WO2016155411A1 - 限制批量请求服务的方法和装置 - Google Patents

限制批量请求服务的方法和装置 Download PDF

Info

Publication number
WO2016155411A1
WO2016155411A1 PCT/CN2016/072359 CN2016072359W WO2016155411A1 WO 2016155411 A1 WO2016155411 A1 WO 2016155411A1 CN 2016072359 W CN2016072359 W CN 2016072359W WO 2016155411 A1 WO2016155411 A1 WO 2016155411A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
topic
computing
service
server
Prior art date
Application number
PCT/CN2016/072359
Other languages
English (en)
French (fr)
Inventor
李伟奇
Original Assignee
北京京东尚科信息技术有限公司
北京京东世纪贸易有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京京东尚科信息技术有限公司, 北京京东世纪贸易有限公司 filed Critical 北京京东尚科信息技术有限公司
Priority to US15/563,034 priority Critical patent/US10366223B2/en
Priority to JP2017550895A priority patent/JP6491352B2/ja
Priority to RU2017134564A priority patent/RU2678643C1/ru
Publication of WO2016155411A1 publication Critical patent/WO2016155411A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/36—User authentication by graphic or iconic representation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2103—Challenge-response
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2133—Verifying human interaction, e.g., Captcha
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a method and apparatus for limiting bulk request services.
  • Network layer restrictions Policy control is applied to the request frequency at the network layer. E.g:
  • a rule policy such as limiting the number of IPs accessed by the URL per unit time, and determining information such as cookies;
  • Mobile phone short message verification the service sends a verification code to the user's mobile phone and asks the user to input before completing the request.
  • Checking by verification code is the most common and mature solution at present, and it has been widely used. However, the validity of the verification code depends on whether the machine can effectively identify and answer the question. If the difficulty of the problem is set too high, it will bring the user It is difficult, and with the low difficulty of evolution of machine intelligence, it has not been able to effectively prevent automatic recognition of machines. Advances in OCR technology have led to a reduction in the effectiveness of image recognition based on character distortion. Machine intelligence advancements have made machine auto-answer testing less reliable. In addition, the verification code reduces the user body. The test has caused great troubles for people such as color blindness and the elderly.
  • SMS authentication based on mobile phone has high reliability, but the limitation is also very large. It requires users to bind mobile phones, have additional SMS sending costs, and user operations are cumbersome.
  • the present invention provides a method and apparatus for restricting bulk request services, which helps to limit the behavior of requesting services in batches, and helps to overcome some of the deficiencies in the prior art.
  • a method of restricting a batch request service is provided.
  • the method for limiting the batch request service of the present invention includes: the server receives the service request information sent by the terminal; the server sends a calculation question to the terminal, where the computing resource demand for the terminal is greater than the corresponding Determining a computing resource requirement of the server; the server receives the calculation result of the terminal on the topic, and then verifies the result, if yes, provides a service to the terminal, otherwise refuses to provide a service to the terminal .
  • the calculation topic includes a calculation topic for consuming memory of the terminal.
  • the method further includes: the server sending, to the terminal, data of a plurality of data segments in a memory of the server device; the calculation topic includes Requiring the terminal to provide data in one of the plurality of data slices in a specified data slice.
  • the calculation topic includes a calculation topic for consuming network resources of the terminal.
  • the method further includes: saving a plurality of network addresses, where each network address has a file; and saving the number of files on the multiple network addresses
  • the summary value includes: the terminal is required to provide a digital digest value of a file on a specified network address of the plurality of network addresses.
  • an apparatus for restricting a bulk request service is provided.
  • the device for limiting the batch request service of the present invention includes: a receiving module, configured to receive service request information sent by the terminal; and a question sending module, configured to send, to the terminal, a computing topic, the computing resource requirement of the computing topic for the terminal The quantity is greater than the amount of computing resources required by the server; the verification response module is configured to receive the calculation result of the terminal by the terminal, and then verify the result. If yes, return to the terminal to indicate that the verification is passed. Information, otherwise returning information indicating that the verification failed.
