WO2023093772A1 - 一种请求调度的方法、装置、电子设备及存储介质 - Google Patents

一种请求调度的方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2023093772A1
WO2023093772A1 PCT/CN2022/133778 CN2022133778W WO2023093772A1 WO 2023093772 A1 WO2023093772 A1 WO 2023093772A1 CN 2022133778 W CN2022133778 W CN 2022133778W WO 2023093772 A1 WO2023093772 A1 WO 2023093772A1
Authority
WO
WIPO (PCT)
Prior art keywords
request
authentication parameter
authentication
user access
access request
Prior art date
Application number
PCT/CN2022/133778
Other languages
English (en)
French (fr)
Inventor
兰晓琴
李逸骏
Original Assignee
贵州白山云科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 贵州白山云科技股份有限公司 filed Critical 贵州白山云科技股份有限公司
Publication of WO2023093772A1 publication Critical patent/WO2023093772A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present disclosure relates to but not limited to a request scheduling method, device, electronic equipment and storage medium.
  • Hotlinking means that service provider A does not provide service content, but provides service provider B’s service content to users on its own website through technical means, in order to defraud browsing and click-through rates. Service provider A who gets benefits does not provide or provides few resources, but service provider B does not get due benefits. Hotlinking will not only affect service providers who provide service content, but also seriously threaten user data security and privacy, resulting in poor user experience.
  • Traditional anti-leech technologies such as UA anti-leech, Referer anti-leech, Token anti-leech, etc., are relatively easy to crack due to the relatively simple implementation principles of existing technologies, and it is difficult to fundamentally achieve the purpose of anti-leech. Therefore, how to better solve the hotlinking problem has become a technical problem to be solved urgently by those skilled in the art and a focus of research all the time.
  • the present disclosure provides a request scheduling method, device, electronic equipment and storage medium.
  • a request scheduling method applied to a client including:
  • the first user access request includes a first authentication parameter
  • the first authentication parameter is used for the jump server to perform the first user access request sent by the client authentication.
  • the redirect server Receives a first response message sent by the redirect server; the first response message includes a second authentication parameter and a redirect URL, and the second authentication parameter is used for the edge node corresponding to the redirect URL to send to the client
  • the second user access request is authenticated.
  • the first authentication parameter is located in request header information or request URL of the first user access request.
  • the second authentication parameter is located in the response header information of the first response message or in the redirect URL.
  • a method for request scheduling is provided, which is applied to a jump server, including:
  • a first user access request sent by the client is received, where the first user access request includes a first authentication parameter.
  • the client After successful authentication, send a first response message to the client, the first response message includes a second authentication parameter and a redirection URL, and the second authentication parameter is used for the edge node corresponding to the redirection URL Authenticate the second user access request sent by the client.
  • sending the first response message to the client includes:
  • the second authentication parameter is encrypted by an encryption algorithm.
  • said encrypting the second authentication parameter by using an encryption algorithm includes:
  • the agreed additional parameters include request header information of the first user access request.
  • sending the first response message to the client includes:
  • the redirection URL is encrypted by an encryption algorithm.
  • the method before sending the first response message to the client after the authentication is successful, the method further includes:
  • the redirection URL is determined according to at least one of the first authentication parameter, client location information, server quality of service information, server ranking information, server cache status information, and cost information.
  • the redirect URL includes at least one of identification information, domain name information, and IP address of the edge node.
  • the first authentication parameter is located in request header information or request URL of the first user access request.
  • the second authentication parameter is located in the response header information of the first response message or in the redirect URL.
  • a method for request scheduling is provided, the method is applied to an edge node, including:
  • the second user access request includes a second authentication parameter; the edge node and the second authentication parameter are based on the first response received by the client from the jump server
  • the message is OK.
  • a second response message is sent to the client, where the second response message includes the resources requested by the second user to access.
  • the first response message includes a second authentication parameter and a redirection URL.
  • the redirect URL includes at least one of identification information, domain name information, and IP address of the edge node.
  • the second authentication parameter is located in response header information of the first response message or in the redirection URL.
  • a device for request scheduling is provided, which is applied to a client, including a first request sending module, a first message receiving module, a second request sending module, and a second message receiving module:
  • the first request sending module is configured to send a first user access request to the jump server; the first user access request includes a first authentication parameter, and the first authentication parameter is used for sending the jump server to the client The first user access request is authenticated.
  • the first message receiving module is configured to receive the first response message sent by the jump server; the first response message includes a second authentication parameter and a jump URL, and the second authentication parameter is used by the edge node to the client The sent second user access request is authenticated.
  • a second request sending module configured to send a second user access request including the second authentication parameter to the edge node corresponding to the redirect URL.
  • the second message receiving module is configured to receive a second response message sent by the edge node, where the second response message includes the resource requested by the second user's access request.
  • an apparatus for request scheduling which is applied to a jump server, including a first request receiving module, a first request authentication module, and a first message sending module:
  • a first request receiving module configured to receive a first user access request sent by a client, where the first user access request includes a first authentication parameter
  • a first request authentication module configured to authenticate the first user access request according to the first authentication parameter
  • the first message sending module is configured to send a first response message to the client after successful authentication, the first response message includes a second authentication parameter and a jump URL, and the second authentication parameter is used for the The edge node corresponding to the redirection URL authenticates the second user access request sent by the client.
  • an apparatus for request scheduling which is applied to an edge node, and the apparatus includes a second request receiving module, a second request authentication module, and a second message sending module:
  • the second request receiving module is configured to receive a second user access request sent by the client; the second user access request includes a second authentication parameter; the edge node and the second authentication parameter are obtained from the client according to The first response message received by the jump server is determined.
  • a second request authentication module configured to authenticate the second user access request according to the second authentication parameter.
  • the second message sending module is configured to send a second response message to the client after successful authentication, where the second response message includes resources requested by the second user to access.
  • an electronic device the electronic device includes a memory and a processor, the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the The processor executes the steps of the request scheduling method in any embodiment of the present disclosure.
  • a storage medium storing computer-readable instructions.
  • the computer-readable instructions When the computer-readable instructions are executed by one or more processors, the one or more processors perform any of the tasks of the present disclosure. Steps of a method for request scheduling in an embodiment.
  • a computer program product including a computer program, and when the computer program is executed by one or more processors, the steps of the request processing method in any embodiment of the present disclosure are implemented.
  • the beneficial effects of the present disclosure are: based on the way of secondary authentication, the present disclosure can better solve the hotlinking problem existing in the prior art, greatly reduce the risk of user configuration asset exposure, and improve the security and protection of user data User privacy, better user experience, higher satisfaction.
  • the configuration information can be sent to the small-grained edge nodes, and the configuration information includes anti-leech information, and the authentication judgment is performed on the small-grained edge nodes, so as to achieve technical purposes such as anti-leech.
  • This disclosure specifically performs an authentication on the jump server, according to the successful receipt of the edge node location and the second authentication parameter of the jump server response after the first authentication, and then performs the second authentication parameter on the corresponding edge node One authentication, thereby realizing two authentications, greatly avoiding the possibility of business hotlinking and protecting the interests of users and websites.
  • This disclosure can better adapt to the scenario where a distributed sinking server is used as a content server, and URL double authentication can also be realized without user configuration on the content server, and this disclosure does not require users to manually operate on the client, effectively reinforcing Anti-hotlinking schemes are established, and hotlinking behaviors can be discovered and dealt with in a timely manner; in addition, by adopting domain name encryption or parameter encryption, this disclosure can comprehensively protect user assets such as domain name information and configuration information.
  • Fig. 1 shows a schematic flowchart of a request scheduling method for a client in one or more embodiments of the present disclosure.
  • Fig. 2 shows a schematic flowchart of a request scheduling method for a jump server in one or more embodiments of the present disclosure.
  • Fig. 3 shows a schematic flowchart of a request scheduling method for an edge node in one or more embodiments of the present disclosure.
  • Fig. 4 shows a schematic flowchart of a scheduling scheme for dual authentication in one or more embodiments of the present disclosure.
  • Fig. 5 shows a schematic diagram of the internal structure of an electronic device in one or more embodiments of the present disclosure.
  • the embodiment of the present disclosure can provide a request scheduling method applied to a client.
  • the request scheduling method includes but not limited to steps S10 to S13 , which are specifically described as follows.
  • Step S10 sending a first user access request to the jump server; the first user access request includes a first authentication parameter, and the first authentication parameter is used for the jump server to authenticate the first user access request sent by the client.
  • the first authentication parameter in this embodiment is located in the request header information of the first user's access request or in the request URL (Uniform Resource Locator, Uniform Resource Locator), and the request URL involved in the present disclosure refers to the first user's access request URL in the URL; the first authentication parameter includes but not limited to time stamp, UA, IP blacklist and whitelist, cookie, referer and other anti-leech parameters.
  • the request header A carries the content that the first authentication parameter is timestamp information, 1.zip indicates the content of the request, and the request method is GET.
  • the first user request may be, for example, an http or https request, but of course it is not limited thereto.
  • the risk of exposure of the first authentication parameter can be effectively reduced, the security of an authentication process can be improved, and the security of user access requests can be improved. Improve user satisfaction.
  • the client in the embodiment of the present disclosure sends a DNS request to the DNS server for domain name resolution, and receives the IP address of the jump server determined by the DNS server through domain name resolution.
  • the disclosed client sends a request to the DNS server for obtaining an IP address, such as www.test.com; then, in step 200, the DNS server responds with an IP address after parsing the request, such as 2.2.2.2; 300.
  • the client After receiving the IP address fed back by the DNS server, the client sends a first user access request to the jump server corresponding to the IP address.
  • the first user access request in this embodiment of the present disclosure is, for example, http://www.test. com/1.zip?
  • the first authentication parameter includes but not limited to time stamp, UA, IP blacklist and whitelist, cookie, referer and other anti-leech parameters, of course it is not limited thereto.
