Traffic access control method and device, storage medium and processor

Abstract

The invention provides a traffic access control method and device, a storage medium and a processor, and belongs to the technical field of computer networks. The method comprises the following steps: in response to a user access request, initializing a flow controller which is used for managing and controlling the access request frequency of each user; under the condition that the flow controller is successfully initialized, a distributed lock is obtained, and the distributed lock is used for controlling a plurality of users to perform mutual exclusion access on the flow controller; under the condition that the distributed lock is successfully obtained, the flow controller executes flow control check to obtain a flow check result; and processing the user access request based on the flow check result to obtain a processing result. According to the invention, the request frequency of each user can be accurately controlled in a distributed environment, excessive flow is avoided, and the expandability and reliability of the system are ensured at the same time. Lock competition and performance overhead are greatly reduced, and flow control in a high-concurrency scene is supported.

Description

Technical Field

[0001] This application relates to the field of computer network technology, specifically to a traffic access control method, a traffic access control device, a computer program product, a machine-readable storage medium, and a processor. Background Technology

[0002] With the rapid development of network technology and the widespread use of the Internet, network security issues have become increasingly prominent. Traffic access control systems are used to limit the frequency of user requests for resources to prevent resource overload and abuse.

[0003] Existing traffic access control systems are typically based on traditional programming languages ​​or hardware devices. These systems may face performance bottlenecks when handling high-concurrency connections, such as issues related to data consistency, concurrency safety, and synchronization.

[0004] Therefore, existing solutions typically lack full support for distributed environments. Summary of the Invention

[0005] The purpose of this application is to provide a traffic access control method, a traffic access control device, a computer program product, a machine-readable storage medium, and a processor.

[0006] To achieve the above objectives, the first aspect of this application provides a traffic access control method, the traffic access control method comprising: In response to a user access request, a traffic controller is initialized, which is used to manage and control the frequency of access requests for each user; Upon successful initialization of the traffic controller, a distributed lock is acquired, which is used to control mutual exclusive access to the traffic controller by multiple users. If the distributed lock is successfully acquired, the flow controller performs a flow control check and obtains the flow check result. Based on the traffic inspection results, the user access request is processed to obtain the processing result.

[0007] In this embodiment of the application, the step of performing a flow control check by the flow controller to obtain a flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm to obtain the flow check results.

[0008] In this embodiment of the application, the step of the flow controller performing a flow control check based on the token bucket algorithm to obtain the flow check result includes: The current flow control status is obtained from Redis by the flow controller, and the current flow control status includes the current number of tokens and the last reset time; The current time window is obtained based on the current time and the last reset time. The flow controller performs a flow control check based on the current number of tokens and the current time window to obtain the flow check result.

[0009] In this embodiment of the application, the step of the flow controller performing a flow control check based on the current token count and the current time window to obtain the flow check result includes: The flow controller determines whether the current number of tokens is less than the preset maximum number of tokens; If the flow controller determines that the current number of tokens is less than the preset maximum number of tokens, it will obtain a pass result for the flow check and increase the current number of tokens. If the current number of tokens is not less than the preset maximum number of tokens, the flow controller determines whether the current time window has expired. If the flow controller determines that the current time window has expired, it will obtain a pass result for the flow check, reset the current token count to 1, and update the last reset time.

[0010] In this embodiment of the application, the step of the flow controller performing a flow control check based on the token bucket algorithm to obtain the flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm using the rate package in the Go language, and obtains the flow check results.

[0011] In this embodiment of the application, the user access request includes user information, and the acquisition of the distributed lock includes: Initialize Redis; Based on the user information, a distributed lock is created using the Redis SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time.

[0012] A second aspect of this application provides a traffic access control device, the traffic access control device comprising: An initialization module is used to initialize a traffic controller in response to a user access request. The traffic controller is used to manage and control the frequency of each user's access requests. The acquisition module is used to acquire a distributed lock upon successful initialization of the traffic controller. The distributed lock is used to control mutual exclusion access to the traffic controller by multiple users. The inspection module is used to perform a flow control check by the flow controller and obtain the flow check result when the distributed lock is successfully acquired. The processing module is used to process the user access request based on the traffic inspection results and obtain the processing results.