  • the calculation topic includes a calculation topic for consuming memory of the terminal.
  • the method further includes: an in-memory data sending module, configured to send, to the terminal, data of a plurality of data segments in a memory of the server device; the computing topic includes: requesting the terminal to provide the plurality of data regions One of the slices specifies the data in the data slice.
  • an in-memory data sending module configured to send, to the terminal, data of a plurality of data segments in a memory of the server device; the computing topic includes: requesting the terminal to provide the plurality of data regions One of the slices specifies the data in the data slice.
  • the calculation topic includes a calculation topic for consuming network resources of the terminal.
  • the method further includes a network address saving module, configured to save a plurality of network addresses, wherein each network address has a file; and save a digital digest value of the file on the plurality of network addresses; Requiring the terminal to provide a digital digest value of a file on a specified one of the plurality of network addresses.
  • a network address saving module configured to save a plurality of network addresses, wherein each network address has a file; and save a digital digest value of the file on the plurality of network addresses; Requiring the terminal to provide a digital digest value of a file on a specified one of the plurality of network addresses.
  • the server providing the service is provided to the terminal requesting the service.
  • the calculation problem is asymmetric for the computing resource requirements of the server and the terminal.
  • the terminal must solve the problem in order to obtain the service further.
  • This limitation cannot be bypassed; and it does not consume too much computing resources for a legitimate terminal that requests only one or several times, so that the availability of the service is not reduced; For a terminal that uses a program malicious bulk request, it will effectively consume its computing resources and make it difficult to continue the request.
  • the technical solution obviously avoids the limitations of existing verification code checking terminals and mobile phone short message authentication terminals. Sex.
  • FIG. 1 is a schematic diagram of main steps of a method for restricting a batch request service according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of main modules of an apparatus for restricting bulk request services, in accordance with an embodiment of the present invention.
  • the service provider gives a topic to the service requester, and the service requester program must consume the computing resources (CPU, memory, network resources, etc.) to solve the problem.
  • the difficulty of the topic is preferably set to a reasonable range, so that the client resource consumption is controlled to an acceptable range for the discrete single normal user, and the parallel batch request, especially the parallel batch request, becomes very large due to the resource requirement multiplication. Difficult to proceed.
  • the resource requirements of the party to be verified are asymmetric, and the resource consumption of the check is small to not degrade the performance of the server.
  • the asymmetry problem described above can be based on asymmetric algorithms (such as large number decomposition) or information asymmetry (such as requiring the service requester to download and calculate a file summary value that is known to the service provider).
  • the service provider requires the requester to solve a problem each time the user registers.
  • the required resource is increased by the CPU to calculate 2s for 100% load, 1G for memory consumption, and 1Mbyte for network traffic.
  • the attacker still starts 256 threads, it can only register up to 30 users in one minute, and the resource consumption is 100% CPU load, 256G memory consumption, and 256 Mbytes of network traffic.
  • FIG. 1 is a schematic diagram of the main steps of a method of restricting a batch request service according to an embodiment of the present invention. The method is performed by a server maintained by the service provider described above.
  • Step S11 The server receives the service request information sent by the terminal.
  • the terminal here is the client software used by the user.
  • the service request information may be sent by a normal user or by a malicious user.
  • Step S12 The server sends a calculation question to the terminal.