  • Step S11 receiving the first response message sent by the jump server; the first response message includes a second authentication parameter and a jump URL, and the second authentication parameter is used by the edge node to authenticate the second user access request sent by the client. right.
  • the second authentication parameter in the embodiment of the present disclosure is located in the response header information of the first response message or in the redirection URL.
  • the redirection URL involved in the present disclosure refers to the URL in the first response message, and the redirection URL is used for When the client accesses the corresponding edge node, the second authentication parameters include but are not limited to time stamp, UA, IP black and white list, cookie, referer and other anti-leech parameters, but are not limited thereto.
  • the disclosure can improve the security of the second authentication parameter and greatly enhance the difficulty of being cracked; It is set in the redirect URL to realize the construction of a URL with authentication rules in the redirect server, and the client can realize the secondary authentication logic with zero modification, which further improves the security of user access requests.
  • the jump server authenticates the first user's access request, and directly rejects the first user's access request if the authentication fails.
  • the redirect server if the redirect server successfully authenticates the first authentication parameter, it will respond to the second authentication parameter and the redirect URL (Location, that is, the location of the edge node); in this embodiment, the client receives the redirect
  • the first response message sent by the server includes the second authentication parameter encrypted by the encryption algorithm.
  • Encrypting the second authentication parameter through an encryption algorithm may include: combining at least one of the agreed additional parameters and time stamp, UA, IP black and white list, cookie, referer into a string through a preset sequence, and using an encryption algorithm to encrypt all The above character string is encrypted to obtain the encrypted second authentication parameter; wherein, the agreed additional parameters include random numbers or pre-agreed parameters; the encryption algorithm includes but not limited to md5 encryption algorithm, base64 encryption algorithm, etc.
  • step 301 an authentication is performed on the first user access request sent by the client. If the authentication fails, it is directly rejected.
  • Step 303 the embodiment of the present disclosure can encrypt the edge node IP and auth_key2 (for example, base64 encryption method) and then assemble it to the original URL.
  • Step S12 sending a second user access request including the second authentication parameter to the edge node corresponding to the redirection URL.
  • the second user's access request is authenticated through the edge node. If the edge node authentication is successful, step S13 is performed. If the edge node authentication fails, the second user's access request is directly rejected; in the embodiment of the disclosure, the authentication fails Circumstances may include, but are not limited to, parameters being changed, parameters being lost, valid access periods being exceeded, and the like.
  • the second user request in this embodiment of the present disclosure may be, for example, an http or https request, but of course it is not limited thereto. As shown in FIG.
  • Authenticate the access request of the second user through the edge node if the authentication fails, directly reject it; if the authentication succeeds, execute step S13.
  • the edge node decrypts the second user's access request through the built-in decryption module.
  • the decryption method corresponds to the encryption method, including but not limited to the md5 decryption method used for the second authentication parameter and the URL used for jumping The base64 decryption method, etc.
  • Step S13 receiving the second response message sent by the edge node, and the second response message includes the resource requested by the second user's access request, that is, step 600, responding to the content corresponding to the second user's access request.
  • the edge node 1.1.1.1 caches the content requested by the second user access request, it will respond to the cached content to the client;
  • the present disclosure can significantly improve the security of content requests by the client, better solve the hotlinking problem that is easy to occur in conventional technologies, protect user configuration assets, improve user data security, and improve user satisfaction and user experience.
  • the embodiment of the present disclosure can also provide a request scheduling method, which is applied to the jump server, and the request scheduling method can include but not limited to Step S20 ⁇ Step S22, specifically described as follows.
  • Step S20 receiving a first user access request sent by the client, the first user access request includes a first authentication parameter; the first authentication parameter is located in the request header information of the first user access request or in the request URL.
  • the first authentication parameter is, for example, time stamp, UA, IP blacklist and whitelist, cookie, referer and other anti-leech parameters, but of course it is not limited thereto.
  • the risk of exposure of the first authentication parameter can be effectively reduced, the security of an authentication process can be improved, and the security of user access requests can be improved. Improve user satisfaction.
  • Step S21 authenticating the first user's access request according to the first authentication parameter.
  • authentication of anti-leech parameters such as time stamp, UA, IP black and white list, cookie, referer, etc.
  • the jump server authenticates the first user's access request, and directly rejects the first user's access request if the authentication fails.
  • Step S22 after successful authentication, send a first response message to the client, the first response message includes a second authentication parameter and a jump URL, and the second authentication parameter is used to send the edge node corresponding to the jump URL to the client
  • the second user's access request is authenticated.
  • the embodiment of the present disclosure adopts a 302 redirection method to respond to a jump URL for the client. Of course, other redirection methods may also be used, which is not limited in the present disclosure.
  • the second authentication parameter in this embodiment is located in the response header information of the first response message or in the redirection URL.
  • the redirection server if it successfully authenticates the first authentication parameter, it will respond to the client with the second authentication parameter and the redirection URL (Location, that is, the location of the edge node).
  • the redirection URL “Location, that is, the location of the edge node).
  • the disclosure can improve the security of the second authentication parameter and greatly enhance the difficulty of being cracked; It is set in the redirect URL to realize the construction of a URL with authentication rules in the redirect server, and the client can realize the secondary authentication logic with zero modification, which further improves the security of user access requests.
  • sending the first response message to the client after successful authentication in the embodiment of the present disclosure includes: if the authentication of the first authentication parameter is successful, encrypting the second authentication parameter by an encryption algorithm; A first response message including the encrypted second authentication parameter is sent to the client.
  • encrypting the second authentication parameter through an encryption algorithm includes: combining at least one of the agreed additional parameters and time stamp, UA, IP black and white list, cookie, and referer into characters in a preset order string, and use an encryption algorithm to encrypt the string to obtain the encrypted second authentication parameter; wherein, the agreed additional parameters include random numbers or pre-agreed parameters; where the encryption algorithm includes but not limited to md5 encryption algorithm, base64 encryption algorithm, etc.
  • This disclosure increases the difficulty of deciphering the second authentication parameter by encrypting the second authentication parameter, and further avoids hotlinking. Even if the encrypted second authentication parameter is intercepted at the client, it is extremely difficult to obtain the second authentication parameter.
  • the specific content contained in the second authentication parameter shows that the present disclosure has the advantage of extremely high security.
  • the present disclosure combines selected parameters based on a preset sequence to form a character string, which further increases the complexity and difficulty of deciphering the encryption process, and improves the security of the second authentication parameter.
  • the embodiment of the present disclosure before sending the first response message to the client after successful authentication, further includes: according to the first authentication parameter, client location information, server quality of service information, server ranking information, server At least one of cache status information and cost information determines the redirect URL.
  • the present disclosure can determine the redirect URL closest to the client according to the client location information, and determine the redirect from the edge node with the best server service quality. URL, determine the redirection URL from the edge nodes with higher server ranking, determine the redirection URL from the edge nodes with good server cache status, determine the redirection URL from the edge nodes with lower cost, the screening of the redirection URL is disclosed
  • the selection strategy may comprehensively consider the above conditions, but of course it is not limited thereto.
  • the jump URL represents the address information of the edge node, and includes but not limited to at least one of identification information, domain name information, and IP address of the edge node. It can be seen that this disclosure can determine the most suitable edge node from a large number of edge nodes, that is, determine the optimal jump URL. The purpose of optimal scheduling and balanced scheduling. Moreover, the present disclosure also uses one or more address information to determine the location of the edge node. This method not only enriches the way of determining the edge node address, but also avoids the problem that the single form of the edge node address is easy to be hotlinked.
  • this disclosure can better solve the hotlinking problem existing in the prior art, greatly reduce the risk of user configuration asset exposure, improve user data security and protect user privacy, and provide better user experience , Higher satisfaction.
  • the configuration information can be sent to the small-grained edge nodes, and the configuration information includes anti-leech information, and the authentication judgment is performed on the small-grained edge nodes, so as to achieve technical purposes such as anti-leech.
  • This disclosure specifically performs an authentication on the jump server, according to the successful receipt of the edge node location and the second authentication parameter of the jump server response after the first authentication, and then performs the second authentication parameter on the corresponding edge node One authentication, thereby realizing two authentications, greatly avoiding the possibility of business hotlinking and protecting the interests of users and websites.
  • This disclosure can better adapt to the scenario where a distributed sinking server is used as a content server, and URL double authentication can also be realized without user configuration on the content server, and this disclosure does not require users to manually operate on the client, effectively reinforcing Anti-hotlinking schemes are established, and hotlinking behaviors can be discovered and dealt with in a timely manner; in addition, by adopting domain name encryption or parameter encryption, this disclosure can comprehensively protect user assets such as domain name information and configuration information.
  • the jump URL in the embodiment of the present disclosure includes at least one of the identification information of the edge node, domain name information, and IP address.
  • the present disclosure also determines the location of the edge node through one or more address information. This method can not only Enrich the way to determine the edge node address, and avoid the problem that a single form of edge node address is easy to be hotlinked
  • This disclosure performs an authentication through the jump server and generates parameters for re-authentication and determines the corresponding edge node after the authentication is passed. It can be seen that this disclosure greatly avoids the possibility of business theft through double authentication. The request security is improved, and the rights and interests of users and resource websites are protected.
  • the embodiment of the present disclosure also provides a method for request scheduling, which is applied to an edge node.
  • the method for request scheduling may include but not limited to steps S30 to S32 , which are specifically described as follows.
  • Step S30 receiving a second user access request sent by the client, where the second user access request in this disclosure includes a second authentication parameter.
  • the edge node and the second authentication parameter are determined according to the first response message received by the client from the redirect server, wherein the first response message includes the second authentication parameter and the redirect URL, and the second authentication parameter is located in the first response message In the response header information or in the redirection URL.