[0013] A third aspect of this application provides a processor configured to execute the above-described flow access control method.

[0014] A fourth aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned flow access control method.

[0015] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described flow access control method.

[0016] The above technical solution involves initializing a traffic controller in response to user access requests. This traffic controller manages and controls the frequency of each user's access requests. Upon successful initialization, a distributed lock is acquired to control mutual exclusion access to the traffic controller by multiple users. After successfully acquiring the distributed lock, the traffic controller performs a traffic control check to obtain the check result. Based on the check result, the user access request is processed to obtain the processing result. By creating a traffic controller for each user and acquiring a distributed lock before performing the traffic control check, it ensures that only one request can modify the user's traffic control state at a time. The traffic control check is performed under the protection of the lock. Because a distributed lock is used, updates to the traffic control state of the same user are atomic in a distributed environment, thus accurately controlling the request frequency of each user, avoiding excessive traffic, and ensuring system scalability and reliability. The use of lock-free data structures and segmented locking mechanisms significantly reduces lock contention and performance overhead, supporting traffic control in high-concurrency scenarios.

[0017] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 This illustration schematically shows an application environment diagram of the traffic access control method according to an embodiment of this application; Figure 2 The schematic diagram illustrates a flow chart of a traffic access control method according to an embodiment of this application; Figure 3 A timing diagram illustrating traffic access control according to an embodiment of this application is shown schematically; Figure 4 This schematically illustrates a structural block diagram of a traffic access control device according to an embodiment of the present application; Figure 5 The diagram illustrates the internal structure of a computer device according to an embodiment of this application.

[0019] Explanation of reference numerals in the attached figures 410 - Initialization module; 420 - Acquisition module; 430 - Checking module; 440 - Processing module; A01 - Processor; A02 - Network interface; A03 - Internal memory; A04 - Display screen; A05 - Input device; A06 - Non-volatile storage medium; B01 - Operating system; B02 - Computer program. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0021] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0022] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0023] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant laws and regulations. Furthermore, it should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0024] The traffic access control method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via the network. By creating a traffic controller for each user, a distributed lock is acquired before performing traffic control checks to ensure that only one request can modify the user's traffic control state at a time. Traffic control checks are then performed under the protection of the lock. Because a distributed lock is used, updates to the traffic control state of the same user are atomic in a distributed environment, thus accurately controlling the request frequency of each user, avoiding excessive traffic, and ensuring the scalability and reliability of the system. Through lock-free data structures and segmented locking mechanisms, lock contention and performance overhead are greatly reduced, supporting traffic control in high-concurrency scenarios. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, and server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0025] Figure 2 A schematic flowchart of a traffic access control method according to an embodiment of this application is shown. Figure 2 As shown, in one embodiment of this application, a traffic access control method is provided. This embodiment mainly applies this method to the above-mentioned... Figure 1 Taking terminal 102 (or server 104) as an example, the following steps are included: Step 210: In response to a user access request, initialize the traffic controller, which is used to manage and control the frequency of each user's access requests; In this embodiment, the aforementioned user access request can be an HTTP request initiated by the user. The traffic controller can be pre-built and responsible for managing and limiting the frequency of user access requests. Initializing the traffic controller can involve initializing its parameters. For example, taking a traffic controller based on a token bucket algorithm as an example, the parameters that need to be initialized include: User identifier: used to uniquely identify a user, typically using a user ID or IP address; Maximum token count: representing the maximum number of requests allowed within a given time window, i.e., the capacity of the token bucket; Token refresh rate: specifying the token refresh time window, for example, refreshing once per minute, i.e., refilling tokens to the maximum quantity every minute. Initializing the traffic controller can create a token bucket for each user and set its capacity and refresh rate, thereby controlling the request frequency of that user.

