WO2017020585A1 - 一种基于cdn的访问控制方法及相关设备 - Google Patents

一种基于cdn的访问控制方法及相关设备 Download PDF

Info

Publication number
WO2017020585A1
WO2017020585A1 PCT/CN2016/074771 CN2016074771W WO2017020585A1 WO 2017020585 A1 WO2017020585 A1 WO 2017020585A1 CN 2016074771 W CN2016074771 W CN 2016074771W WO 2017020585 A1 WO2017020585 A1 WO 2017020585A1
Authority
WO
WIPO (PCT)
Prior art keywords
content
user terminal
fingerprint
http request
service server
Prior art date
Application number
PCT/CN2016/074771
Other languages
English (en)
French (fr)
Inventor
陆达君
程卫明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16832074.5A priority Critical patent/EP3253026B1/en
Publication of WO2017020585A1 publication Critical patent/WO2017020585A1/zh
Priority to US15/824,499 priority patent/US10693858B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/13—File access structures, e.g. distributed indices
    • G06F16/137—Hash-based
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/14—Details of searching files based on file metadata
    • G06F16/148—File search processing
    • G06F16/152—File search processing using file content signatures, e.g. hash values
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/12—Payment architectures specially adapted for electronic shopping systems
    • G06Q20/123—Shopping for digital content
    • G06Q20/1235—Shopping for digital content with control of digital rights management [DRM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof

Definitions

  • the present invention relates to the field of network technologies, and in particular, to a CDN-based access control method and related devices.
  • the Content Delivery Network is a layer of intelligent virtual network formed by node servers placed throughout the network on the basis of the existing Internet.
  • the CDN can redirect the user's request to the nearest service node according to the network traffic and the connection of each node, the load status, and the distance to the user and the response time.
  • the purpose is to be able to select relatively close to the user.
  • the node sends the user the content required by the user, alleviates the network congestion and improves the response speed of the website.
  • the service server When a user accesses a content resource of a service server through a user agent (for example, a browser, a download tool, or a streaming media player), the service server generates a Uniform Resource Locator according to an algorithm and a key provided by the CDN server.
  • the URL points to a content resource in the CDN server, and the user accesses the content resource in the CDN server through the URL, and the CDN server sends the content resource requested by the user to the user.
  • the intruder hacks the URL obtained by the user agent, the actual address of the content resource can be obtained, and the intruder may bypass the service server to obtain the content resource through the actual address, so the content resource stored by the CDN server has certain risks. .
  • the embodiment of the invention provides a CDN-based access control method, a CDN server, and a service server, which can improve the security of content resources stored in the CDN server.
  • a first aspect of the embodiments of the present invention provides a CDN-based access control method, including:
  • the CDN server receives the HTTP request sent by the user terminal and the identification information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access right;
  • the CDN server sends the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal;
  • the CDN server receives an HTTP response including a content fingerprint returned by the service server, where the content fingerprint is used to identify the content resource;
  • the CDN server obtains the content resource according to the content fingerprint and sends the content resource to the user terminal.
  • the CDN server before the CDN server receives the HTTP request sent by the user terminal and the identifier information of the user terminal, the CDN server includes:
  • the CDN server receives the content fingerprint and the content resource sent by the service server;
  • the CDN server checks whether the content fingerprint or the content resource is stored by itself, and if not, saves the content fingerprint and the content resource, and if so, discards the content fingerprint and the content resource.
  • the method includes:
  • the CDN server obtains the updated content resource and the content fingerprint from the service server.
  • a second aspect of the embodiments of the present invention provides a CDN-based access control method, including:
  • the service server receives the HTTP request sent by the CDN server and the identifier information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access right;
  • the service server authenticates the access ticket by using the identifier information of the user terminal
  • the service server If the authentication result is that the access ticket is legal, the service server returns an HTTP response including the content fingerprint to the CDN server, so that the CDN server obtains the content resource according to the content fingerprint.
  • the service server performs a hash operation on the content resource to obtain a content fingerprint
  • the service server sends the content resource and the content fingerprint to the CDN server.
  • the method includes:
  • the service server receives a content update request including a URL sent by the CDN server;
  • the service server searches for the content resource and the content fingerprint according to the URL;
  • the service server returns the content resource corresponding to the URL and the content fingerprint to the CDN server.
  • a third aspect of the embodiments of the present invention provides a CDN-based access control method, including:
  • the service server receives an HTTP request sent by the user terminal, where the HTTP request is used to obtain a content resource;
  • the service server generates a URL according to the HTTP request, where the URL includes a content fingerprint corresponding to the content resource;
  • the service server returns the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • a fourth aspect of the embodiments of the present invention provides a CDN-based access control method, including:
  • the CDN server receives an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint
  • the CDN server acquires a corresponding content resource according to the content fingerprint.
  • the CDN server sends the content resource to the user terminal.
  • a fifth aspect of the embodiments of the present invention provides a CDN-based access control method, including:
  • the user terminal sends an HTTP request to the service server, where the HTTP request is used to obtain the content resource;
  • the user terminal receives a URL returned by the service server, where the URL includes a content fingerprint corresponding to the content resource;
  • the user terminal sends an HTTP request to the CDN server, where the HTTP request includes the content fingerprint, so that the CDN server obtains the corresponding content resource according to the content fingerprint;
  • the user terminal receives the content resource returned by the CDN server.
  • a sixth aspect of the embodiments of the present invention provides a CDN server, including:
  • a receiving module configured to receive an HTTP request sent by the user terminal and identifier information of the user terminal, where the HTTP request includes an access ticket, where the access ticket is used to identify a user access right;
  • a sending module configured to send the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal;
  • the receiving module is further configured to: if the authentication result is that the access ticket is legal, receive an HTTP response that includes a content fingerprint returned by the service server, where the content fingerprint is used to identify a content resource;
  • the acquiring module is configured to obtain the content resource according to the content fingerprint and send the content to the user terminal.
  • the receiving module is further configured to receive a content fingerprint and a content resource that are sent by the service server;
  • the above CDN server also includes:
  • the checking module is configured to check whether the content fingerprint is stored by itself, and if not, triggering the saving module to save the content fingerprint and the content resource, and if so, triggering the execution module to discard the content fingerprint and the content resource;
  • a saving module configured to save the content fingerprint and the content resource
  • the execution module is configured to discard the content fingerprint and the content resource.
  • the obtaining module is further configured to obtain the updated content resource and the content fingerprint from the service server if the number of times the content resource is accessed within a preset time period is not greater than a preset threshold.
  • a seventh aspect of the embodiments of the present invention provides a service server, including:
  • a receiving module configured to receive an HTTP request sent by a CDN server and identifier information of the user terminal, where the HTTP request includes the access ticket;
  • An authentication module configured to authenticate the access ticket by using the identifier information of the user terminal
  • a sending module configured to: when the authentication result is that the access ticket is legal, return an HTTP response including the content fingerprint to the CDN server, so that the CDN server obtains the content resource according to the content fingerprint.
  • the service server further includes:
  • An operation module configured to perform a hash operation on the content resource to obtain a content fingerprint, where the content fingerprint is used to identify the content resource;
  • the sending module is further configured to send the content resource and the content fingerprint to the CDN server.
  • the receiving module is further configured to receive a content update request that includes the URL sent by the CDN server;
  • the service server further includes: a searching module, configured to search for a content resource and a content fingerprint according to the URL;
  • the sending module is further configured to return the content resource corresponding to the URL and the content fingerprint to the The above CDN server.
  • An eighth aspect of the embodiments of the present invention provides a service server, including:
  • a receiving module configured to receive an HTTP request sent by the user terminal, where the HTTP request is used to obtain a content resource
  • a generating module configured to generate a URL according to the HTTP request, where the URL includes a content fingerprint corresponding to the content resource;
  • a sending module configured to return the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • a ninth aspect of the embodiments of the present invention provides a CDN server, including:
  • a receiving module configured to receive an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint
  • An obtaining module configured to acquire a corresponding content resource according to the content fingerprint
  • a sending module configured to send the foregoing content resource to the user terminal.
  • a tenth aspect of the embodiments of the present invention provides a user terminal, including:
  • a sending module configured to send an HTTP request to the service server, where the HTTP request is used to obtain a content resource
  • a receiving module configured to receive a URL returned by the service server, where the URL includes a content fingerprint corresponding to the content resource
  • the sending module is further configured to send an HTTP request to the CDN server, where the HTTP request includes the content fingerprint;
  • the receiving module receives the content resource returned by the CDN server.
  • An eleventh embodiment of the present invention provides a CDN server, including:
  • the receiving device is configured to receive an HTTP request sent by the user terminal and identifier information of the user terminal, where the HTTP request includes an access ticket, where the access ticket is used to identify a user access right;
  • a sending device configured to send the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal;
  • the receiving device is configured to receive an HTTP response including a content fingerprint returned by the service server, if the authentication result is that the access ticket is legal, and the content fingerprint is used to identify the content resource;
  • a processor configured to send the content resource according to the content fingerprint, and send the content to the user terminal.
  • the receiving device is further configured to receive a content fingerprint and a content resource sent by the service server;
  • the processor is further configured to check whether the content fingerprint is stored by itself, and if not, save the content fingerprint and the content resource, and if yes, discard the content fingerprint and the content resource.
  • the processor is further configured to: if the content resource is accessed in a preset time period, the number of times is not greater than The preset threshold is used to obtain updated content resources and content fingerprints from the service server.
  • a twelfth aspect of the embodiments of the present invention provides a service server, including:
  • a receiving device configured to receive an HTTP request sent by a CDN server and identifier information of the user terminal, where the HTTP request includes an access ticket;
  • a processor configured to authenticate the access ticket by using identifier information of the user terminal
  • the sending device is configured to return an HTTP response including the content fingerprint to the CDN server if the authentication result is that the access ticket is legal, so that the CDN server obtains the content resource according to the content fingerprint.
  • the processor is further configured to perform a hash operation on a content resource to obtain a content fingerprint, where the content fingerprint is used to identify Content resource
  • the transmitting device is configured to send the content resource and the content fingerprint to the CDN server.
  • the receiving device is further configured to receive a content update request that is sent by the CDN server and includes a URL;
  • the processor is further configured to search for a content resource and a content fingerprint according to the foregoing URL;
  • the transmitting device is further configured to return the content resource corresponding to the URL and the content fingerprint to the CDN server.
  • a thirteenth aspect of the embodiments of the present invention provides a service server, including:
  • a receiving device configured to receive an HTTP request sent by a user terminal, where the HTTP request is used to acquire a content resource
  • a processor configured to generate a URL according to the foregoing HTTP request, where the URL includes a content fingerprint corresponding to the content resource;
  • a sending device configured to return the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • a fourteenth aspect of the embodiments of the present invention provides a CDN server, including:
  • a receiving device configured to receive an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint
  • a processor configured to acquire a corresponding content resource according to the content fingerprint
  • a sending device configured to send the foregoing content resource to the user terminal.
  • a fifteenth embodiment of the present invention provides a user terminal, including:
  • a sending device configured to send an HTTP request to the service server, where the HTTP request is used to obtain a content resource
  • a receiving device configured to receive a URL returned by the service server, where the URL includes a content fingerprint corresponding to the content resource
  • the sending device is further configured to send an HTTP request to the CDN server, where the HTTP request includes the content fingerprint, so that the CDN server obtains a corresponding content resource according to the content fingerprint;
  • the receiving device is further configured to receive the content resource returned by the CDN server.
  • the CDN server receives the HTTP request sent by the user terminal and the identification information of the user terminal, and the HTTP request includes the access ticket, the access ticket is used to identify the user access right, and the identification information of the user terminal and the HTTP request are sent to the service server.
  • the service server authenticates the access ticket by using the identification information of the user terminal. If the authentication result is that the access ticket is legal, the receiving service server returns an HTTP response including the content fingerprint, the content fingerprint is used to identify the content resource, and the content is obtained according to the content fingerprint.
  • the CDN server After the resource is sent to the user terminal, the CDN server does not directly return the content resource to the user terminal according to the HTTP request, but receives the result of the successful authentication of the HTTP request by the service server, and then searches for and returns the content resource according to the content fingerprint.
  • the content fingerprint is stored by the service server and the CDN server. Without the user terminal, the intruder cannot obtain the content fingerprint through the user terminal, and the content fingerprint cannot acquire the content resource, thereby improving the security of the content resource.
  • FIG. 1 is a schematic diagram of a signaling flow of a CDN-based access control method in the prior art
  • FIG. 2 is a schematic diagram of a signaling flow of a CDN-based access control method according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 4 is another schematic flowchart of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of another signaling process of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 6 is another schematic flowchart of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 7 is another schematic flowchart of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 8 is another schematic flowchart of a CDN-based access control method according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a CDN server according to an embodiment of the present invention.
  • FIG. 10 is another schematic structural diagram of a CDN server according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a service server according to an embodiment of the present invention.
  • FIG. 12 is another schematic structural diagram of a service server according to an embodiment of the present invention.
  • FIG. 13 is another schematic structural diagram of a service server according to an embodiment of the present invention.
  • FIG. 14 is another schematic structural diagram of a CDN server according to an embodiment of the present invention.
  • FIG. 15 is a schematic structural diagram of a user terminal according to an embodiment of the present invention.
  • FIG. 16 is another schematic structural diagram of a CDN server according to an embodiment of the present invention.
  • FIG. 17 is another schematic structural diagram of a service server according to an embodiment of the present invention.
  • FIG. 18 is another schematic structural diagram of a user terminal according to an embodiment of the present invention.
  • the service server is configured to authenticate, authenticate, and provide content resources to the CDN server, and after receiving the content request sent by the user terminal, provide the user with the address of the content resource in the CDN server;
  • the CDN server is configured to store the content resource provided by the service server, and after receiving the content request sent by the user terminal, return the content resource to the user terminal.
  • the user terminal is configured to initiate an HTTP request and obtain a content resource.
  • an embodiment of a CDN-based access control method in the prior art includes:
  • the CDN server provides an encryption and decryption algorithm and a key to the service server, and the service server encrypts the URL according to the encryption and decryption algorithm and the key.
  • the service server When the user terminal accesses the content resource in the service server, the service server generates an HTTP response corresponding to the content resource, where the HTTP response includes: an IP address of the user terminal, a time when the content request is sent, and a URL, and the user terminal specifies the URL.
  • the CDN server sends a content request message. After the user information is authenticated by the CDN server, the CDN server obtains the content resource according to the URL. If the content resource does not exist in the CDN server, the CDN server sends the content request message from the user terminal to the service server. After the service server finds the content resource according to the content request message, the content resource is sent to the CDN server, and the CDN server returns the content resource to the user terminal, and saves the content resource.
  • a user agent for example, a browser, a downloading tool, or a streaming media player.
  • the service server sends the URL of the content resource in the CDN server to the user.
  • the URL is encrypted, the intruder can obtain the URL to access the CDN server, but the CDN server cannot authenticate the user, which is undoubtedly risky.
  • the service server allocates the content resource to the CDN server
  • the content resource is assigned a URL
  • the CDN server identifies the content resource by using the URL. Since the content corresponding to the content stored by different users is different, the CDN server stores a lot of content with the same content. Resources.
  • the embodiment of the present invention provides a CDN-based access control method, which can be used to search for content resources through a content fingerprint. Since the content fingerprint is stored in the CDN server and the service server, the attacker can be prevented from passing.
  • the user terminal directly obtains the URL and obtains the content resource through the URL. Please refer to the signaling flowchart shown in FIG. 2 .
  • the user terminal sends an HTTP request to the service server, where the HTTP request is used to obtain a content resource.
  • the service server generates a URL according to the HTTP request, and sends the URL to the user terminal, where the URL carries an access ticket.
  • the user terminal sends an HTTP request to the CDN server and identifier information of the user terminal, where the HTTP request carries an access ticket.
  • the CDN server sends the HTTP request from the user terminal and the identifier information of the user terminal to the service server.
  • the service server authenticates the access ticket according to the identifier information of the user terminal.
  • the service server searches for the content fingerprint according to the access ticket, and sends the content fingerprint to the CDN server;
  • the CDN server searches for the content resource according to the content fingerprint.
  • the CDN server sends the content resource to the user terminal.
  • an embodiment of a CDN-based access control method in an embodiment of the present invention includes:
  • the CDN server receives an HTTP request sent by the user terminal and identifier information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access authority;
  • the service server when the user accesses the content resource in the service server, the service server generates a URL that points to the content resource in the CDN server, and sends the URL to the user terminal, and the user terminal can generate an HTTP request by using the URL, and the CDN server receives the content.
  • the CDN server can also receive the identifier information sent by the user terminal, and the identifier information of the user terminal can be the IP address of the user terminal, and is carried in the TCP/IP request.
  • the URL includes an access ticket, the access ticket is used to identify the rights of the content resource that the user can access, and the URL further includes user session information, and the user session information is used to maintain an association request between the user terminal and the service server.
  • the CDN server does not search for content resources or content fingerprints according to the URL from the user terminal.
  • the CDN server sends the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal.
  • the CDN server sends the identification information of the user terminal and the HTTP request to the service server, and the service server can authenticate the access ticket by using the identification information of the user terminal. If the access ticket passes the authentication, it indicates that the user has the right to obtain the content resource, otherwise the user has no right to obtain the content resource.
  • the CDN server receives an HTTP response that is returned by the service server and includes a content fingerprint, where the content fingerprint is used to identify the content resource.
  • the content fingerprint is a string obtained by extracting a content summary from the content resource and hashing the content summary, that is, a digital fingerprint of the content resource, and can uniquely identify the content resource.
  • the content fingerprints obtained by the same content resource are the same, and the content fingerprints obtained by different content resources are different. It should be noted that even if the content or the storage location of the content resource with the same content is different, the content fingerprint is still the same.
  • the CDN server obtains the content resource according to the content fingerprint.
  • the CDN server stores the content fingerprint and the content resource, and the content fingerprint corresponds to the content resource. After the CDN server obtains the content fingerprint, the content resource may be obtained according to the content fingerprint.
  • the CDN server sends the content resource to the user terminal.
  • the content resource is sent to the user terminal.
  • the CDN server receives the HTTP request sent by the user terminal and the identification information of the user terminal, and the HTTP request includes the access ticket, the access ticket is used to identify the user access right, and the identification information of the user terminal and the HTTP request are sent to the service server.
  • the service server authenticates the access ticket by using the identification information of the user terminal. If the authentication result is that the access ticket is legal, the receiving service server returns an HTTP response including the content fingerprint, the content fingerprint is used to identify the content resource, and the content is obtained according to the content fingerprint.
  • the resource sends the content resource to the user terminal, and the CDN server does not directly return the content resource to the user terminal according to the HTTP request, but receives the result of the successful authentication of the HTTP request by the service server, and then searches for and returns the content resource according to the content fingerprint, and the content
  • the fingerprint is stored by the service server and the CDN server. The user cannot obtain the content fingerprint through the user terminal without the user terminal, and the content fingerprint cannot be obtained without the content fingerprint, thereby improving the security of the content resource.
  • the CDN server obtains the content resource according to the content fingerprint, which is specifically implemented by: if the content resource is not stored in the CDN server, the CDN server sends the content request including the content fingerprint to the service server. So that the service server finds the content resource according to the content fingerprint, and the CDN server receives the content resource returned by the service server.
  • the CDN server may obtain the content resource from the service server according to the content fingerprint.
  • the CDN server before receiving the HTTP request sent by the user terminal and the identifier information of the user terminal, includes: the CDN server receives the content resource and the content fingerprint sent by the service server; and the CDN server checks the self. Whether the content fingerprint or content resource has been stored, and if not, the content resource and the content fingerprint are saved, and if so, the content fingerprint and the content resource are discarded.
  • the CDN server can receive the content resource and the content fingerprint sent by the service server, and check whether the content fingerprint is stored by itself. If yes, it indicates that the CDN server has stored the content resource, and only one content resource is reserved, and the content can be discarded. The content resource, if not, indicates that the CDN server does not store the content resource, and needs to store the content resource to provide the CDN acceleration service to the user. It should be noted that, when the CDN server has stored the content resource, the CDN server may also retain the last received content resource and discard the stored content resource, which is not limited herein.