  • the disclosure can improve the security of the second authentication parameter and greatly enhance the difficulty of being cracked; It is set in the redirect URL to realize the construction of a URL with authentication rules in the redirect server, and the client can realize the secondary authentication logic with zero modification, which further improves the security of user access requests.
  • the jump URL in the embodiment of the present disclosure includes at least one of the identification information of the edge node, domain name information, and IP address. The present disclosure also determines the location of the edge node through one or more address information. This method can not only The method of determining the address of the edge node is enriched, and the problem that the address of the edge node in a single form is easy to be hotlinked is avoided.
  • Step S31 authenticating the access request of the second user according to the second authentication parameter.
  • the authentication method and rules can be pre-agreed between the edge node and the jump server, or sent to the edge node and the jump server through the third-party management platform, of course, the edge node can also be the second authentication For real-time request and verification to the jump server after the parameters, on the basis of the content of this disclosure, the specific method and rules of the secondary authentication can be determined according to the actual situation and needs, without user configuration, specific authentication rules and methods , which is not limited in the present disclosure.
  • the edge node authenticates the second user's access request: if the authentication fails, it directly refuses, and if the authentication succeeds, step 32 is performed.
  • authenticating the second user's access request according to the second authentication parameter in the embodiment of the present disclosure includes: performing the second user's access request according to the second authentication parameter encrypted by an encryption algorithm authentication.
  • the edge node decrypts the second user's access request through the built-in decryption module, and the decryption method corresponds to the encryption method, and may include but not limited to the md5 decryption method used for the second authentication parameter And the base64 decryption method used to jump to the URL, etc.
  • Step S32 after successful authentication, send a second response message to the client, where the second response message includes the resources requested by the second user to access.
  • the edge node 1.1.1.1 caches the content requested by the second user's access request, it will respond to the cached content to the client; Obtain the response content by means of back-to-source, send the content obtained through back-to-origin to the client, and cache the content obtained through back-to-source on the current edge node.
  • edge nodes involved in this disclosure are, for example, CDN (Content Delivery Network, content distribution network), SD-WAN (Software Defined Wide Area Network, software defined local area network) or nodes in the edge cloud network, which are used in this embodiment to provide Resource used by edge nodes.
  • CDN Content Delivery Network, content distribution network
  • SD-WAN Software Defined Wide Area Network, software defined local area network
  • this disclosure can better solve the hotlinking problem existing in the prior art, greatly reduce the risk of user configuration asset exposure, improve user data security and protect user privacy, and provide better user experience , Higher satisfaction.
  • the configuration information can be sent to the small-grained edge nodes, and the configuration information includes anti-leech information, and the authentication judgment is performed on the small-grained edge nodes, so as to achieve technical purposes such as anti-leech.
  • This disclosure specifically performs an authentication on the jump server, according to the successful receipt of the edge node location and the second authentication parameter of the jump server response after the first authentication, and then performs the second authentication parameter on the corresponding edge node One authentication, thereby realizing two authentications, greatly avoiding the possibility of business hotlinking and protecting the interests of users and websites.
  • This disclosure can better adapt to the scenario where a distributed sinking server is used as a content server, and URL double authentication can also be realized without user configuration on the content server, and this disclosure does not require users to manually operate on the client, effectively reinforcing Anti-hotlinking schemes are established, and hotlinking behaviors can be discovered and dealt with in a timely manner; in addition, by adopting domain name encryption or parameter encryption, this disclosure can comprehensively protect user assets such as domain name information and configuration information.
  • the embodiment of the present disclosure can also provide a request scheduling device, which is applied to the client.
  • the device includes but not limited to a first request sending module, a first message receiving module, a second request sending module and a second message receiving module.
  • the first request sending module can be used to send a first user access request to the jump server; the first user access request includes a first authentication parameter, and the first authentication parameter is used for the first user access request sent by the jump server to the client Authenticate.
  • the first authentication parameter is located in the request header information of the first user's access request or in the request URL.
  • the first message receiving module can be used to receive the first response message sent by the jump server; the first response message includes the second authentication parameter and the jump URL, and the second authentication parameter is used for the second user sent by the edge node to the client Access requests are authenticated.
  • the second authentication parameter is located in the response header information of the first response message or in the redirection URL.
  • the second request sending module may be configured to send the second user access request including the second authentication parameter to the edge node corresponding to the redirection URL.
  • the second message receiving module may be configured to receive a second response message sent by the edge node, where the second response message includes the resource requested by the second user's access request.
  • the present disclosure can significantly improve the security of content requests by the client, better solve the hotlinking problem that is easy to occur in conventional technologies, protect user configuration assets, improve user data security, and improve user satisfaction and user experience.
  • the embodiment of the present disclosure can also provide a request scheduling device, which is applied to a jump server.
  • the device includes but not limited to a first request receiving module, a first request authentication module and a first message sending module.
  • the first request receiving module may be used to receive a first user access request sent by a client, and the first user access request includes a first authentication parameter.
  • the first authentication parameter is located in the request header information of the first user's access request or in the request URL.
  • the first request authentication module is configured to authenticate the first user access request according to the first authentication parameter.
  • the first message sending module can be used to send a first response message to the client after successful authentication, the first response message includes a second authentication parameter and a jump URL, and the second authentication parameter is used for the edge node pair corresponding to the jump URL
  • the second user access request sent by the client is authenticated.
  • the first message sending module in the embodiment of the present disclosure can also be used to determine the jump according to at least one of the first authentication parameter, client location information, server quality of service information, server ranking information, server cache status information, and cost information URL, wherein the jump URL includes at least one of domain name information and IP address of the edge node.
  • the second authentication parameter is located in the response header information of the first response message or in the redirection URL.
  • the disclosure can improve the security of the second authentication parameter and greatly enhance the difficulty of being cracked; It is set in the redirect URL to realize the construction of a URL with authentication rules in the redirect server, and the client can realize the secondary authentication logic with zero modification, which further improves the security of user access requests.
  • the device for requesting scheduling further includes a first encryption module, configured to encrypt the second authentication parameter by using an encryption algorithm under the condition that the authentication of the first authentication parameter is successful.
  • the first encryption module is specifically used to combine the agreed additional parameters and at least one of time stamp, UA, IP black and white list, cookie, referer into a character string in a preset order, and encrypt the character string using an encryption algorithm , to obtain the encrypted second authentication parameter; wherein, the agreed additional parameter includes the request header information of the first user access request.
  • the first message sending module is used for sending the first response message including the encrypted second authentication parameter to the client.
  • the device for request scheduling also includes a second encryption module, which is configured to encrypt the redirection URL with an encryption algorithm under the condition that the authentication of the first authentication parameter is successful.
  • the first message sending module is used for sending the first response message including the encrypted redirection URL to the client.
  • This disclosure performs an authentication through the jump server and generates parameters for re-authentication and determines the corresponding edge node after the authentication is passed. It can be seen that this disclosure greatly avoids the possibility of business theft through double authentication. The request security is improved, and the rights and interests of users and resource websites are protected.
  • the embodiment of the present disclosure can also provide a request scheduling device, which is applied to an edge node.
  • the device includes but not limited to a second request receiving module, a second request authenticating module and a second message sending module.
  • the second request receiving module can be used to receive the second user access request sent by the client, the second user access request includes the second authentication parameter; the edge node and the second authentication parameter are based on the first authentication parameter received by the client from the jump server
  • the response message is OK.
  • the second authentication parameter in the embodiment of the present disclosure is located in the response header information of the first response message or in the redirection URL.
  • the second request authentication module can be used to authenticate the second user's access request according to the second authentication parameter, and the second request authentication module can specifically be used to authenticate the second user's access request according to the second authentication parameter encrypted by the encryption algorithm Access requests are authenticated.
  • the second message sending module may be configured to send a second response message to the client after successful authentication, and the second response message includes the resources requested by the second user for access.
  • this disclosure can better solve the hotlinking problem existing in the prior art, greatly reduce the risk of user configuration asset exposure, improve user data security and protect user privacy, and provide better user experience , Higher satisfaction.
  • the present disclosure can provide an electronic device.
  • the electronic device includes a memory and a processor.
  • Computer-readable instructions are stored in the memory.
  • the processor can execute the steps of the request scheduling method in any embodiment of the present disclosure.
  • the detailed process of the method for requesting scheduling has been recorded in detail in this specification, and will not be repeated here.
  • the present disclosure may also provide a storage medium storing computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, one or more processors may execute The steps of the request scheduling method in any embodiment of the present disclosure.
  • the detailed process of the method for requesting scheduling has been recorded in detail in this specification, and will not be repeated here.
  • the present disclosure may also provide a computer program product, the computer program product includes a computer program, and when the computer program is executed by one or more processors, the request in any embodiment of the present disclosure is implemented.
  • the embodiments of the present disclosure may be provided as a method, an apparatus (device), or a computer program product. Accordingly, the present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data , including but not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can be used in Any other medium, etc. that stores desired information and can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more processes of the flowchart and/or one or more blocks of the block diagram
  • the method based on the secondary authentication in this disclosure can better solve the hotlinking problem, greatly reduce the risk of user configuration asset exposure, and improve user data security and protect user privacy.