  • the computational resource requirement for the computing terminal is greater than the computing resource requirement for the server to achieve proper consumption of computing resources of the terminal.
  • Step S13 The server receives the calculation result of the terminal by the terminal.
  • Step S14 The server verifies whether the received calculation result is correct. If yes, proceed to step S15 to provide a service to the terminal; otherwise, proceed to step S16 to refuse to provide the service to the terminal. Of course, regardless of whether the result is correct or not, the corresponding prompt message will be sent to the terminal.
  • CPU computing resource consumption There are many asymmetric algorithms, such as large number decomposition.
  • the computational complexity of problem solving can be controlled by the number of bits in the target number.
  • the calculation resource requirements for solving and checking are asymmetry, and the cost of checking is very low. (Perform a finite number of multiplication operations); several algorithms can be interleaved in an actual system to further improve security.
  • the resource demand asymmetry can be achieved by the following methods: For the service provider, only one data area needs to be randomly selected as a problem, and only one data area needs to be saved (or even only It is necessary to save a summary of the data area; and for the service requester, since it is not known which data area the data provider needs to answer, only all data areas can be saved. In this way, the server can send different data areas in the memory of the server device to the terminal multiple times, and then the content of the topic to the terminal can be “what is the data of the X zone slice”, where X represents the specified A block. It can be seen that this method is asymmetric for the memory resource consumption of the server and the terminal requesting the service.
  • a database can be established.
  • the database stores a series of links to public documents on the Internet.
  • the digital summary values of each file are pre-calculated and saved.
  • the service provider randomly selects a file and service request during verification. The person is asked to download this file and calculate the digital summary value to pass the verification.
  • the device 20 for limiting the batch request service mainly includes: a receiving module 21, and a The title module 22 and the verification response module 23.
  • the receiving module 21 is configured to receive the service request information sent by the terminal
  • the problem sending module 22 is configured to send, to the terminal, a computing topic, where the computing resource requirement of the computing topic is greater than the computing resource requirement of the server
  • the verification response module 23 is configured to receive the calculation result of the terminal by the terminal, and then verify the result. If yes, return information indicating that the verification is passed to the terminal, otherwise return to the terminal to indicate verification. Information that failed.
  • the calculation topic may include a calculation topic for consuming the memory of the terminal.
  • the device 20 may further include an in-memory data sending module, configured to send data of the plurality of data segments in the memory of the server device to the terminal; and calculating the topic may include: requesting the terminal to provide the plurality of data regions. A data in a specified data slice.
  • the calculation topic may include a calculation topic for consuming the network resources of the terminal.
  • the apparatus 20 may further include a network address saving module for storing a plurality of network addresses, wherein each network address has a file; and storing a digital digest value of the file on the plurality of network addresses; and calculating the title
  • the method includes: requiring the terminal to provide a digital digest value of a file on a specified one of the plurality of network addresses.
  • the server providing the service issues a calculation topic to the terminal requesting the service, and the calculation topic is asymmetric for the computing resource requirements of the server and the terminal.
  • the terminal must solve the problem in order to obtain the service further.
  • This limitation cannot be bypassed; and it does not consume too much computing resources for a legitimate terminal that requests only one or several times, so that the availability of the service is not reduced; For a terminal that uses a program malicious bulk request, it will effectively consume its computing resources and make it difficult to continue the request.
  • the technical solution obviously avoids the limitations of existing verification code checking terminals and mobile phone short message authentication terminals. Sex.

