Request processing method and apparatus, electronic device, and storage medium

Abstract

The application discloses a request processing method and device, electronic equipment and a storage medium. The request processing method comprises the following steps: in response to a plurality of service requests of a client, determining a first service request from the plurality of service requests, which can cause the client to enter a request rejected state; delaying the request processing time point of the first service request; in the case that the request processing time point of the first service request after the delay processing does not arrive, processing a second service request in the plurality of service requests; the second service request is other service request in the plurality of service requests except the first service request; in response to the request processing time point of the first service request after the delay processing, processing the first service request. According to the method of the application, the processing of the service request of the client can be completed to the maximum extent, and the processing efficiency of the service request of the client and the completion degree of the service request are improved.

Description

Technical Field

[0001] This application relates to the field of electronic information technology, and more specifically, to a request processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, when processing service requests from clients on the server side, there are problems such as low service request processing efficiency and low service request completion rate. Summary of the Invention

[0003] In view of this, embodiments of this application propose a request processing method, apparatus, electronic device, and storage medium.

[0004] In a first aspect, embodiments of this application provide a request processing method, the method comprising: responding to multiple service requests from a client, determining from the multiple service requests a first service request that could cause the client to enter a request rejection state; delaying the request processing time point of the first service request; if the request processing time point after the delay of the first service request has not been reached, processing a second service request from the multiple service requests; the second service request being any other service request from the multiple service requests besides the first service request; and processing the first service request in response to the arrival of the request processing time point after the delay of the first service request.

[0005] Secondly, embodiments of this application provide a request processing apparatus, comprising: a response module, configured to, in response to multiple service requests from a client, determine a first service request from the multiple service requests that could cause the client to enter a request rejection state; a delay processing module, configured to delay the request processing time point of the first service request; a first request processing module, configured to process a second service request from the multiple service requests if the request processing time point after the delay processing of the first service request has not been reached; the second service request being other service requests besides the first service request from the multiple service requests; and a second request processing module, configured to process the first service request in response to the arrival of the request processing time point after the delay processing of the first service request.

[0006] Optionally, the response module is also configured to respond to multiple service requests from the client, and determine from the multiple service requests the service request whose request category is included in a preset request category set as the first service request; the request category set includes at least one preset suspicious request category, which refers to the category to which the request belongs that could cause the sender of the request to enter a state of request rejection.

[0007] Optionally, the apparatus further includes an acquisition module for acquiring multiple sample requests, wherein the sample requests are requests that cause the sender of the request to enter a state of request rejection; identifying the request categories of the multiple sample requests to obtain at least one preset suspicious request category; and determining a set of request categories based on the at least one preset suspicious request category.

[0008] Optionally, the second request processing module is further configured to determine, if all other security services have been processed, that the delayed processing time of the service request has been reached; wherein, the other security services are the services requested by the second service request.

[0009] Optionally, the response module is also configured to respond to multiple service requests from the client, determine from the multiple service requests a service request sent by a preset security scanning tool as a third service request; and determine from the third service request a first service request that can cause the client to enter a state of request rejection.

[0010] Optionally, the service request is an authentication request; the second request processing module is also used to perform tool configuration processing based on the pluggable authentication tool to obtain the configured pluggable authentication tool; if the number of authentication failures of the first service request reaches a preset number, the client is controlled to enter the request rejection state through the configured pluggable authentication tool.

[0011] Optionally, the second request processing module is further configured to lock the client's network address using a configured pluggable authentication tool if the number of authentication failures of the first service request reaches a preset number, so that the client enters a request-rejected state.

[0012] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory; the memory stores computer-readable instructions, which, when executed by the processor, implement the above-described method.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-readable instructions that, when executed by a processor, implement the above-described method.

[0014] Fifthly, embodiments of this application provide a computer program product including computer-readable instructions that, when executed by a processor, implement the method described above.