Abstract

本公开是关于一种请求调度的方法、装置、电子设备及存储介质，该请求调度的方法包括：向跳转服务器发送第一用户访问请求；第一用户访问请求包含第一鉴权参数，第一鉴权参数用于跳转服务器对客户端发送的第一用户访问请求进行鉴权；接收跳转服务器发送的第一响应消息；第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数用于跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权；向边缘节点发送包含第二鉴权参数的第二用户访问请求；接收边缘节点发送的第二响应消息。

Description

一种请求调度的方法、装置、电子设备及存储介质
本公开基于2021年11月24日提交中国专利局、申请号为202111408140.9,发明名称为“请求调度的方法、装置、电子设备及存储介质”的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本公开作为参考。
技术领域
本公开涉及但不限于一种请求调度的方法、装置、电子设备及存储介质。
背景技术
盗链指服务提供商A不提供服务内容、通过技术手段在自己网站上向用户提供服务提供商B的服务内容，以骗取浏览和点击率。获得收益的服务提供商A不提供或提供很少资源，服务提供商B却得不到应有收益。盗链问题不仅会影响提供服务内容的服务提供商，而且还会严重威胁用户数据安全和隐私，导致用户体验差。传统的防盗链技术，例如UA防盗链、Referer防盗链、Token防盗链等，由于现有技术的实现原理相对较简单，目前较容易被破解，难以从根本上达到防盗链的目的。因此，如何更好地解决盗链问题，成为了本领域技术人员亟待解决的技术问题和始终研究的重点。
发明内容
为克服相关技术中存在的问题，本公开提供一种请求调度的方法、装置、电子设备及存储介质。
根据本公开的第一方面，提供一种请求调度的方法，应用于客户端，包括：
向跳转服务器发送第一用户访问请求；所述第一用户访问请求包含第一鉴权参数，所述第一鉴权参数用于跳转服务器对客户端发送的所述第一用户访问请求进行鉴权。
接收跳转服务器发送的第一响应消息；所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。
向所述边缘节点发送包含所述第二鉴权参数的第二用户访问请求。
接收所述边缘节点发送的第二响应消息，所述第二响应消息包括第二用户访问请求所请求的资源。
在一些示例性的实施例中，所述第一鉴权参数位于所述第一用户访问请求的请求头信息中或请求URL中。所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL中。
根据本公开的第二方面，提供一种请求调度的方法，应用于跳转服务器，包括：
接收由客户端发出的第一用户访问请求，所述第一用户访问请求包含第一鉴权参数。
根据所述第一鉴权参数对所述第一用户访问请求进行鉴权。
鉴权成功后向所述客户端发送第一响应消息，所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。
在一些示例性的实施例中，所述鉴权成功后向所述客户端发送第一响应消息包括：
若对所述第一鉴权参数鉴权成功，则通过加密算法对第二鉴权参数进行加密。
向所述客户端发送包含经加密后的第二鉴权参数的第一响应消息。
在一些示例性的实施例中，所述通过加密算法对第二鉴权参数进行加密包括：
通过预设顺序对约定的附加参数以及时间戳、UA、IP黑白名单、cookie、referer中的至少一种组合成字符串，并利用加密算法对所述字符串进行加密，以得到加密后的第二鉴权参数。
其中，所述约定的附加参数包括第一用户访问请求的请求头信息。
在一些示例性的实施例中，所述鉴权成功后向所述客户端发送第一响应消息包括：
若对所述第一鉴权参数鉴权成功，则通过加密算法对跳转URL进行加密。
向所述客户端发送包含经加密后的跳转URL的第一响应消息。
在一些示例性的实施例中，所述鉴权成功后向所述客户端发送第一响应消息之前，还包括：
根据第一鉴权参数、客户端位置信息、服务器服务质量信息、服务器排名信息、服务器缓存状态信息、成本信息中的至少一种确定所述跳转URL。
在一些示例性的实施例中，所述跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种。
在一些示例性的实施例中，所述第一鉴权参数位于所述第一用户访问请求的请求头信息中或请求URL中。所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL 中。
根据本公开的第三方面，提供一种请求调度的方法，该方法应用于边缘节点，包括：
接收由客户端发出的第二用户访问请求；所述第二用户访问请求包括第二鉴权参数；所述边缘节点和所述第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定。
根据所述第二鉴权参数对所述第二用户访问请求进行鉴权。
鉴权成功后向所述客户端发送第二响应消息，所述第二响应消息包括第二用户访问请求的资源。
在一些示例性的实施例中，所述第一响应消息包括第二鉴权参数和跳转URL。
在一些示例性的实施例中，所述跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种。
在一些示例性的实施例中，所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL中。
根据本公开的第四方面，提供一种请求调度的装置，应用于客户端，包括第一请求发送模块、第一消息接收模块、第二请求发送模块以及第二消息接收模块：
第一请求发送模块，用于向跳转服务器发送第一用户访问请求；所述第一用户访问请求包含第一鉴权参数，所述第一鉴权参数用于跳转服务器对客户端发送的所述第一用户访问请求进行鉴权。
第一消息接收模块，用于接收跳转服务器发送的第一响应消息；所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于边缘节点对客户端发送的第二用户访问请求进行鉴权。
第二请求发送模块，用于向所述跳转URL对应的边缘节点发送包含所述第二鉴权参数的第二用户访问请求。
第二消息接收模块，用于接收边缘节点发送的第二响应消息，所述第二响应消息包括第二用户访问请求所请求的资源。
根据本公开的第五方面，提供一种请求调度的装置，应用于跳转服务器，包括第一请求接收模块、第一请求鉴权模块以及第一消息发送模块：
第一请求接收模块，用于接收由客户端发出的第一用户访问请求，所述第一用户访问请求包含第一鉴权参数；
第一请求鉴权模块，用于根据所述第一鉴权参数对所述第一用户访问请求进行鉴权；
第一消息发送模块，用于鉴权成功后向所述客户端发送第一响应消息，所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。
根据本公开的第六方面，提供一种请求调度的装置，应用于边缘节点，装置包括第二请求接收模块、第二请求鉴权模块以及第二消息发送模块：
第二请求接收模块，用于接收由客户端发出的第二用户访问请求；所述第二用户访问请求包括第二鉴权参数；所述边缘节点和所述第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定。
第二请求鉴权模块，用于根据所述第二鉴权参数对所述第二用户访问请求进行鉴权。
第二消息发送模块，用于鉴权成功后向所述客户端发送第二响应消息，所述第二响应消息包括第二用户访问请求的资源。
根据本公开的第七方面，提供一种电子设备，该电子设备包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行本公开任一实施例中所述请求调度的方法的步骤。
根据本公开的第八方面，提供一种存储有计算机可读指令的存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行本公开任一实施例中所述请求调度的方法的步骤。
根据本公开的第九方面，提供一种计算机程序产品，包括计算机程序，所述计算机程序被一个或多个处理器执行时实现本公开任一实施例中所述请求处理的方法的步骤。
本公开的有益效果为：基于二次鉴权的方式，本公开能够较好地解决现有技术存在的盗链问题，极大地降低用户配置资产暴露的风险，以提高用户数据的安全性和保护用户隐私，用户体验较佳、满意度较高。本公开可将配置信息下发到小颗粒边缘节点上，配置信息包括防盗链信息，并在小颗粒边缘节点上进行鉴权判断，以达到防盗链等技术目的。本公开具体在跳转服务器上进行一次鉴权，根据一次鉴权成功收到该跳转服务器响应的边缘节点位置和第二鉴权参数，然后在对应的边缘节点上对第二鉴权参数进行一次鉴权，从而实现了两次鉴权，极大地避免了业务被盗链的可能性，保护了用户和网站的利益。本公开能够更好地适应分布式下沉服务器作为内容服务器的场景，内容服务器上无需用户配置的情况下也可实现URL双重鉴权，而且本公开无需用户手动在客户端进行操作，有效地加固了防盗链方案，并能够 及时发现和处理盗链行为；另外，通过采用域名加密或参数加密的方式，本公开能够对域名信息、配置信息等用户资产进行全方位保护。