  • the above CDN server reserves a content resource as the best solution for reducing redundancy.
  • the CDN server can reserve a predetermined number of the same content resources. When the number of the same content resources reaches a predetermined number, When the CDN server receives the same content resource as the above content, the content resource is no longer saved to reduce redundancy.
  • the CDN server obtains the updated content resource and the content fingerprint from the service server.
  • the size of the preset threshold may be obtained according to experience or actual test, which is not limited herein. If the number of times the content resource is accessed in the preset time period is less than or equal to the preset threshold, indicating that the content resource is not concerned during the time period, and the content resource needs to be replaced, the CDN server may send a content update request to the service server, and the service server will update. The content resource and content fingerprint are sent to the CDN server, and the CDN server completes the content update.
  • the CDN server updates the content resources by periodically cleaning the content resources, the invention can immediately update the less visited content resources, and can not update the popular content resources, so that the user can continue to access. This content resource enhances the user experience.
  • the CDN server may immediately delete the original content resource, or may not immediately delete the original content resource.
  • the content resource because the service server points the URL to the updated content resource, the original content resource is no longer accessed by the user, and the CDN server can delete the original content resource by periodically deleting the content resource whose access frequency is too low.
  • FIG. 4 another embodiment of the CDN-based access control method in the embodiment of the present invention includes:
  • the service server receives the HTTP request sent by the CDN server and the identifier information of the user terminal, where the HTTP request includes the access ticket.
  • the service server may receive the HTTP request sent by the CDN server and the identification information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access right.
  • the HTTP request also contains user session information, and the user session information is used to maintain an association request between the user terminal and the service server.
  • the service server authenticates the access ticket by using the identifier information of the user terminal.
  • the service server may check whether the access ticket corresponds to the identification information of the user terminal, whether the access ticket corresponds to the user session, whether the access ticket is within the validity period, and the like. It is to be understood that, in an actual application, the access ticket may be authenticated by using one or more authentication methods, which is not limited herein.
  • the service server returns an HTTP response including the content fingerprint to the CDN server, so that the CDN server obtains the content resource according to the content fingerprint.
  • the method further includes: the service server receives the content request that is sent by the CDN server and includes the content fingerprint; the service server searches for the content resource according to the content fingerprint; and the service server sends the content resource to the CDN server.
  • the CDN server may send a content request including the content fingerprint to the service server, and the service server may search for the content resource according to the content fingerprint, and return the content resource to the CDN server.
  • the service server before the service server returns the HTTP response including the content fingerprint to the CDN server, the service server performs a hash operation on the content resource to obtain a content fingerprint, where the content fingerprint is used to identify the content.
  • the resource server sends the content resource and the content fingerprint to the CDN server.
  • the algorithm used by the service server to hash the content resources may be SHA512, SHA224, SHA256, or SHA384, and may be other security hash algorithms, which are not limited herein. It can be understood that the service server can send some or all of the content resources and content fingerprints to the CDN server.
  • the service server after the service server returns the HTTP response including the content fingerprint to the CDN server, includes: receiving, by the service server, a content update request that includes a URL sent by the CDN server; The URL searches for the content resource and the content fingerprint; the service server returns the content resource and the content fingerprint corresponding to the URL to the CDN server.
  • the service server since the service server updates the content resource at a time, the content fingerprint and the content resource corresponding to the URL may change, and the content resource on the CDN server also needs to be updated, and the CDN server may
  • the service server sends the URL, and the service server can find the content resource and the content fingerprint according to the URL, and return the content resource and the content fingerprint to the CDN server, and the CDN server replaces the original content resource and the original content fingerprint specified by the URL with the updated content resource. And updated content fingerprints.
  • CDN-based access control method in the present invention is described in detail in a specific application scenario:
  • the service server may hash the "2.pdf” to obtain the content fingerprint 1, and send the content fingerprint 1 and "2.pdf” to the CDN server. .
  • the embodiment of the present invention further provides a method for accessing a content resource in a fast manner, which can be used for a user to access a content resource that is not protected in a service server.
  • FIG. 5 is a CDN-based embodiment of the present invention. Another signaling flow diagram of the access control method.
  • the user terminal sends an HTTP request to the service server, where the HTTP request is used to obtain a content resource.
  • the service server generates a URL that includes a content fingerprint according to the HTTP request, and sends the URL to the user terminal.
  • the user terminal sends an HTTP request to the CDN server, where the HTTP request carries a content fingerprint.
  • the CDN server searches for content resources according to the content fingerprint.
  • the CDN server sends the content resource to the user terminal.
  • FIG. 6 another embodiment of a CDN-based access control method in an implementation of the present invention includes:
  • the service server receives an HTTP request sent by the user terminal.
  • the service server when the user accesses the content resource in the service server, the service server receives the HTTP request sent by the user terminal, and the HTTP request is used to acquire the content resource.
  • the service server generates a URL according to the HTTP request, where the URL includes a content fingerprint corresponding to the content resource.
  • the service server checks whether the content resource accessed by the HTTP request needs to be protected. If the content resource is a content type that does not need to be protected, the service server may generate a URL that includes a content fingerprint, where the content fingerprint corresponds to a content resource that does not need to be protected.
  • the service server returns the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • the service server After the service server obtains the URL, the URL is returned to the user terminal, and the user terminal can go to the CDN.
  • the server sends an HTTP request containing the URL.
  • FIG. 7 another embodiment of a CDN-based access control method in an implementation of the present invention includes:
  • the CDN server receives an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint.
  • the CDN server may receive an HTTP request sent by the user terminal, and the HTTP request includes a content fingerprint.
  • the CDN server acquires a corresponding content resource according to the content fingerprint.
  • the CDN server stores the content fingerprint and the content resource, and the content fingerprint corresponds to the content resource. After the CDN server obtains the HTTP request, the HTTP request carries the content fingerprint, and the content resource can be obtained according to the content fingerprint.
  • the CDN server sends the content resource to the user terminal.
  • the content resource may be sent to the user terminal.
  • FIG. 8 another embodiment of a CDN-based access control method in an implementation of the present invention includes:
  • the user terminal sends an HTTP request to the service server, where the HTTP request is used to obtain a content resource.
  • the user terminal may send an HTTP request to the service server, and the HTTP request is used to acquire the content resource.
  • the user terminal receives a URL returned by the service server, where the URL includes a content fingerprint of the content resource.
  • the user terminal can receive the URL returned by the service server, and the URL contains the content fingerprint of the content resource.
  • the user terminal sends an HTTP request to the CDN server, where the HTTP request includes a content fingerprint.
  • the HTTP request including the URL is sent to the CDN server, so that the CDN server obtains the corresponding content resource according to the content fingerprint in the URL.
  • the user terminal receives the content resource returned by the CDN server.
  • CDN-based access control method in the embodiment of the present invention is described in detail in another specific application scenario:
  • the URL is returned to the browser, through which the browser initiates a request to access the "1.gif" to the CDN server, the CDN server checks that the content fingerprint 3 exists in the URL, and the CDN server searches for "1. Gif", return "1.gif” to the user.
  • the CDN-based access control method in the embodiment of the present invention is described in detail from the perspective of the method.
  • the CDN server in the embodiment of the present invention is described in detail from the perspective of the device. Referring to FIG. 9, an implementation of the CDN server in the embodiment of the present invention is described. Examples include:
  • the receiving module 901 is configured to receive an HTTP request sent by the user terminal and identifier information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access authority;
  • the sending module 902 is configured to send the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal;
  • the receiving module 901 is further configured to: if the authentication result is that the access ticket is legal, the CDN server receives an HTTP response that includes a content fingerprint returned by the service server, where the content fingerprint is used to identify the content resource;
  • the obtaining module 903 is configured to obtain the content resource according to the content fingerprint and send the content resource to the user terminal.
  • the receiving module 901 receives the HTTP request sent by the user terminal and the identifier information of the user terminal, the HTTP request includes an access ticket, the access ticket is used to identify the user access right, and the sending module 902 identifies the user terminal and the HTTP request. Sending to the service server, so that the service server authenticates the access ticket by using the identification information of the user terminal. If the authentication result is that the access ticket is legal, the receiving module 901 receives the HTTP response including the content fingerprint returned by the service server, and the content fingerprint is used to identify the content.
  • the resource obtaining module 903 obtains the content resource according to the content fingerprint and sends the content resource to the user terminal.
  • the CDN server does not directly return the content resource to the user terminal according to the HTTP request, but receives the result that the service server successfully authenticates the HTTP request, and then according to the content fingerprint.
  • the content resource is searched and returned, and the content fingerprint is stored by the service server and the CDN server. Without the user terminal, the intruder cannot obtain the content fingerprint through the user terminal, and the content fingerprint cannot obtain the content resource, thereby improving the content resource. Full sex.
  • the sending module 902 is further configured to: if the content resource is not stored in the CDN server 900, send an HTTP request including the content fingerprint to the service server, so that the service server searches for the content resource according to the content fingerprint.
  • the receiving module 901 is further configured to receive a content resource returned by the service server.
  • the receiving module 901 is further configured to receive a content fingerprint and a content resource sent by the service server;
  • the CDN server 900 also includes:
  • the checking module 1001 is configured to check whether the content fingerprint is stored by itself, and if not, trigger the saving module 1002 to save the content resource and the content fingerprint, and if yes, trigger the execution module 1003 to discard Content fingerprints and content resources.
  • a saving module 1002 configured to save a content fingerprint and a content resource
  • the executing module 1003 is configured to discard the content fingerprint and the content resource.
  • the obtaining module 903 is further configured to obtain the updated content resource and the content fingerprint from the service server if the number of times the content resource is accessed within a preset time period is not greater than a preset threshold.
  • an embodiment of a service server in an embodiment of the present invention includes:
  • the receiving module 1101 is configured to receive an HTTP request sent by the CDN server and identifier information of the user terminal, where the HTTP request includes an access ticket;
  • the authentication module 1102 is configured to authenticate the access ticket by using the identifier information of the user terminal.
  • the sending module 1103 is configured to: if the authentication result is that the access ticket is legal, return an HTTP response including the content fingerprint to the CDN server, so that the CDN server obtains the content resource according to the content fingerprint.
  • the receiving module 1101 is further configured to receive a content request that is sent by the CDN server and includes a content fingerprint.
  • the sending module 1103 is further configured to send the content resource corresponding to the content fingerprint to the CDN server.
  • the service server 1100 further includes:
  • the operation module 1201 is configured to perform a hash operation on the content resource to obtain a content fingerprint, where the content fingerprint is used to identify the content resource;
  • the sending module 1103 is further configured to send the content resource and the content fingerprint to the CDN server.
  • the receiving module 1101 is further configured to receive a content update request that is sent by the CDN server and includes a URL;
  • the service server 1100 also includes:
  • the searching module 1202 is configured to search for a content resource and a content fingerprint according to the URL;
  • the sending module 1103 is further configured to return the content resource and the content fingerprint corresponding to the URL to the CDN server.
  • the identifier information of the user terminal is the user IP address.
  • the sending module 902 sends the URL and the user IP address to the receiving module 1101 of the service server, and the authentication module 1102 of the service server authenticates the ticket by using the IP address of the user. If the ticket passes the authentication, the sending module 1103 of the service server will The content fingerprint 1 corresponding to the URL is returned to the receiving module 901 of the CDN server, and the obtaining module 903 of the CDN server acquires "2.pdf" according to the content fingerprint 1, and returns "2.pdf" to the user terminal.
  • the operation module 1201 of the service server may perform hash operation on “2.pdf” to obtain the content fingerprint 1, and the sending module 1103 of the service server will content fingerprint 1 And "2.pdf" is sent to the CDN server.
  • another embodiment of the service server in the embodiment of the present invention includes:
  • the receiving module 1301 is configured to receive an HTTP request sent by the user terminal, where the HTTP request is used to acquire a content resource;
  • a generating module 1302 configured to generate a URL according to the HTTP request, where the URL includes a content fingerprint corresponding to the content resource;
  • the sending module 1303 is configured to return the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • FIG. 14 another embodiment of a CDN server in an embodiment of the present invention includes:
  • the receiving module 1401 is configured to receive an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint;
  • the obtaining module 1402 is configured to obtain a corresponding content resource according to the content fingerprint
  • the sending module 1403 is configured to send the content resource to the user terminal.
  • an embodiment of a user terminal in an embodiment of the present invention includes:
  • the sending module 1501 is configured to send an HTTP request to the service server, where the HTTP request is used to obtain a content resource;
  • the receiving module 1502 is configured to receive a URL returned by the service server, where the URL includes a content fingerprint corresponding to the content resource;
  • the sending module 1501 is further configured to send an HTTP request to the CDN server, where the HTTP request includes a content fingerprint;
  • the receiving module 1502 is further configured to receive a content resource returned by the CDN server.
  • the content resource takes "1.gif” as an example.
  • the sending module 1501 of the user terminal Sending an HTTP request to the service server
  • the receiving module 1301 of the service server receives the HTTP request sent by the user terminal
  • the generating module 1302 generates a URL, for example: http://media.orgin.com/1.gif?
  • the sending module 1303 of the service server returns the URL to the receiving module 1502 of the user terminal, and the sending module 1501 of the user terminal initiates an HTTP request for accessing the “1.gif” to the CDN server through the URL, and the receiving module of the CDN server The 1401 receives the HTTP request. Since the URL includes the content fingerprint 3, the acquiring module 1402 of the CDN server acquires “1.gif” according to the content fingerprint 3, and the sending module 1403 of the CDN server returns “1.gif” to the user terminal, where the user terminal The receiving module 1502 receives "1.gif".
  • the CDN server in the embodiment of the present invention is described above from the perspective of a unitized functional entity.
  • the following describes the CDN server in the embodiment of the present invention from the perspective of hardware processing.
  • the CDN server 1600 in the embodiment of the present invention is described.
  • Another embodiment includes:
  • the processor 1603 and the memory 1604 receive information external to the UE through the receiving device 1601, and the processor 1603 and the memory 1604 transmit information to the outside of the UE through the transmitting device 1602.
  • the receiving device 1601, the transmitting device 1602, the processor 1603, and the memory 1604 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • the receiving device 1601 is configured to receive an HTTP request sent by the user terminal and identifier information of the user terminal, where the HTTP request includes an access ticket, and the access ticket is used to identify the user access authority;
  • the sending device 1602 is configured to send the identifier information of the user terminal and the HTTP request to the service server, so that the service server authenticates the access ticket by using the identifier information of the user terminal;
  • the receiving device 1601 is configured to: if the authentication result is that the access ticket is legal, receive an HTTP response including a content fingerprint returned by the service server, where the content fingerprint is used to identify the content resource;
  • the processor 1603 is configured to obtain the content resource according to the content fingerprint and send the content resource to the user terminal.
  • the memory 1604 can include read only memory and random access memory, and provides instructions and data to the processor 1603.
  • a portion of the memory 1604 can also include, possibly including, a high speed random access memory (RAM), and possibly a non- Unstable memory (Non-Volatile Memory).
  • RAM high speed random access memory
  • Non-Volatile Memory non-Volatile Memory
  • the memory 1604 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof; the operational instructions include various operational instructions for implementing various operations; the operating system includes various system programs, Used to implement a variety of basic services and handle hardware-based tasks.
  • the receiving device 1601 is further configured to receive a content fingerprint and a content resource sent by the service server.
  • the processor 1603 is further configured to check whether the content fingerprint has been stored by itself, and if not, save the content fingerprint and the content resource, and if so, discard the content fingerprint and the content resource.
  • the processor 1603 is further configured to: when the number of times the content resource is accessed in the preset time period is not greater than a preset threshold, obtain the updated content resource and the content fingerprint from the service server.
  • another embodiment of a service server in an embodiment of the present invention includes:
  • the processor 1703 and the memory 1704 receive information external to the UE through the receiving device 1701, and the processor 1703 and the memory 1704 transmit information to the outside of the UE through the transmitting device 1702.
  • the receiving device 1701, the transmitting device 1702, the processor 1703, and the memory 1704 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • the receiving device 1701 is configured to receive an HTTP request sent by the CDN server and identifier information of the user terminal, where the HTTP request includes an access ticket;
  • the processor 1703 is configured to authenticate the access ticket by using the identifier information of the user terminal.
  • the sending device 1702 is configured to return an HTTP response including the content fingerprint to the CDN server if the authentication result is that the access ticket is legal, so that the CDN server obtains the content resource according to the content fingerprint.
  • Memory 1704 can include read only memory and random access memory, and provides instructions and data to processor 1703, which can also include a portion of memory 1704 that may also include non-volatile memory.
  • the memory 1704 stores elements such as executable modules or data structures, or a subset thereof, or an extended set thereof; the operational instructions include various operational instructions for implementing various operations; the operating system includes various system programs, Used to implement a variety of basic services and handle hardware-based tasks.
  • the processor 1703 is further configured to perform a hash operation on the content resource to obtain a content fingerprint, where the content fingerprint is used to identify the content resource;
  • the sending device 1702 is configured to send the content resource and the content fingerprint to the CDN server.
  • the receiving device 1701 is further configured to receive the content that includes the URL sent by the CDN server. New request;
  • the processor 1703 is further configured to search for a content resource and a content fingerprint according to the URL;
  • the sending device 1702 is further configured to return the content resource and the content fingerprint corresponding to the URL to the CDN server.
  • another embodiment of a service server in an embodiment of the present invention includes:
  • the receiving device 1701 is configured to receive an HTTP request sent by the user terminal, where the HTTP request is used to acquire a content resource;
  • the processor 1703 is configured to generate a URL according to the HTTP request, where the URL includes a content fingerprint corresponding to the content resource;
  • the sending device 1702 is configured to return the URL to the user terminal, so that the user terminal sends an HTTP request including the URL to the CDN server.
  • another embodiment of a CDN server in an embodiment of the present invention includes:
  • the receiving device 1601 is configured to receive an HTTP request sent by the user terminal, where the HTTP request includes a content fingerprint;
  • the processor 1603 is configured to acquire a corresponding content resource according to the content fingerprint
  • the sending device 1602 is configured to send the content resource to the user terminal.
  • another embodiment of the user terminal in the embodiment of the present invention includes:
  • the processor 1803 and the memory 1804 receive information external to the UE through the receiving device 1801, and the processor 1803 and the memory 1804 transmit information to the outside of the UE through the transmitting device 1802.
  • the receiving device 1801, the transmitting device 1802, the processor 1803, and the memory 1804 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • the sending device 1802 is configured to send an HTTP request to the service server, where the HTTP request is used to acquire the content resource;
  • the receiving device 1801 is configured to receive a URL returned by the service server, where the URL includes a content fingerprint corresponding to the content resource;
  • the sending device 1802 is further configured to send an HTTP request to the CDN server, where the HTTP request includes a content fingerprint;
  • the receiving device 1801 is further configured to receive a content resource returned by the CDN server.
  • the memory 1804 can include a read only memory and a random access memory, and provides the processor 1803 with For instructions and data, a portion of memory 1804 may also include memory that may be included, as well as non-stable memory.
  • the memory 1804 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof; the operational instructions include various operational instructions for implementing various operations; the operating system includes various system programs, Used to implement a variety of basic services and handle hardware-based tasks.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Automation & Control Theory (AREA)
  • Library & Information Science (AREA)
  • Information Transfer Between Computers (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)

