CDN content anti-stealing-link method and system based on edge and back-to-source collaboration

Abstract

The invention belongs to the technical field of information security, and particularly relates to a CDN content anti-stealing-link method and system based on edge and back-to-source collaboration, and the method comprises the following steps: S1, a source station server executes the steps: selecting a session encryption key from a preset key matrix according to a preset risk level of a C-type network segment to which a client IP of a request content belongs; the content resource path is signed in combination with the session encryption key and the time slice identifier, an access token is generated, and the URL containing the access token is issued to the client; and S2, executing by a CDN edge node. According to the method, the credibility of the malicious request source of which the signature verification fails is reduced, and the progressive silent interception of the duration is started in combination with the threshold value, so that continuous attack behaviors can be identified and attacked, and the stability and availability of CDN services are protected.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a CDN content anti-stealing link method and system based on edge and back source cooperation. BACKGROUND

[0002] A content distribution network improves the access speed of users and the availability of a website by distributing the content of a source station to edge nodes closest to the users. Stealing link refers to an unauthorized third-party website or application linking and using the resources of a source station in a page or service, thereby consuming the bandwidth and computing resources of the source station, increasing the operating cost of the source station, and even possibly affecting normal services due to traffic overload. Anti-stealing link technology mainly checks the legality of a request by checking the URL of a request source page based on the Referer field of the HTTP protocol or based on an IP address blacklist mechanism. The Referer check judges the legality of a request by checking the URL of a request source page, but the Referer field is easy to fake, and the security and reliability are low. The IP blacklist mechanism limits access of specific IP addresses or address segments to achieve protection, but the management is complex, it is difficult to deal with stealing link behaviors using IP or through a proxy server, and normal users under a shared IP are easily mistaken.

[0003] A CDN anti-stealing link scheme uses a pre-shared key by a source station server, combines a resource path and an expired timestamp to generate a signature, and attaches the signature to a URL to issue to a client. The CDN edge node verifies the signature and the timestamp using the same key and algorithm after receiving a request, thereby achieving control over access. However, the defense strategy uses a fixed key and signature algorithm, and cannot provide differentiated security protection according to the risk level of different users or request sources. For legitimate users whose tokens expire due to network delay or normal suspension operation, no renewal or verification channel can be provided. The request behavior lacks evaluation and response capability, and for malicious and repeated signature forgery attempts, no level-by-level punishment can be identified and performed, and it is difficult to curb malicious attack sources. SUMMARY

[0004] The application provides a CDN content anti-stealing link method and system based on edge and back source cooperation to solve the technical problems that the defense strategy of the existing method cannot provide differentiated security protection according to the risk level of different users or request sources, and cannot identify and perform level-by-level punishment for forged signatures.

[0005] In a first aspect, the application provides a CDN content anti-stealing link method based on edge and back source cooperation, including the following steps: S1, performed by the source station server: according to the preset risk level of the C-class network segment to which the client IP of the request content belongs, select a session encryption key from the preset key matrix; and combine the session encryption key and the time slice identifier to sign the content resource path, generate an access token, and issue a URL containing the access token to the client; S2, performed by the CDN edge node: after receiving the client request carrying the access token, reconstruct the session encryption key according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and verify the access token; S3, when the verification passes and the local cache hits, use the reconstructed session encryption key to decrypt the header metadata of the content resource in the cache to obtain a basic decryption offset, adjust the basic decryption offset to a decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP, and then use the decryption offset to decrypt the data block of the content resource and respond to the client; S4, when the verification fails due to the expiration of the time slice identifier, and the request source credibility index is higher than a first preset threshold, initiate a collaborative verification request to the source station server, and the source station server generates and issues a temporary access token based on the credibility index; when the verification fails due to signature mismatch, reduce the request source credibility index; if the reduced request source credibility index is lower than a second preset threshold, calculate the silent interception duration based on the difference between the request source credibility index and the second preset threshold, and start silent interception for the client IP.