附图说明
构成本公开的一部分的附图用来提供对本公开的进一步理解，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1示出了本公开一个或多个实施例中用于客户端的请求调度方法的流程示意图。
图2示出了本公开一个或多个实施例中用于跳转服务器的请求调度方法的流程示意图。
图3示出了本公开一个或多个实施例中用于边缘节点的请求调度方法的流程示意图。
图4示出了本公开一个或多个实施例中双重鉴权的调度方案的流程示意图。
图5示出了本公开一个或多个实施例中电子设备的内部结构组成的示意图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。需要说明的是，在不冲突的情况下，本公开中的实施例及实施例中的特征可以相互任意组合。
如图1所示，并可结合图4，本公开实施例能够提供一种请求调度的方法，应用于客户端，该请求调度的方法包括但不限于步骤S10～步骤S13，具体说明如下。
步骤S10，向跳转服务器发送第一用户访问请求；第一用户访问请求包含第一鉴权参数，第一鉴权参数用于跳转服务器对客户端发送的第一用户访问请求进行鉴权。本实施例中的第一鉴权参数位于第一用户访问请求的请求头信息中或请求URL(Uniform Resource Locator，统一资源定位符)中，本公开所涉及的请求URL是指第一用户访问请求中的URL；第一鉴权参数包括但不限于时间戳、UA、IP黑白名单、cookie、referer等防盗链参数。
示例性的，以第一用户访问请求为例进行说明：
GET/1.zip HTTP/1.1
Host:www.test.com
User-Agent:curl/7.77.0
Accept:*/*
A:1444435200
其中，请求头A携带有第一鉴权参数为时间戳信息的内容，1.zip表示请求的内容，请求方法为GET。
第一用户请求例如可为http或https请求，当然并不限于此。
本公开通过将第一鉴权参数设置于请求头信息中或请求URL中，可有效降低第一鉴权参数暴露的风险，提高一次鉴权过程的安全性，以提高用户访问请求的安全性，提升用户满意度。
如图4所示，本公开实施例中的客户端向DNS服务器发出用于进行域名解析的DNS请求，并接收DNS服务器通过域名解析确定的跳转服务器IP地址。如步骤100所示，本公开客户端向DNS服务器发出用于获取IP地址的请求，例如www.test.com；然后，步骤200，DNS服务器解析请求后响应一个IP地址，例如2.2.2.2；步骤300，客户端收到DNS服务器反馈的IP地址后，则向该IP地址对应的跳转服务器发出第一用户访问请求，本公开实施例的第一用户访问请求例如http://www.test.com/1.zip？auth_key1＝xxx，其中，1.zip表示请求的内容，？表示间隔符，auth_key1＝xxx表示第一鉴权参数。可理解的是，第一鉴权参数包括但不限于时间戳、UA、IP黑白名单、cookie、referer等防盗链参数，当然并不限于此。
步骤S11，接收跳转服务器发送的第一响应消息；第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数用于边缘节点对客户端发送的第二用户访问请求进行鉴权。本公开实施例的第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中，本公开所涉及的跳转URL是指第一响应消息中的URL，该跳转URL用于客户端访问对应的边缘节点，第二鉴权参数包括但不限于时间戳、UA、IP黑白名单、cookie、referer等防盗链参数，当然并不限于此。通过将第二鉴权参数设置于响应头信息中或跳转URL中，本公开能够提高第二鉴权参数的安全性、极大增强被破解的难度；而且本公开通过将第二鉴权参数设置于跳转URL中，实现在跳转服务器中构造出携带有鉴权规则的URL，客户端零改造即可实现二次鉴权逻辑，进一步提高了用户访问请求的安全性。
具体实施时，跳转服务器对第一用户访问请求进行鉴权，鉴权失败则直接拒绝第一用户访问请求。本公开实施例中，若跳转服务器对第一鉴权参数鉴权成功，则响应第二鉴权参数和跳转URL(Location，即边缘节点的位置)；本实施例由客户端接收跳转服务器发出的包含通过加密算法加密后的第二鉴权参数的第一响应消息。通过加密算法加密第二鉴权参数可 包括：通过预设顺序对约定的附加参数以及时间戳、UA、IP黑白名单、cookie、referer中的至少一种组合成字符串，并利用加密算法对所述字符串进行加密，以得到加密后的第二鉴权参数；其中，约定的附加参数包括随机数或事先约定好的参数；其中加密算法包括但不限于md5加密算法、base64加密算法等。
如图4所示，步骤301，对客户端发出的第一用户访问请求进行一次鉴权，鉴权失败则直接拒绝，鉴权成功后执行步骤302；步骤302，跳转服务器生成第二鉴权参数，例如为auth_key2＝timestamp-rand-uid-md5hash，其中timestamp表示时间戳，rand表示随机数，uid表示附加参数，md5hash可表示根据md5加密算法生成的key值，例如auth_key2＝1444435200-0-0-80cd3862d699b7118eed99103f2a3a4f。步骤303，本公开实施例可将边缘节点IP和auth_key2加密(例如采用base64加密方式)后组装至原URL，组装后的内容例如可以为http://1.1.1.1/1.zip？bakey＝zzz，该内容既包含了边缘节点的位置，又包含了第二鉴权参数；步骤400，将该内容响应给客户端，例如跳转服务器将http://1.1.1.1/1.zip？bakey＝zzz响应给客户端。
步骤S12，向跳转URL对应的边缘节点发送包含该第二鉴权参数的第二用户访问请求。通过边缘节点对第二用户访问请求进行鉴权，若边缘节点鉴权成功，则执行步骤S13，若边缘节点鉴权失败，则直接拒绝第二用户访问请求；本公开实施例中鉴权失败的情况可包括但不限于参数被改动、参数丢失、超出有效访问期等等。本公开实施例中的第二用户请求例如可为http或https请求，当然并不限于此。结合图4所示，本公开包括步骤500，向IP1.1.1.1所对应的边缘节点发出第二用户访问请求，例如http://1.1.1.1/1.zip？bakey＝zzz，该请求既包含了请求IP和请求内容，还包含了经过加密和组合处理的第二鉴权参数。通过边缘节点对第二用户访问请求进行鉴权：若鉴权失败，则直接拒绝，若鉴权成功则执行步骤S13。在鉴权之前，边缘节点通过内置的解密模块对第二用户访问请求进行解密，解密方式与加密方式相对应，包括但不限于用于第二鉴权参数的md5解密方式以及用于跳转URL的base64解密方式等。
步骤S13，接收边缘节点发送的第二响应消息，且第二响应消息包括第二用户访问请求所请求的资源，即步骤600，响应与第二用户访问请求相对应的内容。结合图4所示，本公开实施例中，如果边缘节点1.1.1.1缓存有第二用户访问请求所请求的内容，则将该缓存内容响应给客户端，但如果没有响应内容，则可通过回源的方式获取响应内容，即源站作为内容服务器使用，并将通过回源所获得的内容发送至客户端，以及将通过回源获取的内容缓存在当前的边缘节点上。
本公开能够显著提高客户端进行内容请求的安全性，较好地解决常规技术易出现的盗链问题，保护用户配置资产，提高用户数据的安全性，并提升了用户满意度和使用体验。
如图2所示，并可结合图4，本公开实施例还可提供一种请求调度的方法，应用于跳转服务器，该请求调度的方法可包括但不限于步骤S20～步骤S22，具体说明如下。
步骤S20，接收由客户端发出的第一用户访问请求，第一用户访问请求包含第一鉴权参数；第一鉴权参数位于第一用户访问请求的请求头信息中或请求URL中。结合图4中所示，本公开实施例中跳转服务器收到的第一用户访问请求例如可以是http://www.test.com/1.zip？auth_key1＝xxx，其中，1.zip可表示请求的内容，？可表示间隔符，auth_key1＝xxx可表示第一鉴权参数。可理解的是，第一鉴权参数例如为时间戳、UA、IP黑白名单、cookie、referer等防盗链参数，当然并不限于此。本公开通过将第一鉴权参数设置于请求头信息中或请求URL中，可有效降低第一鉴权参数暴露的风险，提高一次鉴权过程的安全性，以提高用户访问请求的安全性，提升用户满意度。