Abstract

本发明实施例公开了一种基于CDN的访问控制方法，能够提高存储于CDN服务器的内容资源的安全性。本发明实施例中基于CDN的访问控制方法包括：CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证；若认证结果为访问票据合法，接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源，根据内容指纹获取内容资源，将内容资源发送给用户终端。本发明实施例还提供用于实现上述访问控制方法的CDN服务器以及业务服务器。

Description

一种基于CDN的访问控制方法及相关设备
本申请要求于2015年7月31日提交中国专利局、申请号为201510466027.4、发明名称为“一种基于CDN的访问控制方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络技术领域，尤其涉及一种基于CDN的访问控制方法及相关设备。
背景技术
内容分发网络(CDN，Content Delivery Network)是一种在现有互联网基础之上通过在网络各处放置的节点服务器所构成的一层智能虚拟网络。CDN能够实时地根据网络流量和各节点的连接、负载状况以及到用户的距离和响应时间等综合信息将用户的请求重新导向离用户最近的服务节点上，其目的是能够选择离用户相对较近的节点向用户发送用户所需的内容，缓解网络拥挤的状况，提高网站的响应速度。
现有技术中提供一种基于CDN的访问控制方法大致如下所示：
当用户通过用户代理(例如，浏览器、下载工具或流媒体播放器)访问业务服务器的内容资源时，业务服务器根据CDN服务器提供的算法及密钥生成统一资源定位器(URL，Uniform Resource Locator)，该URL指向CDN服务器中的内容资源，用户通过该URL访问CDN服务器中的内容资源，CDN服务器将用户请求的内容资源发送给用户。
但是，如果入侵者对通过用户代理获取的URL进行破解，就可以获取内容资源的实际地址，入侵者可能绕过业务服务器，通过该实际地址获取内容资源，因此CDN服务器存储的内容资源存在一定风险。
发明内容
本发明实施例提供了一种基于CDN的访问控制方法以及CDN服务器、业务服务器，能够提高存储于CDN服务器的内容资源的安全性。
本发明实施例第一方面提供了一种基于CDN的访问控制方法，包括：
CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含访问票据，上述访问票据用于标识用户访问权限；
上述CDN服务器将上述用户终端的标识信息及上述HTTP请求发送给业务服务器，以使得上述业务服务器利用上述用户终端的标识信息对上述访问票据进行认证；
若认证结果为上述访问票据合法，上述CDN服务器接收上述业务服务器返回的包含内容指纹的HTTP响应，上述内容指纹用于标识内容资源；
上述CDN服务器根据上述内容指纹获取内容资源后发送给上述用户终端。
结合本发明实施例第一方面，本发明实施例第一方面的第一种实现方式中，所述CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息之前包括：
上述CDN服务器接收上述业务服务器发送的内容指纹及内容资源；
上述CDN服务器检查其自身是否已存储上述内容指纹或内容资源，若否，则保存上述内容指纹及内容资源，若是，丢弃上述内容指纹及上述内容资源。
结合本发明第一方面，本发明第一方面的第二种实现方式中，上述CDN服务器将上述内容资源发送给上述用户终端之后包括：
若在预设时段内上述内容资源被访问的次数不大于预设阈值，上述CDN服务器从上述业务服务器获取更新的内容资源以及内容指纹。
本发明实施例第二方面提供了一种基于CDN的访问控制方法，包括：
业务服务器接收CDN服务器发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含有访问票据，上述访问票据用于标识用户访问权限；
上述业务服务器利用上述用户终端的标识信息对上述访问票据进行认证；
若认证结果为上述访问票据合法，上述业务服务器将包含内容指纹的HTTP响应返回给上述CDN服务器，以使得上述CDN服务器根据上述内容指纹获取内容资源。
结合本发明实施例第二方面，本发明实施例第二方面的第一种实现方式中，上述业务服务器将包含内容指纹的HTTP响应返回给上述CDN服务器之前包括：
上述业务服务器对内容资源进行哈希运算得到内容指纹；
上述业务服务器将内容资源及内容指纹发送给上述CDN服务器。
结合本发明实施例第二方面，本发明实施例第二方面的第二种实现方式中，上述业务服务器将包含上述内容指纹的HTTP响应返回给上述CDN服务器之后包括：
上述业务服务器接收上述CDN服务器发送的包含URL的内容更新请求；
上述业务服务器根据上述URL查找内容资源及内容指纹；
上述业务服务器将上述URL对应的内容资源及上述内容指纹返回给上述CDN服务器。
本发明实施例第三方面提供了一种基于CDN的访问控制方法，包括：
业务服务器接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
上述业务服务器根据上述HTTP请求生成URL，上述URL包含上述内容资源对应的内容指纹；
上述业务服务器将上述URL返回给用户终端，以使得上述用户终端向CDN服务器发送包含上述URL的HTTP请求。
本发明实施例第四方面提供了一种基于CDN的访问控制方法，包括：
CDN服务器接收用户终端发送的HTTP请求，上述HTTP请求包含内容指纹；
上述CDN服务器根据上述内容指纹获取对应的内容资源；
上述CDN服务器将上述内容资源发送给上述用户终端。
本发明实施例第五方面提供了一种基于CDN的访问控制方法，包括：
用户终端向业务服务器发送HTTP请求，HTTP请求用于获取内容资源；
上述用户终端接收业务服务器返回的URL，上述URL包含上述内容资源对应的内容指纹；
上述用户终端向CDN服务器发送HTTP请求，上述HTTP请求包含上述内容指纹，以使得上述CDN服务器根据上述内容指纹获取对应的内容资源；
上述用户终端接收上述CDN服务器返回的上述内容资源。
本发明实施例第六方面提供了一种CDN服务器，包括：
接收模块，用于接收用户终端发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含访问票据，上述访问票据用于标识用户访问权限；
发送模块，用于将上述用户终端的标识信息及上述HTTP请求发送给业务服务器，以使得上述业务服务器利用上述用户终端的标识信息对上述访问票据进行认证；
上述接收模块，还用于若认证结果为上述访问票据合法，接收上述业务服务器返回的包含内容指纹的HTTP响应，上述内容指纹用于标识内容资源；
获取模块，用于根据上述内容指纹获取内容资源后发送给上述用户终端。
结合本发明实施例第六方面，本发明实施例第六方面的第一种实现方式中，上述接收模块，还用于接收上述业务服务器发送的内容指纹及内容资源；
上述CDN服务器还包括：
检查模块，用于检查其自身是否已存储上述内容指纹，若否，则触发保存模块保存上述内容指纹及上述内容资源的步骤，若是，则触发执行模块丢弃上述内容指纹及上述内容资源；
保存模块，用于保存上述内容指纹及上述内容资源；
执行模块，用于丢弃上述内容指纹及上述内容资源。
结合本发明实施例第六方面，本发明实施例第六方面的第二种实现方式中，
上述获取模块，还用于若在预设时段内所述内容资源被访问的次数不大于预设阈值，从所述业务服务器获取更新的内容资源以及内容指纹。
本发明实施例第七方面提供了一种业务服务器，包括：
接收模块，用于接收CDN服务器发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含有上述访问票据；
认证模块，用于利用上述用户终端的标识信息对上述访问票据进行认证；
发送模块，用于若认证结果为所述访问票据合法，将包含内容指纹的HTTP响应返回给上述CDN服务器，以使得上述CDN服务器根据上述内容指纹获取内容资源。
结合本发明实施例第七方面，本发明实施例第七方面的第一种实现方式中，上述业务服务器还包括：
运算模块，用于对内容资源进行哈希运算得到内容指纹，上述内容指纹用于标识内容资源；
上述发送模块，还用于将上述内容资源及内容指纹发送给上述CDN服务器。
结合本发明实施例第七方面，本发明实施例第七方面的第二种实现方式中，
上述接收模块，还用于接收上述CDN服务器发送的包含URL的内容更新请求；
所述业务服务器还包括：查找模块，用于根据上述URL查找内容资源及内容指纹；
上述发送模块，还用于将上述URL对应的内容资源及上述内容指纹返回给 上述CDN服务器。
本发明实施例第八方面提供了一种业务服务器，包括：
接收模块，用于接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
生成模块，用于根据上述HTTP请求生成URL，上述URL包含上述内容资源对应的内容指纹；
发送模块，用于将上述URL返回给用户终端，以使得上述用户终端向CDN服务器发送包含上述URL的HTTP请求。
本发明实施例第九方面提供了一种CDN服务器，包括：
接收模块，用于接收用户终端发送的HTTP请求，上述HTTP请求包含内容指纹；
获取模块，用于根据上述内容指纹获取对应的内容资源；
发送模块，用于将上述内容资源发送给上述用户终端。
本发明实施例第十方面提供了一种用户终端，包括：
发送模块，用于向业务服务器发送HTTP请求，上述HTTP请求用于获取内容资源；
接收模块，用于接收业务服务器返回的URL，上述URL包含上述内容资源对应的内容指纹；
上述发送模块，还用于向CDN服务器发送HTTP请求，上述HTTP请求包含上述内容指纹；
上述接收模块，接收上述CDN服务器返回的内容资源。
本发明实施例第十一方面提供了一种CDN服务器，包括：
接收装置，用于接收用户终端发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含访问票据，上述访问票据用于标识用户访问权限；
发送装置，用于将上述用户终端的标识信息及上述HTTP请求发送给业务服务器，以使得上述业务服务器利用上述用户终端的标识信息对上述访问票据进行认证；
上述接收装置，用于若认证结果为上述访问票据合法，接收上述业务服务器返回的包含内容指纹的HTTP响应，上述内容指纹用于标识内容资源；
处理器，用于根据上述内容指纹获取内容资源后发送给所述用户终端。
结合本发明实施例第十一方面，本发明实施例第十一方面的第一种实现方 式中，
上述接收装置，还用于接收上述业务服务器发送的内容指纹及内容资源；
上述处理器，还用于检查其自身是否已存储上述内容指纹，若否，则保存上述内容指纹及上述内容资源，若是，则丢弃上述内容指纹及上述内容资源。
结合本发明实施例第十一方面，本发明实施例第十一方面的第二种实现方式中，所述处理器，还用于若在预设时段内所述内容资源被访问的次数不大于预设阈值，从所述业务服务器获取更新的内容资源以及内容指纹。
本发明实施例第十二方面提供了一种业务服务器，包括：
接收装置，用于接收CDN服务器发送的HTTP请求及用户终端的标识信息，上述HTTP请求包含有访问票据；
处理器，用于利用上述用户终端的标识信息对上述访问票据进行认证；
发送装置，用于若认证结果为所述访问票据合法，将包含上述内容指纹的HTTP响应返回给上述CDN服务器，以使得上述CDN服务器根据上述内容指纹获取内容资源。
结合本发明实施例第十二方面，本发明实施例第十二方面的第一种实现方式中，上述处理器，还用于对内容资源进行哈希运算得到内容指纹，上述内容指纹用于标识内容资源；
上述发送装置，用于将上述内容资源及内容指纹发送给上述CDN服务器。
结合本发明实施例第十二方面，本发明实施例第十二方面的第二种实现方式中，上述接收装置，还用于接收上述CDN服务器发送的包含URL的内容更新请求；
上述处理器，还用于根据上述URL查找内容资源及内容指纹；
上述发送装置，还用于将上述URL对应的内容资源及上述内容指纹返回给上述CDN服务器。
本发明实施例第十三方面提供了一种业务服务器，包括：
接收装置，用于接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
处理器，用于根据上述HTTP请求生成URL，上述URL包含上述内容资源对应的内容指纹；
发送装置，用于将上述URL返回给用户终端，以使得上述用户终端向CDN服务器发送包含上述URL的HTTP请求。
本发明实施例第十四方面提供了一种CDN服务器，包括：
接收装置，用于接收用户终端发送的HTTP请求，上述HTTP请求包含内容指纹；
处理器，用于根据上述内容指纹获取对应的内容资源；
发送装置，用于将上述内容资源发送给上述用户终端。
本发明实施例第十五面提供了一种用户终端，包括：
发送装置，用于向业务服务器发送HTTP请求，HTTP请求用于获取内容资源；
接收装置，用于接收业务服务器返回的URL，上述URL包含上述内容资源对应的内容指纹；
上述发送装置，还用于向CDN服务器发送HTTP请求，上述HTTP请求包含上述内容指纹，以使得上述CDN服务器根据上述内容指纹获取对应的内容资源；
上述接收装置，还用于接收上述CDN服务器返回的内容资源。
从以上技术方案可以看出，本发明实施例具有以下优点：
本发明实施例中，CDN服务器接收用户终端发送的HTTP请求以及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限，将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证，若认证结果为访问票据合法，接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源，根据内容指纹获取内容资源后，将内容资源发送给用户终端，CDN服务器不会根据HTTP请求将内容资源直接返回给用户终端，而是接收业务服务器对HTTP请求认证成功的结果之后，根据内容指纹查找并返回内容资源，内容指纹由业务服务器与CDN服务器存储，不经过用户终端，入侵者无法通过用户终端获取内容指纹，而没有内容指纹无法获取内容资源，因此提高了内容资源的安全性。
附图说明
图1为现有技术中基于CDN的访问控制方法的一个信令流程示意图；
图2为本发明实施例中基于CDN的访问控制方法的一个信令流程示意图；
图3为本发明实施例中基于CDN的访问控制方法的一个流程示意图；
图4为本发明实施例中基于CDN的访问控制方法的另一个流程示意图；
图5为本发明实施例中基于CDN的访问控制方法的另一个信令流程示意图；
图6为本发明实施例中基于CDN的访问控制方法的另一个流程示意图；
图7为本发明实施例中基于CDN的访问控制方法的另一个流程示意图；
图8为本发明实施例中基于CDN的访问控制方法的另一个流程示意图；
图9为本发明实施例中CDN服务器的一个结构示意图；
图10为本发明实施例中CDN服务器的另一个结构示意图；
图11为本发明实施例中业务服务器的一个结构示意图；
图12为本发明实施例中业务服务器的另一个结构示意图；