[0015] This application provides a request processing method, apparatus, electronic device, and storage medium. In this application, firstly, a first service request that could cause the client to enter a request rejection state is determined. Then, the processing of the first service request is delayed, and second service requests (service requests that cannot cause the client to enter a request rejection state) are processed first. Finally, when the request processing time point after the delayed processing of the first service request arrives, the first service request is processed. This allows for the priority processing of other second service requests, reducing the likelihood of client service requests being blocked or unable to be processed in a timely manner after the first service request causes the client to enter a request rejection state. This maximizes the processing efficiency and completeness of client service requests. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram is shown illustrating the application scenarios applicable to the embodiments of this application; Figure 2 A flowchart of a request processing method according to an embodiment of this application is shown; Figure 3 A flowchart of a request processing method according to yet another embodiment of this application is shown; Figure 4 A flowchart of a request processing method according to another embodiment of this application is shown; Figure 5 A flowchart of a request processing method according to another embodiment of this application is shown; Figure 6 A flowchart of a request processing method according to another embodiment of this application is shown; Figure 7 A block diagram of a request processing apparatus according to one embodiment of this application is shown; Figure 8 A structural block diagram of an electronic device for performing a request processing method according to an embodiment of this application is shown. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0019] In the following description, the terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit the application. It should be noted that "multiple" as used herein refers to two or more. "And / or" describes the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0021] Please refer to Figure 1 The diagram illustrates an application scenario applicable to the embodiments of this application. This application scenario includes a client 110 and a server 120.

[0022] Client 110 can be, for example, a smartphone, tablet, e-book reader, music player, wearable device, smart home device, in-vehicle client, etc. Client 110 can be a terminal that integrates a request client, which can respond to the user's request operation and send a service request to server 120, so that server 120 can respond to the service request and perform the corresponding service action.

[0023] The server 120 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0024] In some implementations, the client 110 may initiate a service request to the server 120, so that the server 120 can respond to the service request of the client 110, determine the first service request that can cause the client to enter the state of request rejection, then the server 120 delays the request processing time of the first service request, and if the request processing time after the delay of the first service request has not been reached, processes the second service request among multiple service requests, and finally, the server 120 responds to the request processing time after the delay of the first service request has been reached and processes the first service request.

[0025] Please see Figure 2 , Figure 2 This application illustrates a flowchart of a request processing method according to an embodiment of the present application. The method is applied to an electronic device, which may be... Figure 1 The server-side method 120 in the middle can include: S110. In response to multiple service requests from the client, determine the first service request from the multiple service requests that can cause the client to enter the state of request rejection.

[0026] In this application, "service" refers to the services that the server can provide. The service categories provided by the server can include web application services, API services, network services, and database services, etc. For example, the services provided by the server are MySQL services and MariaDB services.

[0027] In some implementations, the server can refer to a physical or virtual node in a server cluster that provides services.

[0028] A client can refer to a device or an application installed on a device that communicates with the server. In response to a user's request, the client can create a service request, which may include the target service identifier of the requested service. The service identifier refers to the service name, number, and code of the service, while the target service identifier is the service identifier of the target service, used to directly indicate the target service.

[0029] For each service request sent by the client, after receiving the service request from the client, the server can directly respond to the service request sent by the client and determine whether the server service request can cause the client to enter the request rejection state. The request rejection state means that the client's request is rejected. The client request rejection state is equivalent to the client being locked. The server no longer or temporarily does not process the client's request. This does not mean that the client cannot send a request, but that the server does not respond or process it.

[0030] For example, in a Linux environment, the state where a request is rejected is the Faillock state. The faillock mechanism in Linux is an authentication failure locking function provided by the PAM module pam_faillock. It is used to lock an account after the client fails to authenticate multiple times to prevent brute-force attacks.

[0031] Generally, in a Linux environment, after the server limits the number of failures using pam.d, the client's IP address is locked, causing the client to enter a faillock state. Pam.D: PluggableAuthentication Modules, in Linux systems, allows system administrators to customize how applications or services authenticate users, manage sessions, and manage passwords.

[0032] In this embodiment, it can be determined whether a service request can cause the client to enter a request rejection state based on the request category or request content.

[0033] Among multiple service requests, the service request that can cause the client to enter the request rejection state is designated as the first service request, while the other service requests that cannot cause the client to enter the request rejection state are designated as the second service requests.

[0034] It is worth mentioning that multiple service requests from the client can be triggered simultaneously or within a short period of time (e.g., within 10 seconds or 1 minute). The server can hardly complete each service request in parallel at the same time. The server usually executes each service request in a certain order. Therefore, according to the method of this application, the second service request can be processed first, and the first service request that can cause the client to enter the state of request rejection can be delayed.

[0035] Of course, multiple service requests initiated by the client at a certain time period may all be second service requests, that is, the service requests do not include the first service request that could cause the client to enter the state of request rejection. In this case, the service requests can be processed in the normal request processing manner, and there is no need to delay the processing of the service requests in accordance with the method of this application.

[0036] S120. Delay the processing time of the first service request.