步骤S21，根据第一鉴权参数对第一用户访问请求进行鉴权。例如对时间戳、UA、IP黑白名单、cookie、referer等防盗链参数进行鉴权，当然并不限于此。跳转服务器对第一用户访问请求进行鉴权，鉴权失败则直接拒绝第一用户访问请求。
步骤S22，鉴权成功后向客户端发送第一响应消息，该第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数用于跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权，本公开实施例采用302重定向的方式为客户端响应跳转URL，当然也可采用其他重定向的方式，本公开对此不进行限制。本实施例中的第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中。本公开实施例中，若跳转服务器对第一鉴权参数鉴权成功，则向客户端响应第二鉴权参数以及跳转URL(Location，即边缘节点的位置)。通过将第二鉴权参数设置于响应头信息中或跳转URL中，本公开能够提高第二鉴权参数的安全性、极大增强被破解的难度；而且本公开通过将第二鉴权参数设置于跳转URL中，实现在跳转服务器中构造出携带有鉴权规则的URL，客户端零改造即可实现二次鉴权逻辑，进一步提高了用户访问请求的安全性。
在一示例性实施例中，本公开实施例鉴权成功后向客户端发送第一响应消息包括：若对第一鉴权参数鉴权成功，则通过加密算法对第二鉴权参数进行加密；向客户端发送包含经加密后的第二鉴权参数的第一响应消息。具体地，本公开实施例通过加密算法对第二鉴权参数进行加密包括：通过预设顺序对约定的附加参数以及时间戳、UA、IP黑白名单、cookie、referer中的至少一种组合成字符串，并利用加密算法对所述字符串进行加密，以得到加密后的第二 鉴权参数；其中，约定的附加参数包括随机数或事先约定好的参数；其中加密算法包括但不限于md5加密算法、base64加密算法等。本公开通过对第二鉴权参数进行加密的方式提高了第二鉴权参数破解难度，进一步避免了盗链行为，即使在客户端截获到加密后的第二鉴权参数，也极难得到第二鉴权参数所包含的具体内容，可见本公开具有安全性极高的优点。而且，本公开基于预设顺序对所选的参数进行组合而形成字符串，该方式进一步地提高了加密过程的复杂度和破解难度，提高第二鉴权参数安全性。
在一示例性实施例中，本公开实施例鉴权成功后向客户端发送第一响应消息包括：若对第一鉴权参数鉴权成功，则通过加密算法对跳转URL进行加密；向客户端发送包含经加密后的第二鉴权参数的第一响应消息；加密算法包括但不限于base64加密算法等，结合图4所示，本公开实施例具体可将边缘节点IP和auth_key2加密后组装至原URL，结合如上的实施例，组装后的内容例如为http://1.1.1.1/1.zip？bakey＝zzz，该内容既包含了即将重定向到的地址，即边缘节点的位置，又包含了第二鉴权参数。本公开实施例对跳转URL进行了加密，从而有效提高了跳转URL的破解难度，进而有效避免了盗链问题发生的可能性，所以本公开具有安全性极高的优点。
在一示例性实施例中，本公开实施例鉴权成功后向客户端发送第一响应消息之前还包括：根据第一鉴权参数、客户端位置信息、服务器服务质量信息、服务器排名信息、服务器缓存状态信息、成本信息中的至少一种确定跳转URL，例如，本公开能够根据客户端位置信息确定与客户端距离最近的跳转URL，从服务器服务质量最佳的边缘节点中确定跳转URL，从服务器排名较高的边缘节点中确定跳转URL，从服务器缓存状态良好的边缘节点中确定跳转URL，从成本较低的边缘节点中确定跳转URL，本公开跳转URL的筛选或选择策略可综合考虑如上的条件，当然并不限于此。其中，跳转URL表示边缘节点的地址信息，并包括但不限于边缘节点的标识信息、域名信息、IP地址中的至少一种。可见本公开能够从大量边缘节点中确定最合适的边缘节点，即确定最优跳转URL，本公开综合考虑了位置、服务质量、排名、缓存状态以及成本等多方面因素，达到用户访问请求的最优调度和均衡调度等目的。而且，本公开还通过一种或多种地址信息确定边缘节点的位置，该方式不仅能够丰富边缘节点地址的确定方式，而且避免了单一形式的边缘节点地址容易被盗链的问题。
基于二次鉴权的方式，本公开能够较好地解决现有技术存在的盗链问题，极大地降低用户配置资产暴露的风险，以提高用户数据的安全性和保护用户隐私，用户体验较佳、满意度较高。本公开可将配置信息下发到小颗粒边缘节点上，配置信息包括防盗链信息，并在小颗粒边缘节点上进行鉴权判断，以达到防盗链等技术目的。本公开具体在跳转服务器上进行一 次鉴权，根据一次鉴权成功收到该跳转服务器响应的边缘节点位置和第二鉴权参数，然后在对应的边缘节点上对第二鉴权参数进行一次鉴权，从而实现了两次鉴权，极大地避免了业务被盗链的可能性，保护了用户和网站的利益。本公开能够更好地适应分布式下沉服务器作为内容服务器的场景，内容服务器上无需用户配置的情况下也可实现URL双重鉴权，而且本公开无需用户手动在客户端进行操作，有效地加固了防盗链方案，并能够及时发现和处理盗链行为；另外，通过采用域名加密或参数加密的方式，本公开能够对域名信息、配置信息等用户资产进行全方位保护。
另外，本公开实施例中的跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种，本公开还通过一种或多种地址信息确定边缘节点的位置，该方式不仅能够丰富边缘节点地址的确定方式，而且避免了单一形式的边缘节点地址容易被盗链的问题
本公开通过跳转服务器进行一次鉴权和在鉴权通过后生成用于再次鉴权的参数以及确定对应的边缘节点，可见本公开通过双重鉴权极大避免了业务被盗连的可能性，提高了请求安全性，保护了用户和资源网站权益。
如图3所示，并可结合图4，本公开实施例还提供一种请求调度的方法，应用于边缘节点，该请求调度的方法可包括但不限于步骤S30～步骤S32，具体说明如下。
步骤S30，接收由客户端发出的第二用户访问请求，本公开中的第二用户访问请求包括第二鉴权参数。边缘节点和第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定，其中，第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中。结合图4所示，本公开实施例中的第二用户访问请求例如为http://1.1.1.1/1.zip？bakey＝zzz，该请求既包含了请求IP和请求内容，还包含了经过加密和组合处理的第二鉴权参数。通过将第二鉴权参数设置于响应头信息中或跳转URL中，本公开能够提高第二鉴权参数的安全性、极大增强被破解的难度；而且本公开通过将第二鉴权参数设置于跳转URL中，实现在跳转服务器中构造出携带有鉴权规则的URL，客户端零改造即可实现二次鉴权逻辑，进一步提高了用户访问请求的安全性。另外，本公开实施例中的跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种，本公开还通过一种或多种地址信息确定边缘节点的位置，该方式不仅能够丰富边缘节点地址的确定方式，而且避免了单一形式的边缘节点地址容易被盗链的问题。
步骤S31，根据第二鉴权参数对第二用户访问请求进行鉴权。鉴权的方式和规则既可以是边缘节点与跳转服务器事先约定的，或者通过第三方管理平台分别下发至边缘节点和跳转服务器的，当然也可以是边缘节点在收到第二鉴权参数后向跳转服务器进行实时请求和验证 的，在本公开公开内容基础上，可根据实际情况和需要确定二次鉴权的具体方式和规则，而无需用户配置，具体的鉴权规则和方式，本公开对此不进行限制。本公开通过边缘节点对第二用户访问请求进行鉴权：若鉴权失败，则直接拒绝，若鉴权成功则执行步骤32。
在一示例性实施例中，本公开实施例中根据第二鉴权参数对第二用户访问请求进行鉴权包括：根据通过加密算法进行加密后的第二鉴权参数对第二用户访问请求进行鉴权。应当理解的是，在鉴权之前边缘节点通过内置的解密模块对第二用户访问请求进行解密，解密方式与加密方式相对应，并可包括但不限于用于第二鉴权参数的md5解密方式以及用于跳转URL的base64解密方式等。
步骤S32，鉴权成功后向客户端发送第二响应消息，第二响应消息包括第二用户访问请求的资源。结合图4所示，本公开实施例中，如果边缘节点1.1.1.1缓存有第二用户访问请求所请求的内容，则将该缓存内容响应给客户端，但如果没有响应内容，则通过回源的方式获取响应内容，并将通过回源所获得的内容发送至客户端，以及将通过回源获取的内容缓存在当前的边缘节点上。
面对节点分布越来越广、节点粒度也在逐渐变小的情况，本公开通过跳转服务器和边缘节点的调度方案不仅更好地适应了技术发展，且通过增加二次鉴权方案保障即使边缘节点暴露也可以降低盗链风险等目的。本公开涉及的边缘节点例如是CDN(Content Delivery Network，内容分发网络)、SD-WAN(Software Defined Wide Area Network，软件定义局域网)或边缘云网络中的节点，在本实施例中作为用于提供资源的边缘节点使用。
