WO2020098773A1

WO2020098773A1 - Request response method and device, edge node and authentication system

Info

Publication number: WO2020098773A1
Application number: PCT/CN2019/118711
Authority: WO
Inventors: 王永强
Original assignee: 北京金山云网络技术有限公司; 北京金山云科技有限公司
Priority date: 2018-11-15
Filing date: 2019-11-15
Publication date: 2020-05-22
Also published as: CN111193692A

Abstract

A request response method and device, an edge node and an authentication system, belonging to the field of Internet technology. According to the request response method and device, the edge node and the authentication system provided in the embodiments of the present application, upon reception of a first service request sent by first user equipment, the edge node can determine, according to a locally stored blacklist, whether to respond to the first service request of the first user equipment. It is not necessary to wait for an authentication server to perform authentication and feed back the authentication result, so the response speed of the edge node can be improved, improving the user experience.

Description

Request response method, device, edge node and authentication system

This application requires the priority of the Chinese patent application filed on November 15, 2018 in the Chinese Patent Office with the application number 201811371745.3 and the invention titled "Request Response Method, Device, Edge Node, and Authentication System", the entire contents of which are incorporated by reference In this application.

Technical field

The present application relates to the field of Internet technology, specifically, to a request response method, device, edge node, and authentication system.

Background technique

CDN (Content Delivery Network) is used to publish the content of the website to the network device closest to the user (hereinafter referred to as the edge node). Based on the user's proximity and the judgment of the server load, the user can obtain the required content nearby . In the current content distribution network, the edge node of the CDN needs to perform authentication when receiving a request from the user equipment to access certain specific URLs (Uniform Resource Locator) or specific encrypted data. For example, for a certain encrypted data, only a limited number of user devices are allowed to access the entire network. If this number is exceeded, the next user device that accesses the encrypted data will be denied access during the authentication process.

In the related art, when the user equipment requests the CDN's edge node to obtain data, the edge node needs to first send an authentication request to the CDN's authentication server, and the edge node only receives the authentication pass information returned by the authentication server. It will respond to the data acquisition request of the user equipment, obtain the data from the local cache or request the data source to obtain the data, and send it to the user equipment.

The above process will extend the response time of the CDN edge node to return data to the user equipment. If the authentication server receives more authentication requests, the feedback speed of the authentication server is slower, which further causes the edge node to return the first packet of data to the user equipment The longer the time, the lower the service quality and the lower the user experience.

Summary of the invention

In response to the above problems in the prior art, the present application provides a request response method, device, edge node and authentication system, which can improve the response speed of the edge node and improve the user experience.

In a first aspect, an embodiment of the present application provides a request response method, which is applied to an edge node of a CDN. The method includes:

Receiving the first service request sent by the first user equipment;

Determine whether to respond to the first service request of the first user equipment according to the first service request and a blacklist pre-stored on the edge node, wherein the blacklist is used to indicate that the edge node refuses to respond to the user The condition of the service request sent by the device.

With reference to the first aspect, the embodiments of the present application provide a first possible implementation manner of the first aspect, wherein the first service request includes at least one of the following: device information of the first user equipment, the first URL information of a uniform resource locator that a user equipment needs to access, and identification information of encrypted data that the first user equipment needs to access.

With reference to the first aspect, the embodiments of the present application provide a second possible implementation manner of the first aspect, wherein the condition includes at least one of the following: specifying a uniform resource locator URL does not allow user equipment to access, and specifying encrypted data is not Allow user device access, specify a uniform resource locator URL, do not allow user device access in a specified area, and specify encrypted data do not allow user device access in a specified area.

With reference to the first aspect, the embodiments of the present application provide a third possible implementation manner of the first aspect, wherein, after receiving the first service request sent by the first user equipment, the method further includes:

Sending an access request to the authentication server, so that the authentication server is used to update the blacklist based on the access request and the rejection rule.

With reference to the first aspect, the embodiments of the present application provide a fourth possible implementation manner of the first aspect, wherein the method further includes:

Every set time period, receive and save the blacklist or blacklist change amount sent by the authentication server.