图13为本发明实施例中业务服务器的另一个结构示意图；
图14为本发明实施例中CDN服务器的另一个结构示意图；
图15为本发明实施例中用户终端的一个结构示意图；
图16为本发明实施例中CDN服务器的另一个结构示意图；
图17为本发明实施例中业务服务器的另一个结构示意图；
图18为本发明实施例中用户终端的另一个结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例中基于CDN的访问控制方法可以应用的网络架构包括：
业务服务器，用于对用户进行鉴权，认证，向CDN服务器提供内容资源，接收用户终端发送的内容请求之后，向用户提供CDN服务器中内容资源的地址；
CDN服务器，用于存储业务服务器提供的内容资源，接收用户终端发送的内容请求之后，将内容资源返回给用户终端。
用户终端，用于发起HTTP请求，获取内容资源。
请参阅图1，基于上述网络架构，现有技术中基于CDN的访问控制方法的一个实施例包括：
CDN服务器向业务服务器提供加解密算法以及密钥，业务服务器根据加解密算法及密钥对URL进行加密。
用户终端访问业务服务器中的内容资源时，业务服务器会生成内容资源对应的HTTP响应，其中，HTTP响应包括：用户终端的IP地址、发送内容请求的时间及URL，用户终端会向上述URL指定的CDN服务器发送内容请求报文，用户信息通过CDN服务器认证之后，CDN服务器根据上述URL获取内容资源，若CDN服务器中不存在内容资源，CDN服务器会将来自用户终端的内容请求报文发送给业务服务器，业务服务器根据内容请求报文查找到内容资源之后，将内容资源发送给CDN服务器，CDN服务器将内容资源返回给用户终端，并保存内容资源。可以理解的是，用户终端与服务器侧的交互是通过用户代理(例如，浏览器、下载工具或流媒体播放器)来实现的，具体可参考现有技术，此处不再赘述。
现有技术中，业务服务器会将CDN服务器中内容资源的URL发送给用户，虽然此URL经过加密，但是入侵者可以获取此URL访问CDN服务器，CDN服务器却无法对用户鉴权，无疑存在风险。
同时，业务服务器为CDN服务器分配内容资源时，会给内容资源分配一个URL，CDN服务器通过URL来识别内容资源，由于不同用户存储的内容对应的URL不同，因此CDN服务器会存储很多内容相同的内容资源。
为了提高内容资源的安全性，本发明实施例提供了一种基于CDN的访问控制方法，可以实现通过内容指纹查找内容资源，由于内容指纹保存在CDN服务器与业务服务器中，因此可以避免攻击者通过用户终端直接获取URL，通过URL获取内容资源的可能，请参阅图2所示的信令流程图。
201、用户终端向业务服务器发送HTTP请求，该HTTP请求用于获取内容资源；
202、业务服务器根据上述HTTP请求生成URL，将该URL发送给用户终端，该URL携带有访问票据；
203、用户终端向CDN服务器发送HTTP请求以及用户终端的标识信息，该HTTP请求携带有访问票据；
204、CDN服务器将来自用户终端的HTTP请求以及用户终端的标识信息发送给业务服务器；
205、业务服务器根据用户终端的标识信息对访问票据进行认证；
206、若访问票据合法，业务服务器根据访问票据查找内容指纹，将内容指纹发送给CDN服务器；
207、CDN服务器根据内容指纹查找内容资源；
208、CDN服务器将内容资源发送给用户终端。
请参阅图3，本发明实施例中基于CDN的访问控制方法的一个实施例包括：
301、CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限；
本实施例中，当用户访问业务服务器中的内容资源时，业务服务器生成指向CDN服务器中内容资源的URL，并将该URL发送给用户终端，用户终端可以利用该URL生成HTTP请求，CDN服务器接收该请求。CDN服务器还可以接收用户终端发送的标识信息，用户终端的标识信息可以是用户终端的IP地址，携带在TCP/IP请求中。
该URL包含访问票据，访问票据用于标识用户可以访问的内容资源的权限，该URL还包含用户会话信息，用户会话信息用于维护用户终端与业务服务器之间的关联请求。
需要说明的是，本实施例中，CDN服务器不会根据来自用户终端的URL查找内容资源或内容指纹。
302、CDN服务器将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证；
其中，CDN服务器将用户终端的标识信息及HTTP请求发送给业务服务器，业务服务器可以利用用户终端的标识信息对访问票据进行认证。如果访问票据通过认证，表明用户有权获取内容资源，否则表明用户无权获取内容资源。
303、若认证结果为访问票据合法，CDN服务器接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源；
其中，内容指纹是对内容资源提取内容摘要，并对内容摘要进行哈希运算得到的字符串，即内容资源的数字指纹，能够唯一标识内容资源。相同的内容资源加密所得内容指纹相同，不同的内容资源加密所得内容指纹不同。需要说明的是，即使内容相同的内容资源的名称或存储位置不同，内容指纹仍然相同。
304、CDN服务器根据内容指纹获取内容资源；
其中，CDN服务器存储有内容指纹及内容资源，内容指纹与内容资源对应，CDN服务器获取内容指纹之后，可以根据内容指纹获取内容资源。
305、CDN服务器将内容资源发送给用户终端。
CDN服务器获取内容资源之后，将内容资源发送给用户终端。
本发明实施例中，CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限，将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证，若认证结果为访问票据合法，接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源，根据内容指纹获取内容资源，将内容资源发送给用户终端，CDN服务器不会根据HTTP请求将内容资源直接返回给用户终端，而是接收业务服务器对HTTP请求认证成功的结果之后，根据内容指纹查找并返回内容资源，内容指纹由业务服务器与CDN服务器存储，不经过用户终端，入侵者无法通过用户终端获取内容指纹，而没有内容指纹无法获取内容资源，因此提高了内容资源的安全性。
可选的，在本发明的一些实施例中，CDN服务器根据内容指纹获取内容资源具体通过以下方式实现：若CDN服务器中未存储内容资源，则CDN服务器向业务服务器发送包含有内容指纹的内容请求，以使得业务服务器根据内容指纹查找内容资源，CDN服务器接收业务服务器返回的内容资源。
具体的，当CDN服务器中未存储内容资源时，CDN服务器可以根据内容指纹从业务服务器获取内容资源。
可选的，在本发明的另一些实施例中，CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息之前包括：CDN服务器接收业务服务器发送的内容资源及内容指纹；CDN服务器检查其自身是否已存储内容指纹或内容资源，若否，则保存内容资源及内容指纹，若是，则丢弃内容指纹及内容资源。
本实施例中，CDN服务器可以接收业务服务器发送的内容资源及内容指纹，检查其自身是否已存储内容指纹，若是，则表明CDN服务器已存储内容资源，仅保留一个内容资源即可，可以丢弃此内容资源，若否，则表明CDN服务器未存储此内容资源，需要存储此内容资源，用来向用户提供CDN加速服务。需要说明的是，当CDN服务器已存储内容资源时，CDN服务器也可以保留最后接收的内容资源，并丢弃已存储的内容资源，具体此处不作限定。
需要说明的是，以上CDN服务器保留一个内容资源为减少冗余的最佳方案，在实际应用中，CDN服务器可以保留预定数量的相同的内容资源，当相同的内容资源的数量达到预定数量之后，CDN服务器再接收与上述内容相同的内容资源时，不再保存该内容资源，以减少冗余。
可选的，在本发明的另一些实施例中，若在预设时段内内容资源被访问的次数不大于预设阈值，CDN服务器从业务服务器获取更新的内容资源以及内容指纹。
具体的，预设阈值的大小可以根据经验或实际测试获取，此处不作限定。若在预设时段内内容资源被访问的次数小于或等于预设阈值，表明内容资源在此时段内不受关注，需要更换内容资源，CDN服务器可以向业务服务器发送内容更新请求，业务服务器将更新后的内容资源及内容指纹发送给CDN服务器，CDN服务器从而完成内容更新。
若在预设时段内内容资源被访问的次数大于预设阈值，表明内容资源受人欢迎，无需更换该内容资源。与现有技术中CDN服务器通过定期清理内容资源的方式更新内容资源相比，本发明可以立即更新被访问较少的内容资源，同时可以将受人欢迎的内容资源不更新，使得用户可以继续访问该内容资源，提高了用户体验。
需要说明的是，当CDN服务器将URL指定的原内容资源及原内容指纹，替换为更新后的内容资源及更新后的内容指纹之后，CDN服务器可以立即删除原内容资源，也可以不立即删除原内容资源，由于业务服务器将URL指向更新后的内容资源，原内容资源不会再被用户访问，CDN服务器可以通过定期删除访问次数过低的内容资源的方式，将原内容资源删除。
请参阅图4，本发明实施例中基于CDN的访问控制方法的另一实施例包括：
401、业务服务器接收CDN服务器发送的HTTP请求及用户终端的标识信息，HTTP请求包含有访问票据；
本实施例中，业务服务器可以接收CDN服务器发送的HTTP请求及用户终端的标识信息，HTTP请求包含有访问票据，所述访问票据用于标识用户访问权限。HTTP请求还包含有用户会话信息，用户会话信息用于维护用户终端与业务服务器之间的关联请求。
402、业务服务器利用用户终端的标识信息对访问票据进行认证；
其中，业务服务器可以检查访问票据是否与上述用户终端的标识信息对应，访问票据是否与用户会话对应，访问票据是否在有效期以内等。可以理解的是，在实际应用中，可以使用其中一种或多种认证方式对访问票据进行认证，此处不作限定。
业务服务器对访问票据进行认证的具体过程可参阅现有技术，此处不再赘 述。
403、若认证结果为访问票据合法，业务服务器将包含内容指纹的HTTP响应返回给CDN服务器，以使得CDN服务器根据内容指纹获取内容资源。
可选的，本发明一些实施例中，上述方法还包括：业务服务器接收CDN服务器发送的包含内容指纹的内容请求；业务服务器根据内容指纹查找内容资源；业务服务器将内容资源发送给CDN服务器。
具体的，若CDN服务器中没有存储内容资源，CDN服务器可以向业务服务器发送包含内容指纹的内容请求，业务服务器可以根据内容指纹查找内容资源，并将内容资源返回给CDN服务器。
可选的，本发明一些实施例中，所述业务服务器将包含内容指纹的HTTP响应返回给所述CDN服务器之前包括：业务服务器对内容资源进行哈希运算得到内容指纹，内容指纹用于标识内容资源；业务服务器将内容资源及内容指纹发送给CDN服务器。
具体的，业务服务器对内容资源进行哈希运算所用算法可以为SHA512，SHA224，SHA256或SHA384，还可以为其他安全哈希算法，此处不作限定。可以理解的是，业务服务器可以将一部分或全部的内容资源及内容指纹发送给CDN服务器。
可选的，本发明一些实施例中，所述业务服务器将包含所述内容指纹的HTTP响应返回给所述CDN服务器之后包括：业务服务器接收CDN服务器发送的包含URL的内容更新请求；业务服务器根据URL查找内容资源及内容指纹；业务服务器将URL对应的内容资源及内容指纹返回给所述CDN服务器。
本实施例中，在实际应用中，由于业务服务器隔一段时间会更新内容资源，URL所对应的内容指纹和内容资源会发生变化，CDN服务器上的内容资源也需要随之更新，CDN服务器可以向业务服务器发送URL，业务服务器可以根据URL查找到内容资源及内容指纹，将该内容资源及内容指纹返回给CDN服务器，CDN服务器将URL指定的原内容资源及原内容指纹替换为更新后的内容资源及更新后的内容指纹。
为便于理解，下面以一个具体应用场景对本发明中的基于CDN的访问控制方法进行详细描述：
当用户打开名为“http://media.orgin.com”的网站，点击观看该网站的付费内容“2.pdf”时，网站会跳转至付费页面，当用户付费之后，业务服务器生成 一个URL，例如：http://media.orgin.com/2.pdf？ticket＝1？session＝2，将该URL返回给浏览器，浏览器通过该URL向CDN服务器发起访问“2.pdf”的请求，CDN服务器将该URL发送给业务服务器，业务服务器对ticket进行认证，若通过认证，则根据该URL查找内容指纹1，将内容指纹1返回给CDN服务器，CDN服务器根据内容指纹1查找“2.pdf”，将“2.pdf”返回给用户。
可选的，CDN服务器根据内容指纹1查找“2.pdf”之前，业务服务器可以对“2.pdf”进行哈希运算得到内容指纹1，将内容指纹1及“2.pdf”发送给CDN服务器。
在实际应用中，本发明实施例还提供一种快捷的访问内容资源的方法，可用于用户访问业务服务器中无需保护的内容资源，请参阅图5，图5为本发明实施例中基于CDN的访问控制方法的另一信令流程图。
501、用户终端向业务服务器发送HTTP请求，该HTTP请求用于获取内容资源；
502、业务服务器根据上述HTTP请求生成包含内容指纹的URL，发送给用户终端；
503、用户终端向CDN服务器发送HTTP请求，HTTP请求携带有内容指纹；
504、CDN服务器根据内容指纹查找内容资源；
505、CDN服务器将内容资源发送给用户终端。
请参阅图6，本发明实施中基于CDN的访问控制方法的另一个实施例包括：
601、业务服务器接收用户终端发送的HTTP请求；
本实施例中，当用户访问业务服务器中内容资源时，业务服务器接收用户终端发送的HTTP请求，HTTP请求用于获取内容资源。
602、业务服务器根据HTTP请求生成URL，URL包含内容资源对应的内容指纹；
其中，业务服务器检查上述HTTP请求访问的内容资源是否需要保护，若该内容资源为无需保护的内容类型，业务服务器可以生成包含内容指纹的URL，该内容指纹与无需保护的内容资源对应。
603、业务服务器将URL返回给用户终端，以使得用户终端向CDN服务器发送包含URL的HTTP请求。
业务服务器获取URL之后，将URL返回给用户终端，用户终端可以向CDN 服务器发送包含URL的HTTP请求。
请参阅图7，本发明实施中基于CDN的访问控制方法的另一个实施例包括：
701、CDN服务器接收用户终端发送的HTTP请求，HTTP请求包含内容指纹；
本实施例中，CDN服务器可以接收用户终端发送的HTTP请求，HTTP请求包含内容指纹。
702、CDN服务器根据内容指纹获取对应的内容资源；
其中，CDN服务器存储有内容指纹及内容资源，内容指纹与内容资源对应，CDN服务器获取HTTP请求之后，由于HTTP请求携带有内容指纹，可以根据内容指纹获取内容资源。
703、CDN服务器将内容资源发送给用户终端。
CDN服务器获取内容资源之后，可以将内容资源发送给用户终端。
请参阅图8，本发明实施中基于CDN的访问控制方法的另一个实施例包括：
801、用户终端向业务服务器发送HTTP请求，HTTP请求用于获取内容资源；
本实施例中，用户终端可以向业务服务器发送HTTP请求，HTTP请求用于获取内容资源。