Abstract

一种限制批量请求服务的方法和装置，有助于对批量地请求服务的行为做出限制，并有助于克服现有技术中的一些不足之处。其中，方法包括：服务端接收终端发送的服务请求信息（S11）；所述服务端向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量（S12）；所述服务端接收所述终端对所述题目的计算结果（S13），然后对该结果进行验证（S14），若正确，则向所述终端提供服务（S15），否则拒绝向所述终端提供服务（S16）。

Description

限制批量请求服务的方法和装置 技术领域
本发明涉及计算机技术领域，特别地涉及一种限制批量请求服务的方法和装置。
背景技术
在Internet给我们带来强大的业务支撑能力的同时，作为服务提供者也同时面临着严峻的来自公网的恶意攻击。这其中有一大类攻击属于利用批量程序快速、重复执行来获取服务，如：批量注册、批量发帖、刷排名、秒杀器、利用爬虫复制网站等等，通过这些批量操作以达到冒充一批用户操作的目的；以批量注册程序为例，如果服务提供者不加限制，一个批量注册程序可以在一台个人计算机上通过并行执行的方式1小时注册上万仿冒用户，这些仿冒用户后续可以进一步用来获得非法收益。
这些批量操作请求大量的消耗了服务提供者的计算资源，但是带来的却是无效流量、降低了服务性能、干扰了正常用户的访问。为了保证服务的正常运行，服务提供者需要考虑如何限制这类批量操作(常称作“防刷”)，使得服务资源能服务于正常用户。
目前常用的限制批量请求服务(防刷)的手段包括如下方法：
1、网络层限制：在网络层对请求频率做出策略控制。例如：
(1)、按照IP地址与端口号访问情况做具体限制，如单位时间内允许的访问次数；
(2)、根据HTTP头做规则策略，如限制URL的单位时间访问的IP数量，判断Cookie等信息；
(3)、改变浏览器端设置，利用Cookie变化、Javascript等技术，阻止重复请求，例如：限制http_referer防盗链、限制http_user_agent 防爬虫、限制request_method方法、限制http_cookie禁止没有携带正确cookie的访问者。
2、应用层限制：通过程序主动控制访问行为。例如：
(1)、限制单位时间内访问次数；
(2)、设置访问时间间隔设置；
(3)、设置封锁时间；
(4)、设置黑白名单；
3、通过反向图灵测试(CAPTCHA、验证码等)屏蔽来自自动程序的访问，一般是设置一个开放问题，对人具有较好的辨识度而机器非常难解决；通过强制要求真实的人员参与回答问题限制程序的批量请求行为，目前流行的验证码测试包括图片辨识、回答随机问题、语音验证等。
4、手机短信验证，服务向用户手机发送一个验证码并要求用户在完成请求前输入。
以上方法存在很多不足之处，下面作一简要分析。
在网络层对访问频率做限制很容易被绕过，同时误封率很高。例如，目前存在大量的NAT架构，服务端采集的访问者IP地址是相同的，基于访问频率限制不可行；利用代理技术和http_cookie、IP地址伪造可以容易的绕过限制；另外通过程序主动控制访问行为需要设置控制规则，而规则的有效性较难把控，设置合适的黑白名单很困难，不恰当的控制规则可能使得服务的用性降低，例如设置单位时间的访问次数，某种程度上降低了服务的可用性。
通过验证码方式检查是当前最常见、最成熟的一种解决方案，得到了广泛的应用，但是验证码的有效性取决于机器能否有效辨识及回答问题，问题难度设置太高会给用户带来困难，而随着机器智能的进化难度低的问题已经不能有效阻止机器自动识别。OCR技术的进步使得基于字符扭曲变形等一类基于图像识别测试有效性降低。机器智能进步使得机器自动答题测试变得不再可靠。另外验证码降低了用户体 验，对如色盲、老年群体造成了很大的困扰。
基于手机短信认证具有极高的可靠性，但同时限制也非常大，需要用户绑定手机、有额外的短信发送成本、用户操作繁琐。
发明内容
有鉴于此，本发明提供一种限制批量请求服务的方法和装置，有助于对批量地请求服务的行为做出限制，并有助于克服现有技术中的一些不足之处。
为实现上述目的，根据本发明的一个方面，提供了一种限制批量请求服务的方法。
本发明的限制批量请求服务的方法包括：服务端接收终端发送的服务请求信息；所述服务端向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量；所述服务端接收所述终端对所述题目的计算结果，然后对该结果进行验证，若正确，则向所述终端提供服务，否则拒绝向所述终端提供服务。