In a second aspect, an embodiment of the present application further provides a request response device, which is applied to an edge node of a CDN. The device includes:

A service request receiving unit, configured to receive the first service request sent by the first user equipment;

The authentication unit is configured to determine whether to respond to the first service request of the first user equipment according to the first service request and a blacklist pre-stored on the edge node, where the blacklist is used to indicate The condition that the edge node refuses to respond to the service request sent by the user equipment.

With reference to the second aspect, the embodiments of the present application provide a first possible implementation manner of the second aspect, wherein the first service request includes at least one of the following: device information of the first user equipment, the first URL information of a uniform resource locator that a user equipment needs to access, and identification information of encrypted data that the first user equipment needs to access.

With reference to the second aspect, the embodiments of the present application provide a second possible implementation manner of the second aspect, wherein the condition includes at least one of the following: specifying a uniform resource locator URL does not allow user equipment to access, and specifying encrypted data is not Allow user device access, specify a uniform resource locator URL, do not allow user device access in a specified area, and specify encrypted data do not allow user device access in a specified area.

With reference to the second aspect, the embodiments of the present application provide a third possible implementation manner of the second aspect, wherein the device further includes:

The access request sending unit is configured to send the access request to the authentication server, so that the authentication server is used to update the blacklist based on the access request and the rejection rule.

With reference to the second aspect, the embodiments of the present application provide a fourth possible implementation manner of the second aspect, wherein the device further includes:

The blacklist receiving unit is set to receive and save the blacklist or the amount of change of the blacklist sent by the authentication server every set time period.

In a third aspect, an embodiment of the present application further provides an edge node, including a first processor and a first memory connected to the first processor;

The first memory stores machine executable instructions that can be executed by the first processor, and the first processor executes the machine executable instructions to implement the method of any one of the first aspects.

According to a fourth aspect, an embodiment of the present application further provides an authentication system, including the edge node and the authentication server according to the third aspect; the authentication server is connected to at least one of the edge nodes.

According to a fifth aspect, an embodiment of the present application further provides a computer-readable storage medium that stores computer program instructions used to implement the request response method of the first aspect.

The embodiments of the present application bring the following beneficial effects:

The request response method, apparatus, edge node and authentication system provided in the embodiments of the present application, when receiving the first service request sent by the first user equipment, the edge node can determine whether to respond to the first according to the locally stored blacklist The first service request of the user equipment; that is, the edge node performs authentication based on the locally stored blacklist, and then determines whether to respond to the first service request of the first user equipment without waiting for the authentication server to perform authentication and feedback the authentication result, Therefore, the response speed of the edge node can be improved and the user experience can be improved.

Other features and advantages of the present application will be explained in the subsequent description, and partly become obvious from the description, or be understood by implementing the present application. The purpose and other advantages of the present application are achieved and obtained by the structures specified in the description, claims and drawings.

In order to make the above-mentioned objects, features and advantages of the present application more obvious and understandable, preferred embodiments are described below in conjunction with the accompanying drawings, which are described in detail below.

BRIEF DESCRIPTION

In order to more clearly explain the embodiments of the present application and the technical solutions of the prior art, the following briefly introduces the drawings required in the embodiments and the prior art. Obviously, the drawings in the following description are only For some embodiments of the application, for those of ordinary skill in the art, without paying any creative labor, other drawings may be obtained based on these drawings.

1 is a schematic diagram of a response process of a CDN edge node to a service request of a user equipment in the prior art;

2 is a flowchart of a request response method provided by an embodiment of this application;

3 is a flowchart of an information sending method provided by another embodiment of this application;

4 is an interaction diagram of a request response method provided by an embodiment of this application;

5 is a schematic diagram of a response process of a CDN edge node to a service request of a user equipment in an embodiment of the present application;

6 is a structural block diagram of a request response device provided by an embodiment of the present application;

7 is a structural block diagram of an information sending apparatus provided by another embodiment of this application;

8 is a structural block diagram of an edge node provided by an embodiment of this application;

9 is a structural block diagram of an authentication server provided by an embodiment of this application;

10 is a structural block diagram of an authentication system provided by an embodiment of this application.

detailed description

To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions of the present application will be described clearly and completely in conjunction with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, but not all的实施例。 Examples. The components of the embodiments of the present application that are generally described and illustrated in the drawings herein can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

In the current content distribution network, the edge node of the CDN needs to perform authentication when receiving a request from the user equipment to access certain specific URLs (Uniform Resource Locator) or specific encrypted data. For example, for a certain encrypted data, only a limited number of user devices are allowed to access the entire network. If this number is exceeded, the next user device that accesses the encrypted data will be denied access during the authentication process.

