WO2021068205A1 - 访问控制方法、装置、服务器和计算机可读介质 - Google Patents

访问控制方法、装置、服务器和计算机可读介质 Download PDF

Info

Publication number
WO2021068205A1
WO2021068205A1 PCT/CN2019/110639 CN2019110639W WO2021068205A1 WO 2021068205 A1 WO2021068205 A1 WO 2021068205A1 CN 2019110639 W CN2019110639 W CN 2019110639W WO 2021068205 A1 WO2021068205 A1 WO 2021068205A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
caller
server
visits
access request
Prior art date
Application number
PCT/CN2019/110639
Other languages
English (en)
French (fr)
Inventor
郭子亮
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN201980099241.7A priority Critical patent/CN114223177A/zh
Priority to PCT/CN2019/110639 priority patent/WO2021068205A1/zh
Publication of WO2021068205A1 publication Critical patent/WO2021068205A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This application relates to the field of data access, and more specifically, to an access control method, device, server, and computer-readable medium.
  • the current current limiting method can control the service frequency and prevent the system from crashing due to requests exceeding the service capacity, the current limiting method is too single or fixed, and not flexible enough.
  • This application proposes an access control method, device, server and computer-readable medium to improve the above-mentioned drawbacks.
  • an embodiment of the present application provides an access control method, which is applied to a server, the method includes: obtaining an access request sent by a caller to access the server; if the server is allowed to be accessed by the caller , Execute the access operation of the caller in response to the access request; obtain the access times of the access request sent by the caller within a preset period of time as the caller’s access times; according to the caller’s access times.
  • the calling end sets a time period for banning access, and during the banning time period, the server is prohibited from being accessed by the calling side, wherein the higher the number of visits by the calling side, the greater the length of the time period for banning access.
  • an embodiment of the present application also provides an access control device, which is applied to a server, and the device includes: an acquisition unit, a response unit, a determination unit, and a processing unit.
  • the obtaining unit is used to obtain the access request sent by the calling end to access the server.
  • the response unit is configured to, if the server is allowed to be accessed by the calling side, respond to the access request and execute the access operation of the calling side.
  • the determining unit is configured to obtain the access times of the access request sent by the caller within a preset time length as the caller's access times.
  • the processing unit is configured to set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is forbidden to be accessed by the caller, wherein the number of visits by the caller is greater High, the greater the length of the banned period.
  • an embodiment of the present application also provides a server, including: one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory and Is configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned method.
  • an embodiment of the present application also provides a computer-readable medium, the readable storage medium stores a program code executable by a processor, and when multiple instructions in the program code are executed by the processor The processor is caused to execute the above-mentioned method.
  • the access control method, device, server, and computer-readable medium provided in this application obtain the access request sent by the calling end, and the access request is the request sent when the calling end requests to access the server.
  • the server judges that if the called terminal is allowed to access, it responds to the access request and executes the calling terminal's access operation.
  • the server is forbidden to be accessed by the caller, wherein the higher the number of visits by the caller, the greater the length of the access prohibition period.
  • the server after the server affects the access request of the caller, it can set a ban period for the caller according to the number of visits of the caller, and the higher the number of visits of the caller, the greater the length of the ban period, making the ban period dynamically change , Which is related to the number of visits of the calling end, avoids a single or fixed current-limiting method, and improves the flexibility of current-limiting.
  • Fig. 1 shows an application scenario diagram of the access control method and device provided by the embodiments of the present application
  • FIG. 2 shows a method flowchart of an access control method provided by an embodiment of the present application
  • FIG. 3 shows a method flowchart of an access control method provided by another embodiment of the present application.
  • FIG. 4 shows a method flowchart of an access control method provided by another embodiment of the present application.
  • FIG. 5 shows a method flowchart of an access control method provided by still another embodiment of the present application.
  • FIG. 6 shows a method flowchart of an access control method provided by still another embodiment of the present application.
  • FIG. 7 shows a block diagram of a module of an access control device provided by an embodiment of the present application.
  • FIG. 8 shows a block diagram of a module of an access control device provided by another embodiment of the present application.
  • FIG. 9 shows a module block diagram of a server provided by an embodiment of the present application.
  • Fig. 10 shows a storage unit provided by an embodiment of the present application for storing or carrying program code for implementing the access control method according to the embodiment of the present application.
  • FIG. 1 shows an application scenario diagram of the access control method and device provided by the embodiments of the present application.
  • the electronic device 100 and the server 200 are located in a wireless network or a wired network, and the electronic device 100 and the server 200 perform data interaction.
  • the client is installed in the electronic device 100, for example, it may be an application program installed in the electronic device 100.
  • the user logs in through an account at the client, and all information corresponding to the account can be stored in the storage space of the server 200.
  • the server 200 may be a separate server, or a server cluster, and may be a local server or a cloud server.
  • the electronic device 100 can access the server 200, the electronic device 100 can act as a calling end and request access to the server 200.
  • the electronic device 100 can act as a calling end and request access to the server 200.
  • most of the services in the external interface layer of the server are equipped with flow limiters in order to restrict access to traffic beyond expectations. Part of the traffic.
  • Some service plans often use ip or some unique device identifiers to identify each caller while limiting the current flow, and then calculate and record the number of calls made by each caller within a unit time range. When a specified threshold is exceeded Next, the caller will be added to the blacklist, and then the caller’s request will be directly rejected. However, this method of restricting current traffic is too rude. For some specific scenarios, such as spike or ticket grabbing services, some normal system users will indeed send a large number of non-malicious requests in a short period of time, but the frequency is relative to The tens of thousands of malicious attacks per second or even higher frequency issued by the program cannot be compared. If the normal user request is directly recognized as a malicious request and the user is directly shielded, it is obviously very unfriendly to the caller of the service. Therefore, the current limiting method is not reasonable enough, and the method is too simple.
  • an embodiment of the present application provides an access control method, as shown in FIG. 2, which is applied to the above-mentioned server 200, so as to reasonably set the access restriction policy.
  • the method includes: S201 to S204.
  • the caller may be a client in the electronic device, and the access request may be a request for the caller to interact with the server.
  • the access request may be a login request, a request for sending data, or a request for downloading data.
  • the access request may send an access request to the server when the caller detects that the trigger event occurs.
  • the trigger event can be triggered by the user operating the calling side, for example, clicking a button on the calling side, the corresponding operation of the button needs to download certain data in the server or submit certain data to the server, for example, in the shopping APP If the order is submitted within the operation, the trigger is initiated by the user.
  • the trigger request can also be triggered by a buried point event in the calling terminal. Specifically, multiple buried points may be set in the calling terminal in advance.
  • the specific preset event Assuming that the event can be triggered by a non-user, for example, a timed time, specifically, it can be that the caller determines that it is a trigger of a buried point at the end of the time, and then sends an access request to the server.
  • the access request sent by the caller may be sent by a program at a certain frequency, specifically, when a user triggers or a buried point triggers a certain operation, for example, a login operation. Then the program sends multiple access requests to the server at a certain frequency.
  • the access authority of the caller on the server may include permitted access and disallowed access.
  • the access authority may be set by the server for the caller, and the server will record the access authority of the caller, for example, in the server Recording the access authority of the caller can be recorded in the server according to the identifier of the caller and the status of the access authority.
  • the server obtains the access request sent by the caller, it can determine the identity of the caller corresponding to the access request, so that it can determine whether the caller is allowed to access, that is, it can determine whether the server is allowed to be accessed by the caller. access.
  • the access state parameter corresponding to the identifier of the calling terminal may be stored in the server, and it can be determined whether the calling terminal is allowed to call the server according to the parameter, which is specifically introduced in the subsequent embodiments.
  • the server determines that the called terminal is allowed to access, it responds to the access request and executes the calling terminal's access operation.
  • S203 Obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • the preset time length may be a time length set according to requirements. Specifically, the starting point of the preset time length may be the time point of responding to the access request, that is, the server determines that the server is allowed to be accessed by the caller. , And start from the moment of responding to the access request, within a preset time length, count the number of access requests sent by the caller to the server within the time length, so as to count the number of calls by the caller. Then, in this embodiment, the access request acquired within the preset time length will not be responded.
  • the time starting point of the preset time length may be the time when the access request sent by the calling end to access the server is acquired.
  • the server stores a record of the number of visits of the caller, which can be the starting point at the time of the first response to the access request sent by the caller, record the time point corresponding to each visit, and store it to the call In the access record corresponding to the end. Then, when it is determined that the server is allowed to be accessed by the calling end and responds to the access request, the number of accesses within a preset length of time is obtained in the access record, where the preset length of time may be in the access count record, The preset length of time before the time of responding to the access request.
  • the way to obtain the access times of the access request sent by the caller within the preset time length may be to take the time of responding to the access request as the end point, and determine the time before the end point. The number of access requests sent by the caller recorded in the access count record within 1 second.
  • S204 Set a ban period for the caller according to the number of visits by the caller.
  • the server is forbidden to be accessed by the caller. The higher the number of visits by the caller, the higher the number of visits by the caller. The greater the length of the banned period.
  • the access prohibition period is the time period set by the server for the caller to prohibit the caller from accessing the server.
  • the server records that the access authority of the caller remains in a prohibited state, that is, the server prohibits Accessed by the caller.
  • the banned period is determined according to the number of visits by the calling end, that is, after the server responds to the caller’s visit, it sets a banned period for the caller based on the number of caller’s access counts within a preset length of time. Then when the access request sent by the caller is obtained later, if the time of obtaining the access request is still within the banned period, when the server judges that the server is allowed to be accessed by the caller, the judgment result obtained is that the server If access by the caller is prohibited, the server will not respond to the access request, and will not perform the access operation corresponding to the access request.