可选地，所述计算题目包括用于消耗所述终端的内存的计算题目。
可选地，所述服务端向所述终端发送一个计算题目之前，还包括：所述服务端向所述终端发送服务端设备的内存中的多个数据区片的数据；所述计算题目包括：要求所述终端提供所述多个数据区片中的一个指定数据区片中的数据。
可选地，所述计算题目包括用于消耗所述终端的网络资源的计算题目。
可选地，所述服务端向所述终端发送一个计算题目之前，还包括：保存多个网络地址，其中每个网络地址上有一个文件；并且保存所述多个网络地址上的文件的数字摘要值；所述计算题目包括：要求所述终端提供所述多个网络地址中的指定网络地址上的文件的数字摘要值。
根据本发明的另一方面，提供了一种限制批量请求服务的装置。
本发明的限制批量请求服务的装置包括：接收模块，用于接收终端发送的服务请求信息；出题模块，用于向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量；验证响应模块，用于接收所述终端对所述题目的计算结果，然后对该结果进行验证，若正确，则向所述终端返回表示验证通过的信息，否则向所述终端返回表示验证未通过的信息。
可选地，所述计算题目包括用于消耗所述终端的内存的计算题目。
可选地，还包括内存数据发送模块，用于向所述终端发送服务端设备的内存中的多个数据区片的数据；所述计算题目包括：要求所述终端提供所述多个数据区片中的一个指定数据区片中的数据。
可选地，所述计算题目包括用于消耗所述终端的网络资源的计算题目。
可选地，还包括网络地址保存模块，用于保存多个网络地址，其中每个网络地址上有一个文件；并且保存所述多个网络地址上的文件的数字摘要值；所述计算题目包括：要求所述终端提供所述多个网络地址中的指定网络地址上的文件的数字摘要值。
根据本发明的技术方案，提供服务的服务端对请求服务的终端出 具计算题目，该计算题目对于服务端和终端的计算资源需求是不对称的。这种方式使终端必须解题才可以进一步获得服务，这种限制无法绕过；并且对于仅请求一次或几次的合法终端来说并不消耗太多计算资源，从而不会降低服务的可用性；而对于使用程序恶意批量请求的终端来说则会有效消耗其计算资源使其难以继续进行请求；另外本技术方案显然也避免了现有的以验证码检查终端、手机短信认证终端等方案的局限性。
附图说明
附图用于更好地理解本发明，不构成对本发明的不当限定。其中：
图1是根据本发明实施例的限制批量请求服务的方法的主要步骤的示意图；
图2是根据本发明实施例的限制批量请求服务的装置的主要模块的示意图。
具体实施方式
以下结合附图对本发明的示范性实施例做出说明，其中包括本发明实施例的各种细节以助于理解，应当将它们认为仅仅是示范性的。因此，本领域普通技术人员应当认识到，可以对这里描述的实施例做出各种改变和修改，而不会背离本发明的范围和精神。同样，为了清楚和简明，以下的描述中省略了对公知功能和结构的描述。
在本发明实施例中，通过提高批量请求发起者程序的单次请求资源消耗，使得批量请求发起者在单位时间内能执行的请求次数得到自然的限制。本实施例的限制批量请求服务方法中，由服务提供者对服务请求者给出题目，而服务请求者程序必须消耗计算资源(CPU、内存、网络资源等)解题。题目的难度最好是设置在一个合理范围，使得客户端资源消耗对于离散的单个正常用户的计算规模控制在一个可接受范围，而对于并行批量请求尤其是并行批量请求因为资源要求倍增变得很难进行。设置的题目对于请求者(进行解题的一方)和服务端(进 行验算的一方)的资源需要是非对称的，验算的资源消耗很小以不降低服务端的性能。上述的不对称问题可以基于非对称算法(如大数分解)或信息的不对称性(例如要求服务请求者下载并计算一个文件摘要值，该文件摘要对于服务提供者已知)设计。
以批量注册用户举例来说，一个恶意注册程序可以在一台主流配置的个人计算机上非常轻松的并行执行256个批处理线程，每线程消耗1M内存，每次注册网络流量消耗8K字节，每个线程1秒注册成功一个新用户，则1分钟可以注册256×60＝15360个新用户；其资源消耗为内存256×1M，流量消耗256×8K＝2M字节。
采用本方法，服务提供者要求请求者每次注册用户需要解决一道题目，其需要的资源提高以CPU以100％负载计算2s、内存消耗1G、网络流量消耗1M字节来计算，对于上面的例子，攻击者如果还是启动256个线程，1分钟内最多只能注册成功30个用户，而资源消耗为CPU负载100％、256G内存消耗、256M字节网络流量。