[0006] Further, selecting a session encryption key from the preset key matrix comprises: The preset key matrix is set as a two-dimensional matrix, and the row index of the two-dimensional matrix corresponds to the risk level of the C-class network segment, and the column index corresponds to the time slice identifier; the process of selecting the session encryption key is: taking the risk level of the C-class network segment to which the client IP belongs as the row index, and taking the current time slice identifier as the column index, finding and determining a unique session encryption key in the two-dimensional matrix.

[0007] Further, combining the session encryption key and the time slice identifier to sign the content resource path to generate an access token comprises: The content resource path, the time slice identifier and the session encryption key are concatenated to form a to-be-signed string; the HMAC-SHA256 algorithm is used to perform hash operation on the to-be-signed string to generate a signature digest; and the signature digest is Base64 encoded as an access token.

[0008] Further, adjusting the basic decryption offset to a decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP comprises: The initial value and the maximum value of the request source credibility index are set are all 100, and the value range is [0, 100]; the decryption offset is calculated according to the following formula : ; wherein, is a basic decryption offset, is a preset adjustment coefficient.

[0009] Further, the data block of the content resource is decrypted using the decryption offset and a response is sent to the client, including: The data block of the content resource is regarded as a byte sequence; starting from the beginning of the byte sequence, a number of bytes specified by the decryption offset is skipped; the continuous content data after the skipped position is read, and the read content data is sent to the client as the decrypted content resource.

[0010] Further, when the verification fails due to the mismatch of the signature, the request source credibility index is reduced, including: Each time the verification fails due to the mismatch of the signature, a fixed degradation score value is subtracted from the current request source credibility index value.

[0011] Further, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold value, and the silent interception is started for the client IP, including: The second preset threshold value is set to ; the silent interception duration is calculated according to the following formula : ; wherein, is the current request source credibility index, is a preset time penalty factor; all subsequent requests of the client IP are rejected within the calculated silent interception duration.

[0012] In a second aspect, the application provides a CDN content anti-theft link system based on edge and back-to-source cooperation, including the following modules: The generation module is used for the source station server to perform: according to the preset risk level of the C-class network segment to which the client IP of the request content belongs, a session encryption key is selected from a preset key matrix; and the content resource path is signed in combination with the session encryption key and the time slice identifier to generate an access token, and the URL containing the access token is sent to the client; The verification module is used for the CDN edge node to perform: after receiving the client request carrying the access token, the session encryption key is reconstructed according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and the access token is verified; The adjusting module is configured to, when the verification passes and the local cache hits, decrypt the header metadata of the cached content resource by using the reconstructed session encryption key to obtain a basic decryption offset, adjust the basic decryption offset to a decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP, and decrypt the data block of the content resource by using the decryption offset and respond to the client. The intercepting module is configured to, when the verification fails due to the time slice identifier being expired and the request source credibility index is higher than the first preset threshold, initiate a collaborative verification request to the source station server, and generate and issue a temporary access token by the source station server according to the credibility index; when the verification fails due to the signature mismatch, reduce the request source credibility index; and if the reduced request source credibility index is lower than the second preset threshold, calculate a silent interception duration based on the difference between the request source credibility index and the second preset threshold, and start the silent interception for the client IP.

[0013] Further, the session encryption key is selected from the preset key matrix, including: The preset key matrix is set as a two-dimensional matrix, the row index of the two-dimensional matrix corresponds to the risk level of the C-type network segment, and the column index corresponds to the time slice identifier; the process of selecting the session encryption key is that the risk level of the C-type network segment to which the client IP belongs is taken as the row index, the current time slice identifier is taken as the column index, and the unique session encryption key is found and determined in the two-dimensional matrix.

[0014] Further, the content resource path is signed in combination with the session encryption key and the time slice identifier to generate an access token, including: The content resource path, the time slice identifier and the session encryption key are string-spliced to form a to-be-signed string; the HMAC-SHA256 algorithm is adopted to perform hash operation on the to-be-signed string to generate a signature digest; and the signature digest is Base64 encoded as the access token.