  • the higher the number of visits of the calling terminal the greater the length of the banned access period. Therefore, for those calling terminals that send a large number of access requests in a short period of time through a program, the duration of their banned access is longer, and For callers with fewer visits, the banned visit period will be shorter.
  • an embodiment of the present application provides an access control method. As shown in FIG. 3, the method is applied to the above-mentioned server 200 so as to reasonably set the access restriction policy. Specifically, the method includes: S301 to S306.
  • S303 Obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • the functional relationship between the number of visits and the length of the banned access time that is, through the functional relationship, the number of visits is used as the input of the functional relationship, that is, the number of visits is the independent variable in the functional relationship, and the length of the banned access time is the functional relationship
  • the output of, that is, the length of the banned access time is the dependent variable in the function relationship, and the number of visits and the length of the banned access time satisfy the above functional relationship.
  • S305 Determine, according to the functional relationship, the length of the access prohibition time corresponding to the number of visits by the calling end.
  • the number of accesses of the access request sent by the caller within the preset time length is input into the function relationship to obtain the length of the banned access time corresponding to the number of accesses of the caller.
  • S306 Set a banned period for the caller according to the length of the banned period.
  • the ban period according to the length of the ban period. Specifically, set the time start of the banned visit period and the time end of the banned visit period, then the length of time between the start of the banned visit period and the end of the banned visit period is the length of the banned visit period, and the time start of the banned visit period to the banned visit period The period at the end of the time period is the banned period.
  • the time starting point of the banned visit period may be the moment when the banned visit time length is obtained.
  • the access-ban period determined by the functional relationship still satisfies the rule that the higher the number of visits by the calling terminal, the greater the length of the access-ban period.
  • the functional relationship may be that in the functional relationship, the greater the number of visits, the faster the length of the banned visit time increases.
  • the functional relationship is an increasing function, and as the number of accesses increases, the output of the functional relationship also increases.
  • the functional relationship may be a non-incremental function, and as the number of visits increases, the greater the number of visits, the greater the increase in the length of the banned access time output by the functional relationship.
  • the functional relationship may be a power function.
  • the power function has the following characteristics:
  • num is the number of visits
  • punish_factor is a constant
  • punish_factor is greater than 1
  • y is the length of time banned from accessing.
  • the power function is used to provide a scalable penalty scheme to prevent valuable service resources from being wasted.
  • the higher the request frequency the greater the punishment for malicious requests, and the smaller or no punishment for the normal and occasional high-frequency user requests.
  • the server is allowed to be accessed by the caller, the response to the access request can take into account the processing speed of the server.
  • FIG. 4 An embodiment of the present application provides an access control method, such as As shown in FIG. 4, this method is applied to the above-mentioned server 200 in order to reasonably set the access restriction policy. Specifically, the method includes: S401 to S405.
  • the server request processing rate is the number of access requests processed by the server in a unit time.
  • the access request processing rate may be set according to actual use, specifically, may be set according to the number of callers of the access request currently received by the server and the system resources of the server.
  • S403 Respond to the access request according to the access request processing rate, and execute the access operation of the calling end.
  • the server When the server obtains the access requests from multiple callers, it temporarily stores the access requests, and processes the access requests one by one according to the access request processing rate. Specifically, in response to the access request according to the access request processing rate and the leaky bucket algorithm, the access operation of the caller is executed.
  • the core idea of the Leaky Bucket algorithm can be that the access request is regarded as a water flow that first enters the specified capacity n (usually the number of requests allowed to be processed by the server per unit time, that is, the access request processing rate).
  • the container which can be regarded as an array list, etc.
  • the “leaky bucket” container discharges water at a certain rate every 1/n (that is, a request is released).
  • the request speed will overflow directly (access request frequency Exceeding the interface release rate), it will wait or reject the request. It can be seen that the leaky bucket algorithm can maintain a strict and smooth rate of requests entering the system for processing.
  • S404 Obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • S405 Set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is prohibited from being accessed by the caller. The higher the number of visits by the caller, the higher the number of visits by the caller. The greater the length of the banned period.
  • the server when the server obtains the access request sent by the calling end, if the server is allowed to be accessed by the calling end, it responds to the access request with a leaky bucket algorithm according to the access processing speed of the server, and then passes
  • the number of visits of the access request sent by the caller within the preset time length is a period for the caller to set a ban on access, specifically, to set a period for the caller based on the power function and the number of visits.
  • the server after the server affects the access request of the caller, it can set a ban period for the caller according to the number of visits of the caller, and the higher the number of visits of the caller, the greater the length of the ban period, making the ban period dynamically change , Which is related to the number of visits of the calling end, avoids a single or fixed current-limiting method, and improves the flexibility of current-limiting.
  • it uses the power function to provide a scalable penalty scheme to prevent valuable service resources from being wasted. The higher the request frequency, the greater the punishment for malicious requests, while the normal and occasional high-frequency user requests are less severely punished or not punished.
  • the leaky bucket algorithm is used to respond to access requests to keep the server processing the response request smoothly. .
  • an embodiment of the present application provides an access control method. As shown in Fig. 5, this method is applied to the above-mentioned server 200 so as to reasonably set the access restriction policy. Specifically, the method includes: S501 to S508.
  • S501 Obtain an access request sent by the calling end for accessing the server.
  • the data stored in the server corresponding to the calling end is stored in the distributed cache corresponding to the server. Specifically, the access prohibition period, the number of visits, the access status, and the corresponding respective ones of the calling end are applied to this application.
  • the data of the provided access control methods are all stored in the distributed cache.
  • Redis is an open source key-value storage system, based on high-speed memory access and its distributed and scalable characteristics, providing an efficient solution for the high concurrency and high availability of Internet applications. It is often used as a cache layer of distributed applications, sharing data between various server instances, providing fast feedback for client requests, and alleviating the pressure on the bottom of the application database. At the same time, its rich data structure and API are provided for various application scenarios. A strong support.
  • the call identifier of the calling end is stored in the server, and the call identifier corresponds to the access state.
  • the key value is the service name
  • the call identifier "call” is spliced
  • the uuid is spliced (for example, server A, the corresponding key value is "serviceA_call_uuid")
  • the call identifier of the caller is serviceA_call_uuid
  • the call identifier includes first information and second information, where the first information is the identifier of the server, and the second field is the identifier of the caller.
  • the caller initiates a service call request, and the request carries a unique identifier of the caller, where the unique identifier may be the ip or device number of the caller, which may be called uuid.
  • S503 Determine whether the access state of the calling end is a state that allows access.
  • the access state includes the state that is allowed to be accessed and the state that is forbidden to be accessed. It can also be that there is only one state, that is, the state that is allowed to be accessed. As long as the access state corresponding to the call identifier is not the state that is allowed to be accessed, the call identifier is determined The corresponding access status is a status where access is prohibited. If the state is allowed to be accessed, execute S504; otherwise, return to execute S501.
  • the access status of the calling side is a state that allows access
  • S505 Obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • a counter identifier is set for the caller to store the access times of the caller, that is, the value of the counter identifier is the number of visits by the caller.
  • the access request includes the identification of the calling end, and the counting identification is set according to the calling identification.
  • the caller initiates a service call request, and the request carries a unique identifier of the caller, where the unique identifier may be the ip or device number of the caller, which may be referred to as uuid.
  • the server recognizes the calling end, splices "times" with the name of the server, and then splices the string of uuid as the key value. For example, server A, the corresponding key value is "serviceA_times_uuid".
  • the preset time length corresponding to the caller is acquired, and the number of accesses of the access request sent by the caller within the preset time length is counted as the caller's number of visits.
  • the preset time lengths corresponding to different callers can be different.
  • the corresponding relationship between the caller ID and the time length can be set in the server in advance, and the corresponding relationship between the caller ID and the time length can be determined in the corresponding relationship.
  • the time length is used as the preset time length corresponding to the caller.
  • the server judges whether the key value exists in the distributed cache redis of the server, and there are two situations at this time:
  • the key value is set and counted at the same time.
  • the value of the key is set to the initial value of 1, and a preset time length is set for the key.
  • the preset time length is the unit time that the system needs to count (as mentioned in the above embodiment, it can be 1 second).
  • the preset time length set for the key in advance is obtained, the key count is incremented by 1, and the number of accesses within the preset time length is accumulated.
  • the number of accesses of the access request sent by the caller within the preset time length can be obtained.
  • the incr method is used to count the number of accesses of the access request sent by the caller within the preset time length as the number of accesses of the caller, that is, the incr method of redis is called to add 1 to the key count.
  • the Redis Incr command increases the numeric value stored in the key by one. If the key does not exist, the value of the key will be initialized to 0 first, and then the INCR operation will be executed. If the value contains the wrong type, or the value of the string type cannot be represented as a number, then an error is returned. According to the Incr instruction, the counter function can be realized.
  • S506 Set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is forbidden to be accessed by the caller. The higher the number of visits by the caller, the higher the number of visits by the caller. The greater the length of the banned period.