In the case where there is no cached data in the edge node of the CDN and data needs to be obtained from the source station, the process of the user equipment in the related art requesting the edge node of the CDN to obtain data is shown in FIG. 1 and includes the following steps:

Step 1: The user equipment sends a data acquisition request to the edge node;

Step 2: The edge node sends an authentication request to the authentication server of the CDN;

Step 3: The authentication server feeds back authentication information to the edge node;

Step 4: The edge node sends a data access request to the upper node of the CDN;

Step 5: The upper node sends a data acquisition request to the source server;

Step 6: The source server sends the data to the upper node;

Step 7: The upper node sends the data to the edge node;

Step 8: The edge node sends the data to the user equipment.

If the cache data of the edge node contains the data requested by the user equipment, the process of the existing user equipment requesting the edge node of the CDN to obtain the data includes the following steps:

Step 1: The user equipment sends a data acquisition request to the edge node;

Step 8: The edge node extracts the data from the local cache data and sends it to the user equipment.

In short, when the existing user equipment requests the CDN's edge node to obtain data, the edge node needs to first send an authentication request to the CDN's authentication server, and the edge node only receives the authentication pass information returned by the authentication server. Will respond to the data acquisition request of the user device. That is, for the edge node, after sending an authentication request to the authentication server and responding to the data acquisition request of the user equipment at the edge node, there is a process of waiting for the authentication server to feed back the authentication pass information. This process will extend the edge node of the CDN to The response time of the data returned by the user equipment makes the first packet time of the data returned by the edge node longer. If the authentication server receives many authentication requests and the QPS (Query Per Second) of the authentication server is very high, the pressure on the authentication server is high and the feedback speed is slow, resulting in the edge node The response speed is slower, the service quality is reduced, and the user experience is reduced.

In order to solve the above problems, embodiments of the present application provide a request response method, device, edge node, authentication server, and authentication system. The following first describes the request response method of the present application in detail.

An embodiment of the present application provides a request response method, which is applied to an edge node of a CDN. As shown in FIG. 2, the method includes the following steps:

Step 202: Receive a first service request sent by a first user equipment.

The user sends a first service request to the edge node of the CDN through the first user equipment. The first service request may be a request to access a certain URL or a certain encrypted data. According to different application scenarios, the information included in the first service request may be different. For example, if the first service request is to request access to a certain URL, the first service request may include device information of the first user equipment and URL information of the uniform resource locator that the first user equipment needs to access. For another example, if the first service request is to request access to certain encrypted data, the first service request may include device information of the first user equipment and identification information of the encrypted data that the first user equipment needs to access. The device information of the first user equipment may include a device identifier, an IP (Internet Protocol, Internet Protocol) address of the user equipment, and so on.

Step 204: Determine whether to respond to the first service request of the first user equipment according to the first service request and the blacklist pre-stored on the edge node.

The blacklist is used to indicate the condition that the edge node refuses to respond to the service request sent by the user equipment. The conditions may include at least one of the following: specifying a uniform resource locator URL not allowing user device access, specifying encrypted data not allowing user device access, specifying uniform resource locator URL not allowing user device access in a specified area, and specifying encrypted data not Allow user device access in the specified area.

The edge node authenticates the first service request of the first user equipment based on the pre-stored blacklist. The following uses a blacklist to indicate that a specified URL does not allow access to user equipment in the first specified area as an example. The edge node receives the service request for the first user equipment to access the URL, and then, based on the device information of the first user equipment Determine whether the first user equipment belongs to the first designated area; if the first user equipment belongs to the first designated area, the edge node will refuse to respond to the service request of the first user equipment. If the first user equipment does not belong to the first designated area, the edge node will respond to the service request of the first user equipment. According to different application scenarios, the edge node may respond to the service request in different ways. Exemplarily, the edge node may Send a request to access the URL to the upper node of the CDN. The upper node obtains the data or link from the source server and returns it to the edge node. The edge node then sends the data or link to the first user device so that the first user device can access the URL URL.