802、用户终端接收业务服务器返回的URL，URL包含内容资源的内容指纹；
用户终端可以接收业务服务器返回的URL，URL包含内容资源的内容指纹。
803、用户终端向CDN服务器发送HTTP请求，HTTP请求包含内容指纹；
用户终端获取URL之后，向CDN服务器发送包含该URL的HTTP请求，以使得CDN服务器根据URL中的内容指纹获取对应的内容资源。
804、用户终端接收CDN服务器返回的内容资源。
为便于理解，下面以另一个具体应用场景对本发明实施例中的基于CDN的访问控制方法进行详细描述：
当用户打开“http://media.orgin.com”的网站，点击观看该网站的免费内容“1.gif”时，业务服务器生成一个URL，例如：http://media.orgin.com/1.gif？Fingerprint＝3，将该URL返回给浏览器，浏览器通过该URL向CDN服务器发起访问“1.gif”的请求，CDN服务器检查该URL存在内容指纹3，CDN服务器根据内容指纹3查找“1.gif”，将“1.gif”返回给用户。
以上从方法角度对本发明实施例中的基于CDN的访问控制方法进行了说明，下面从装置角度对本发明实施例中CDN服务器进行详细描述，请参阅图9，本发明实施例中CDN服务器的一个实施例包括：
接收模块901，用于接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限；
发送模块902，用于将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证；
接收模块901，还用于若认证结果为访问票据合法，CDN服务器接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源；
获取模块903，用于根据内容指纹获取内容资源后发送给用户终端。
本发明实施例中，接收模块901接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限，发送模块902将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证，若认证结果为访问票据合法，接收模块901接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源，获取模块903根据内容指纹获取内容资源后发送给用户终端，CDN服务器不会根据HTTP请求将内容资源直接返回给用户终端，而是接收业务服务器对HTTP请求认证成功的结果之后，根据内容指纹查找并返回内容资源，内容指纹由业务服务器与CDN服务器存储，不经过用户终端，入侵者无法通过用户终端获取内容指纹，而没有内容指纹无法获取内容资源，因此提高了内容资源的安全性。
可选的，在本发明的一些实施例中，
发送模块902，还用于若CDN服务器900中未存储内容资源，则向业务服务器发送包含有内容指纹的HTTP请求，以使得业务服务器根据内容指纹查找内容资源，
接收模块901，还用于接收业务服务器返回的内容资源。
可选的，请参阅图10，在本发明的一些实施例中，
接收模块901，还用于接收业务服务器发送的内容指纹及内容资源；
CDN服务器900还包括：
检查模块1001，用于检查其自身是否已存储内容指纹，若否，则触发保存模块1002保存内容资源及内容指纹的步骤，若是，则触发执行模块1003丢弃 内容指纹及内容资源。
保存模块1002，用于保存内容指纹及内容资源；
执行模块1003，用于丢弃内容指纹及内容资源。
可选的，在本发明的一些实施例中，
获取模块903，还用于若在预设时段内所述内容资源被访问的次数不大于预设阈值，从所述业务服务器获取更新的内容资源以及内容指纹。
请参阅图11，本发明实施例中业务服务器的一个实施例包括：
接收模块1101，用于接收CDN服务器发送的HTTP请求及用户终端的标识信息，HTTP请求包含有访问票据；
认证模块1102，用于利用用户终端的标识信息对访问票据进行认证；
发送模块1103，用于若认证结果为访问票据合法，将包含内容指纹的HTTP响应返回给CDN服务器，以使得CDN服务器根据内容指纹获取内容资源。
可选的，在本发明的一些实施例中，
接收模块1101，还用于接收CDN服务器发送的包含内容指纹的内容请求；
发送模块1103，还用于将内容指纹对应的内容资源发送给CDN服务器。
可选的，在本发明的另一些实施例中，业务服务器1100还包括：
运算模块1201，用于对内容资源进行哈希运算得到内容指纹，内容指纹用于标识内容资源；
发送模块1103，还用于将内容资源及内容指纹发送给CDN服务器。
可选的，在本发明的另一些实施例中，
接收模块1101，还用于接收CDN服务器发送的包含URL的内容更新请求；
业务服务器1100还包括：
查找模块1202，用于根据URL查找内容资源及内容指纹；
发送模块1103，还用于将所述URL对应的内容资源及内容指纹返回给所述CDN服务器。
为便于理解，下面以一个具体应用场景对本发明实施例中基于CDN的访问控制方法中的各网元或各网元中模块之间的交互进行详细描述：
在本发明实施例的具体应用场景中，用户终端的标识信息为用户IP地址，当用户打开名为“http://media.orgin.com”的网站，点击观看该网站的付费内容“2.pdf”时，网站会跳转至付费页面，当用户付费之后，业务服务器的接收模块1101接收用户终端发送的HTTP请求及用户终端的标识信息，生成一个URL， 例如：http://media.orgin.com/2.pdf？ticket＝1？session＝2，将该URL返回给浏览器，浏览器通过该URL向CDN服务器发起访问“2.pdf”的请求，CDN服务器的接收模块901接收用户终端发送的HTTP请求及用户IP地址，CDN服务器的发送模块902将该URL及用户IP地址发送给业务服务器的接收模块1101，业务服务器的认证模块1102利用用户的IP地址对ticket进行认证，若ticket通过认证，则业务服务器的发送模块1103将该URL对应的内容指纹1返回给CDN服务器的接收模块901，CDN服务器的获取模块903根据内容指纹1获取“2.pdf”，并将“2.pdf”返回给用户终端。
可选的，CDN服务器将“2.pdf”返回给用户终端之前，业务服务器的运算模块1201可以对“2.pdf”进行哈希运算得到内容指纹1，业务服务器的发送模块1103将内容指纹1及“2.pdf”发送给CDN服务器。
请参阅图13，本发明实施例中业务服务器的另一个实施例包括：
接收模块1301，用于接收用户终端发送的HTTP请求，HTTP请求用于获取内容资源；
生成模块1302，用于根据HTTP请求生成URL，URL包含内容资源对应的内容指纹；
发送模块1303，用于将URL返回给用户终端，以使得用户终端向CDN服务器发送包含URL的HTTP请求。
请参阅图14，本发明实施例中CDN服务器的另一个实施例包括：
接收模块1401，用于接收用户终端发送的HTTP请求，HTTP请求包含内容指纹；
获取模块1402，用于根据内容指纹获取对应的内容资源；
发送模块1403，用于将内容资源发送给用户终端。
请参阅图15，本发明实施例中用户终端的一个实施例包括：
发送模块1501，用于向业务服务器发送HTTP请求，HTTP请求用于获取内容资源；
接收模块1502，用于接收业务服务器返回的URL，URL包含内容资源对应的内容指纹；
发送模块1501，还用于向CDN服务器发送HTTP请求，HTTP请求包含内容指纹；
接收模块1502，还用于接收CDN服务器返回的内容资源。
为便于理解，下面以一个具体应用场景对本发明实施例中基于CDN的访问控制方法中的各网元或各网元中模块之间的交互进行详细描述：
内容资源以“1.gif”为例，当用户打开名为“http://media.orgin.com”的网站，点击观看该网站的免费内容“1.gif”时，用户终端的发送模块1501向业务服务器发送HTTP请求，业务服务器的接收模块1301接收用户终端发送的HTTP请求，生成模块1302生成一个URL，例如：http://media.orgin.com/1.gif？Fingerprint＝3，业务服务器的发送模块1303将该URL返回给用户终端的接收模块1502，用户终端的发送模块1501通过该URL向CDN服务器发起访问“1.gif”的HTTP请求，CDN服务器的接收模块1401接收HTTP请求，由于该URL包含内容指纹3，CDN服务器的获取模块1402根据内容指纹3获取“1.gif”，CDN服务器的发送模块1403将“1.gif”返回给用户终端，用户终端的接收模块1502接收“1.gif”。
上面从单元化功能实体的角度对本发明实施例中的CDN服务器进行了描述，下面从硬件处理的角度对本发明实施例中的CDN服务器进行描述，请参阅图16，本发明实施例中CDN服务器1600的另一个实施例包括：
接收装置1601、发送装置1602、处理器1603及存储器1604，其中CDN服务器1600中的处理器1603的数量可以一个或多个，图16中以一个处理器1603为例。处理器1603和存储器1604通过接收装置1601接收UE外部的信息，处理器1603和存储器1604通过发送装置1602将信息发射到UE外部。在本发明的一些实施例中，接收装置1601、发送装置1602、处理器1603和存储器1604可通过总线或其它方式连接，其中，图16中以通过总线连接为例。
接收装置1601，用于接收用户终端发送的HTTP请求及用户终端的标识信息，HTTP请求包含访问票据，访问票据用于标识用户访问权限；
发送装置1602，用于将用户终端的标识信息及HTTP请求发送给业务服务器，以使得业务服务器利用用户终端的标识信息对访问票据进行认证；
接收装置1601，用于若认证结果为访问票据合法，接收业务服务器返回的包含内容指纹的HTTP响应，内容指纹用于标识内容资源；
处理器1603，用于根据内容指纹获取内容资源后发送给用户终端。
存储器1604可以包括只读存储器和随机存取存储器，并向处理器1603提供指令和数据，存储器1604的一部分还可以包括可能包含高速随机存取存储器(RAM，Random Access Memory)，也可能还包括非不稳定的存储器 (Non-Volatile Memory)。
存储器1604存储了如下的元素：可执行模块或者数据结构，或者它们的子集，或者它们的扩展集；操作指令包括各种操作指令，用于实现各种操作；操作系统包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
其中，接收装置1601，还用于接收业务服务器发送的内容指纹及内容资源；
处理器1603，还用于检查其自身是否已存储内容指纹，若否，则保存内容指纹及内容资源，若是，则丢弃内容指纹及内容资源。
其中，处理器1603，还用于若在预设时段内内容资源被访问的次数不大于预设阈值，从业务服务器获取更新的内容资源以及内容指纹。
请参阅图17，本发明实施例中业务服务器的另一个实施例包括：
接收装置1701、发送装置1702、处理器1703及存储器1704，其中业务服务器1700中的处理器1703的数量可以一个或多个，图17中以一个处理器1703为例。处理器1703和存储器1704通过接收装置1701接收UE外部的信息，处理器1703和存储器1704通过发送装置1702将信息发射到UE外部。在本发明的一些实施例中，接收装置1701、发送装置1702、处理器1703和存储器1704可通过总线或其它方式连接，其中，图17中以通过总线连接为例。
接收装置1701，用于接收CDN服务器发送的HTTP请求及用户终端的标识信息，HTTP请求包含有访问票据；
处理器1703，用于利用用户终端的标识信息对访问票据进行认证；
发送装置1702，用于若认证结果为访问票据合法，将包含内容指纹的HTTP响应返回给CDN服务器，以使得CDN服务器根据内容指纹获取内容资源。
存储器1704可以包括只读存储器和随机存取存储器，并向处理器1703提供指令和数据，存储器1704的一部分还可以包括可能包含RAM，也可能还包括非不稳定的存储器。
存储器1704存储了如下的元素：可执行模块或者数据结构，或者它们的子集，或者它们的扩展集；操作指令包括各种操作指令，用于实现各种操作；操作系统包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
其中，处理器1703，还用于对内容资源进行哈希运算得到内容指纹，内容指纹用于标识内容资源；
发送装置1702，用于将内容资源及内容指纹发送给CDN服务器。
其中，接收装置1701，还用于接收CDN服务器发送的包含URL的内容更 新请求；
处理器1703，还用于根据URL查找内容资源及内容指纹；
发送装置1702，还用于将URL对应的内容资源及内容指纹返回给CDN服务器。
请参阅图17，本发明实施例中业务服务器的另一个实施例包括：
接收装置1701，用于接收用户终端发送的HTTP请求，HTTP请求用于获取内容资源；
处理器1703，用于根据HTTP请求生成URL，URL包含内容资源对应的内容指纹；
发送装置1702，用于将URL返回给用户终端，以使得用户终端向CDN服务器发送包含URL的HTTP请求。
请参阅图16，本发明实施例中CDN服务器的另一个实施例包括：
接收装置1601，用于接收用户终端发送的HTTP请求，HTTP请求包含内容指纹；
处理器1603，用于根据内容指纹获取对应的内容资源；
发送装置1602，用于将内容资源发送给用户终端。
请参阅图18，本发明实施例中用户终端的另一个实施例包括：
接收装置1801、发送装置1802、处理器1803及存储器1804，其中业务服务器1800中的处理器1803的数量可以一个或多个，图18中以一个处理器1803为例。处理器1803和存储器1804通过接收装置1801接收UE外部的信息，处理器1803和存储器1804通过发送装置1802将信息发射到UE外部。在本发明的一些实施例中，接收装置1801、发送装置1802、处理器1803和存储器1804可通过总线或其它方式连接，其中，图18中以通过总线连接为例。
发送装置1802，用于向业务服务器发送HTTP请求，HTTP请求用于获取内容资源；
接收装置1801，用于接收业务服务器返回的URL，URL包含内容资源对应的内容指纹；
发送装置1802，还用于向CDN服务器发送HTTP请求，HTTP请求包含内容指纹；
接收装置1801，还用于接收CDN服务器返回的内容资源。
存储器1804可以包括只读存储器和随机存取存储器，并向处理器1803提 供指令和数据，存储器1804的一部分还可以包括可能包含RAM，也可能还包括非不稳定的存储器。
存储器1804存储了如下的元素：可执行模块或者数据结构，或者它们的子集，或者它们的扩展集；操作指令包括各种操作指令，用于实现各种操作；操作系统包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以 存储程序代码的介质。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (27)