基于二次鉴权的方式，本公开能够较好地解决现有技术存在的盗链问题，极大地降低用户配置资产暴露的风险，以提高用户数据的安全性和保护用户隐私，用户体验较佳、满意度较高。本公开可将配置信息下发到小颗粒边缘节点上，配置信息包括防盗链信息，并在小颗粒边缘节点上进行鉴权判断，以达到防盗链等技术目的。本公开具体在跳转服务器上进行一次鉴权，根据一次鉴权成功收到该跳转服务器响应的边缘节点位置和第二鉴权参数，然后在对应的边缘节点上对第二鉴权参数进行一次鉴权，从而实现了两次鉴权，极大地避免了业务被盗链的可能性，保护了用户和网站的利益。本公开能够更好地适应分布式下沉服务器作为内容服务器的场景，内容服务器上无需用户配置的情况下也可实现URL双重鉴权，而且本公开无需用户手动在客户端进行操作，有效地加固了防盗链方案，并能够及时发现和处理盗链行为；另外，通过采用域名加密或参数加密的方式，本公开能够对域名信息、配置信息等用户资产进行全方位保护。
与请求调度的方法基于同一发明技术构思，本公开实施例还能够提供一种请求调度的装 置，应用于客户端。该装置包括但不限于第一请求发送模块、第一消息接收模块、第二请求发送模块以及第二消息接收模块。
第一请求发送模块可用于向跳转服务器发送第一用户访问请求；第一用户访问请求包含第一鉴权参数，第一鉴权参数用于跳转服务器对客户端发送的第一用户访问请求进行鉴权。本公开实施例中，第一鉴权参数位于第一用户访问请求的请求头信息中或请求URL中。
第一消息接收模块可用于接收跳转服务器发送的第一响应消息；第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数用于边缘节点对客户端发送的第二用户访问请求进行鉴权。本实施例中，第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中。通过将第二鉴权参数设置于响应头信息中或跳转URL中，本公开能够提高第二鉴权参数的安全性、极大增强被破解的难度；而且本公开通过将第二鉴权参数设置于跳转URL中，实现在跳转服务器中构造出携带有鉴权规则的URL，客户端零改造即可实现二次鉴权逻辑，进一步提高了用户访问请求的安全性。
第二请求发送模块可用于向跳转URL对应的边缘节点发送包含第二鉴权参数的第二用户访问请求。
第二消息接收模块可用于接收边缘节点发送的第二响应消息，第二响应消息包括第二用户访问请求所请求的资源。
本公开能够显著提高客户端进行内容请求的安全性，较好地解决常规技术易出现的盗链问题，保护用户配置资产，提高用户数据的安全性，并提升了用户满意度和使用体验。
与请求调度的方法基于同一发明技术构思，本公开实施例还能够提供一种请求调度的装置，应用于跳转服务器。该装置包括但不限于第一请求接收模块、第一请求鉴权模块以及第一消息发送模块。
第一请求接收模块可用于接收由客户端发出的第一用户访问请求，第一用户访问请求包含第一鉴权参数。第一鉴权参数位于第一用户访问请求的请求头信息中或请求URL中。
第一请求鉴权模块可用于根据第一鉴权参数对第一用户访问请求进行鉴权。
第一消息发送模块可用于鉴权成功后向客户端发送第一响应消息，第一响应消息包括第二鉴权参数和跳转URL，第二鉴权参数用于跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。本公开实施例中的第一消息发送模块还可用于根据第一鉴权参数、客户端位置信息、服务器服务质量信息、服务器排名信息、服务器缓存状态信息、成本信息中的至少一种确定跳转URL，其中，跳转URL包括边缘节点的域名信息、IP地址中的至少一种。 第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中。通过将第二鉴权参数设置于响应头信息中或跳转URL中，本公开能够提高第二鉴权参数的安全性、极大增强被破解的难度；而且本公开通过将第二鉴权参数设置于跳转URL中，实现在跳转服务器中构造出携带有鉴权规则的URL，客户端零改造即可实现二次鉴权逻辑，进一步提高了用户访问请求的安全性。
该请求调度的装置还包括第一加密模块，第一加密模块用于在对第一鉴权参数鉴权成功的条件下通过加密算法对第二鉴权参数进行加密。第一加密模块具体用于通过预设顺序对约定的附加参数以及时间戳、UA、IP黑白名单、cookie、referer中的至少一种组合成字符串，并利用加密算法对所述字符串进行加密，以得到加密后的第二鉴权参数；；其中，约定的附加参数包括第一用户访问请求的请求头信息。第一消息发送模块用于向客户端发送包含经加密后的第二鉴权参数的第一响应消息。
该请求调度的装置还包括第二加密模块，第二加密模块用于在对第一鉴权参数鉴权成功的条件下通过加密算法对跳转URL进行加密。第一消息发送模块用于向客户端发送包含经加密后的跳转URL的第一响应消息。
本公开通过跳转服务器进行一次鉴权和在鉴权通过后生成用于再次鉴权的参数以及确定对应的边缘节点，可见本公开通过双重鉴权极大避免了业务被盗连的可能性，提高了请求安全性，保护了用户和资源网站权益。
与请求调度的方法基于同一发明技术构思，本公开实施例还能够提供一种请求调度的装置，应用于边缘节点。该装置包括但不限于第二请求接收模块、第二请求鉴权模块以及第二消息发送模块。
第二请求接收模块可用于接收由客户端发出的第二用户访问请求，第二用户访问请求包括第二鉴权参数；边缘节点和第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定。本公开实施例中的第二鉴权参数位于第一响应消息的响应头信息中或跳转URL中。
第二请求鉴权模块可用于根据第二鉴权参数对第二用户访问请求进行鉴权，第二请求鉴权模块具体可用于根据通过加密算法进行加密后的第二鉴权参数对第二用户访问请求进行鉴权。
第二消息发送模块可用于鉴权成功后向客户端发送第二响应消息，第二响应消息包括第二用户访问请求的资源。
基于二次鉴权的方式，本公开能够较好地解决现有技术存在的盗链问题，极大地降低用 户配置资产暴露的风险，以提高用户数据的安全性和保护用户隐私，用户体验较佳、满意度较高。
如图5所示，与请求调度的方法基于同一发明技术构思，本公开能够提供一种电子设备。该电子设备包括存储器和处理器，该存储器中存储有计算机可读指令，计算机可读指令被处理器执行时，使得处理器可执行本公开任一实施例中请求调度的方法的步骤。其中，请求调度的方法的详细过程已在本说明书中有详细的记载，此处不再进行赘述。
与请求调度的方法基于同一发明技术构思，本公开还可提供一种存储有计算机可读指令的存储介质，计算机可读指令被一个或多个处理器执行时，使得一个或多个处理器执行本公开任一实施例中的请求调度的方法的步骤。其中，请求调度的方法的详细过程已在本说明书中有详细的记载，此处不再进行赘述。
与请求调度的方法基于同一发明技术构思，本公开还可提供一种计算机程序产品，该计算机程序产品包括计算机程序，计算机程序被一个或多个处理器执行时实现本公开任一实施例中请求处理的方法的步骤。其中，请求调度的方法的详细过程已在本说明书中有详细的记载，此处不再进行赘述。
本领域技术人员应明白，本公开的实施例可提供为方法、装置(设备)、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质上实施的计算机程序产品的形式。计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质,包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质等。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
本公开是参照根据本公开实施例的方法、装置(设备)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在本公开中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括……”限定的要素，并不排除在包括所述要素的物品或者设备中还存在另外的相同要素。
尽管已描述了本公开的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本公开范围的所有变更和修改。
显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开的精神和范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开的意图也包含这些改动和变型在内。
工业实用性
本公开中基于二次鉴权的方式，能够较好地解决盗链问题，极大降低用户配置资产暴露的风险，以提高用户数据安全和保护用户隐私。