[0026] Step 220: If the traffic controller is successfully initialized, acquire a distributed lock, which is used to control mutual exclusive access to the traffic controller by multiple users; In this embodiment, upon successful initialization of the traffic controller, the traffic controller corresponding to the user is obtained. In a distributed system, the state of the traffic controller (such as the current token count, last refresh time, etc.) can be stored in a distributed cache (such as Redis) so that multiple service instances can share the state of the same user, thereby achieving global traffic control. In a distributed system, to prevent multiple instances from modifying the traffic control state simultaneously, a distributed lock can be used for synchronization. That is, after successful initialization of the traffic controller, in order to safely execute traffic control logic in a distributed environment (e.g., checking whether a request is allowed and updating the corresponding count), a distributed lock can be acquired. This lock will ensure that at any given time, only one instance (or one thread) can execute these critical operations, thereby avoiding data inconsistency problems caused by concurrent access.

[0027] In some embodiments, the user access request includes user information, and the acquisition of the distributed lock includes: First, initialize Redis; In this embodiment, the Redis client is first initialized and connected to the Redis server.

[0028] Then, based on the user information, a distributed lock is created using the Redis SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time.

[0029] In this embodiment, based on user information, a lock key (lock identifier) ​​and value (lock holder identifier) ​​can be constructed, and an expiration time can be set. The lock identifier is usually a unique string used to identify the lock; the lock holder identifier ensures that only the lock holder can release the lock; and the lock expiration time prevents deadlocks. Redis's SETNX command and Lua scripts can effectively implement this functionality. Specifically, the SETNX command can be used to attempt to set the lock. If it returns success (i.e., the lock did not exist previously), the lock acquisition is successful. If SETNX returns failure, it means the lock is already held by another client, and the current client's attempt to acquire the lock fails.

[0030] Distributed locks are created using Redis's SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time, which makes the locking strategy of the distributed lock more granular. This enables the provision of high-performance and highly available services while ensuring data consistency, meeting the stringent requirements of production environments.

[0031] Step 230: If the distributed lock is successfully acquired, the flow controller performs a flow control check to obtain the flow check result; In this embodiment, if the distributed lock is successfully acquired, the flow controller continues to perform flow control checks; otherwise, the flow control checks are not performed, and a message indicating that the distributed lock acquisition failed is returned. The flow control checks include checking whether the current user's requests exceed a set limit (e.g., a maximum of 10 requests per minute). The flow controller can support multiple flow control strategies, such as funnel algorithms, sliding window algorithms, and token bucket algorithms, to adapt to different application scenarios.

[0032] In some embodiments, the step of performing a flow control check by the flow controller to obtain a flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm to obtain the flow check results.

[0033] In this embodiment, the token bucket algorithm is a simple and effective flow control algorithm that uses a fixed-capacity bucket to store tokens, with each request consuming one token. During flow control checks, the token bucket algorithm maintains a fixed-capacity bucket and adds tokens to it at a fixed rate. Each request needs to obtain one or more tokens from the bucket; if there are enough tokens in the bucket, the request is allowed; otherwise, it is rejected. In distributed systems, external storage such as Redis can be used to maintain the token bucket's state (current token count, last update time, etc.). This allows for both limiting long-term average traffic and handling short-term traffic bursts, thus smoothly limiting the request rate while allowing for a certain degree of bursty traffic.

[0034] In some embodiments, the step of the flow controller performing a flow control check based on the token bucket algorithm to obtain the flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm using the rate package in the Go language, and obtains the flow check results.

[0035] In this embodiment, the `rate` package in Go, part of the `golang.org / x / time / rate` library, provides an implementation of flow control. This package implements a flow control mechanism based on the token bucket algorithm to limit the number of operations within a certain period. The `rate` package provides a limiter, which controls the number of events allowed per second. It can be used to limit the rate of function calls or the frequency of other operations. For example, by creating a limiter, you can set it to allow 5 events per second, with a 1-second time interval between each event. If the program has 10 requests, it can determine whether a request is allowed and print the result; alternatively, it can wait until it can continue processing requests. This ensures that the request processing rate does not exceed the set limit. Common configurations include the rate per second (the number of events allowed per second) and the bucket capacity (the bucket's capacity for handling bursts of traffic). Dynamic adjustment of the bucket capacity and rate is supported to adapt to different traffic demands, providing flexible flow control capabilities. In a concurrent environment, the flow controller needs to ensure thread safety. Go's `sync.Mutex` can be used to ensure mutual exclusion access to the flow controller. `sync.Mutex` is a mutex implementation provided by the Go standard library, used to ensure safe access to struct fields in a concurrent environment. Operations in the flow controller are performed under the protection of the lock to prevent data race conditions.