[0037] The request processing time point of a service request refers to the time point at which the service request is processed. Generally, service requests are usually requests without timed functionality configured, in which case the request processing time point is the time point when the service request is received. If the service request is a request with timed functionality configured, then the time point configured for the service request is used as the request processing time point.

[0038] If a service request does not cause the client to enter a request-rejected state, the service request is treated as a second service request. When the processing time of the second service request arrives, the second service request is processed directly. If a service request does cause the client to enter a request-rejected state, the service request is treated as a first service request. The processing time of the first service request is delayed to obtain a delayed processing time.

[0039] In some implementations, the processing time of the first service request can be delayed for a fixed period of time, such as one hour or 10 hours.

[0040] In some other implementations, the delay can be dynamically adjusted based on the specific details of the service requests sent by the client to the server. For example, if the client sends 10 service requests to the server, and the 5th service request is the first service request that causes the client to enter a request rejection state, this first service request is delayed to be the last service request processed. However, if the server receives a new service request from the client while processing the request, the first service request is further delayed to be processed last (that is, the 11th service request processed is the first service request).

[0041] Since the first service request can cause the client to enter a request rejection state, in order to avoid the first service request causing the client to enter a request rejection state, the processing of the first service request is delayed (by delaying the request time of the service request). This allows the server to complete the services requested by other second service requests first, thus avoiding the situation where the server is unable to provide services to the client after the client enters a request rejection state.

[0042] It is understandable that delaying the processing time of the first service request when it causes the client to enter the request rejection state can delay the client's entry into the request rejection state, giving the client more time to obtain the service provided by the server and ensuring that the server can continue to provide services to the client.

[0043] S130. If the request processing time point after the delayed processing of the first service request has not been reached, process the second service request among the multiple service requests.

[0044] S140. When the delayed processing time point for the first service request is reached, the first service request is processed.

[0045] As mentioned above, if the processing time point after the delayed processing of the first service request has not been reached, the second service request among multiple service requests will be processed first, so as to prioritize the service requests that will not cause the client to enter the request rejection state, and provide the client with as many services as possible.

[0046] Subsequently, at the request processing time point after the delayed processing of the first service request, the server directly processes the first service request to provide services to the client.

[0047] For example, if the client sends a security scan request to the server, and the server determines that the security scan request may cause the client to enter a request rejection state, then the processing time for the security scan request is delayed, and the second service request sent by the client (a service request that will not cause the client to enter a request rejection state) is processed first. After the processing time for the security scan request is reached, the security scan request is executed, the security scan of the server is performed, and the obtained security scan results are returned to the client.

[0048] In this embodiment, firstly, a first service request that could cause the client to enter a request rejection state is identified. Then, the processing of the first service request is delayed, while second service requests (service requests that cannot cause the client to enter a request rejection state) are processed first. Finally, when the request processing time for the first service request is reached after the delayed processing, the first service request is processed. This prioritizes the processing of other second service requests, reducing the likelihood of the client's service requests being blocked and unable to be processed in a timely manner after the first service request causes the client to enter a request rejection state. This maximizes the processing efficiency and completeness of client service requests.

[0049] Furthermore, by delaying the processing order of service requests that may cause faillocks, allowing other services to be evaluated first, the vulnerability identification rate can be greatly improved in specific scenarios (such as when the other party's server has enabled pam.d to limit the number of authentication failures).

[0050] In some implementations, such as Figure 3 As shown, S110 includes: S111. In response to multiple service requests from the client, determine the service request whose request category is included in a preset set of request categories from the multiple service requests, and take it as the first service request.

[0051] The request category set includes at least one preset suspicious request category, which refers to the category to which a request belongs that could cause the sender of the request to enter a state of request rejection.

[0052] In other words, a set of request categories can be pre-configured, including preset suspicious request categories. Preset suspicious request categories refer to the category to which a request belongs that causes the sender of the request to enter a state of request rejection. For example, preset suspicious request categories may include SSH request categories and telnet request categories, etc.

[0053] Therefore, the request categories of each service request sent by the client are analyzed to determine the request category of the client's service request. If the request category of the service request is included in the request category set, it is directly determined that the service request can cause the client to enter the request rejection state, and the service request is identified as the first service request. If the request category of the service request is not included in the request category set, it is directly determined that the service request cannot cause the client to enter the request rejection state, and the service request is identified as the second service request.

[0054] In some implementations, prior to S111, the method further includes: acquiring multiple sample requests, wherein the sample requests are requests that cause the sender of the request to enter a state of request rejection; identifying the request categories of the multiple sample requests to obtain at least one preset suspicious request category; and determining a set of request categories based on the at least one preset suspicious request category.