[0015] Beneficial effects are that: the application realizes differentiated access token generation and verification by using the key matrix based on the risk level of the client IP, enhances the security strength and anti-counterfeiting capability of the signature, encrypts the cached content at the edge node, and uses the request source credibility index to intervene the decryption process twice, thereby protecting the security of the cached data on the CDN node and controlling the access authority based on the request history behavior. In addition, for the trusted user with expired token, a fault-tolerant channel of collaborative verification is established, a temporary token is issued to guarantee the access continuity, and the problem of user experience degradation caused by network delay is improved. The credibility of the malicious request source with failed signature verification is reduced, and the silent interception with the threshold start duration is started in combination, so that the persistent attack behavior can be identified and attacked, thereby protecting the stability and availability of the CDN service. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 This is a flowchart of a CDN content hotlinking prevention method based on edge and origin collaboration. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] An embodiment of the CDN content hotlinking prevention method based on edge and origin-back collaboration provided by this invention: like Figure 1 As shown, the CDN content hotlinking prevention method based on edge and origin collaboration includes the following steps: S1, executed by the origin server: Based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs, select a session encryption key from the preset key matrix; and sign the content resource path by combining the session encryption key and the time segmentation identifier to generate an access token, and send the URL containing the access token to the client.

[0019] The origin server maintains a risk level database to store and query the preset risk level of the Class C network segment to which the client IP belongs. The preset risk level is a predetermined level, such as high risk, medium risk, or low risk, based on an assessment of the Class C network segment's historical attack frequency, geographical location, and whether it is an IDC or proxy. This database records the aforementioned assessment information for different IPs and Class C network segments, such as 202.xxx.22.0, and uses this information to classify risk levels. Simultaneously, the origin server pre-configures a two-dimensional key matrix. The row index represents the risk level, and the column index represents the time shard identifier. The time shard identifier is obtained by dividing the current Unix timestamp by a preset duration and rounding down. The matrix stores string keys of varying strengths. When a request is received from a client with an IP such as 202.xxx.22.10, the server queries and determines that the risk level of the Class C network segment 202.xxx.22.0 to which the request belongs is medium.

[0020] The server selects the corresponding session encryption key, e.g. KeyMediumSecurity, from the key matrix according to the row index of the medium risk level. The server obtains the current Unix timestamp and divides it by a preset time length, e.g. 300 seconds, and takes the integer part to obtain the time slice identifier, e.g. 16788864. The content resource path / videos / movie.mp4 and the time slice identifier 16788864 are spliced, and the spliced string is hashed using the HMAC-SHA256 algorithm and the session encryption key KeyMediumSecurity to generate a hexadecimal string as an access token.

[0021] The resource path, the access token, and the time slice identifier are combined into a URL, e.g. http: / / cdn.example.com / videos / movie.mp4?token=xxxxxxxx&ts=16788864, and returned to the client.

[0022] In an optional embodiment, selecting the session encryption key from the preset key matrix includes: The preset key matrix is set as a two-dimensional matrix, and the row index of the two-dimensional matrix corresponds to the risk level of the C-class network segment, and the column index corresponds to the time slice identifier. The process of selecting the session encryption key is as follows: taking the risk level of the C-class network segment to which the client IP belongs as the row index and the current time slice identifier as the column index, searching and determining the unique session encryption key in the two-dimensional matrix.

[0023] For example, the rows of the matrix can be defined as risk levels 1, 2, and 3, representing low risk, medium risk, and high risk, respectively. The columns of the matrix correspond to time slice identifiers divided by 10 minutes in a day, such as 001, 002, and 144. Each cell in the matrix stores a unique key string. When a request is initiated from a client with an IP address of 202.xxx.134.133, it is determined that the C-class network segment to which it belongs is 202.xxx.134.0. The risk assessment database is queried to determine that the risk level of the network segment is 2, i.e. medium risk. At the same time, the current timestamp is obtained and the current time slice identifier is calculated to be 005. Thus, the row index 2 and the column index 005 are used to search the two-dimensional matrix to locate the unique session encryption key.