图1是根据本发明实施例的限制批量请求服务的方法的主要步骤的示意图。该方法由上述的服务提供者所维护的服务器来执行。
步骤S11：服务端接收终端发送的服务请求信息。这里的终端即为用户使用的客户端软件。该服务请求信息可能是正常用户所发送，也可能是恶意用户所发送。
步骤S12：服务端向该终端发送一个计算题目。如前文所述，该计算题目对于终端的计算资源需求量要大于其对服务端的计算资源需求量，以实现对终端的计算资源的适当消耗。
步骤S13：服务端接收终端对题目的计算结果。
步骤S14：服务端验证收到的计算结果是否正确。若正确，进入步骤S15，向终端提供服务；否则进入步骤S16，拒绝向终端提供服务。当然无论结果正确与否，都会向终端发送相应的提示信息。
为保证解题和验算资源需求的不对称性，需要仔细设计验证题目，以下从三个方面的资源要求来分别阐述。
CPU计算资源消耗：存在多种非对称算法，例如大数分解，解题的计算复杂度可以通过目标数的位数来控制，解题与验算的计算资源要求具不对称性，验算成本很低(执行有限次的乘法操作)；在实际系统中可以使用几种算法交错使用进一步提高安全性。
内存资源消耗：基于信息不对称性，可通过如下方法实现资源需求的不对称性：对于服务提供者，只需要随机选择一个数据区片作为问题，且只需要保存这一个数据区片(甚至只需要保存该数据区片的摘要)；而对于服务请求者，因为不知道服务提供者会要求回答哪个数据区片的数据内容，只能选择保存所有的数据区片。按照这种方式，服务端可以向终端多次地发送服务端设备的内存中的不同数据区片，然后给终端出的题目内容可以是“X区片的数据是什么”，其中X表示指定的一个区片。可以看出这种方式对于服务端和请求服务的终端的内存资源消耗是非对称的。
网络资源消耗：可以建立一个资料库，资料库中存放一系列指向Internet网上的公开文件的链接，每个文件的数字摘要值都预先算出保存，在验证时服务提供者随机选择一个文件，服务请求者被要求下载此文件，并计算数字摘要值以通过验证。
图2是根据本发明实施例的限制批量请求服务的装置的主要模块的示意图。该装置作为计算机软件，可设置在上述的服务端设备中。如图2所示，限制批量请求服务的装置20主要包括：接收模块21、出 题模块22、以及验证响应模块23。接收模块21用于接收终端发送的服务请求信息；出题模块22用于向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量；验证响应模块23用于接收所述终端对所述题目的计算结果，然后对该结果进行验证，若正确，则向所述终端返回表示验证通过的信息，否则向所述终端返回表示验证未通过的信息。
计算题目可包括用于消耗终端的内存的计算题目。这样，装置20还可包括内存数据发送模块，用于向终端发送服务端设备的内存中的多个数据区片的数据；并且计算题目可包括：要求终端提供所述多个数据区片中的一个指定数据区片中的数据。
计算题目可包括用于消耗终端的网络资源的计算题目。这样，装置20还可包括网络地址保存模块，用于保存多个网络地址，其中每个网络地址上有一个文件；并且保存所述多个网络地址上的文件的数字摘要值；并且计算题目可包括：要求终端提供所述多个网络地址中的指定网络地址上的文件的数字摘要值。
根据本发明实施例的技术方案，提供服务的服务端对请求服务的终端出具计算题目，该计算题目对于服务端和终端的计算资源需求是不对称的。这种方式使终端必须解题才可以进一步获得服务，这种限制无法绕过；并且对于仅请求一次或几次的合法终端来说并不消耗太多计算资源，从而不会降低服务的可用性；而对于使用程序恶意批量请求的终端来说则会有效消耗其计算资源使其难以继续进行请求；另外本技术方案显然也避免了现有的以验证码检查终端、手机短信认证终端等方案的局限性。
以上结合具体实施例描述了本发明的基本原理，在本发明的装置和方法中，显然，各部件或各步骤是可以分解和/或重新组合的。这些分解和/或重新组合应视为本发明的等效方案。并且，执行上述系列处 理的步骤可以自然地按照说明的顺序按时间顺序执行，但是并不需要一定按照时间顺序执行。某些步骤可以并行或彼此独立地执行。
上述具体实施方式，并不构成对本发明保护范围的限制。本领域技术人员应该明白的是，取决于设计要求和其他因素，可以发生各种各样的修改、组合、子组合和替代。任何在本发明的精神和原则之内所作的修改、等同替换和改进等，均应包含在本发明保护范围之内。