[0055] In other words, requests that cause the sender to enter a request rejection state can be obtained as sample requests. The request categories of these sample requests are statistically analyzed, and based on these sample request categories, at least one preset suspicious request category is obtained to complete the construction of the request category set. For example, the request categories involved in all sample requests can be obtained as preset suspicious request categories, or one or more of the request categories involved in all sample requests can be obtained as preset suspicious request categories.

[0056] Of course, the request category set can also be updated at any time. When a sufficient number of new requests that can cause the sender to enter the request rejection state are obtained, the new requests that can cause the sender to enter the request rejection state are taken as new sample requests. The new sample requests are analyzed to obtain new preset suspicious request categories, and the new preset suspicious request categories are added to the request category set.

[0057] In this embodiment, a preset suspicious request category in the request category set is used to indicate whether a service request can cause the client to enter a request rejection state. This enables accurate determination of service requests, thereby improving the accurate delay processing of service requests that need to be delayed. It also avoids delaying the processing of service requests that do not need to be delayed, which would lead to untimely service request responses and low service request processing efficiency.

[0058] In some embodiments, such as Figure 4 As shown, before S140, the method further includes: S141. If all other security services have been completed, the delayed processing time of the service request is determined to have been reached.

[0059] Among these, the other security services are those requested by the second service request. In other words, the first service request, which may have caused the client to enter a state of request rejection, is processed only after the security services requested by the client's second service request have been processed.

[0060] If, in addition to the target service requested by the first service request and other security services (i.e., the services requested by the second service request), the client also sends other insecure requests (requests that cause the client to enter a request-rejected state), then the first service request and other insecure requests can be executed sequentially based on their priority. The priority of different requests that cause the client to enter a request-rejected state can be set according to requirements, and this application does not impose any limitations. For example, the priority of a security scan request is higher than the priority of a login request.

[0061] In this embodiment, by providing other security services first and then executing the first service request that causes the client to enter the request rejection state, it is ensured that other security services can be completed smoothly. This allows the server to respond promptly to security service requests from the client that do not cause the client to enter the request rejection state, thereby improving the processing efficiency of security service requests.

[0062] In some embodiments, such as Figure 5 As shown, S110 includes: S112. In response to multiple service requests from the client, determine the service request sent by the preset security scanning tool as the third service request from among the multiple service requests.

[0063] S113. From the third service request, determine the first service request that can cause the client to enter the state of request rejection.

[0064] Among them, the preset security scanning tool refers to the tool used to perform security scanning on the server. Preset security scanning tools can be, for example, Fortify, Checkmarx, VScan, Veracode, and Syhunt Code.

[0065] If it is determined that the service request was sent through a preset security scanning tool, it means that the service request is used to perform a security scan on the server. The service request is highly likely to cause the client to enter the request rejection state. Therefore, the service request is identified as a third service request - a suspicious service request, which has a high probability of causing the client to enter the request rejection state. Then, the third service request is further filtered to identify the first service request that can cause the client to enter the request rejection state.

[0066] If it is determined that the service request was not sent through the preset security scanning tool, it means that the service request was not used to perform a security scan on the server. The service request is unlikely to cause the client to enter a request rejection state. Therefore, the service request is directly determined as the second service request, and the server responds to the service request.

[0067] Generally, service requests can carry a client identifier. If the service request is sent through a pre-defined security scanning tool, it can also carry the tool identifier of that tool. This tool identifier allows identification of whether the service request was sent by the pre-defined security scanning tool. The tool identifier can be the name, code, or number of the pre-defined security scanning tool.

[0068] After identifying the third service request, determine the first service request from among the third service requests that could cause the client to enter a request rejection state. For example, the first service request can be a third service request whose request category is included in a preset set of request categories.

[0069] In this embodiment, by pre-judging whether the service request was sent through a preset security scanning tool, instead of analyzing all service requests to determine whether they cause the client to enter a request rejection state, the number of requests analyzed is reduced, and the speed and efficiency of request analysis are improved.

[0070] In some embodiments, such as Figure 6 As shown, the service request is an authentication request. Before S140, the method also includes: S150. Perform tool configuration processing based on the pluggable authentication tool to obtain the configured pluggable authentication tool.

[0071] The pluggable authentication tool can refer to pam.d. After obtaining the pluggable authentication tool, the server is configured using it to obtain the configured pluggable authentication tool.