  1. 一种基于CDN的访问控制方法，其特征在于，包括：
    内容分发网络CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含访问票据，所述访问票据用于标识用户访问权限；
    所述CDN服务器将所述用户终端的标识信息及所述HTTP请求发送给业务服务器，以使得所述业务服务器利用所述用户终端的标识信息对所述访问票据进行认证；
    若认证结果为所述访问票据合法，所述CDN服务器接收所述业务服务器返回的包含内容指纹的HTTP响应，所述内容指纹用于标识内容资源；
    所述CDN服务器根据所述内容指纹获取内容资源后发送给所述用户终端。
  2. 根据权利要求1所述的方法，其特征在于，所述CDN服务器接收用户终端发送的HTTP请求及用户终端的标识信息之前包括：
    所述CDN服务器接收所述业务服务器发送的内容指纹及内容资源；
    所述CDN服务器检查其自身是否已存储所述内容指纹或内容资源，若否，则保存所述内容指纹及内容资源，若是，丢弃所述内容指纹及所述内容资源。
  3. 根据权利要求1所述的方法，其特征在于，所述CDN服务器将所述内容资源发送给所述用户终端之后包括：
    若在预设时段内所述内容资源被访问的次数不大于预设阈值，所述CDN服务器从所述业务服务器获取更新的内容资源以及内容指纹。
  4. 一种基于CDN的访问控制方法，其特征在于，包括：
    业务服务器接收内容分发网络CDN服务器发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含有访问票据，所述访问票据用于标识用户访问权限；
    所述业务服务器利用所述用户终端的标识信息对所述访问票据进行认证；若认证结果为所述访问票据合法，所述业务服务器将包含内容指纹的HTTP响应返回给所述CDN服务器，以使得所述CDN服务器根据所述内容指纹获取内容资源。
  5. 根据权利要求4所述的方法，其特征在于，所述业务服务器将包含内容指纹的HTTP响应返回给所述CDN服务器之前包括：
    所述业务服务器对内容资源进行哈希运算得到内容指纹；
    所述业务服务器将所述内容资源及内容指纹发送给所述CDN服务器。
  6. 根据权利要求4所述的方法，其特征在于，所述业务服务器将包含所述内容指纹的HTTP响应返回给所述CDN服务器之后包括：
    所述业务服务器接收所述CDN服务器发送的包含URL的内容更新请求；
    所述业务服务器根据所述URL查找内容资源及内容指纹；
    所述业务服务器将所述URL对应的内容资源及内容指纹返回给所述CDN服务器。
  7. 一种基于CDN的访问控制方法，其特征在于，包括：
    业务服务器接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
    所述业务服务器根据所述HTTP请求生成URL，所述URL包含所述内容资源对应的内容指纹；
    所述业务服务器将所述URL返回给用户终端，以使得所述用户终端向CDN服务器发送包含所述URL的HTTP请求。
  8. 一种基于CDN的访问控制方法，其特征在于，包括：
    内容分发网络CDN服务器接收用户终端发送的HTTP请求，所述HTTP请求包含内容指纹；
    所述CDN服务器根据所述内容指纹获取对应的内容资源；
    所述CDN服务器将所述内容资源发送给所述用户终端。
  9. 一种基于CDN的访问控制方法，其特征在于，包括：
    用户终端向业务服务器发送HTTP请求，所述HTTP请求用于获取内容资源；
    所述用户终端接收业务服务器返回的URL，所述URL包含所述内容资源对应的内容指纹；
    所述用户终端向内容分发网络CDN服务器发送HTTP请求，所述HTTP请求包含所述内容指纹，以使得所述CDN服务器根据所述内容指纹获取对应的内容资源；
    所述用户终端接收所述CDN服务器返回的所述内容资源。
  10. 一种CDN服务器，其特征在于，包括：
    接收模块，用于接收用户终端发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含访问票据，所述访问票据用于标识用户访问权限；
    发送模块，用于将所述用户终端的标识信息及所述HTTP请求发送给业务服务器，以使得所述业务服务器利用所述用户终端的标识信息对所述访问票据进行认证；
    所述接收模块，还用于若认证结果为所述访问票据合法，接收所述业务服务器返回的包含内容指纹的HTTP响应，所述内容指纹用于标识内容资源；
    获取模块，用于根据所述内容指纹获取内容资源后发送给所述用户终端。
  11. 根据权利要求10所述的CDN服务器，其特征在于，
    所述接收模块，还用于接收所述业务服务器发送的内容指纹及内容资源；
    所述CDN服务器还包括：检查模块，用于检查其自身是否已存储所述内容指纹，若否，则触发保存模块保存所述内容指纹及所述内容资源的步骤，若是，则触发执行模块丢弃所述内容指纹及所述内容资源；
    保存模块，用于保存所述内容指纹及所述内容资源；
    执行模块，用于丢弃所述内容指纹及所述内容资源。
  12. 根据权利要求10所述的CDN服务器，其特征在于，
    所述获取模块，还用于若在预设时段内所述内容资源被访问的次数不大于预设阈值，从所述业务服务器获取更新的内容资源以及内容指纹。
  13. 一种业务服务器，其特征在于，包括：
    接收模块，用于接收内容分发网络CDN服务器发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含有所述访问票据；
    认证模块，用于利用所述用户终端的标识信息对所述访问票据进行认证；
    发送模块，用于若认证结果为所述访问票据合法，将包含内容指纹的HTTP响应返回给所述CDN服务器，以使得所述CDN服务器根据所述内容指纹获取内容资源。
  14. 根据权利要求13所述的业务服务器，其特征在于，所述业务服务器还包括：
    运算模块，用于对内容资源进行哈希运算得到内容指纹，所述内容指纹用于标识内容资源；
    所述发送模块，还用于将所述内容资源及内容指纹发送给所述CDN服务器。
  15. 根据权利要求13所述的业务服务器，其特征在于，
    所述接收模块，还用于接收所述CDN服务器发送的包含URL的内容更新 请求；
    所述业务服务器还包括：查找模块，用于根据所述URL查找内容资源及内容指纹；
    所述发送模块，还用于将所述URL对应的内容资源及所述内容指纹返回给所述CDN服务器。
  16. 一种业务服务器，其特征在于，包括：
    接收模块，用于接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
    生成模块，用于根据所述HTTP请求生成URL，所述URL包含所述内容资源对应的内容指纹；
    发送模块，用于将所述URL返回给用户终端，以使得所述用户终端向CDN服务器发送包含所述URL的HTTP请求。
  17. 一种CDN服务器，其特征在于，包括：
    接收模块，用于接收用户终端发送的HTTP请求，所述HTTP请求包含内容指纹；
    获取模块，用于根据所述内容指纹获取对应的内容资源；
    发送模块，用于将所述内容资源发送给所述用户终端。
  18. 一种用户终端，其特征在于，包括：
    发送模块，用于向业务服务器发送HTTP请求，所述HTTP请求用于获取内容资源；
    接收模块，用于接收业务服务器返回的URL，所述URL包含所述内容资源对应的内容指纹；
    所述发送模块，还用于向内容分发网络CDN服务器发送HTTP请求，所述HTTP请求包含所述内容指纹，以使得所述CDN服务器根据所述内容指纹获取对应的内容资源；
    所述接收模块，还用于接收所述CDN服务器返回的内容资源。
  19. 一种CDN服务器，其特征在于，包括：
    接收装置，用于接收用户终端发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含访问票据，所述访问票据用于标识用户访问权限；
    发送装置，用于将所述用户终端的标识信息及所述HTTP请求发送给业务服务器，以使得所述业务服务器利用所述用户终端的标识信息对所述访问票据 进行认证；
    所述接收装置，用于若认证结果为所述访问票据合法，接收所述业务服务器返回的包含内容指纹的HTTP响应，所述内容指纹用于标识内容资源；
    处理器，用于根据所述内容指纹获取内容资源后发送给所述用户终端。
  20. 根据权利要求19所述的CDN服务器，其特征在于，
    所述接收装置，还用于接收所述业务服务器发送的内容指纹及内容资源；
    所述处理器，还用于检查其自身是否已存储所述内容指纹，若否，则保存所述内容指纹及所述内容资源，若是，则丢弃所述内容指纹及所述内容资源。
  21. 根据权利要求19所述的CDN服务器，其特征在于，
    所述处理器，还用于若在预设时段内所述内容资源被访问的次数不大于预设阈值，从所述业务服务器获取更新的内容资源以及内容指纹。
  22. 一种业务服务器，其特征在于，包括：
    接收装置，用于接收内容分发网络CDN服务器发送的HTTP请求及用户终端的标识信息，所述HTTP请求包含有访问票据；
    处理器，用于利用所述用户终端的标识信息对所述访问票据进行认证；
    发送装置，用于若认证结果为所述访问票据合法，将包含内容指纹的HTTP响应返回给所述CDN服务器，以使得所述CDN服务器根据所述内容指纹获取内容资源。
  23. 根据权利要求22所述的业务服务器，其特征在于，
    所述处理器，还用于对内容资源进行哈希运算得到内容指纹，所述内容指纹用于标识内容资源；
    所述发送装置，用于将所述内容资源及内容指纹发送给所述CDN服务器。
  24. 根据权利要求22所述的业务服务器，其特征在于，
    所述接收装置，还用于接收所述CDN服务器发送的包含URL的内容更新请求；
    所述处理器，还用于根据所述URL查找内容资源及内容指纹；
    所述发送装置，还用于将所述URL对应的内容资源及所述内容指纹返回给所述CDN服务器。
  25. 一种业务服务器，其特征在于，包括：
    接收装置，用于接收用户终端发送的HTTP请求，所述HTTP请求用于获取内容资源；
    处理器，用于根据所述HTTP请求生成URL，所述URL包含所述内容资源对应的内容指纹；
    发送装置，用于将所述URL返回给用户终端，以使得所述用户终端向CDN服务器发送包含所述URL的HTTP请求。
  26. 一种CDN服务器，其特征在于，包括：
    接收装置，用于接收用户终端发送的HTTP请求，所述HTTP请求包含内容指纹；
    处理器，用于根据所述内容指纹获取对应的内容资源；
    发送装置，用于将所述内容资源发送给所述用户终端。
  27. 一种用户终端，其特征在于，包括：
    发送装置，用于向业务服务器发送HTTP请求，所述HTTP请求用于获取内容资源；
    接收装置，用于接收业务服务器返回的URL，所述URL包含所述内容资源对应的内容指纹；
    所述发送装置，还用于向内容分发网络CDN服务器发送HTTP请求，所述HTTP请求包含所述内容指纹，以使得所述CDN服务器根据所述内容指纹获取对应的内容资源；
    所述接收装置，还用于接收所述CDN服务器返回的内容资源。
PCT/CN2016/074771 2015-07-31 2016-02-27 一种基于cdn的访问控制方法及相关设备 WO2017020585A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16832074.5A EP3253026B1 (en) 2015-07-31 2016-02-27 Cdn-based access control method and relevant device
US15/824,499 US10693858B2 (en) 2015-07-31 2017-11-28 CDN-based access control method and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510466027.4 2015-07-31
CN201510466027.4A CN106411823B (zh) 2015-07-31 2015-07-31 一种基于cdn的访问控制方法及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/824,499 Continuation US10693858B2 (en) 2015-07-31 2017-11-28 CDN-based access control method and related device