Claims (10)

  1. 一种限制批量请求服务的方法，其特征在于，包括：
    服务端接收终端发送的服务请求信息；
    所述服务端向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量；
    所述服务端接收所述终端对所述题目的计算结果，然后对该结果进行验证，若正确，则向所述终端提供服务，否则拒绝向所述终端提供服务。
  2. 根据权利要求1所述的方法，其特征在于，所述计算题目包括用于消耗所述终端的内存的计算题目。
  3. 根据权利要求2所述的方法，其特征在于，
    所述服务端向所述终端发送一个计算题目之前，还包括：所述服务端向所述终端发送服务端设备的内存中的多个数据区片的数据；
    所述计算题目包括：要求所述终端提供所述多个数据区片中的一个指定数据区片中的数据。
  4. 根据权利要求1所述的方法，其特征在于，所述计算题目包括用于消耗所述终端的网络资源的计算题目。
  5. 根据权利要求4所述的方法，其特征在于，
    所述服务端向所述终端发送一个计算题目之前，还包括：保存多个网络地址，其中每个网络地址上有一个文件；并且保存所述多个网络地址上的文件的数字摘要值；
    所述计算题目包括：要求所述终端提供所述多个网络地址中的指定网络地址上的文件的数字摘要值。
  6. 一种限制批量请求服务的装置，其特征在于，包括：
    接收模块，用于接收终端发送的服务请求信息；
    出题模块，用于向所述终端发送一个计算题目，该计算题目对于所述终端的计算资源需求量大于其对所述服务端的计算资源需求量；
    验证响应模块，用于接收所述终端对所述题目的计算结果，然后对该结果进行验证，若正确，则向所述终端返回表示验证通过的信息，否则向所述终端返回表示验证未通过的信息。
  7. 根据权利要求6所述的装置，其特征在于，所述计算题目包括用于消耗所述终端的内存的计算题目。
  8. 根据权利要求7所述的装置，其特征在于，
    还包括内存数据发送模块，用于向所述终端发送服务端设备的内存中的多个数据区片的数据；
    所述计算题目包括：要求所述终端提供所述多个数据区片中的一个指定数据区片中的数据。
  9. 根据权利要求6所述的装置，其特征在于，所述计算题目包括用于消耗所述终端的网络资源的计算题目。
  10. 根据权利要求9所述的装置，其特征在于，
    还包括网络地址保存模块，用于保存多个网络地址，其中每个网络地址上有一个文件；并且保存所述多个网络地址上的文件的数字摘要值；
    所述计算题目包括：要求所述终端提供所述多个网络地址中的指定网络地址上的文件的数字摘要值。
PCT/CN2016/072359 2015-03-31 2016-01-27 限制批量请求服务的方法和装置 WO2016155411A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US15/563,034 US10366223B2 (en) 2015-03-31 2016-01-27 Methods and apparatus for restricting batch requests for service
JP2017550895A JP6491352B2 (ja) 2015-03-31 2016-01-27 サービスのバッチ請求を規制する方法および装置
RU2017134564A RU2678643C1 (ru) 2015-03-31 2016-01-27 Способ и устройство ограничения пакетных запросов услуги

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510148230.7A CN104899482B (zh) 2015-03-31 2015-03-31 限制批量请求服务的方法和装置
CN201510148230.7 2015-03-31

Publications (1)

Publication Number Publication Date
WO2016155411A1 true WO2016155411A1 (zh) 2016-10-06

Family

ID=54032144

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/072359 WO2016155411A1 (zh) 2015-03-31 2016-01-27 限制批量请求服务的方法和装置

Country Status (5)

Country Link
US (1) US10366223B2 (zh)
JP (1) JP6491352B2 (zh)
CN (1) CN104899482B (zh)
RU (1) RU2678643C1 (zh)
WO (1) WO2016155411A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110392022A (zh) * 2018-04-19 2019-10-29 阿里巴巴集团控股有限公司 一种网络资源访问方法、计算机设备、存储介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104899482B (zh) * 2015-03-31 2018-09-28 北京京东尚科信息技术有限公司 限制批量请求服务的方法和装置
CN109714301B (zh) * 2017-10-25 2021-11-30 北京京东尚科信息技术有限公司 注册风险识别方法、装置、电子设备及存储介质
US10817357B2 (en) * 2018-04-30 2020-10-27 Servicenow, Inc. Batch representational state transfer (REST) application programming interface (API)
CN109391686B (zh) * 2018-09-27 2022-04-12 网宿科技股份有限公司 访问请求的处理方法及cdn节点服务器
CN110138671A (zh) * 2019-05-16 2019-08-16 重庆八戒传媒有限公司 一种降低流量洪峰的系统和方法
CN111241541A (zh) * 2019-12-04 2020-06-05 珠海横琴电享科技有限公司 一种根据请求数据防爬虫系统和方法
CN113536301A (zh) * 2021-07-19 2021-10-22 北京计算机技术及应用研究所 一种基于行为特征分析的反爬方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8370926B1 (en) * 2010-04-27 2013-02-05 Symantec Corporation Systems and methods for authenticating users
CN103455965A (zh) * 2012-05-30 2013-12-18 北京小米科技有限责任公司 一种基于验证图片的验证方法、装置及服务器
GB2505407A (en) * 2012-08-18 2014-03-05 Dongyong Dai Authentication using digital photo to prevent phishing
CN104253687A (zh) * 2013-06-26 2014-12-31 深圳市腾讯计算机系统有限公司 降低验证效率方法、生成验证码方法、相关系统及服务器
CN104899482A (zh) * 2015-03-31 2015-09-09 北京京东尚科信息技术有限公司 限制批量请求服务的方法和装置