  • the server attempts to apply to the current-limiting component based on the leaky bucket algorithm to execute this access request, and the current-limiting component determines whether the current access request can be released according to the server's access request processing rate set by the system This visit request. If the application is successful, the access request will be executed for the corresponding caller.
  • S507 Set the access state of the calling end to a state of being prohibited from being accessed during the time period of prohibiting access.
  • the access status of the caller is set to a state that is forbidden to be accessed, and a banned period is set for the caller, then during the banned period, the access state of the caller is kept as forbidden The state of being visited.
  • the server sets the call identifier of the caller to true in redis, where true is the state that is forbidden to be accessed.
  • the server reads the call identifier as true, it determines that the access state of the caller is set to the state that is forbidden to be accessed. .
  • the access request sent by the caller will not be executed, because the server continues to be in a state of being prohibited from being accessed during the banned period, and at the end of the banned period, the caller’s access status is set
  • serviceA_call_uuid If it is, respond to the visit according to the leaky bucket algorithm Request, set serviceA_call_uuid to true in redis, and set a corresponding banned access period. Specifically, it can be set according to the above-mentioned power function, where the value of key "serviceA_times_uuid" is num, and the specific implementation can refer to the aforementioned The embodiments are not repeated here. And, during the banned period, keep serviceA_call_uuid as true.
  • an embodiment of the present application provides an access control method. As shown in FIG. 6, the method is applied to the above-mentioned server 200 so as to reasonably set the access restriction policy. Specifically, the method includes: S601 to S609.
  • S601 Obtain an access request sent by the calling end to access the server.
  • S602 Detect whether the call identifier of the caller can be read in the distributed cache.
  • the specific implementation of the call identifier of the caller can refer to the foregoing embodiment.
  • the call identifier of the caller exists in the server, specifically, if the call identifier of the caller exists in the redis of the server, it means that the server is called. If the calling terminal has been called, it can be determined that the server is not called by the calling terminal when the calling identification of the calling terminal is not detected, that is, it is determined that the server is allowed to be accessed by the calling terminal, and then S605 is executed.
  • the call identifier is serviceA_call_uuid. If there is a key value in redis, where the key value is serviceA_call_uuid, the operation of executing the access request according to the leaky bucket algorithm is executed.
  • S604 Determine whether the access state of the calling end is a state that allows access.
  • S606 Obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • S607 Set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is prohibited from being accessed by the caller. The higher the number of visits by the caller, the higher the number of visits by the caller. The greater the length of the banned period.
  • S608 Set the access state of the calling terminal to a state of being prohibited from being accessed during the time period of prohibiting access.
  • S609 At the end of the access prohibition period, set the access status of the caller to a state that allows access or delete the call identifier of the caller in the distributed cache.
  • the call identifier of the caller is not stored in the server, and the call identifier of the caller can be deleted in the distributed cache at the end of the access prohibition period.
  • the method of executing the access operation of the caller can be compared with the above-mentioned judging whether the access status of the caller is allowed to be accessed, if it is allowed to be accessed. , It is determined that the server is allowed to be accessed by the calling side, and then in response to the access request, a combination of the access operations of the calling side is performed. Specifically, reference may be made to the foregoing embodiment, and details are not described herein again.
  • FIG. 7 shows a structural block diagram of an access control apparatus 700 provided by an embodiment of the present application.
  • the apparatus may include: an acquisition unit 701, a response unit 702, a determination unit 703, and a processing unit 704.
  • the obtaining unit 701 is configured to obtain an access request sent by the calling end to access the server.
  • the response unit 702 is configured to, if the server is allowed to be accessed by the caller, respond to the access request and execute the access operation of the caller.
  • the determining unit 703 is configured to obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • the processing unit 704 is configured to set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is prohibited from being accessed by the caller, wherein the number of visits by the caller is The higher the value, the greater the length of the banned visit period.
  • FIG. 8 shows a structural block diagram of an access control apparatus 800 provided by an embodiment of the present application.
  • the apparatus may include: an acquisition unit 801, a response unit 802, a determination unit 803, a processing unit 804, and a setting unit 805.
  • the obtaining unit 801 is configured to obtain an access request sent by the calling end to access the server.
  • the response unit 802 is configured to respond to the access request and execute the access operation of the calling side if the server is allowed to be accessed by the calling side.
  • the response unit 802 is further configured to obtain the access request processing rate of the server if the server is allowed to be accessed by the caller; respond to the access request according to the access request processing rate, and execute the access of the caller operating. Further, the response unit is further configured to respond to the access request according to the access request processing rate and the leaky bucket algorithm, and execute the access operation of the caller.
  • the response unit 802 is also used to obtain the access status of the caller; determine whether the access status of the caller is an allowed access state; if it is an access allowed state, determine that the server is allowed to be accessed by the caller, Then, in response to the access request, the access operation of the caller is executed.
  • the response unit 802 is specifically configured to detect whether the call identifier of the caller can be read in the distributed cache; if the call identifier cannot be read, it is determined that the server is allowed to be used by the caller. Access; if the call identifier can be read, the access status of the caller corresponding to the call identifier is obtained; it is determined whether the access status of the caller is a state that allows access.
  • the determining unit 803 is configured to obtain the number of accesses of the access request sent by the caller within a preset time length as the number of accesses of the caller.
  • the determining unit 803 is further configured to obtain a preset time length corresponding to the caller; and count the number of accesses of the access request sent by the caller within the preset time length as the number of caller visits.
  • the incr method is used to count the number of accesses of the access request sent by the caller within the preset time length as the number of caller's accesses.
  • the processing unit 804 is configured to set a ban period for the caller according to the number of visits by the caller. During the ban period, the server is prohibited from being accessed by the caller, wherein the number of visits by the caller is The higher the value, the greater the length of the banned period.
  • the processing unit 804 is further configured to obtain the functional relationship between the number of accesses set in advance and the length of banned access time; determine the banned time length corresponding to the number of visits of the caller according to the functional relationship;
  • the length of the visit time is the time period set by the caller to ban visits.
  • the functional relationship is a power function.
  • num is the number of visits
  • punish_factor is a constant
  • punish_factor is greater than 1
  • y is the length of time banned from accessing.
  • the setting unit 805 is configured to set the access status of the calling terminal to a state where access is prohibited during the access prohibition period; at the end of the access prohibition period, set the access status of the calling terminal to be accessed permitted status.
  • the setting unit 805 is further configured to set the access status of the calling side to a state where access is prohibited during the access prohibition period; and at the end of the access prohibition period, set the access status of the calling side to be access permitted State or delete the call identifier of the caller in the distributed cache.
  • the calling identifier includes first information and second information, wherein the first information is an identifier of the server, and the second field is an identifier of the calling terminal.
  • the distributed cache is a redis storage system.
  • the preset time length is 1 second.
  • the coupling between the modules may be electrical, mechanical or other forms of coupling.
  • each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software function modules.
  • the server 200 may be an electronic device capable of running application programs, such as a smart phone, a tablet computer, or an e-book.
  • the server 200 in this application may include one or more of the following components: a processor 110, a memory 120, and one or more application programs.
  • One or more application programs may be stored in the memory 120 and configured to be Or multiple processors 110 execute, and one or more programs are configured to execute the method described in the foregoing method embodiment.
  • the processor 110 may include one or more processing cores.
  • the processor 110 uses various interfaces and lines to connect various parts of the entire server 200, and executes the server by running or executing instructions, programs, code sets, or instruction sets stored in the memory 120, and calling data stored in the memory 120. 200's various functions and processing data.
  • the processor 110 may use at least one of digital signal processing (Digital Signal Processing, DSP), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), and Programmable Logic Array (Programmable Logic Array, PLA).
  • DSP Digital Signal Processing
  • FPGA Field-Programmable Gate Array
  • PLA Programmable Logic Array
  • the processor 110 may be integrated with one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like.
  • the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing of display content; the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented by a communication chip alone.
  • the memory 120 may include random access memory (RAM) or read-only memory (Read-Only Memory), where the memory may be the aforementioned distributed cache, that is, redis.
  • the memory 120 may be used to store instructions, programs, codes, code sets or instruction sets.
  • the memory 120 may include a program storage area and a data storage area, where the program storage area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc.
  • the storage data area can also store data (such as phone book, audio and video data, chat record data) created by the server 200 during use.
  • FIG. 10 shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the computer-readable medium 800 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.
  • the computer-readable storage medium 800 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the computer-readable storage medium 800 includes a non-transitory computer-readable storage medium.
  • the computer-readable storage medium 800 has storage space for the program code 810 for executing any method steps in the above-mentioned methods. These program codes can be read from or written into one or more computer program products.
  • the program code 810 may be compressed in a suitable form, for example.
  • the access control method, device, server, and computer-readable medium provided by the present application obtain the access request sent by the caller, and the access request is the request sent when the caller requests to access the server.
  • the server judges that if the called terminal is allowed to access, it responds to the access request and executes the calling terminal's access operation.
  • the server is forbidden to be accessed by the caller, wherein the higher the number of visits by the caller, the greater the length of the access prohibition period.
  • the server after the server affects the access request of the caller, it can set a ban period for the caller according to the number of visits of the caller, and the higher the number of visits of the caller, the greater the length of the ban period, making the ban period dynamically change , Which is related to the number of visits of the calling end, avoids a single or fixed current-limiting method, and improves the flexibility of current-limiting.
  • the embodiments of the present application play a role in identifying malicious requests, and use the characteristics of the power function to provide a scalable penalty solution to prevent valuable service resources from being wasted.