The blacklist stored on the edge node may be generated by the authentication server and sent to the edge node. For example, in a possible embodiment, after receiving the first service request sent by the first user equipment, the edge node may send an access request to the authentication server, so that the authentication server updates the black based on the access request and the denial rule The list and rejection rules can be preset.

For another example, in another possible embodiment, after receiving the first service request sent by the first user equipment, the edge node may determine whether to respond to the first service request of the first user equipment, and if it responds to the first service Request, the edge node may simultaneously send an access request to the authentication server, where the access request includes the first service request of the first user equipment, so that the authentication server updates the blacklist based on the access request and the rejection rule. It should be noted that after receiving the first service request sent by the first user equipment, the edge node does not need to send an access request to the authentication server if the edge node refuses to respond to the first service request of the first user equipment.

The edge node sends the access request to the authentication server, and the authentication server can perform statistics according to the access request, and generate or revise a blacklist according to the statistical results. Exemplarily, the authentication server records the information contained in the access request, such as recording the URL accessed by the IP address of the user equipment. The blacklist may be formed by the authentication server according to preset rules. For example, if it is specified in advance that a certain URL only allows user devices with n different IP addresses to access, after receiving access requests from user devices with n different IP addresses, the blacklist is added: the specified URL does not allow access. If it is specified in advance that certain encrypted data is only allowed to be accessed by user equipment with n different IP addresses, after receiving the access request of the user equipment with n IP addresses, the blacklist is added: the specified encrypted data is not allowed to be accessed. If specified in advance, a URL only allows access to user devices with a maximum of n different IP addresses in the specified area. You can determine whether the user device belongs to the specified area based on the IP address of the user device, and receive n different differences in the specified area After the access request of the user device with the IP address is added to the blacklist: the specified encrypted data does not allow the user device of the specified area to access. If it is detected that user equipment goes offline in the specified area, the blacklist can be dynamically adjusted to remove this condition from the blacklist.

Optionally, every set time period, the edge node will receive and save the blacklist or blacklist change amount sent by the authentication server, so that the blacklist stored on the edge node and the single list on the authentication server can be maintained Synchronize. The set time period may be set according to user needs or experience. Exemplarily, the time period may be 2 minutes.

In the request response method provided in this embodiment, when receiving a service request sent by a user equipment, the edge node can determine whether to respond to the service request of the user equipment according to a locally stored blacklist; there is no need to wait for the authentication server to perform authentication and feedback The authentication result can therefore improve the response speed of the edge node and improve the user experience.

The embodiment of the present application provides another method for sending information, which is applied to the CDN authentication server. As shown in FIG. 3, the method includes the following steps:

Step S302: When receiving the access request sent by the edge node, count the access request.

According to different preset rejection rules, the required statistical information can be different. For example, suppose that URL1 is only allowed to be accessed by user devices with n different IP addresses in the entire network. Then the number of IP addresses accessing URL1 can be counted. When the access request contains a user device with an IP address of IP1 to request access to URL1, the number can be increased by 1, and when the number reaches n, the IP address of accessing URL1 can be known Reach n.

Step S304: Adjust the blacklist according to the statistical results.

Still taking the example in S302 as an example, when the number reaches n, it is added to the blacklist: URL1 does not allow access. After the blacklist is synchronously sent to each edge node, user devices with other IP addresses accessing URL1 will be denied.

Step S306: Send the blacklist or the change amount of the blacklist to each edge node connected to the authentication server every set time period.

Among them, the change amount of the blacklist refers to the change of the blacklist between the current transmission and the last transmission, including the increased content, the decreased content, and the changed content in the blacklist. The set time period can be 2 minutes.