[0072] Accordingly, after S140, the method may also include: S160. If the number of authentication failures for the first service request reaches a preset number, the client is controlled to enter a request rejection state through the configured pluggable authentication tool.

[0073] The preset number of times can be set according to needs, for example, the preset number of times is 3 or 5 times, etc.

[0074] If the number of authentication failures for the first service request reaches a preset number, it means that the first service request is suspected to be a request generated by malicious scanning or malicious brute-force attacks. Through the configured pluggable authentication tool, the client is controlled to enter the request rejection state so that the client's request will no longer be responded to, thereby avoiding the adverse impact of malicious requests on the operation of the server and ensuring the normal operation of the server.

[0075] In this embodiment, controlling the client to enter the request rejected state can be either to permanently control the client to enter the request rejected state or to temporarily control the client to enter the request rejected state. The duration of temporarily entering the request rejected state can be, for example, 10 minutes or 1 hour.

[0076] Optionally, S160 may include: if the number of authentication failures of the first service request reaches a preset number, locking the client's network address through a configured pluggable authentication tool, so that the client enters a request-rejected state.

[0077] In other words, in this embodiment, the client is locked by locking its network address (IP address), thus entering a state where the request is rejected.

[0078] For example, to lock the client's network address, the following pluggable authentication tool is configured on the server: # Add the following to / etc / pam.d / sshd or / etc / pam.d / password-auth Auth required pam_tally2.so deny=5 unlock_time=600 even_deny_root Account required pam_tally2.so Here, "5" refers to the preset number of rejections, and "unlock_time" refers to the duration of the lock on the client, which is 600 seconds.

[0079] In this embodiment, a pluggable authentication tool is used to identify clients exhibiting suspicious malicious behavior, thereby preventing the server from being attacked by malicious actions and ensuring the safe and stable operation of the server.

[0080] Please see Figure 7 , Figure 7 This illustration shows a block diagram of a request processing apparatus according to an embodiment of the present application. The request processing apparatus 800 includes: The response module 810 is used to respond to multiple service requests from the client and determine the first service request from the multiple service requests that can cause the client to enter the state of request rejection. The delay processing module 820 is used to delay the request processing time of the first service request; The first request processing module 830 is used to process the second service request among multiple service requests if the request processing time point after the delayed processing of the first service request has not been reached; the second service request is other service requests among multiple service requests besides the first service request. The second request processing module 840 is used to process the first service request when the delayed processing time point of the first service request is reached.

[0081] Optionally, the response module 810 is further configured to respond to multiple service requests from the client, and determine from the multiple service requests a service request whose request category is included in a preset request category set, as the first service request; the request category set includes at least one preset suspicious request category, which refers to the category to which a request belongs that could cause the sender of the request to enter a state of request rejection.

[0082] Optionally, the apparatus further includes an acquisition module for acquiring multiple sample requests, wherein the sample requests are requests that cause the sender of the request to enter a state of request rejection; identifying the request categories of the multiple sample requests to obtain at least one preset suspicious request category; and determining a set of request categories based on the at least one preset suspicious request category.

[0083] Optionally, the second request processing module 840 is further configured to determine, if all other security services have been processed, that the delayed processing time of the service request has been reached; wherein, the other security services are the services requested by the second service request.

[0084] Optionally, the response module 810 is further configured to respond to multiple service requests from the client, determine from the multiple service requests a service request sent by a preset security scanning tool as a third service request; and determine from the third service request a first service request that can cause the client to enter a state where the request is rejected.

[0085] Optionally, the service request is an authentication request; the second request processing module 840 is also used to perform tool configuration processing based on the pluggable authentication tool to obtain the configured pluggable authentication tool; if the number of authentication failures of the first service request reaches a preset number, the client is controlled to enter the request rejection state through the configured pluggable authentication tool.

[0086] Optionally, the second request processing module 840 is further configured to lock the client's network address using a configured pluggable authentication tool if the number of authentication failures of the first service request reaches a preset number, so that the client enters a request-rejected state.

[0087] It should be noted that the device embodiments in this application correspond to the aforementioned method embodiments. The specific principles in the device embodiments can be found in the content of the aforementioned method embodiments, and will not be repeated here.

[0088] Figure 8 A structural block diagram of an electronic device for performing a request processing method according to an embodiment of this application is shown. The electronic device may be... Figure 1 The server-side 120, etc., should be noted that Figure 8 The computer system 1200 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0089] like Figure 8 As shown, the computer system 1200 includes a Central Processing Unit (CPU) 1201, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 1202 or programs loaded from storage portion 1208 into Random Access Memory (RAM) 1203. The RAM 1203 also stores various programs and data required for system operation. The CPU 1201, ROM 1202, and RAM 1203 are interconnected via a bus 1204. An Input / Output (I / O) interface 1205 is also connected to the bus 1204.