Abstract

本申请公开了一种访问控制方法、装置、服务器和计算机可读介质，涉及数据访问领域。该方法包括：获取调用端发送的请求访问服务器的访问请求；若服务器允许被调用端访问，则响应访问请求，执行调用端的访问操作；获取在预设时间长度内调用端发送的访问请求的访问次数，作为调用端访问次数；根据调用端访问次数为调用端设置禁访时段，在禁访时段内，服务器禁止被调用端访问，其中，调用端访问次数越高，禁访时段的长度越大。因此，服务器可以根据调用端的访问次数为调用端设置一个禁访时段，且调用端的访问次数越高，禁访时段的长度越大，使得禁访时段是动态变化的，避免限流方式过于单一或者固定，提高限流的灵活性。

Description

访问控制方法、装置、服务器和计算机可读介质 技术领域
本申请涉及数据访问领域，更具体地，涉及一种访问控制方法、装置、服务器和计算机可读介质。
背景技术
随着互联网行业的蓬勃发展，服务器中的大多数对外接口层的服务都设置有限流器，限制超出预期流量访问部分的流量，以通过限流器来保护服务免受外界突发性的流量毛刺带来的服务压力巨增问题。
现有的限流方法虽然能够起到控制服务频率的作用，防止超过服务容量的请求导致系统崩溃的现象出现，但是，其限流方式过于单一或者固定，而不够灵活。
发明内容
本申请提出了一种访问控制方法、装置、服务器和计算机可读介质，以改善上述缺陷。
第一方面，本申请实施例提供了一种访问控制方法，应用于服务器，所述方法包括：获取调用端发送的请求访问所述服务器的访问请求；若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作；获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数；根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
第二方面，本申请实施例还提供了一种访问控制装置，应用于服务器，所述装置包括：获取单元、响应单元、确定单元和处理单元。获取单元，用于获取调用端发送的请求访问所述服务器的访问请求。响应单元，用于若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。确定单元，用于获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。处理单元，用于根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
第三方面，本申请实施例还提供了一种服务器，包括：一个或多个处理器；存储器；一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行上述方法。
第四方面，本申请实施例还提供了一种计算机可读介质，所述可读存储介质存储有处理器可执行的程序代码，所述程序代码中的多条指令被所述处理器执行时使所述处理器执行上述方法。
本申请提供的访问控制方法、装置、服务器和计算机可读介质，获取调用端发送的 访问请求，该访问请求为调用端请求访问服务器时发送的请求。服务器判断如果允许被调用端访问，则响应所述访问请求，执行所述调用端的访问操作。获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数，根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。因此，服务器在影响调用端的访问请求之后，可以根据调用端的访问次数为调用端设置一个禁访时段，且调用端的访问次数越高，禁访时段的长度越大，使得禁访时段是动态变化的，其与调用端的访问次数有关，避免限流方式过于单一或者固定，提高限流的灵活性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了本申请实施例提供的访问控制方法及装置的应用场景图；
图2示出了本申请一实施例提供的一种访问控制方法的方法流程图；
图3示出了本申请另一实施例提供的一种访问控制方法的方法流程图；
图4示出了本申请又一实施例提供的一种访问控制方法的方法流程图；
图5示出了本申请再一实施例提供的一种访问控制方法的方法流程图；
图6示出了本申请再又一实施例提供的一种访问控制方法的方法流程图；
图7示出了本申请一实施例提供的一种访问控制装置的模块框图；
图8示出了本申请另一实施例提供的一种访问控制装置的模块框图；
图9示出了本申请实施例提供的服务器的模块框图；
图10出了本申请实施例提供的用于保存或者携带实现根据本申请实施例的访问控制方法的程序代码的存储单元。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
请参阅图1，图1示出了本申请实施例提供的访问控制方法及装置的应用场景图。如图1中所示，电子设备100和服务器200位于无线网络或有线网络中，电子设备100和服务器200进行数据交互。
在一些实施例中，客户端安装在电子设备100内，例如，可以是安装在电子设备100的应用程序。用户在客户端通过帐号登录，则该帐号对应的所有信息可以存储在服务器200的存储空间内。服务器200可以是单独的服务器，也可以是服务器集群，可以是本地服务器，也可以是云端服务器。
电子设备100能够访问服务器200，则电子设备100可以作为调用端，请求访问服务器200。而服务器为了避免突发性的流量毛刺带来的服务压力巨增问题，同时为了杜绝一些调用端的恶意访问，服务器中的大多数对外接口层的服务都设置有限流器，以便限制超出预期流量访问部分的流量。
但是，发明人在研究中发现，目前主流的大型互联网系统限流方案主要都以令牌桶算法和漏桶算法作为支撑，达到平滑关键服务请求速率的效果，避免因短时间系统请求 过多导致系统服务资源耗尽而崩溃。
而现有的技术方案，虽然达到了限流的效果，起到了控制服务频率的作用，防止超过服务容量的请求导致系统崩溃的现象出现。但是对于一些攻击服务的恶意调用和请求，并没有进行进一步的识别和拦截，这些恶意请求往往会占用宝贵的服务资源。
一些服务方案往往在限流的同时，会以ip或者一些唯一设备标识去识别出每个调用方，然后计算并记录每个调用方在单位时间范围内的调用次数，当超过一个指定阈值的情况下，就将这个调用方加入黑名单，之后对于这个调用方的请求直接拒绝。但是这种限流加拉黑的方式过于粗暴，对于一些特定的场景，比如秒杀或者抢票服务，一些正常的系统用户确实会在短时间内发出大量的非恶意的请求，但是其频率相对于由程序发出的每秒数以万记甚至更高频的恶意攻击无法相提并论，如果这时直接将正常的用户请求识别为恶意请求直接屏蔽用户，明显对于服务的调用方是十分不友好的。因此，现有的限流方式设置不够合理，方式过于单一。
因此，为了改善上述缺陷，本申请实施例提供了一种访问控制方法，如图2所示，该方法应用于上述服务器200，以便合理的设置访问限制策略。具体地，该方法包括：S201至S204。
S201：获取调用端发送的请求访问所述服务器的访问请求。
具体地，调用端可以是电子设备内的客户端，而访问请求可以是调用端请求与服务器交互的请求，具体地，该访问请求可以是一个登录请求、发送数据的请求或者下载数据的请求。
则作为一种实施方式，该访问请求可以是调用端对应检测到触发事件发生的时候，发送一个访问请求至服务器。则该触发事件可以是用户操作调用端而触发的，例如，点击调用端的某个按钮，该按钮对应的操作是需要去服务器内下载某个数据或者向服务器提交某个数据，例如，在购物APP内的提交订单的操作，则该触发是由用户发起的。另外，该触发请求还可以是调用端内的埋点事件触发的，具体地，可以是预先在调用端内设置多个埋点，每个埋点调用端的一个预设事件，则具体的该预设事件可以是非用户触发的，例如，定时时间，具体地，可以是调用端在定时结束的时候认定是一个埋点的触发，则发送一个访问请求至服务器。
作为另一种实施方式，该调用端发送的访问请求可以是通过程序按照一定的频率发送的，具体地，可以是用户触发或者埋点触发某个操作的时候，例如，登录操作。则程序按照一定的频率发送多个访问请求至服务器。
S202：若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
具体地，调用端在服务器的访问权限可以包括允许访问和不允许访问，具体地，该访问权限可以是服务器为调用端设定的，而服务器内会记录调用端的访问权限，例如，在服务器内记录调用端的访问权限，可以是以调用端的标识和访问权限状态对应记录在服务器内。在服务器在获取到调用端发送的访问请求的时候，能够确定该访问请求对应的调用端的标识，从而能够确定该调用端是否处于被允许访问的状态，即能够确定服务器是否允许被所述调用端访问。
作为一种实施方式，可以在服务器内存储调用端的标识对应的访问状态参数，根据该参数能够确定该调用端是否被允许调用服务器，具体地，在后续实施例中介绍。
当服务器确定允许被调用端访问时，响应所述访问请求，执行所述调用端的访问操作。
S203：获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
其中，预设时间长度可以是根据需求而设定的时间长度，具体地，该预设时间长度的起点可以是响应所述访问请求的时间点，即服务器在确定服务器允许被所述调用端访问，并响应访问请求的时刻开始，在预设时间长度的时间内，统计在该时间长度内，调用端发送至服务器的访问请求的个数，从而统计出调用端访问次数。则在此实施方式中，在预设时间长度内获取到的访问请求不会被响应。
作为另一种实施方式，该预设时间长度的时间起点可以是获取到调用端发送的请求访问所述服务器的访问请求的时刻。
作为又一种实施方式，服务器内存储有调用端的访问次数记录，可以是在本次第一次响应调用端发送的访问请求的时刻为起点，记录每次访问对应的时间点，存储至该调用端对应的访问记录内。则在确定服务器允许被所述调用端访问，并响应所述访问请求的时候，在访问记录内获取预设时间长度内的访问次数，其中，该预设时间长度可以是在访问次数记录内，响应所述访问请求的时刻之前的预设时间长度。例如，该预设时间长度为1秒，则获取在预设时间长度内所述调用端发送的访问请求的访问次数的方式可以是，以响应所述访问请求的时刻为终点，确定该终点之前的1秒内访问次数记录中所记录的调用端发送的访问请求的访问次数。
S204：根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
具体地，禁访时段为服务器为调用端设置的禁止该调用端访问服务器的时间段，在所述禁访时段内，服务器内记录调用端的访问权限保持是禁止访问的状态，即所述服务器禁止被所述调用端访问。
其中，该禁访时段是根据调用端访问次数而确定的，即服务器在响应调用端的访问之后，根据在预设时间长度内统计得到的调用端访问次数，为该调用端设置一个禁访时段，则在之后获取到调用端发送的访问请求的时候，如果获取该访问请求的时间依然在禁访时段内，则服务器在判断服务器允许被所述调用端访问的时候，所得到的判断结果是服务器禁止被所述调用端访问，则服务器不会响应访问请求，也就不会执行该访问请求对应的访问操作。
具体地，调用端访问次数越高，所述禁访时段的长度越大，因此，对于那些通过程序的方式短时间内发送大量的访问请求的调用端，其被禁止访问的时长更久，而对于访问次数较少的调用端，禁访时段越短。
请参阅图3，本申请实施例提供了一种访问控制方法，如图3所示，该方法应用于上述服务器200，以便合理的设置访问限制策略。具体地，该方法包括：S301至S306。
S301：获取调用端发送的请求访问所述服务器的访问请求。
S302：若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
S303：获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
S304：获取预先设置的访问次数与禁访时间长度之间的函数关系。
预先设置访问次数与禁访时间长度的函数关系，即通过该函数关系，以访问次数作为该函数关系的输入，即访问次数为该函数关系内的自变量，而禁访时间长度为该函数关系的输出，即禁访时间长度为该函数关系内的因变量，访问次数与禁访时间长度满足上述函数关系。
S305：根据所述函数关系确定所述调用端访问次数对应的禁访时间长度。
将在预设时间长度内所述调用端发送的访问请求的访问次数，即调用端访问次数输 入该函数关系内，以得到对应该调用端访问次数的禁访时间长度。
S306：根据所述禁访时间长度为所述调用端设置禁访时段。
则根据该禁访时间长度设定禁访时段。具体地，设置禁访时段时间起点和禁访时段时间终点，则禁访时段时间起点和禁访时段时间终点之间的时间长度为禁访时间长度，而该禁访时段时间起点至禁访时段时间终点的时段为禁访时段。其中，禁访时段时间起点可以是获取到禁访时间长度的时刻。
通过函数关系确定的禁访时段依然满足调用端访问次数越高，所述禁访时段的长度越大的规律。具体地，可以是所述函数关系中，访问次数越大，所述禁访时间长度增大的越快。也就是说，函数关系是一个增函数，访问次数增大，则函数关系的输出也增大。作为一种实施方式，该函数关系可以是一个非递增的函数，并且，随着访问次数的增大，访问次数越大，则函数关系输出的禁访时间长度的增长幅度越大。具体地，该函数关系可以是幂函数。
具体地，表达式如y＝x a的函数关系称为幂函数。例如，函数关系y＝x 2、y＝x -1和y＝x 1/2均为幂函数。
当a>0时，幂函数具备如下特征:
(1)函数的曲线在[0，+∞)上为增函数；
(2)函数曲线必然经过(0,0)和(1,1)两个点；
(3)在第一象限内，当a>1时，导数值逐渐增大(即y值增大的幅度会越来越大)，当a＝1时导数值为常量值，当0<a<1时导数值则逐渐变小。
则具体地，访问次数与禁访时间长度之间的函数关系为：
y＝(num) punish_factor
其中，num为访问次数，punish_factor为常数，且punish_factor大于1，y为禁访时间长度。
根据上述幂函数的特性，当指数常量即punish_factor>1时，其导数值会单调递增，则随着预设时间长度的访问次数num的增大，禁访时段增大的幅度越来越剧烈，例如，在num等间距增长的情况表，每个num对应的禁访时段中，相邻的两个禁访时段之间的差值越来越大，以预设时间长度为1秒为例，随单位时间请求的次数num变大，其惩罚无法访问系统的时间y(即禁访时段)增大的幅度会越来越剧烈，也就是说访问次数越多，惩罚力度越大，即被禁止访问的时长越大。，
因此，并利用幂函数的特性提供了具有伸缩性的惩罚方案，以防止宝贵的服务资源被浪费。对于请求频率越高的恶意请求惩罚力度越大，而对于正常偶发的高频用户请求惩罚力度较小或者不予惩罚。
另外，若所述服务器允许被所述调用端访问，对访问请求的响应可以考虑到服务器端的处理速度而响应，具体地，请参阅图4，本申请实施例提供了一种访问控制方法，如图4所示，该方法应用于上述服务器200，以便合理的设置访问限制策略。具体地，该方法包括：S401至S405。
S401：获取调用端发送的请求访问所述服务器的访问请求
S402：若所述服务器允许被所述调用端访问，获取所述服务器的访问请求处理速率。
其中，服务器请求处理速率为服务器单位时间内处理访问请求的个数。具体地，该访问请求处理速率可以是实际使用而设定的，具体地，可以是根据服务器的当前所接收的访问请求的调用端的个数以及服务器的系统资源而设定。
S403：根据所述访问请求处理速率响应所述访问请求，执行所述调用端的访问操作。
服务器在获取到多个调用端的访问请求的时候，将该访问请求暂存，在根据访问请求处理速率逐个处理访问请求。具体地，根据所述访问请求处理速率和所述漏桶算法响 应所述访问请求，执行所述调用端的访问操作。
其中，漏桶(Leaky Bucket)算法其核心思想可以是，将访问请求看做水流先进入到指定容量n(通常为单位时间内服务器允许处理的请求数，即访问请求处理速率)的“漏桶”容器(可以看作是数组列表等)里，“漏桶”容器以一定的速度每隔1/n出水(即放行一个请求)，当水流入速度即请求速度过大会直接溢出(访问请求频率超过接口放行速率)，就会等待或拒绝请求，可以看出漏桶算法能让进入系统进行处理的请求保持一个严格平滑的速率。
S404：获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
S405：根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
本申请实施例，服务器在获取到调用端发送的访问请求的时候，若所述服务器允许被所述调用端访问，根据服务器的访问处理速度以漏桶算法响应所述访问请求，然后，再通过预设时间长度内所述调用端发送的访问请求的访问次数为调用端设置禁访时段，具体地，为根据幂函数和访问次数为调用端设置禁访时段。
因此，服务器在影响调用端的访问请求之后，可以根据调用端的访问次数为调用端设置一个禁访时段，且调用端的访问次数越高，禁访时段的长度越大，使得禁访时段是动态变化的，其与调用端的访问次数有关，避免限流方式过于单一或者固定，提高限流的灵活性。尤其是，并利用幂函数的特性提供了具有伸缩性的惩罚方案，以防止宝贵的服务资源被浪费。对于请求频率越高的恶意请求惩罚力度越大，而对于正常偶发的高频用户请求惩罚力度较小或者不予惩罚，另外，还通过漏桶算法响应访问请求，保持服务器处理响应请求的平滑速度。
需要说明的是，图4对应的方法同样适用于前述实施例，例如图4中的S405等其他步骤也可以参考前述实施例。
另外，还可以是在服务器为调用端设置一个访问状态，通过该访问状态确定该调用端是否具备访问服务器的权限，具体地，请参阅图5，本申请实施例提供了一种访问控制方法，如图5所示，该方法应用于上述服务器200，以便合理的设置访问限制策略。具体地，该方法包括：S501至S508。
S501：获取调用端发送的请求访问所述服务器的访问请求。
S502：获取所述调用端的访问状态。
于本申请实施例中，服务器内所存储的与调用端对应的数据存储于服务器对应的分布式缓存内，具体地，调用端的禁访时段、访问次数、访问状态以及对应的各个应用于本申请所提供的访问控制方法的数据均存储于分布式缓存内。
其中，分布式缓存为redis。redis是一个开源的key-value存储系统，基于内存的高速存取和其分布式可扩展的特性，为互联网应用的高并发，高可用提供了高效的解决方案。常用于作为分布式应用的缓存层，在各个服务器实例之间共享数据，为客户端请求提供快速的反馈，缓解应用数据库底层的压力，同时其丰富的数据结构和API更为各种应用场景提供了强有力的支撑。
则在服务器内存储调用端的调用标识，该调用标识对应访问状态。具体地，在服务器端的redis内设置一个key值，key值为服务名称，拼接调用标识“call”，拼接uuid(如服务器A,则相应的key值为“serviceA_call_uuid”)，则调用端的调用标识为serviceA_call_uuid，调用标识包括第一信息和第二信息，其中，所述第一信息为所述服务器的标识，所述第二字段为所述调用端的标识。其中，调用端发起服务调用请求， 请求带有调用端的唯一标识，其中，该唯一标识可以是调用端的ip或者设备号，可以称为uuid。
S503：判断所述调用端的访问状态是否为允许被访问的状态。
而访问状态包括允许被访问的状态和禁止被访问的状态，还可以是，只有一个状态，就是允许被访问的状态，而只要调用标识对应的访问状态不是允许被访问的状态，就判定调用标识对应的访问状态是禁止被访问的状态。如果是允许被访问的状态，则执行S504，否则，返回执行S501。
S504：响应所述访问请求，执行所述调用端的访问操作。
如果调用端的访问状态为允许被访问的状态，则判定所述服务器允许被所述调用端访问，响应所述访问请求，执行所述调用端的访问操作。
S505：获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
为调用端设置一个计数标识，用于存储调用端访问次数，即计数标识的值为调用端访问次数。
具体地，在服务器获取到访问请求的时候，该访问请求内包括调用端的标识，根据该调用标识设置计数标识。
作为一种实施方式，调用端发起服务调用请求，请求带有调用端的唯一标识，其中，该唯一标识可以是调用端的ip或者设备号，可以称为uuid。服务器识别出调用端，以服务器的名称，拼接“times”，再拼接uuid的字符串作为key值。例如，服务器A,则相应的key值为“serviceA_times_uuid”。
然后，获取所述调用端对应的预设时间长度，统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。具体地，不同的调用端对应的预设时间长度可以不同，作为一种实施方式，可以是预先在服务器内设置调用端标识与时间长度的对应关系，在该对应关系内确定调用端标识对应的时间长度，作为调用端对应的预设时间长度。
具体地，服务器判断服务器的分布式缓存redis中是否存在该key值，则此时存在两种情况：
若服务器的分布式缓存redis中不存在该key值，则设置该key值的同时，并进行计数，此时设置该key的值为初始值1，同时为该key设置一个预设时间长度，该预设时间长度为系统需要统计的单位时间(如上述实施例提到的，可以是1秒)。
若服务器的分布式缓存redis中存在该key值，则获取预先为该key设置的预设时间长度，对该key计数加1，累加预设时间长度内的访问次数。
则通过读取该key值就能够获取在预设时间长度内所述调用端发送的访问请求的访问次数。
具体地，通过incr方法统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数，即调用redis的incr方法对该key计数加1。
Redis Incr命令将key中储存的数字值增一。如果key不存在，那么key的值会先被初始化为0，然后再执行INCR操作。如果值包含错误的类型，或字符串类型的值不能表示为数字，那么返回一个错误。根据该Incr指令能够实现计数器功能。
S506：根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
若所述服务器允许被所述调用端访问，服务器尝试向基于漏桶算法实现的限流组件申请执行此次访问请求，限流组件根据系统设定的服务器的访问请求处理速率判定当前 是否可以放行此次访问请求。若申请成功，则为相应调用端执行访问请求。
S507：在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态。
具体地，在访问请求成功执行的时候，将调用端的访问状态设置为禁止被访问的状态，并且为该调用端设置一个禁访时段，则在禁访时段内时，保持调用端的访问状态为禁止被访问的状态。
服务器将此次调用端的调用标识，在redis中设置为true，其中，true为禁止被访问的状态，服务器在读取到调用标识为true时，就确定调用端的访问状态设置为禁止被访问的状态。
S508：在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态。
在禁访时段内，调用端发送的访问请求不会被执行，因为，所述服务器在禁访时段内持续处于禁止被访问的状态，而在禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态，另外，还可以删除计数标识，或者将计数标识清零，例如，可以是在redis中删除serviceA_times_uuid。