Publications (1)

Publication Number Publication Date
WO2017020585A1 true WO2017020585A1 (zh) 2017-02-09

Family

ID=57942401

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/074771 WO2017020585A1 (zh) 2015-07-31 2016-02-27 一种基于cdn的访问控制方法及相关设备

Country Status (4)

Country Link
US (1) US10693858B2 (zh)
EP (1) EP3253026B1 (zh)
CN (1) CN106411823B (zh)
WO (1) WO2017020585A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019109809A1 (zh) * 2017-12-04 2019-06-13 腾讯科技（深圳）有限公司 媒体数据的处理方法、计算设备及存储介质
CN115695580A (zh) * 2022-10-27 2023-02-03 上海识装信息科技有限公司 资源获取方法、装置、设备及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6408180B1 (ja) * 2018-03-20 2018-10-17 ヤフー株式会社 端末制御プログラム、端末装置および端末制御方法
CN110413215B (zh) * 2018-04-28 2023-11-07 伊姆西Ip控股有限责任公司 用于获取访问权限的方法、设备和计算机程序产品
CN112118206B (zh) * 2019-06-19 2022-04-12 贵州白山云科技股份有限公司 一种解密方法、装置、系统、介质及设备
CN110489276B (zh) * 2019-07-25 2023-08-29 腾讯科技（深圳）有限公司 基于业务页面的验证服务的容灾方法和装置
JP7332869B2 (ja) * 2019-07-31 2023-08-24 富士通株式会社 通信プログラム、通信方法および通信装置
CN111314365B (zh) * 2020-02-25 2022-08-16 卓望数码技术（深圳）有限公司 应用下载、应用链接生成方法、设备及介质
CN114301903A (zh) * 2020-09-19 2022-04-08 华为云计算技术有限公司 一种基于内容分发网络获取数据的方法及装置
CN112187804B (zh) * 2020-09-29 2023-01-20 北京金山云网络技术有限公司 服务器的通信方法、装置、计算机设备和存储介质
CN113377519B (zh) * 2021-07-07 2022-03-22 江苏云工场信息技术有限公司 一种基于cdn的内容调度方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102130935A (zh) * 2010-08-05 2011-07-20 华为技术有限公司 数据获取方法和装置以及网络存储方法和设备
CN102571936A (zh) * 2011-12-23 2012-07-11 华为技术有限公司 数据查找的方法、装置及系统
CN103109511A (zh) * 2010-04-07 2013-05-15 杰出网络公司 内容分发网络中的部分对象分配
US20130202150A1 (en) * 2012-02-07 2013-08-08 Nishith Kumar Sinha Method and system for an automatic content recognition abstraction layer

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7689532B1 (en) * 2000-07-20 2010-03-30 Digimarc Corporation Using embedded data with file sharing
US8145908B1 (en) * 2004-10-29 2012-03-27 Akamai Technologies, Inc. Web content defacement protection system
WO2011020088A1 (en) * 2009-08-14 2011-02-17 Azuki Systems, Inc. Method and system for unified mobile content protection
ES2401900B1 (es) * 2011-05-12 2014-03-05 Telefónica, S.A. Método de autenticación entre un proveedor de servicios de red de distribución de contenido y un propietario de contenido
US8776241B2 (en) 2011-08-29 2014-07-08 Kaspersky Lab Zao Automatic analysis of security related incidents in computer networks
EP2834961A1 (en) * 2012-04-04 2015-02-11 Unwired Planet, LLC System and method for proxy media caching
CN102611713B (zh) * 2012-04-10 2015-03-25 西南交通大学 基于熵运算的网络入侵检测方法和装置
FR3003061B1 (fr) * 2013-03-11 2019-08-23 Morpho Procede de traitement securise de donnees et application a la biometrie
US9247291B2 (en) * 2013-03-13 2016-01-26 Echostar Technologies L.L.C. Systems and methods for securely providing adaptive bit rate streaming media content on-demand
US9009103B2 (en) * 2013-03-15 2015-04-14 Microsoft Technology Licensing, Llc Fingerprint-based, intelligent, content pre-fetching
US20150052584A1 (en) * 2013-08-13 2015-02-19 News UK & Ireland Limited Access Control System
CN103607416B (zh) * 2013-12-09 2019-04-30 吴东辉 一种网络终端机器身份认证的方法及应用系统
WO2015127075A1 (en) * 2014-02-19 2015-08-27 Level 3 Communications, Llc Content delivery network architecture with edge proxy
US9959839B2 (en) * 2015-06-24 2018-05-01 Intel Corporation Predictive screen display method and apparatus

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103109511A (zh) * 2010-04-07 2013-05-15 杰出网络公司 内容分发网络中的部分对象分配
CN102130935A (zh) * 2010-08-05 2011-07-20 华为技术有限公司 数据获取方法和装置以及网络存储方法和设备
CN102571936A (zh) * 2011-12-23 2012-07-11 华为技术有限公司 数据查找的方法、装置及系统
US20130202150A1 (en) * 2012-02-07 2013-08-08 Nishith Kumar Sinha Method and system for an automatic content recognition abstraction layer

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019109809A1 (zh) * 2017-12-04 2019-06-13 腾讯科技（深圳）有限公司 媒体数据的处理方法、计算设备及存储介质
US11128899B2 (en) 2017-12-04 2021-09-21 Tencent Technology (Shenzhen) Company Limited Media data processing method, computing device and storage medium
CN115695580A (zh) * 2022-10-27 2023-02-03 上海识装信息科技有限公司 资源获取方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US20180091495A1 (en) 2018-03-29
EP3253026A4 (en) 2018-03-21
EP3253026A1 (en) 2017-12-06
CN106411823A (zh) 2017-02-15
EP3253026B1 (en) 2019-06-26
CN106411823B (zh) 2019-07-12
US10693858B2 (en) 2020-06-23

Similar Documents

Publication Publication Date Title
WO2017020585A1 (zh) 一种基于cdn的访问控制方法及相关设备
US10560471B2 (en) Detecting web exploit kits by tree-based structural similarity search
US10419425B2 (en) Method, device, and system for access control of a cloud hosting service
KR101850677B1 (ko) 웹사이트에 로그인하는 단말기가 모바일 단말기인지를 결정하기 위한 방법 및 시스템
EP3345087B1 (en) Method, device, and system for access control of a cloud hosting service
WO2018036314A1 (zh) 一种单点登录认证方法及装置、存储介质
US9979717B2 (en) Algorithm hardening in background context and external from the browser to prevent malicious intervention with the browser
US7765275B2 (en) Caching of private data for a configurable time period
US20180212963A1 (en) Method and apparatus for accessing website
WO2017190641A1 (zh) 拦截爬虫的方法、装置、服务器终端以及计算机可读介质
US10270792B1 (en) Methods for detecting malicious smart bots to improve network security and devices thereof
AU2015409179B2 (en) Machine-driven crowd-disambiguation of data resources
NL2008503C2 (en) Method and system for detecting malicious web content.
EP3852327A1 (en) Exception access behavior identification method and server
CN107864677B (zh) 内容访问验证系统和方法
US10860382B1 (en) Resource protection using metric-based access control policies
KR102690980B1 (ko) 브라우저 쿠키 보안
CN116158057A (zh) 用于增强用户隐私的系统和方法
US9465921B1 (en) Systems and methods for selectively authenticating queries based on an authentication policy
US9124472B1 (en) Providing file information to a client responsive to a file download stability prediction
CN107343028B (zh) 一种基于http协议的通信方法及系统
CN113225348B (zh) 请求防重放校验方法和装置
CN112637171A (zh) 数据流量处理方法、装置、设备、系统和存储介质
RU2781477C2 (ru) Способ и система для обнаружения мошеннического доступа к веб-ресурсу
US11128645B2 (en) Method and system for detecting fraudulent access to web resource

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16832074

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2016832074

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE