comprises: The signature verification parameter carried in the second resource URL is removed to obtain a third resource URL; The second target key parameter and a host name of the target edge service node are both concatenated with the third resource URL to obtain a fourth resource URL; The fourth resource URL is calculated by encryption, and based on the matching result of the encryption result and the signature verification parameter, it is determined whether the current access of the client passes through the center node.

5. The method of claim 4, wherein, The judgment whether the current access of the client passes through the center node based on the matching result of the encryption result and the signature verification parameter comprises: In the case that the second target key parameter is an old key parameter without regular update or a new key parameter obtained after updating the old key parameter, it is judged whether the old key parameter is stored out of time; If the storage is not out of time and the encryption result corresponding to the new key parameter matches the signature verification parameter, it is determined that the current access of the client passes through the center node; If the storage is not out of time and the encryption result corresponding to the new key parameter does not match the signature verification parameter, it is judged whether the encryption result corresponding to the old key parameter matches the signature verification parameter, and according to the matching result, it is determined whether the current access of the client passes through the center node; If the storage is out of time, according to the matching result of the encryption result corresponding to the new key parameter and the signature verification parameter, it is determined whether the current access of the client passes through the center node.

6. A computer device comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the data access method in any one of claims 1 to 5.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to realize the data access method in any one of claims 1 to 5.

Images