作为一种实施方式，可以是在获取调用端发送的请求访问所述服务器的访问请求，若服务器的分布式缓存redis中不存在该key值(serviceA_times_uuid)，则判定所获取的访问请求是本次第一次获取的访问请求，设置该key的值为初始值1，同时为该key设置一个预设时间长度，统计该预设时间长度内的访问次数，同时，确定调用端的访问状态是否为允许被访问的状态，如果不是，返回结果，还可以停止本次方法，即停止对预设时间长度内所述调用端发送的访问请求的访问次数的统计，如果是，根据漏桶算法响应该访问请求，在redis中设置serviceA_call_uuid为true，并设置一个对应的禁访时段，具体地，可以是根据上述的幂函数的方式设置，其中，key“serviceA_times_uuid”的值num，具体的实施方式可以参考前述实施例，在此不再赘述。并且，在禁访时段内，保持serviceA_call_uuid为true。
请参阅图6，本申请实施例提供了一种访问控制方法，如图6所示，该方法应用于上述服务器200，以便合理的设置访问限制策略。具体地，该方法包括：S601至S609。
S601：获取调用端发送的请求访问所述服务器的访问请求。
S602：检测是否能够在所述分布式缓存内读取到所述调用端的调用标识。
调用端的调用标识的具体实施方式可以参考前述实施例，则作为一种实施方式，当调用端的调用标识存在与服务器内时，具体地，如果服务器的redis中存在调用端的调用标识就表示服务器被调用端调用过，则可以在未检测到调用端的调用标识时，判定服务器未被调用端调用，即判定所述服务器允许被所述调用端访问，然后，执行S605。
如果检测到调用端的调用表示，则根据该调用表示的状态确定是否要响应访问请求，即执行S603。
以服务器为服务A为例，调用标识为serviceA_call_uuid，如果在redis中存在key值，其中，该key值为serviceA_call_uuid，则执行根据漏桶算法执行访问请求的操作。
S603：获取所述调用端的访问状态。
S604：判断所述调用端的访问状态是否为允许被访问的状态。
S605：响应所述访问请求，执行所述调用端的访问操作。
S606：获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
S607：根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
S608：在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态。
S609：在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态或将所述调用端的调用标识在所述分布式缓存内删除。
由于，服务器为被调用端访问的时候，在服务器内是未存储调用端的调用标识的，则在所述禁访时段结束时，可以将调用端的调用标识在所述分布式缓存内删除。
另外，根据所述访问请求处理速率响应所述访问请求，执行所述调用端的访问操作的方式，可以与上述的判断所述调用端的访问状态是否为允许被访问的状态，若是允许被访问的状态，判定所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作相结合，具体地，可参考前述实施例，在此不再赘述。
请参阅图7，其示出了本申请实施例提供的一种访问控制装置700的结构框图，该装置可以包括：获取单元701、响应单元702、确定单元703和处理单元704。
获取单元701，用于获取调用端发送的请求访问所述服务器的访问请求。
响应单元702，用于若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
确定单元703，用于获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
处理单元704，用于根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述装置和模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
请参阅图8，其示出了本申请实施例提供的一种访问控制装置800的结构框图，该装置可以包括：获取单元801、响应单元802、确定单元803、处理单元804和设置单元805。
获取单元801，用于获取调用端发送的请求访问所述服务器的访问请求。
响应单元802，用于若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
具体地，响应单元802还用于若所述服务器允许被所述调用端访问，获取所述服务器的访问请求处理速率；根据所述访问请求处理速率响应所述访问请求，执行所述调用端的访问操作。进一步地，响应单元还用于根据所述访问请求处理速率和所述漏桶算法响应所述访问请求，执行所述调用端的访问操作。
另外，响应单元802还用于获取所述调用端的访问状态；判断所述调用端的访问状态是否为允许被访问的状态；若是允许被访问的状态，判定所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
具体地，响应单元802具体用于检测是否能够在所述分布式缓存内读取到所述调用端的调用标识；若不能读取到所述调用标识，则判定所述服务器允许被所述调用端访问；若能够读取到所述调用标识，获取所述调用标识对应的所述调用端的访问状态；判断所述调用端的访问状态是否为允许被访问的状态。
确定单元803，用于获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
具体地，确定单元803还用于获取所述调用端对应的预设时间长度；统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。具体地，通过incr方法统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
处理单元804，用于根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
具体地，该处理单元804还用于获取预先设置的访问次数与禁访时间长度之间的函数关系；根据所述函数关系确定所述调用端访问次数对应的禁访时间长度；根据所述禁访时间长度为所述调用端设置禁访时段。其中，所述函数关系中，访问次数越大，所述禁访时间长度增大的越快。进一步地，所述函数关系为幂函数。
所述访问次数与禁访时间长度之间的函数关系为：
y＝(num) punish_factor
其中，num为访问次数，punish_factor为常数，且punish_factor大于1，y为禁访时间长度。
设置单元805，用于在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态；在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态。
设置单元805还用于在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态；在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态或将所述调用端的调用标识在所述分布式缓存内删除。
进一步地，所述调用标识包括第一信息和第二信息，其中，所述第一信息为所述服务器的标识，所述第二字段为所述调用端的标识。所述分布式缓存为redis存储系统。所述预设时间长度为1秒钟。
在本申请所提供的几个实施例中，模块相互之间的耦合可以是电性，机械或其它形式的耦合。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
请参考图9，其示出了本申请实施例提供的一种服务器的结构框图。该服务器200可以是智能手机、平板电脑、电子书等能够运行应用程序的电子设备。本申请中的服务器200可以包括一个或多个如下部件：处理器110、存储器120、以及一个或多个应用程序，其中一个或多个应用程序可以被存储在存储器120中并被配置为由一个或多个处理器110执行，一个或多个程序配置用于执行如前述方法实施例所描述的方法。
处理器110可以包括一个或者多个处理核。处理器110利用各种接口和线路连接整个服务器200内的各个部分，通过运行或执行存储在存储器120内的指令、程序、代码集或指令集，以及调用存储在存储器120内的数据，执行服务器200的各种功能和处理数据。可选地，处理器110可以采用数字信号处理(Digital Signal Processing，DSP)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)、可编程逻辑阵列(Programmable Logic Array，PLA)中的至少一种硬件形式来实现。处理器110可集成中央处理器(Central Processing Unit，CPU)、图像处理器(Graphics Processing Unit，GPU)和调制解调器等中的一种或几种的组合。其中，CPU主要处理操作系统、用户界面和应用程序等；GPU用于负责显示内容的渲染和绘制；调制解调器用于处理无线通信。可以理解的是，上述调制解调器也可以不集成到处理器110中，单独通过一块通信芯片进行实现。
存储器120可以包括随机存储器(Random Access Memory，RAM)，也可以包括只读存储器(Read-Only Memory)，其中，存储器可以上述的分布式缓存，即redis。存储器120可用于存储指令、程序、代码、代码集或指令集。存储器120可包括存储程序区和存储数据区，其中，存储程序区可存储用于实现操作系统的指令、用于实现至少一个功 能的指令(比如触控功能、声音播放功能、图像播放功能等)、用于实现下述各个方法实施例的指令等。存储数据区还可以存储服务器200在使用中所创建的数据(比如电话本、音视频数据、聊天记录数据)等。
请参考图10，其示出了本申请实施例提供的一种计算机可读存储介质的结构框图。该计算机可读介质800中存储有程序代码，所述程序代码可被处理器调用执行上述方法实施例中所描述的方法。
计算机可读存储介质800可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。可选地，计算机可读存储介质800包括非易失性计算机可读介质(non-transitory computer-readable storage medium)。计算机可读存储介质800具有执行上述方法中的任何方法步骤的程序代码810的存储空间。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。程序代码810可以例如以适当形式进行压缩。
综上所述，本申请提供的访问控制方法、装置、服务器和计算机可读介质，获取调用端发送的访问请求，该访问请求为调用端请求访问服务器时发送的请求。服务器判断如果允许被调用端访问，则响应所述访问请求，执行所述调用端的访问操作。获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数，根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。因此，服务器在影响调用端的访问请求之后，可以根据调用端的访问次数为调用端设置一个禁访时段，且调用端的访问次数越高，禁访时段的长度越大，使得禁访时段是动态变化的，其与调用端的访问次数有关，避免限流方式过于单一或者固定，提高限流的灵活性。
因此，本申请实施例完成服务限流目的的同时，对于恶意请求起到识别作用，并利用幂函数的特性提供了具有伸缩性的惩罚方案，以防止宝贵的服务资源被浪费。对于请求频率越高的恶意请求惩罚力度越大，而对于正常偶发的高频用户请求惩罚力度较小或者不予惩罚(通过合理的阈值设定可以实现)。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (21)