[0090] The following components are connected to I / O interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to I / O interface 1205 as needed. Removable media 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1210 as needed so that computer programs read from them can be installed into storage section 1208 as needed.

[0091] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1209, and / or installed from removable medium 1211. When the computer program is executed by central processing unit (CPU) 1201, it performs various functions defined in the system of this application.

[0092] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer-readable instructions.

[0094] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0095] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries computer-readable instructions that, when executed by a processor, implement the methods in any of the above embodiments.

[0096] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer-readable instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer-readable instructions from the computer-readable storage medium, and the processor executes the computer-readable instructions, causing the electronic device to perform the methods of any of the above embodiments.

[0097] In the embodiments of this application, the terms "module" or "unit" refer to a part of a computer program with a predetermined function, which works together with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (e.g., processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that functions as a whole.

[0098] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0099] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause an electronic device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0100] Other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. It should be understood that this application is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A request processing method, characterized in that, The method includes: In response to multiple service requests from a client, determine from the multiple service requests a first service request that could cause the client to enter a request rejection state; The request processing time of the first service request is delayed; If the processing time point after the delayed processing of the first service request has not been reached, the second service request among the plurality of service requests will be processed; the second service request is any other service request among the plurality of service requests besides the first service request. When the delayed processing time for the first service request is reached, the first service request is processed.

2. The method according to claim 1, characterized in that, The step of responding to multiple service requests from a client and determining, from among the multiple service requests, a first service request that can cause the client to enter a request rejection state includes: In response to multiple service requests from the client, a service request whose request category is included in a preset request category set is identified from the multiple service requests and designated as the first service request; the request category set includes at least one preset suspicious request category, which refers to the category to which a request belongs that could cause the sender of the request to enter a state of request rejection.

3. The method according to claim 2, characterized in that, Before determining, in response to multiple service requests from the client, a service request whose request category is included in a preset set of request categories is selected as the first service request, the method further includes: Obtain multiple sample requests, wherein the sample requests are requests that cause the sender of the request to enter a state of request rejection; The request categories of the multiple sample requests are identified to obtain at least one preset suspicious request category; Based on the at least one preset suspicious request category, the set of request categories is determined.

4. The method according to claim 1, characterized in that, The method further includes: If all other security services have been processed, the delayed processing time of the service request is determined to have been reached; wherein, the other security services are the services requested by the second service request.

5. The method according to claim 1, characterized in that, The step of responding to multiple service requests from a client and determining, from among the multiple service requests, a first service request that can cause the client to enter a request rejection state includes: In response to multiple service requests from the client, a service request sent through a preset security scanning tool is selected as the third service request from among the multiple service requests; From the third service request, determine the first service request that could cause the client to enter a state where the request is rejected.

6. The method according to claim 1, characterized in that, The first service request is an authentication request; before processing the first service request after the delayed processing time point in response to the first service request has arrived, the method further includes: The tool configuration process is performed based on the pluggable authentication tool to obtain the configured pluggable authentication tool; When the delayed processing time point in response to the first service request is reached, and the first service request is processed, the method further includes: If the number of authentication failures for the first service request reaches a preset number, the client is controlled to enter a request rejection state through the configured pluggable authentication tool.

7. The method according to claim 6, characterized in that, If the number of authentication failures for the first service request reaches a preset number, the configured pluggable authentication tool controls the client to enter a request-rejected state, including: If the number of authentication failures for the first service request reaches a preset number, the network address of the client is locked using the configured pluggable authentication tool, so that the client enters a request-rejected state.

8. A request processing apparatus, characterized in that, The device includes: The response module is used to respond to multiple service requests from a client and determine, from the multiple service requests, a first service request that can cause the client to enter a request rejection state. The delay processing module is used to delay the request processing time of the first service request; The first request processing module is used to process the second service request among the plurality of service requests if the request processing time point after the delayed processing of the first service request has not been reached; the second service request is any other service request among the plurality of service requests besides the first service request. The second request processing module is used to process the first service request when the request processing time point after the delayed processing of the first service request is reached.

9. An electronic device, characterized in that, include: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.

11. A computer program product, characterized in that, It includes computer-readable instructions that, when executed by a processor, implement the method as described in any one of claims 1-7.

Images