[0024] In an optional embodiment, the content resource path is signed in combination with the session encryption key and the time slice identifier to generate an access token, including: The content resource path, time slice identifier and session encryption key are concatenated to form a to-be-signed string; the HMAC-SHA256 algorithm is used to hash the to-be-signed string to generate a signature digest; the signature digest is Base64 encoded as an access token.

[0025] Suppose the content resource path requested by the client is / data / document.pdf, the current time slice identifier is 123, and the corresponding session encryption key has been obtained according to the foregoing method as secretkey12345. The three elements are concatenated in a predetermined order to form a to-be-signed string, for example, / data / document.pdf123secretkey12345. The to-be-signed string / data / document.pdf123secretkey12345 is calculated using the session encryption key secretkey12345 as the key for the hash operation to generate a 256-bit binary signature digest. The binary signature digest is Base64 encoded to convert it into a printable ASCII string, for example, eW91clRva2VuSGVyZQ==. This string is the generated access token for verifying the legality of the request.

[0026] S2, performed by the CDN edge node: after receiving the client request carrying the access token, reconstruct the session encryption key according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and verify the access token.

[0027] The specific method of reconstructing the session encryption key is: taking the preset risk level of the C-class network segment to which the client IP belongs as the row index and the current time slice identifier as the column index, searching and determining the unique session encryption key in the locally synchronized preset key matrix. This process ensures that the key reconstructed is exactly the same as the session encryption key selected by the origin server in step S1 for signing (generating the access token). After reconstructing the session encryption key, the verification module uses the key and the HMAC-SHA256 algorithm to recalculate the signature of the resource path and time slice identifier in the request, and compares it with the access token carried in the request for verification.

[0028] The CDN edge node also synchronizes the risk level database and the key matrix of the origin server. When receiving the URL request from IP 202.xxx.22.10, the edge node extracts the client IP, and queries the risk level as medium. The edge node then selects the same session encryption key KeyMediumSecurity from the local key matrix according to the medium risk level. Meanwhile, the edge node obtains the current Unix timestamp and calculates the current time slice identifier in the same way. The edge node extracts the resource path / videos / movie.mp4 and the time slice identifier 16788864 from the request URL, splices the string in the same way as the origin server, and calculates a new signature using the reconstructed session encryption key KeyMediumSecurity and the HMAC-SHA256 algorithm. The newly generated signature is compared with the access token token=xxxxxxxx carried in the URL bit by bit. If they are completely consistent, the verification is passed.

[0029] S3, when the verification is passed and the local cache hits, the reconstructed session encryption key is used to decrypt the header metadata of the cached content resource to obtain a basic decryption offset, and based on the request source credibility index maintained by the CDN edge node for the client IP, the basic decryption offset is adjusted to a decryption offset, and then the data block of the content resource is decrypted using the decryption offset and a response is sent to the client.

[0030] Specifically, the edge node confirms that the local cache has a cached copy of movie.mp4, that the data blocks of the cached copy have been uniformly encrypted when cached, and that a field encrypted using a session encryption key is stored in the header metadata of the cached copy. The edge node decrypts the field using the reconstructed session encryption key KeyMediumSecurity to obtain a basic decryption offset value, for example, 1024. Meanwhile, the edge node maintains a credibility index of 80 points as an initial value for IP 202.xxx.22.10. The edge node calculates the decryption offset as 1344 according to a preset algorithm, for example, decryption offset = basic decryption offset + (100-credibility index) x 16. The edge node then uses the decryption offset 1344 as a decryption parameter, for example, as an initial vector of a streaming decryption algorithm or a starting reading point of a byte stream, to decrypt the cached encrypted data block, and sends the decrypted video stream data to the client through the HTTP response body.

[0031] In an optional embodiment, adjusting the basic decryption offset to the decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP includes: setting the initial value and the maximum value of the request source credibility index ​are all 100, and the value range is [0, 100]; the decryption offset is calculated according to the following formula : ; wherein, is a basic decryption offset, is a preset adjustment coefficient.