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003167850A (ja) * 2001-12-03 2003-06-13 Tech Res & Dev Inst Of Japan Def Agency 端末監視制御システム、端末監視制御方法およびその方法をコンピュータに実行させるプログラム
US20030236980A1 (en) * 2002-06-20 2003-12-25 Hsu Raymond T. Authentication in a communication system
CN1293729C (zh) * 2003-08-08 2007-01-03 华为技术有限公司 一种防止无线局域网频繁进行网络选择交互的方法
JP5274885B2 (ja) * 2008-04-28 2013-08-28 河村電器産業株式会社 ユーザ認証システム
TWI423032B (zh) * 2009-04-30 2014-01-11 Ralink Technology Corp 提升資料傳輸效能的方法
RU2510982C2 (ru) * 2012-04-06 2014-04-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ оценки пользователей для фильтрации сообщений
EP2822216A1 (en) * 2013-07-05 2015-01-07 Gemalto SA Method of privacy preserving during an access to a restricted service
EP3035640B1 (en) * 2014-12-19 2021-03-24 Orange Method for authenticating a device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8370926B1 (en) * 2010-04-27 2013-02-05 Symantec Corporation Systems and methods for authenticating users
CN103455965A (zh) * 2012-05-30 2013-12-18 北京小米科技有限责任公司 一种基于验证图片的验证方法、装置及服务器
GB2505407A (en) * 2012-08-18 2014-03-05 Dongyong Dai Authentication using digital photo to prevent phishing
CN104253687A (zh) * 2013-06-26 2014-12-31 深圳市腾讯计算机系统有限公司 降低验证效率方法、生成验证码方法、相关系统及服务器
CN104899482A (zh) * 2015-03-31 2015-09-09 北京京东尚科信息技术有限公司 限制批量请求服务的方法和装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110392022A (zh) * 2018-04-19 2019-10-29 阿里巴巴集团控股有限公司 一种网络资源访问方法、计算机设备、存储介质
CN110392022B (zh) * 2018-04-19 2022-04-05 阿里巴巴集团控股有限公司 一种网络资源访问方法、计算机设备、存储介质

Also Published As

Publication number Publication date
JP6491352B2 (ja) 2019-03-27
CN104899482B (zh) 2018-09-28
CN104899482A (zh) 2015-09-09
US20180349591A1 (en) 2018-12-06
US10366223B2 (en) 2019-07-30
RU2678643C1 (ru) 2019-01-30
JP2018513472A (ja) 2018-05-24

Similar Documents

Publication Publication Date Title
WO2016155411A1 (zh) 限制批量请求服务的方法和装置
US10936078B2 (en) Account management services for load balancers
US8453209B2 (en) Method and system for providing internet services
US20120216244A1 (en) System and method for application attestation
US8555365B2 (en) Directory authentication method for policy driven web filtering
US10484433B2 (en) Virtual communication endpoint services
WO2013177687A1 (en) Policy service authorization and authentication
US11770385B2 (en) Systems and methods for malicious client detection through property analysis
US9866587B2 (en) Identifying suspicious activity in a load test
CN109361685A (zh) 一种防止恶意请求的方法及装置
Sharieh et al. Securing apis and chaos engineering
Nisar et al. Incentivizing censorship measurements via circumvention
US20150128247A1 (en) Centralized device reputation center
CN111385313B (zh) 一种对象请求合法性验证的方法和系统
US9231930B1 (en) Virtual endpoints for request authentication
US20230239324A1 (en) Securing web browsing on a managed user device
US20230275927A1 (en) Securing web browsing on a managed user device
US11968226B1 (en) Targeted traffic filtering

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16771166

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017550895

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017134564

Country of ref document: RU

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 24/01/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 16771166

Country of ref document: EP

Kind code of ref document: A1