For ease of understanding, FIG. 4 shows an interaction diagram between an authentication server and an edge node. As shown in FIG. 4, in the content distribution network, the authentication server may be connected to multiple edge nodes. In FIG. 4, edge node A and edge node B are used as examples for illustration. When edge node A receives the During the first service request, it is determined whether to respond to the first service request of the first user equipment according to the first service request and the black list pre-stored on the edge node A, without waiting for the feedback information of the authentication server. The blacklist is used to indicate the condition that the edge node A refuses to respond to the service request sent by the user equipment. If the edge node A determines to respond to the first service request of the first user equipment, it will generate an access request according to the first service request of the first user equipment and send it to the authentication server. The authentication server performs statistics based on the received access request, and adjusts the blacklist based on the statistical results. When the edge node B receives the second service request sent by the second user equipment, the execution logic is the same as that of the edge node A. The second user equipment and the first user equipment may be the same user equipment or different users. The equipment is not limited here. The authentication server receives the access requests sent by each edge node, performs statistics and adjusts the blacklist. Every set time period, the authentication server sends the blacklist to each edge node synchronously, so that the blacklist on each edge node is consistent with the authentication server.

In the embodiment of the present application, when there is no cached data in the edge node of the CDN, the process of the user equipment requesting the edge node to obtain data is shown in FIG. 5 and includes the following steps:

Step a: The user equipment sends a data acquisition request to the edge node; the edge node determines whether to respond to the user equipment request according to the pre-stored blacklist. If the response is determined, the following steps are performed:

Step b: The edge node sends an access request to the authentication server of the CDN; at the same time, the edge node sends an access data request to the upper node of the CDN;

The authentication server updates the blacklist based on the access request and the rejection rule, and synchronizes the updated blacklist to the edge node every set time period.

Step c: The upper node sends a request to obtain data to the source server;

Step d: The source server sends the data to the upper node;

Step e: The upper node sends the data to the edge node;

Step f: The edge node sends the data to the user equipment.

It can be seen from the processes shown in FIGS. 1 and 5 that the embodiment of the present application changes the existing synchronous authentication method (sending authentication request to the authentication server authentication) to asynchronous authentication method (no need to send each time (Authentication request to the authentication server). After the user equipment initiates the service request, the edge node authenticates the user equipment according to the locally stored blacklist, and does not need to receive a response from the authentication server. For the authentication server, the access request may be sent when the edge node determines to respond to the data acquisition request. When the edge node determines not to respond to the data acquisition request, the authentication server will not receive the access request, so the authentication can be reduced The QPS of the weight server does not need to wait for the result of the authentication server for the edge node, which is equivalent to no time-consuming connection and communication with the authentication server. Quality of service.

Corresponding to the above method embodiment, an embodiment of the present application provides a request response device, which is applied to an edge node of a CDN. As shown in Figure 6, the device includes:

The service request receiving unit 61 is configured to receive the first service request sent by the first user equipment;

The authentication unit 62 is configured to determine whether to respond to the first service request of the first user equipment according to the first service request and the blacklist pre-stored on the edge node, wherein the blacklist is used for It indicates the condition that the edge node refuses to respond to the service request sent by the user equipment.

The first service request includes at least one of the following: device information of the first user equipment, URL information of a uniform resource locator that the first user equipment needs to access, and encrypted data of the first user equipment that needs to be accessed Identification information.

The conditions include at least one of the following: specifying a uniform resource locator URL does not allow user device access, specifying encrypted data does not allow user device access, specifying uniform resource locator URL does not allow user device access in a specified area, and specifying encrypted data does not allow User device access in the specified area.

Optionally, the above device may further include an access request sending unit connected to the authentication unit 62, and configured to send an access request to an authentication server, so that the authentication server is used to based on the access request and Reject rule update blacklist.

The above device may further include a blacklist receiving unit, which is set to receive and store the blacklist or the amount of change of the blacklist sent by the authentication server every set time period. The blacklist receiving unit may be connected to the service request receiving unit 61, the authentication unit 62, or the service request receiving unit 61 and the authentication unit 62.

Corresponding to the above method embodiments, the embodiments of the present application provide an information sending device, which is applied to an authentication server of a CDN. As shown in Figure 7, the device includes:

The statistics unit 71 is configured to perform statistics on the access information when receiving the access request sent by the edge node;

The blacklist revision unit 72 adjusts the blacklist based on statistical results.

Optionally, the above-mentioned device may further include: a blacklist sending unit 73 configured to send the blacklist or the amount of change of the blacklist to each edge node connected to the authentication server every set time period.

This embodiment provides an edge node in a CDN. As shown in FIG. 8, the edge node includes a first processor 81 and a first memory 82 connected to the first processor 81, and further includes a first communication interface 84. The first processor 81, the first communication interface 84, and the first memory 82 may be connected through the first bus 83.