[0032] A request source credibility index is maintained for each client IP address, and the full score is 100; assuming that the preset basic decryption offset is 1024 bytes and the adjustment coefficient is 10. For a client IP that accesses for the first time or behaves normally all the time, the request source credibility index of the client IP is 100. According to the calculation formula, the decryption offset is still 1024 bytes. The client with the highest credibility will use the smallest offset and obtain the fastest response. If the client IP subsequently exhibits some abnormal behavior, for example, multiple signature verification failures, the request source credibility index is reduced to 60. At this time, the decryption offset is recalculated. The calculation result is 400. The decryption offset is adjusted to 1424 bytes. By increasing the starting position of the decrypted data, a slight resource consumption penalty is imposed on the request source with lower credibility.

[0033] In an optional embodiment, the data block of the content resource is decrypted by using the decryption offset and a response is sent to the client, including: The data block of the content resource is regarded as a byte sequence; from the starting position of the byte sequence, a number of bytes specified by the decryption offset is skipped; the continuous content data after the skipped position is read, and the read content data is sent to the client as the decrypted content resource.

[0034] Suppose that the client requests a video file with a size of 1 megabyte, and the decryption offset calculated according to the foregoing method is 2048 bytes. In processing the request, the edge node server locates the original data block of the video file in the storage. The data block can be regarded as a continuous byte sequence from byte 0 to byte 1048575. The server does not read the data from byte 0, but directly moves the file reading pointer forward by 2048 bytes to locate at the 2048th byte of the byte sequence. From the new position, the server continuously reads all the data from the 2048th byte to the end of the file. The partially read data is encapsulated in the HTTP response and sent to the client. The first 2048 bytes of data of the original file are ignored in this response.

[0035] S4, when the verification fails due to the time-sliced identifier being expired and the request source credibility index is higher than a first preset threshold, a cooperative verification request is initiated to the source station server, the source station server generates and issues a temporary access token according to the credibility index; when the verification fails due to the signature mismatch, the request source credibility index is reduced; if the reduced request source credibility index is lower than a second preset threshold, a silence interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and the silence interception is started for the client IP.

[0036] Specifically, if the current time-sliced identifier calculated by the edge node is 16788865, which does not match 16788864 in the request URL, it is determined that the token is expired. At this time, the request source credibility index of IP 202.xxx.22.10 is 80 points, which is higher than the first preset threshold of 70 points. The edge node initiates an internal API request to the source station server, which includes the client IP, the original request path and the current request source credibility index of 80. After receiving the request, the source station server recognizes that the request is a renewal request from a trusted edge node initiated by a high credibility user, and immediately generates a temporary access token using the current latest time-sliced identifier 16788865 and the corresponding session encryption key, and returns a new URL containing the temporary token to the edge node. The edge node then issues it to the client through HTTP redirection and the like, so that the client can continue to access.

[0037] If the signature calculated by the edge node does not match the token carried in the URL, it is determined that it is a signature forgery attempt. The edge node queries the current request source credibility index of IP 202.xxx.22.10, for example, 35 points, which is reduced by 10 points to 25 points. After updating, the edge node checks whether the score is lower than the second preset threshold of 30 points, and finds that 25 points is lower than 30 points. Therefore, the edge node calculates the interception duration according to the formula, for example, the interception duration=(second threshold-current index) x 60 seconds, and calculates the interception duration as 300 seconds. The edge node adds IP 202.xxx.22.10 to a local temporary blacklist and sets the expiration time as 300 seconds. During this period, any request from this IP is directly discarded without any processing, until the 300 seconds are over and the IP is automatically unblocked.

[0038] In an optional embodiment, when the verification fails due to the signature mismatch, the request source credibility index is reduced, including: Each time the verification fails due to the signature mismatch, a fixed degradation score value is subtracted from the current request source credibility index value.