[0036] The token bucket algorithm can be implemented using Go's `rate` package. It allows for bursty requests (based on the bucket's capacity) and supports setting the average rate. The algorithm is highly efficient, with atomic operations, resulting in good performance. The Go implementation is simple and easy to use, allowing for quick integration into existing applications and improving system stability and reliability.

[0037] Considering that the precision of the `rate` package is limited by system clock precision and Go runtime scheduling, it may not be suitable for scenarios requiring extremely high precision; if the configured bucket capacity is too large, it may consume a lot of memory, especially when handling a large number of concurrent requests; although the token bucket algorithm is suitable for most flow control needs, in some specific scenarios (e.g., extreme flow control requirements or complex flow patterns), other more complex algorithms or libraries may be needed; it may introduce latency, especially under high load conditions, where long waiting times may occur if requests are too frequent. Therefore, in some embodiments, the flow controller performs flow control checks based on the token bucket algorithm to obtain flow check results, including: First, the traffic controller obtains the current traffic control status from Redis, which includes the current number of tokens and the last reset time; In this embodiment, two Redis keys can be used to store the current token count and the timestamp of the last reset (last reset time). The current flow control status can be obtained by reading the key values. The current token count can be represented as the number of tokens currently issued.

[0038] Then, based on the current time and the last reset time, the current time window is obtained; In this embodiment, the current time window can be obtained by calculating the difference between the current time and the last reset time.

[0039] Finally, the flow controller performs a flow control check based on the current number of tokens and the current time window to obtain the flow check result.

[0040] In this embodiment, a flow control check is performed based on the current number of tokens and the current time window. This allows us to determine whether the current number of tokens and the current time window meet the preset requirements, thereby obtaining the flow check result.

[0041] By combining the current token count with the elapsed time for flow control checks, it's possible to accurately determine whether the current request should be allowed. This allows for handling bursts of traffic (because tokens can accumulate to the bucket's capacity) while ensuring the average rate remains within limits. By storing the state in Redis, multiple instances can share the same state, enabling unified flow control for the same user or the same rate-limiting key. This ensures that the rate-limiting rules are consistent regardless of which instance handles the request. It prevents inaccurate token counts caused by multiple requests simultaneously reading and updating the token count, ensuring consistency in token management and flow control within the distributed system.

[0042] In some embodiments, the step of the flow controller performing a flow control check based on the current token count and the current time window to obtain a flow check result includes: The flow controller determines whether the current number of tokens is less than the preset maximum number of tokens; If the flow controller determines that the current number of tokens is less than the preset maximum number of tokens, it will obtain a pass result for the flow check and increase the current number of tokens. If the current number of tokens is not less than the preset maximum number of tokens, the flow controller determines whether the current time window has expired. If the flow controller determines that the current time window has expired, it will obtain a pass result for the flow check, reset the current token count to 1, and update the last reset time.

[0043] In this embodiment, the preset maximum number of tokens can be set in advance according to the actual situation. If the current number of tokens is less than the maximum number of tokens, the request is allowed, i.e., the traffic check result is passed, and the current number of tokens is increased. If the current number of tokens has reached the maximum value, it is determined whether the current time window has expired, i.e., whether the time difference between the current time and the last reset time exceeds the preset time window, i.e., whether the current time window exceeds the preset time window threshold. If it exceeds the threshold, it means that the current time window has expired, the traffic check result is passed, the request is allowed, the current number of tokens is reset to 1, and the last reset time is updated. Otherwise, the traffic check result is failed, and the request is rejected.

[0044] The system checks whether the current token count is less than the preset maximum token count. If the current token count is less than the preset maximum token count, the traffic check is passed, and the current token count is increased. If the current token count is not less than the preset maximum token count, the system checks whether the current time window has expired. If the current time window has expired, the traffic check is passed, the current token count is reset to 1, and the last reset time is updated. The logic is simple, easy to implement, and easy to understand. The high-precision token generation and consumption mechanism ensures the accuracy of traffic control and reduces inconsistencies caused by system scheduling delays. It ensures that the number of requests will not exceed the maximum token count within any time window, and the time window expiration reset avoids problems caused by long-term token occupation.

[0045] Step 240: Based on the traffic inspection results, process the user access request to obtain the processing result.

[0046] In this embodiment, if the traffic check result is successful, it means that access is allowed, and the user access request is responded to; otherwise, it means that access is denied, and the user access request is not responded to.

[0047] In the above implementation process, a traffic controller is initialized in response to a user access request. This traffic controller manages and controls the frequency of each user's access requests. Upon successful initialization, a distributed lock is acquired to control mutual exclusion access to the traffic controller by multiple users. After successfully acquiring the distributed lock, the traffic controller performs a traffic control check to obtain the check result. Based on the check result, the user access request is processed to obtain the processing result. By creating a traffic controller for each user and acquiring a distributed lock before performing the traffic control check, it is ensured that only one request can modify the user's traffic control state at a time. The traffic control check is performed under the protection of the lock. Because a distributed lock is used, it ensures that updates to the traffic control state of the same user are atomic in a distributed environment, thereby accurately controlling the request frequency of each user in a distributed environment, avoiding excessive traffic, and ensuring the scalability and reliability of the system. Through lock-free data structures and segmented locking mechanisms, lock contention and performance overhead are greatly reduced, supporting traffic control in high-concurrency scenarios.

[0048] It should be noted that in practical implementation, traffic control can be refined to different Application Programming Interface (API) endpoints or user roles, using different rate limiting strategies to meet specific needs. In a distributed environment, traffic control across multiple data centers or geographical regions can be supported to improve the global performance and reliability of the system.

[0049] When deploying a traffic access control system, comprehensive testing must be conducted to ensure its performance under various load conditions. Here are some recommended testing and optimization steps: 1. Load testing: Simulate high-concurrency requests to verify the system's performance under load. Tools such as Apache JMeter or Locust can be used for this type of testing.

[0050] 2. Performance Optimization: Analyze the performance bottlenecks of Redis and Go applications, and optimize Redis configuration and Go code to improve processing capacity and response time.

[0051] 3. Monitoring and Logging: Implement logging and monitoring mechanisms to track the effectiveness of flow control and system health. Tools such as Prometheus and Grafana can help monitor Redis performance and the status of Go applications.

[0052] 4. Fault recovery: Design and implement fault recovery strategies to ensure that the system can maintain stable operation when Redis crashes or the network fails.

[0053] Please refer to Figure 3 , Figure 3 The illustration shows a timing diagram of traffic access control according to an embodiment of this application. First, the user role initiates an HTTP request to the object's request handler, and the traffic controller obtains the traffic controller through initialization; then, Redis is initialized, and a distributed lock is created; then, the traffic controller checks the traffic control, and after the traffic check passes, the request is processed, the processing result is returned to the user role, and finally the distributed lock is released.

[0054] Figure 2 This is a flowchart illustrating a traffic access control method in one embodiment. It should be understood that, although... Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0055] Please refer to Figure 4 , Figure 4 A schematic block diagram of a traffic access control device according to an embodiment of this application is shown. This embodiment provides a traffic access control device including an initialization module 410, an acquisition module 420, a checking module 430, and a processing module 440, wherein: Initialization module 410 is used to initialize the traffic controller in response to a user access request. The traffic controller is used to manage and control the access request frequency of each user. The acquisition module 420 is used to acquire a distributed lock when the traffic controller is successfully initialized. The distributed lock is used to control multiple users to access the traffic controller mutually exclusively. The inspection module 430 is used to perform a flow control check by the flow controller and obtain the flow check result when the distributed lock is successfully acquired. The processing module 440 is used to process the user access request based on the traffic inspection result and obtain the processing result.

[0056] The inspection module 430 includes: The token bucket submodule is used by the flow controller to perform flow control checks based on the token bucket algorithm and obtain the flow check results.

[0057] The token bucket submodule includes: The status acquisition unit is used to obtain the current flow control status from Redis by the flow controller. The current flow control status includes the current number of tokens and the last reset time. The calculation unit is used to obtain the current time window based on the current time and the last reset time; The execution unit is used by the flow controller to perform a flow control check based on the current number of tokens and the current time window, and obtain the flow check result.

[0058] The execution unit includes: The first judgment subunit is used by the flow controller to determine whether the current number of tokens is less than the preset maximum number of tokens; The first determining subunit is used to determine, when the flow controller determines that the current number of tokens is less than the preset maximum number of tokens, that the flow check result is passed and to increase the current number of tokens; The second judgment subunit is used by the flow controller to determine whether the current time window has expired when the current number of tokens is not less than the preset maximum number of tokens. The second determining subunit is used to determine, when the flow controller determines that the current time window has expired, that the flow check result is passed, reset the current token count to 1 and update the last reset time.

[0059] The token bucket submodule includes: A Go language unit is used by the flow controller to perform flow control checks based on the token bucket algorithm using the rate package in Go language, and obtain the flow check results.

[0060] The user access request includes user information, and the acquisition module 420 includes: The initialization submodule is used to initialize Redis; A submodule is created to create a distributed lock based on the user information using the Redis SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time.

[0061] The traffic access control device includes a processor and a memory. The initialization module 410, acquisition module 420, inspection module 430 and processing module 440 are all stored in the memory as program units. The processor executes the program modules stored in the memory to implement the corresponding functions.

[0062] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and traffic access control methods can be implemented by adjusting kernel parameters.

[0063] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0064] This application provides a machine-readable storage medium storing a program that, when executed by a processor, implements the above-described traffic access control method.

[0065] This application provides a processor for running a program, wherein the program executes the above-described traffic access control method during runtime.

[0066] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown in the figure, the computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05, and a memory (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A06. The network interface A02 is used for communication with external terminals via a network connection. When the computer program is executed by the processor A01, it implements a flow access control method. The display screen A04 can be a liquid crystal display (LCD) or an e-ink display. The input device A05 can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0067] Those skilled in the art will understand that Figure 5The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0068] In one embodiment, the traffic access control device provided in this application can be implemented as a computer program, and the computer program can be implemented in such a way as... Figure 5 It runs on the computer device shown. The computer device's memory can store the various program modules that make up the traffic access control device, for example, Figure 4 The diagram shows an initialization module 410, an acquisition module 420, an inspection module 430, and a processing module 440. The computer program comprised of these modules causes the processor to execute the steps of the traffic access control methods described in the various embodiments of this application.

[0069] Figure 5 The computer device shown can be used as follows Figure 4 The initialization module 410 in the illustrated traffic access control device executes step 210. The computer device can execute step 220 via the acquisition module 420. The computer device can execute step 230 via the inspection module 430. The computer device can execute step 240 via the processing module 440.

[0070] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: In response to a user access request, a traffic controller is initialized, which is used to manage and control the frequency of access requests for each user; Upon successful initialization of the traffic controller, a distributed lock is acquired, which is used to control mutual exclusive access to the traffic controller by multiple users. If the distributed lock is successfully acquired, the flow controller performs a flow control check and obtains the flow check result. Based on the traffic inspection results, the user access request is processed to obtain the processing result.

[0071] In one embodiment, the step of performing a flow control check by the flow controller to obtain a flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm to obtain the flow check results.

[0072] In one embodiment, the step of the flow controller performing a flow control check based on the token bucket algorithm to obtain the flow check result includes: The current flow control status is obtained from Redis by the flow controller, and the current flow control status includes the current number of tokens and the last reset time; The current time window is obtained based on the current time and the last reset time. The flow controller performs a flow control check based on the current number of tokens and the current time window to obtain the flow check result.

[0073] In one embodiment, the step of the traffic controller performing a traffic control check based on the current token count and the current time window to obtain a traffic check result includes: The flow controller determines whether the current number of tokens is less than the preset maximum number of tokens; If the flow controller determines that the current number of tokens is less than the preset maximum number of tokens, it will obtain a pass result for the flow check and increase the current number of tokens. If the current number of tokens is not less than the preset maximum number of tokens, the flow controller determines whether the current time window has expired. If the flow controller determines that the current time window has expired, it will obtain a pass result for the flow check, reset the current token count to 1, and update the last reset time.

[0074] In one embodiment, the step of the flow controller performing a flow control check based on the token bucket algorithm to obtain the flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm using the rate package in the Go language, and obtains the flow check results.

[0075] In one embodiment, the user access request includes user information, and acquiring the distributed lock includes: Initialize Redis; Based on the user information, a distributed lock is created using the Redis SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time.

[0076] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0080] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0081] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0082] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0083] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0084] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A traffic access control method, characterized in that, The traffic access control method includes: In response to a user access request, a traffic controller is initialized, which is used to manage and control the frequency of access requests for each user; Upon successful initialization of the traffic controller, a distributed lock is acquired, which is used to control mutual exclusive access to the traffic controller by multiple users. If the distributed lock is successfully acquired, the flow controller performs a flow control check and obtains the flow check result. Based on the traffic inspection results, the user access request is processed to obtain the processing result.

2. The method according to claim 1, characterized in that, The process of performing a flow control check by the flow controller to obtain the flow check result includes: The flow controller performs flow control checks based on the token bucket algorithm to obtain the flow check results.

3. The method according to claim 2, characterized in that, The flow control controller performs flow control checks based on the token bucket algorithm to obtain flow check results, including: The current flow control status is obtained from Redis by the flow controller, and the current flow control status includes the current number of tokens and the last reset time; The current time window is obtained based on the current time and the last reset time. The flow controller performs a flow control check based on the current number of tokens and the current time window to obtain the flow check result.

4. The method according to claim 3, characterized in that, The flow controller performs a flow control check based on the current token count and the current time window to obtain the flow check result, including: The flow controller determines whether the current number of tokens is less than the preset maximum number of tokens; If the flow controller determines that the current number of tokens is less than the preset maximum number of tokens, it will obtain a pass result for the flow check and increase the current number of tokens. If the current number of tokens is not less than the preset maximum number of tokens, the flow controller determines whether the current time window has expired. If the flow controller determines that the current time window has expired, it will obtain a pass result for the flow check, reset the current token count to 1, and update the last reset time.

5. The method according to claim 2, characterized in that, The flow control controller performs flow control checks based on the token bucket algorithm to obtain flow check results, including: The flow controller performs flow control checks based on the token bucket algorithm using the rate package in the Go language, and obtains the flow check results.

6. The method according to claim 1, characterized in that, The user access request includes user information, and the acquisition of the distributed lock includes: Initialize Redis; Based on the user information, a distributed lock is created using the Redis SETNX command. The parameters of the SETNX command include the lock identifier, the lock holder identifier, and the lock expiration time.

7. A traffic access control device, characterized in that, The traffic access control device includes: An initialization module is used to initialize a traffic controller in response to a user access request. The traffic controller is used to manage and control the frequency of each user's access requests. The acquisition module is used to acquire a distributed lock upon successful initialization of the traffic controller. The distributed lock is used to control mutual exclusion access to the traffic controller by multiple users. The inspection module is used to perform a flow control check by the flow controller and obtain the flow check result when the distributed lock is successfully acquired. The processing module is used to process the user access request based on the traffic inspection results and obtain the processing results.

8. A processor, characterized in that, It is configured to perform the traffic access control method according to any one of claims 1 to 6.

9. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the traffic access control method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the traffic access control method according to any one of claims 1 to 6.

Images