The first memory 82 may include a high-speed random access memory (RAM, Random Access Memory), or may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the network element of the system and at least one other network element (such as a cooking appliance) is achieved through at least one first communication interface 84 (which may be wired or wireless), and the Internet, wide area network, local network, metropolitan area network, etc. . The first bus 83 may be an ISA bus, a PCI bus, an EISA bus, or the like. The bus can be divided into an address bus, a data bus, and a control bus. For ease of representation, only one bidirectional arrow is used in FIG. 8, but it does not mean that there is only one bus or one type of bus.

The first processor 81 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the first processor 81 or instructions in the form of software. The above-mentioned first processor 81 may be a general-purpose processor, and may implement or execute the disclosed methods, steps, and logical block diagrams in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present disclosure may be directly embodied and executed by a hardware decoding processor, or may be executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, and a register. The storage medium is located in the first memory 82. The first processor 81 reads the information in the first memory 82 and completes the above request response method in combination with its hardware. Optionally, the following operations may be implemented:

Receiving the first service request sent by the first user equipment;

This embodiment provides an authentication server in a CDN. As shown in FIG. 9, the edge node includes a second processor 91 and a second memory 92 connected to the second processor 91, and further includes a second communication interface 94 . The second processor 91, the second communication interface 94, and the second memory 92 may be connected through the second bus 93.

The second memory 92 may include a high-speed random access memory (RAM, Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the network element of the system and at least one other network element (such as a cooking appliance) is achieved through at least one second communication interface 94 (which may be wired or wireless), and the Internet, wide area network, local network, metropolitan area network, etc. can be used . The second bus 93 may be an ISA bus, a PCI bus, an EISA bus, or the like. The bus can be divided into an address bus, a data bus, and a control bus. For ease of representation, only one bidirectional arrow is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.

The second processor 91 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the second processor 91 or an instruction in the form of software. The above-mentioned second processor 91 may be a general-purpose processor, and may implement or execute the disclosed methods, steps, and logical block diagrams in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present disclosure may be directly embodied and executed by a hardware decoding processor, or may be executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, and a register. The storage medium is located in the second memory 92. The second processor 91 reads the information in the second memory 92 and completes the above information sending method in combination with its hardware. Optionally, the following operations may be implemented:

When receiving the access request sent by the edge node, perform statistics on the access information;

Adjust the blacklist according to the statistical results.

Every set time period, the blacklist or the amount of change of the blacklist is sent to each edge node connected to the authentication server.

Further, an embodiment of the present application further provides a machine-readable storage medium that stores machine-executable instructions. When the machine-executable instructions are called and executed by the processor, the machine-executable instructions cause The processor implements the method described in any of the above method embodiments.

This embodiment provides an authentication system, which is applied to a content distribution network. As shown in FIG. 10, the system includes an authentication server 90 and an edge node 80. The authentication server 90 in the system is connected to multiple edge nodes 80. When receiving the service request sent by the user equipment, the edge node 80 generates access information and sends it to the authentication server 90 according to the device information and service request of the user equipment. At the same time, the edge node 80 determines whether to respond to the user equipment according to the locally stored blacklist Business request. The authentication server 90 performs statistics based on the received access information, and revises the blacklist according to the statistical results. Every set time period, the authentication server 90 sends the blacklist to each edge node 80 synchronously, so that the blacklist on each edge node 80 is consistent with the authentication server 90.

This embodiment provides a computer-readable storage medium that stores computer program instructions used to implement the request response method described in any one of the above.

This embodiment provides a computer program product, which when run on a computer, causes the computer to execute any of the above-mentioned request response methods.

The request response method, device, edge node and authentication system, computer readable storage medium, and computer program product provided by the embodiments of the present application have the same technical characteristics, so they can also solve the same technical problems and achieve the same technical effect.