  1. 一种访问控制方法，其特征在于，应用于服务器，所述方法包括：
    获取调用端发送的请求访问所述服务器的访问请求；
    若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作；
    获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数；
    根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
  2. 根据权利要求1所述的方法，其特征在于，根据所述调用端访问次数为所述调用端设置禁访时段，包括：
    获取预先设置的访问次数与禁访时间长度之间的函数关系；
    根据所述函数关系确定所述调用端访问次数对应的禁访时间长度；
    根据所述禁访时间长度为所述调用端设置禁访时段。
  3. 根据权利要求2所述的方法，其特征在于，所述函数关系中，访问次数越大，所述禁访时间长度增大的越快。
  4. 根据权利要求3所述的方法，其特征在于，所述函数关系为幂函数。
  5. 根据权利要求4所述的方法，其特征在于，所述访问次数与禁访时间长度之间的函数关系为：
    y＝(num) punish_factor
    其中，num为访问次数，punish_factor为常数，且punish_factor大于1，y为禁访时间长度。
  6. 根据权利要求1-5任一所述的方法，其特征在于，所述若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作，包括：
    若所述服务器允许被所述调用端访问，获取所述服务器的访问请求处理速率；
    根据所述访问请求处理速率响应所述访问请求，执行所述调用端的访问操作。
  7. 根据权利要求6所述的方法，其特征在于，所述根据所述访问请求处理速率响应所述访问请求，执行所述调用端的访问操作，包括：
    根据所述访问请求处理速率和所述漏桶算法响应所述访问请求，执行所述调用端的访问操作。
  8. 根据权利要求1-5任一所述的方法，其特征在于，所述若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作，包括：
    获取所述调用端的访问状态；
    判断所述调用端的访问状态是否为允许被访问的状态；
    若是允许被访问的状态，判定所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作。
  9. 根据权利要求8所述的方法，其特征在于，所述根据所述调用端访问次数为所述调用端设置禁访时段之后，还包括：
    在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态；
    在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态。
  10. 根据权利要求8所述的方法，其特征在于，所述调用端的访问状态和调用标识被对应存储于所述服务器的分布式缓存内；所述获取所述调用端的访问状态，判断所述调用端的访问状态是否为允许被访问的状态，包括：
    检测是否能够在所述分布式缓存内读取到所述调用端的调用标识；
    若不能读取到所述调用标识，则判定所述服务器允许被所述调用端访问；
    若能够读取到所述调用标识，获取所述调用标识对应的所述调用端的访问状态；
    判断所述调用端的访问状态是否为允许被访问的状态。
  11. 根据权利要求10所述的方法，其特征在于，所述根据所述调用端访问次数为所述调用端设置禁访时段之后，还包括：
    在所述禁访时段内时，设置所述调用端的访问状态为禁止被访问的状态；
    在所述禁访时段结束时，设置所述调用端的访问状态为允许被访问的状态或将所述调用端的调用标识在所述分布式缓存内删除。
  12. 根据权利要求11所述的方法，其特征在于，所述调用标识包括第一信息和第二信息，其中，所述第一信息为所述服务器的标识，所述第二字段为所述调用端的标识。
  13. 根据权利要求1所述的方法，其特征在于，所述获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数，包括：
    获取所述调用端对应的预设时间长度；
    统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
  14. 根据权利要求13所述的方法，其特征在于，所述调用端访问次数存储于所述服务器的分布式缓存内，所述统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数，包括：
    通过incr方法统计所述预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数。
  15. 根据权利要求8、11或14所述的方法，其特征在于，所述分布式缓存为redis存储系统。
  16. 根据权利要求1所述的方法，其特征在于，所述预设时间长度为1秒钟。
  17. 一种访问控制装置，其特征在于，应用于服务器，所述装置包括：
    获取单元，用于获取调用端发送的请求访问所述服务器的访问请求；
    响应单元，用于若所述服务器允许被所述调用端访问，则响应所述访问请求，执行所述调用端的访问操作；
    确定单元，用于获取在预设时间长度内所述调用端发送的访问请求的访问次数，作为调用端访问次数；
    处理单元，用于根据所述调用端访问次数为所述调用端设置禁访时段，在所述禁访时段内，所述服务器禁止被所述调用端访问，其中，所述调用端访问次数越高，所述禁访时段的长度越大。
  18. 根据权利要求17所述的装置，其特征在于，所述处理单元还用于：
    获取预先设置的访问次数与禁访时间长度之间的函数关系；
    根据所述函数关系确定所述调用端访问次数对应的禁访时间长度；
    根据所述禁访时间长度为所述调用端设置禁访时段。
  19. 根据权利要求18所述的装置，其特征在于，所述函数关系为幂函数。
  20. 一种服务器，其特征在于，包括：
    一个或多个处理器；
    存储器；
    一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行如权利要求 1-16任一项所述的方法。
  21. 一种计算机可读介质，其特征在于，所述可读存储介质存储有处理器可执行的程序代码，所述程序代码中的多条指令被所述处理器执行时使所述处理器执行权利要求1-16任一项所述方法。
PCT/CN2019/110639 2019-10-11 2019-10-11 访问控制方法、装置、服务器和计算机可读介质 WO2021068205A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980099241.7A CN114223177A (zh) 2019-10-11 2019-10-11 访问控制方法、装置、服务器和计算机可读介质
PCT/CN2019/110639 WO2021068205A1 (zh) 2019-10-11 2019-10-11 访问控制方法、装置、服务器和计算机可读介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/110639 WO2021068205A1 (zh) 2019-10-11 2019-10-11 访问控制方法、装置、服务器和计算机可读介质

Publications (1)

Publication Number Publication Date
WO2021068205A1 true WO2021068205A1 (zh) 2021-04-15

Family

ID=75437608

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/110639 WO2021068205A1 (zh) 2019-10-11 2019-10-11 访问控制方法、装置、服务器和计算机可读介质

Country Status (2)

Country Link
CN (1) CN114223177A (zh)
WO (1) WO2021068205A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572701A (zh) * 2021-07-26 2021-10-29 杭州米络星科技(集团)有限公司 服务接口流控方法、装置、设备及存储介质
CN113691457A (zh) * 2021-08-10 2021-11-23 中国银联股份有限公司 限流控制方法、装置、设备及存储介质
CN114553791A (zh) * 2022-01-19 2022-05-27 浙江百应科技有限公司 一种外部接口限流方法、装置、电子设备以及存储介质
CN115208939A (zh) * 2022-07-14 2022-10-18 Oppo广东移动通信有限公司 访问控制方法、装置、存储介质及电子设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1032236A1 (en) * 1999-02-24 2000-08-30 ICO Services Ltd. Improved congestion control using access classes
CN1816215A (zh) * 2005-01-12 2006-08-09 株式会社Ntt都科摩 数据通信限制方法、数据通信限制系统及移动终端
CN102841915A (zh) * 2011-05-19 2012-12-26 巴比禄股份有限公司 文件管理装置及其控制方法
CN104618352A (zh) * 2015-01-16 2015-05-13 沈文策 一种基于脚本的流量防刷方法及系统
CN107547548A (zh) * 2017-09-05 2018-01-05 北京京东尚科信息技术有限公司 数据处理方法及系统
CN109743294A (zh) * 2018-12-13 2019-05-10 平安科技（深圳）有限公司 接口访问控制方法、装置、计算机设备及存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108400963A (zh) * 2017-10-23 2018-08-14 平安科技（深圳）有限公司 电子装置、访问请求控制方法和计算机可读存储介质
CN109873794B (zh) * 2017-12-04 2022-11-08 北京安云世纪科技有限公司 一种拒绝服务攻击的防护方法及服务器
CN108683604B (zh) * 2018-04-03 2021-11-26 平安科技（深圳）有限公司 并发访问控制方法、终端设备及介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1032236A1 (en) * 1999-02-24 2000-08-30 ICO Services Ltd. Improved congestion control using access classes
CN1816215A (zh) * 2005-01-12 2006-08-09 株式会社Ntt都科摩 数据通信限制方法、数据通信限制系统及移动终端
CN102841915A (zh) * 2011-05-19 2012-12-26 巴比禄股份有限公司 文件管理装置及其控制方法
CN104618352A (zh) * 2015-01-16 2015-05-13 沈文策 一种基于脚本的流量防刷方法及系统
CN107547548A (zh) * 2017-09-05 2018-01-05 北京京东尚科信息技术有限公司 数据处理方法及系统
CN109743294A (zh) * 2018-12-13 2019-05-10 平安科技（深圳）有限公司 接口访问控制方法、装置、计算机设备及存储介质

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113572701A (zh) * 2021-07-26 2021-10-29 杭州米络星科技(集团)有限公司 服务接口流控方法、装置、设备及存储介质
CN113691457A (zh) * 2021-08-10 2021-11-23 中国银联股份有限公司 限流控制方法、装置、设备及存储介质
CN113691457B (zh) * 2021-08-10 2023-07-18 中国银联股份有限公司 限流控制方法、装置、设备及存储介质
CN114553791A (zh) * 2022-01-19 2022-05-27 浙江百应科技有限公司 一种外部接口限流方法、装置、电子设备以及存储介质
CN115208939A (zh) * 2022-07-14 2022-10-18 Oppo广东移动通信有限公司 访问控制方法、装置、存储介质及电子设备
CN115208939B (zh) * 2022-07-14 2024-03-19 Oppo广东移动通信有限公司 访问控制方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
CN114223177A (zh) 2022-03-22

Similar Documents

Publication Publication Date Title
WO2021068205A1 (zh) 访问控制方法、装置、服务器和计算机可读介质
CN111030936B (zh) 网络访问的限流控制方法、装置及计算机可读存储介质
US10356127B2 (en) Methods and systems for applying security policies in a virtualization environment
US20230376454A1 (en) Method and system for applying data retention policies in a computing platform
CN109542361B (zh) 一种分布式存储系统文件读取方法、系统及相关装置
US11671402B2 (en) Service resource scheduling method and apparatus
WO2014059650A1 (zh) 一种音频管理方法及装置
US10831915B2 (en) Method and system for isolating application data access
US9779250B1 (en) Intelligent application wrapper
US11443037B2 (en) Identification of invalid requests
WO2021189257A1 (zh) 恶意进程的检测方法、装置、电子设备及存储介质
US10223535B2 (en) Ranking security scans based on vulnerability information from third party resources
US20210274013A1 (en) Scan protection with rate limiting
WO2019047708A1 (zh) 资源配置方法及相关产品
CN113517985A (zh) 文件数据处理方法、装置、电子设备及计算机可读介质
WO2016169212A1 (zh) 文件管理方法和装置
CN109525512B (zh) 一种bgp邻居的建立方法及装置
CN115039082A (zh) 日志写入方法、装置、电子设备以及存储介质
WO2023011233A1 (zh) 流量管理方法、装置、设备及计算机可读存储介质
CN112866265B (zh) 一种csrf攻击防护方法及装置
WO2020238971A1 (zh) 文件共享方法、装置、系统、服务器、终端及存储介质
CN111770126B (zh) 服务请求处理方法、装置及存储介质
US20230412693A1 (en) Network-aware endpoint data loss prevention for web transactions
CN107547345A (zh) 一种vxlan动态接入方法、装置、设备及介质
WO2023246168A1 (zh) 一种微服务迁移方法、装置及计算设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19948288

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19948288

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 29/09/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 19948288

Country of ref document: EP

Kind code of ref document: A1