[0039] A fixed degradation score value is preset, for example, 10 points are deducted for each failed signature verification. A request source with a client IP of 8.8.8.8 has an initial trustworthiness index of 100 points. When the client initiates a request but the access token carried by the request is found to be mismatched after verification, it is determined that the request is illegal. At the same time of rejecting the request, the trustworthiness index of the request source associated with the client IP address 8.8.8.8 is updated. The preset degradation score value of 10 is subtracted from the current value of 100, so that the trustworthiness index of the request source becomes 90. If the next request from the IP address again has the error of signature mismatch, the trustworthiness index of the request source will be reduced by 10 points from the base of 90, to 80, and so on, until the index decreases to the set threshold.

[0040] In an optional embodiment, the silent interception duration is calculated based on the difference between the request source trustworthiness index and the second preset threshold, and the silent interception is started for the client IP, including: The second preset threshold is set to , and the silent interception duration is calculated according to the following formula : ; wherein, the current request source trustworthiness index, is a preset time penalty factor; all subsequent requests of the client IP are rejected within the calculated silent interception duration.

[0041] The second preset threshold triggering the silent interception is, for example, 30, and a time penalty factor is 5 seconds per minute. The request source trustworthiness index of a client IP decreases from 35 to 25 due to continuous request failures. At this time, it is detected that the request source trustworthiness index 25 is lower than the second preset threshold 30, so it is decided to start the silent interception. The difference between the request source trustworthiness index and the second preset threshold is calculated, which is 5. The difference 5 is multiplied by the time penalty factor 5 to obtain the silent interception duration of 25 seconds. The client IP address is added to a temporary blacklist and marked with an interception end time. Within the next 25 seconds, any request from the IP address will be directly discarded without any processing until the penalty time of 25 seconds ends.

[0042] Embodiments of the CDN content anti-linking system based on edge and back-to-source cooperation provided by the application include the following modules: The generating module is configured to be executed by the source station server: according to a preset risk level of a C-class network segment to which a client IP of a request content belongs, select a session encryption key from a preset key matrix; and combine the session encryption key and a time slice identifier to sign a content resource path to generate an access token, and send a URL containing the access token to a client; The verification module is configured to perform the following by the CDN edge node: after receiving the client request carrying the access token, reconstructing the session encryption key according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and verifying the access token; The adjustment module is configured to, when the verification passes and the local cache hits, decrypt the header metadata of the content resource in the cache by using the reconstructed session encryption key to obtain a basic decryption offset, adjust the basic decryption offset to a decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP, decrypt the data block of the content resource by using the decryption offset, and respond to the client. The interception module is configured to, when the verification fails due to the expiration of the time slice identifier and the request source credibility index is higher than a first preset threshold, initiate a cooperative verification request to the source station server, generate and issue a temporary access token by the source station server according to the credibility index; when the verification fails due to the signature mismatch, reduce the request source credibility index; if the reduced request source credibility index is lower than a second preset threshold, calculate a silent interception duration based on the difference between the request source credibility index and the second preset threshold, and start the silent interception for the client IP.

[0043] The above are preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Therefore, equivalent changes made in the structure, shape, and principle of the present application should be covered within the protection scope of the present application.

Claims

1. A CDN content hotlinking prevention method based on edge and origin-back collaboration, characterized in that, Includes the following steps: S1, executed by the origin server: Select a session encryption key from the preset key matrix based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs; The content resource path is signed by combining the session encryption key and the time segmentation identifier, an access token is generated, and the URL containing the access token is sent to the client. S2, executed by the CDN edge node: After receiving a client request carrying an access token, it reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token; S3, when the verification passes and the local cache is hit, the header metadata of the content resource in the cache is decrypted using the reconstructed session encryption key to obtain the basic decryption offset. Based on the request source trust index maintained by the CDN edge node for the client IP, the basic decryption offset is adjusted to the decryption offset. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client. S4. When the verification fails due to the expiration of the time segment identifier and the credibility index of the request source is higher than the first preset threshold, a collaborative verification request is initiated to the origin server, and the origin server generates and issues a temporary access token based on the credibility index. When verification fails due to signature mismatch, the request source credibility index is lowered; if the lowered request source credibility index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and silent interception is initiated on the client IP.

2. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, Select a session encryption key from the preset key matrix, including: The preset key matrix is ​​set as a two-dimensional matrix. The row index of the two-dimensional matrix corresponds to the risk level of the Class C network segment, and the column index corresponds to the time segment identifier. The process of selecting the session encryption key is as follows: the risk level of the Class C network segment to which the client IP belongs is used as the row index, and the current time segment identifier is used as the column index. The unique session encryption key is searched and determined in the two-dimensional matrix.

3. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, The content resource path is signed by combining the session encryption key and the time-segment identifier to generate an access token, including: The content resource path, time segment identifier, and session encryption key are concatenated to form a string to be signed; the HMAC-SHA256 algorithm is used to hash the string to be signed to generate a signature digest; the signature digest is Base64 encoded and used as an access token.

4. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, Based on the request source trustworthiness metric maintained by CDN edge nodes for client IPs, the basic decryption offset is adjusted to a decryption offset, including: Set the source credibility index initial value and maximum value All values ​​are 100, and the range is [0, 100]. Calculate the decryption offset using the following formula. : ； in, Based on the decryption offset, This is the preset adjustment coefficient.

5. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, Decrypt the data blocks of the content resource using the decryption offset and respond to the client, including: Treat the data blocks of the content resource as a sequence of bytes; starting from the beginning of the byte sequence, skip the number of bytes specified by the decryption offset; start reading continuous content data from the skipped position, and respond to the client with the read content data as the decrypted content resource.

6. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, When verification fails due to signature mismatch, the credibility metric of the request source is lowered, including: Each time a verification fails due to a signature mismatch, a fixed downgrade score is subtracted from the current request source credibility index value.

7. The CDN content hotlinking prevention method based on edge and origin collaboration according to claim 1, characterized in that, The silent interception duration is calculated based on the difference between the request source credibility index and a second preset threshold, and silent interception is initiated for the client IP, including: Set the second preset threshold as Calculate the silent interception duration using the following formula. : ； in, This is an indicator of the credibility of the current request source. The preset time penalty factor; within the calculated silent interception period, all subsequent requests from the client IP are rejected.

8. A CDN content anti-leeching system based on edge and origin collaboration, characterized in that, Includes the following modules: The generation module, executed by the origin server, selects a session encryption key from a preset key matrix based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs; The content resource path is signed by combining the session encryption key and the time segmentation identifier, an access token is generated, and the URL containing the access token is sent to the client. The verification module, executed by the CDN edge node, receives a client request carrying an access token, reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token. The adjustment module is used to decrypt the header metadata of the content resource in the cache using the reconstructed session encryption key when the verification passes and the local cache is hit, to obtain the basic decryption offset, and adjust the basic decryption offset to the decryption offset based on the request source trust index maintained by the CDN edge node for the client IP. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client. The interception module is used to initiate a collaborative verification request to the origin server when the verification fails due to the expiration of the time slice identifier and the credibility index of the request source is higher than the first preset threshold. The origin server generates and issues a temporary access token based on the credibility index. When verification fails due to signature mismatch, the request source credibility index is lowered; if the lowered request source credibility index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and silent interception is initiated on the client IP.

9. The CDN content anti-leeching system based on edge and origin collaboration as described in claim 8, characterized in that, Select a session encryption key from the preset key matrix, including: The preset key matrix is ​​set as a two-dimensional matrix. The row index of the two-dimensional matrix corresponds to the risk level of the Class C network segment, and the column index corresponds to the time segment identifier. The process of selecting the session encryption key is as follows: the risk level of the Class C network segment to which the client IP belongs is used as the row index, and the current time segment identifier is used as the column index. The unique session encryption key is searched and determined in the two-dimensional matrix.

10. The CDN content anti-leeching system based on edge and origin collaboration according to claim 8, characterized in that, The content resource path is signed by combining the session encryption key and the time-segment identifier to generate an access token, including: The content resource path, time segment identifier, and session encryption key are concatenated to form a string to be signed; the HMAC-SHA256 algorithm is used to hash the string to be signed to generate a signature digest; the signature digest is Base64 encoded and used as an access token.

Images