It should be noted that, in the embodiments provided in this application, it should be understood that the disclosed system and method may be implemented in other ways. The device embodiments described above are only schematics. For example, the division of the units is only a division of logical functions. In actual implementation, there may be other divisions. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, the functional units in the embodiments provided in this application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application essentially or part of the contribution to the existing technology or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to enable a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

In addition, the terms "first", "second", and "third" are for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present application, and are used to illustrate the technical solutions of the present application, rather than limit them, and the scope of protection of the present application is not limited thereto, although referring to the foregoing The embodiment describes the application in detail, and those of ordinary skill in the art should understand that any person skilled in the art can still modify the technical solutions described in the foregoing embodiments within the technical scope disclosed in the application Or it is easy to think of changes, or equivalent replacement of some of the technical features; and these modifications, changes, or replacements do not deviate from the essence and scope of the corresponding technical solutions of the technical solutions of the embodiments of this application, and should be covered in this application. Within the scope of protection. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Industrial applicability

Based on the request response method, apparatus, edge node, and authentication system provided in the embodiments of the present application, when receiving the first service request sent by the first user equipment, the edge node can determine whether to respond to the first request according to the locally stored blacklist The first service request of a user equipment; there is no need to wait for the authentication server to perform authentication and feedback the authentication result, so the response speed of the edge node can be improved and the user experience can be improved.

Claims

A request response method applied to the edge node of a CDN. The method includes:

Receiving the first service request sent by the first user equipment;

Determine whether to respond to the first service request of the first user equipment according to the first service request and a blacklist pre-stored on the edge node, wherein the blacklist is used to indicate that the edge node refuses to respond to the user The condition of the service request sent by the device.
The method according to claim 1, wherein the first service request includes at least one of the following: device information of the first user equipment, URL information of a uniform resource locator that the first user equipment needs to access, so The identification information of the encrypted data that the first user equipment needs to access is described.
The method according to claim 1, wherein the condition comprises at least one of the following: specifying a uniform resource locator URL does not allow user device access, specifying encrypted data does not allow user device access, specifying uniform resource locator URL does not allow specifying User equipment access in the area and designated encrypted data are not allowed to be accessed by user equipment in the specified area.
The method according to claim 1, wherein, after receiving the first service request sent by the first user equipment, the method further comprises:

Sending an access request to the authentication server, so that the authentication server updates the blacklist based on the access request and the rejection rule.
The method according to claim 1, wherein, after the determining whether to respond to the first service request of the first user equipment, the method further comprises:

If it is determined to respond to the first service request of the first user equipment, send an access request to the authentication server, so that the authentication server updates the blacklist based on the access request and the rejection rule.
The method of claim 1, wherein the method further comprises:

Every set time period, receive and save the blacklist or blacklist change amount sent by the authentication server.
A request response device applied to an edge node of a CDN. The device includes:

A service request receiving unit, configured to receive the first service request sent by the first user equipment;

The authentication unit is configured to determine whether to respond to the first service request of the first user equipment according to the first service request and a blacklist pre-stored on the edge node, where the blacklist is used to indicate The condition that the edge node refuses to respond to the service request sent by the user equipment.
The apparatus according to claim 7, wherein the first service request includes at least one of the following: device information of the first user equipment, uniform resource locator URL information that the first user equipment needs to access, and The identification information of the encrypted data that the first user equipment needs to access is described.
The apparatus according to claim 7, wherein the condition includes at least one of the following: specifying a uniform resource locator URL does not allow user device access, specifying encrypted data does not allow user device access, specifying uniform resource locator URL does not allow User equipment access in the area and designated encrypted data are not allowed to be accessed by user equipment in the specified area.
The device according to claim 7, wherein the device further comprises:

The access request sending unit is configured to send the access request to the authentication server, so that the authentication server is used to update the blacklist based on the access request and the rejection rule.
The apparatus according to claim 10, wherein the access request sending unit is specifically configured to send an access request to the authentication server if it is determined to respond to the first service request of the first user equipment, so that the authentication The server updates the blacklist based on the access request and denial rules.
The device according to claim 7, wherein the device further comprises:

The blacklist receiving unit is set to receive and save the blacklist or the amount of change of the blacklist sent by the authentication server every set time period.
An edge node includes a first processor and a first memory connected to the first processor;

The first memory stores machine-executable instructions executable by the first processor, and the first processor executes the machine-executable instructions to implement the method of any one of claims 1 to 6. .
An authentication system includes the edge node and the authentication server of claim 13; the authentication server is connected to at least one of the edge nodes.
A computer-readable storage medium storing computer program instructions for implementing the request response method according to any one of claims 1 to 6.