Claims (19)

  1. 一种请求调度的方法，应用于客户端，包括：
    向跳转服务器发送第一用户访问请求；所述第一用户访问请求包含第一鉴权参数，所述第一鉴权参数用于跳转服务器对客户端发送的所述第一用户访问请求进行鉴权；
    接收跳转服务器发送的第一响应消息；所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权；
    向所述边缘节点发送包含所述第二鉴权参数的第二用户访问请求；
    接收所述边缘节点发送的第二响应消息，所述第二响应消息包括第二用户访问请求所请求的资源。
  2. 根据权利要求1所述的请求调度的方法，其中，
    所述第一鉴权参数位于所述第一用户访问请求的请求头信息中或请求URL中；
    所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL中。
  3. 一种请求调度的方法，应用于跳转服务器，包括：
    接收由客户端发出的第一用户访问请求，所述第一用户访问请求包含第一鉴权参数；
    根据所述第一鉴权参数对所述第一用户访问请求进行鉴权；
    鉴权成功后向所述客户端发送第一响应消息，所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。
  4. 根据权利要求3所述的请求调度的方法，其中，所述鉴权成功后向所述客户端发送第一响应消息包括：
    若对所述第一鉴权参数鉴权成功，则通过加密算法对第二鉴权参数进行加密；
    向所述客户端发送包含经加密后的第二鉴权参数的第一响应消息。
  5. 根据权利要求4所述的请求调度的方法，其中，所述通过加密算法对第二鉴权参数进行加密包括：
    通过预设顺序对约定的附加参数以及时间戳、UA、I P黑白名单、cookie、referer中的至少一种组合成字符串，并利用加密算法对所述字符串进行加密，以得到加密后的第二鉴权参数；
    其中，所述约定的附加参数包括第一用户访问请求的请求头信息。
  6. 根据权利要求3所述的请求调度的方法，其中，所述鉴权成功后向所述客户端发送第 一响应消息包括：
    若对所述第一鉴权参数鉴权成功，则通过加密算法对跳转URL进行加密；
    向所述客户端发送包含经加密后的跳转URL的第一响应消息。
  7. 根据权利要求3所述的请求调度的方法，其中，所述鉴权成功后向所述客户端发送第一响应消息之前，还包括：
    根据第一鉴权参数、客户端位置信息、服务器服务质量信息、服务器排名信息、服务器缓存状态信息、成本信息中的至少一种确定所述跳转URL。
  8. 根据权利要求3所述的请求调度的方法，其中，
    所述跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种。
  9. 根据权利要求3所述的请求调度的方法，其中，
    所述第一鉴权参数位于所述第一用户访问请求的请求头信息中或请求URL中；
    所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL中。
  10. 一种请求调度的方法，应用于边缘节点，包括：
    接收由客户端发出的第二用户访问请求；所述第二用户访问请求包括第二鉴权参数；所述边缘节点和所述第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定；
    根据所述第二鉴权参数对所述第二用户访问请求进行鉴权；
    鉴权成功后向所述客户端发送第二响应消息，所述第二响应消息包括第二用户访问请求的资源。
  11. 根据权利要求10所述的请求调度的方法，其中，所述根据所述第二鉴权参数对所述第二用户访问请求进行鉴权包括：
    所述第一响应消息包括第二鉴权参数和跳转URL。
  12. 根据权利要求11所述的请求调度的方法，其中，
    所述跳转URL包括边缘节点的标识信息、域名信息、IP地址中的至少一种。
  13. 根据权利要求10所述的请求调度的方法，其中，
    所述第二鉴权参数位于所述第一响应消息的响应头信息中或所述跳转URL中。
  14. 一种请求调度的装置，应用于客户端，包括：
    第一请求发送模块，用于向跳转服务器发送第一用户访问请求；所述第一用户访问请求包含第一鉴权参数，所述第一鉴权参数用于跳转服务器对客户端发送的所述第一用户访问请求进行鉴权；
    第一消息接收模块，用于接收跳转服务器发送的第一响应消息；所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发 送的第二用户访问请求进行鉴权；
    第二请求发送模块，用于向所述边缘节点发送包含所述第二鉴权参数的第二用户访问请求；
    第二消息接收模块，用于接收所述边缘节点发送的第二响应消息，所述第二响应消息包括第二用户访问请求所请求的资源。
  15. 一种请求调度的装置，应用于跳转服务器，包括：
    第一请求接收模块，用于接收由客户端发出的第一用户访问请求，所述第一用户访问请求包含第一鉴权参数；
    第一请求鉴权模块，用于根据所述第一鉴权参数对所述第一用户访问请求进行鉴权；
    第一消息发送模块，用于鉴权成功后向所述客户端发送第一响应消息，所述第一响应消息包括第二鉴权参数和跳转URL，所述第二鉴权参数用于所述跳转URL对应的边缘节点对客户端发送的第二用户访问请求进行鉴权。
  16. 一种请求调度的装置，应用于边缘节点，包括：
    第二请求接收模块，用于接收由客户端发出的第二用户访问请求；所述第二用户访问请求包括第二鉴权参数；所述边缘节点和所述第二鉴权参数根据客户端从跳转服务器接收的第一响应消息确定；
    第二请求鉴权模块，用于根据所述第二鉴权参数对所述第二用户访问请求进行鉴权；
    第二消息发送模块，用于鉴权成功后向所述客户端发送第二响应消息，所述第二响应消息包括第二用户访问请求的资源。
  17. 一种电子设备，该电子设备包括存储器和处理器，所述存储器中存储有计算机可读指令，所述计算机可读指令被所述处理器执行时，使得所述处理器执行如权利要求1-2或3-9或10-13中任一项权利要求所述请求调度的方法的步骤。
  18. 一种存储有计算机可读指令的存储介质，所述计算机可读指令被一个或多个处理器执行时，使得所述一个或多个处理器执行如权利要求1-2或3-9或10-13中任一项权利要求所述请求调度的方法的步骤。
  19. 一种计算机程序产品，包括计算机程序，所述计算机程序被一个或多个处理器执行时实现如权利要求1-2或3-9或10-13中任一项权利要求所述请求处理的方法的步骤。
PCT/CN2022/133778 2021-11-24 2022-11-23 一种请求调度的方法、装置、电子设备及存储介质 WO2023093772A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111408140.9A CN116170164A (zh) 2021-11-24 2021-11-24 请求调度的方法、装置、电子设备及存储介质
CN202111408140.9 2021-11-24

Publications (1)

Publication Number Publication Date
WO2023093772A1 true WO2023093772A1 (zh) 2023-06-01

Family

ID=86416879

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/133778 WO2023093772A1 (zh) 2021-11-24 2022-11-23 一种请求调度的方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN116170164A (zh)
WO (1) WO2023093772A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117040746A (zh) * 2023-10-10 2023-11-10 联通在线信息科技有限公司 一种cdn客户端加密防盗链实现方法及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1992594A (zh) * 2005-12-31 2007-07-04 中兴通讯股份有限公司 一种适用于流媒体系统的url扩展方法
CN104283845A (zh) * 2013-07-03 2015-01-14 中国电信股份有限公司 防盗链方法和系统以及cdn服务器和客户端
CN105827673A (zh) * 2015-01-05 2016-08-03 中国移动通信集团浙江有限公司 一种防盗链的方法、装置及网络服务器
US20170149803A1 (en) * 2015-11-20 2017-05-25 International Business Machines Corporation Guarding against cross-site request forgery (CSRF) attacks
CN110365688A (zh) * 2019-07-19 2019-10-22 湖南快乐阳光互动娱乐传媒有限公司 防盗链方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1992594A (zh) * 2005-12-31 2007-07-04 中兴通讯股份有限公司 一种适用于流媒体系统的url扩展方法
CN104283845A (zh) * 2013-07-03 2015-01-14 中国电信股份有限公司 防盗链方法和系统以及cdn服务器和客户端
CN105827673A (zh) * 2015-01-05 2016-08-03 中国移动通信集团浙江有限公司 一种防盗链的方法、装置及网络服务器
US20170149803A1 (en) * 2015-11-20 2017-05-25 International Business Machines Corporation Guarding against cross-site request forgery (CSRF) attacks
CN110365688A (zh) * 2019-07-19 2019-10-22 湖南快乐阳光互动娱乐传媒有限公司 防盗链方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117040746A (zh) * 2023-10-10 2023-11-10 联通在线信息科技有限公司 一种cdn客户端加密防盗链实现方法及电子设备
CN117040746B (zh) * 2023-10-10 2024-02-27 联通在线信息科技有限公司 一种cdn客户端加密防盗链实现方法及电子设备

Also Published As

Publication number Publication date
CN116170164A (zh) 2023-05-26

Similar Documents

Publication Publication Date Title
CN106209749B (zh) 单点登录方法及装置、相关设备和应用的处理方法及装置
US7478434B1 (en) Authentication and authorization protocol for secure web-based access to a protected resource
US8275984B2 (en) TLS key and CGI session ID pairing
US7711647B2 (en) Digital rights management in a distributed network
CN107517179B (zh) 一种鉴权方法、装置和系统
CA2509206C (en) System for digital rights management using distributed provisioning and authentication
WO2016188290A1 (zh) Api调用的安全认证方法、装置、系统
CA2875255C (en) Policy service authorization and authentication
US11303431B2 (en) Method and system for performing SSL handshake
AU2016351458A1 (en) Methods and systems for PKI-based authentication
US20120284506A1 (en) Methods and apparatus for preventing crimeware attacks
US20140289839A1 (en) Resource control method and apparatus
US20090290715A1 (en) Security architecture for peer-to-peer storage system
US9172707B2 (en) Reducing cross-site scripting attacks by segregating HTTP resources by subdomain
CN109672675B (zh) 一种基于OAuth2.0的密码服务中间件的WEB认证方法
US10257171B2 (en) Server public key pinning by URL
US20130007867A1 (en) Network Identity for Software-as-a-Service Authentication
CN105429962B (zh) 一种通用的面向加密数据的中间网络服务构建方法与体系
CN111526161A (zh) 一种通信方法、通信设备及代理系统
US11451517B2 (en) Secure and auditable proxy technology using trusted execution environments
de Carné de Carnavalet et al. A Survey and Analysis of TLS Interception Mechanisms and Motivations: Exploring how end-to-end TLS is made “end-to-me” for web traffic
WO2023093772A1 (zh) 一种请求调度的方法、装置、电子设备及存储介质
US20130091355A1 (en) Techniques to Prevent Mapping of Internal Services in a Federated Environment
CN107026828A (zh) 一种基于互联网缓存的防盗链方法及互联网缓存
US20180324211A1 (en) System and method for prevening denial of service attacks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897855

Country of ref document: EP

Kind code of ref document: A1