CN110311907A - A kind of cloud platform instead chain method and apparatus - Google Patents

Abstract

The invention discloses a kind of cloud platform instead chain method and apparatus, comprising: monitor client and the first kind Http for the first kind page of cloud platform server requested, and from first kind Http request in parse the first identifier information of client；The first kind page of cloud platform server feedback is intercepted, the first information abstract based on first identifier information is added in the Http hyperlink editor of direction the second class page into the first kind page, and sends client for the edited first kind page；It monitors client to request the second class Http for the second class page of cloud platform server, and parses the second identifier information and first information abstract of client from the second class Http request；It determines the second informative abstract based on second identifier information, and mismatches and intercept the second class page of cloud platform server feedback in response to first information abstract and the second informative abstract.The solution of the present invention can perform effectively instead chain protection, reduce server load, promote safety and availability.

Description

A method and device for reverse chaining on a cloud platform

technical field

The present invention relates to the field of computers, and more specifically, to a cloud platform anti-chain method and device.

Background technique

A large number of websites are deployed to cloud services, and website hotlinking technology increases the load on cloud servers. In the prior art, a complete page is not sent to the client all at once. If the request is for a page with many pictures and other information, the first Http request is sent back the text of this page, and then the client's browser interprets and executes the text, and finds that there are For the image, the client's browser sends another Http request. When the request is processed, the image file will be sent to the client, and the browser will place the image in the correct position on the page. In this way, a complete page may be completely displayed by sending multiple Http requests. The hotlink problem is based on such a mechanism: if a website does not have the aforementioned information mentioned in the page, such as picture information, then it can completely connect this picture to other websites and use the resources of other websites to provide traffic for its website. In this way, a website without any resources uses the resources of other websites to display to viewers, increasing its traffic, but most viewers will not easily find out, which is obviously unfair to the website being used. In order to expand content without increasing costs, some unscrupulous websites often steal links from other websites. On the one hand, this damages the legitimate interests of the original website, and on the other hand, it increases the burden on the server.

The implementation principle of the reverse link in the prior art is as follows: the header field referer in the HTTP protocol adopts the URL format to indicate the link source of the current web page or file. In other words, the website can detect the source webpage of the accessed target webpage through the referer, or display the webpage address of the resource file. Once it is detected that the source is not this site, it can block or return to the specified page.

For the method of checking the referer, you can first enter another page of the destination address in the page middleware and then go to the destination page to crack it, so that the referer of the page is the resource site. There are many tools that can be used in this regard, especially mature web project testing packages, such as HtmlUnit, which can even freely set the referer directly in the request.

There is no effective solution to the problem that the referer detection in the prior art can no longer reverse the link.

Contents of the invention

In view of this, the purpose of the embodiment of the present invention is to propose a method and device for reverse chaining on a cloud platform, which can perform reverse chaining protection for different servers in the cloud platform or different visitors of the same server, reduce server load, improve security and availability.

Based on the above purpose, the first aspect of the embodiment of the present invention provides a cloud platform anti-chain method, including loading the cloud platform anti-chain module on the cloud platform server to perform the following steps:

Listening to the first type of Http request from the client to the cloud platform server for the first type of page, and parsing the first identification information of the client from the first type of Http request;

Intercepting the first type of page fed back by the cloud platform server, adding the first information abstract based on the first identification information to the Http hyperlink editing pointing to the second type of page in the first type of page, and sending the edited first type of page to the client;

Listening to the second type of Http request of the client to the cloud platform server for the second type of page, and parsing the second identification information and the first information summary of the client from the second type of Http request;

Determining the second information abstract based on the second identification information, and intercepting the second type of page fed back by the cloud platform server in response to verifying that the first information abstract and the second information abstract do not match.

In some implementations, the first type of pages includes guide pages that do not need to enable anti-linkage measures; the second type of pages include protected pages or protected page elements that need to enable anti-linkage measures.

In some implementations, the first identification information and the second identification information include an IP address and a pre-agreed keyword.

In some implementations, the first message digest and the second message digest include a hashed message authentication code.

In some embodiments, the method further includes: before listening to the first type of Http request from the client to the cloud platform server for the first type of page, first loading the keyword list storing all pre-agreed keywords.

In some embodiments, it also includes: while parsing out the second identification information of the client and the first information abstract from the second type of Http request, also parsing out the reference source information of the client; in response to determining that the reference source information does not point to The first type of page or the second type of page intercepts the second type of page fed back by the cloud platform server.

In some embodiments, the first identification information and the second identification information further include time-based information.

In some implementations, the second type of page includes a plurality of pieces of data that are scheduled to be acquired at different times; it also includes: responding to data requests for different pieces of data at different times, according to the data request and based on time-based information information summary to determine whether to intercept multiple shard data.

The second aspect of the embodiment of the present invention provides a cloud platform anti-chain device, which is set on the connection between the cloud platform server and the client, including:

The first collection module is used to listen to the first type of Http request of the client to the cloud platform server for the first type of page, and parse out the first identification information of the client from the first type of Http request;

The challenge module is used to intercept the first type of page fed back by the cloud platform server, edit the Http hyperlinks pointing to the second type of page in the first type of page, add the first information summary based on the first identification information, and edit the The first type of page is sent to the client;

The second acquisition module is used to listen to the second type of Http request of the client to the cloud platform server for the second type of page, and parse out the second identification information and the first information summary of the client from the second type of Http request;

The verification module is configured to determine the second information abstract based on the second identification information, and intercept the second type of page fed back by the cloud platform server in response to the mismatch between the first information abstract and the second information abstract.

A third aspect of the embodiments of the present invention provides a cloud computing management platform, including:

Cloud platform server;

processor; and

The memory stores the program code executable by the processor, and when the program code is executed, the above-mentioned reverse chaining method of the cloud platform is executed.

The present invention has the following beneficial technical effects: the cloud platform anti-link method and device provided by the embodiment of the present invention, by parsing the first identification information of the client from the first type of Http request, to the second type in the first type of page The Http hyperlink editing of the page adds the first information abstract based on the first identification information, parses the second identification information and the first information abstract of the client from the second type of Http request, and responds to the first information abstract and the second information abstract The technical solution of intercepting the second type of pages fed back by the cloud platform server without matching can perform anti-link protection for different servers in the cloud platform or different visitors of the same server, reduce server load, and improve security and availability.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic flow chart of the cloud platform reverse chain method provided by the present invention;

Fig. 2 is a detailed flow diagram of an embodiment of the cloud platform anti-chain method provided by the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are to distinguish two entities with the same name but different parameters or parameters that are not the same, see "first" and "second" It is only for the convenience of expression, and should not be construed as a limitation on the embodiments of the present invention, which will not be described one by one in the subsequent embodiments.

Based on the above purpose, the first aspect of the embodiments of the present invention proposes an embodiment of a method for performing reverse link protection for different servers in the cloud platform or different visitors of the same server. Fig. 1 shows a schematic flow chart of the cloud platform anti-chain method provided by the present invention.

Described cloud platform reverse chain method, as shown in Figure 1, comprises that cloud platform reverse chain module is loaded on the cloud platform server to perform the following steps:

Step S101: Listening to the first type of Http request from the client to the cloud platform server for the first type of page, and parsing the first identification information of the client from the first type of Http request;

Step S103: Intercept the first type of page fed back by the cloud platform server, edit and add the first information abstract based on the first identification information to the Http hyperlink pointing to the second type of page in the first type of page, and edit the first The class page is sent to the client;

Step S105: Listening to the second type of Http request from the client to the cloud platform server for the second type of page, and parsing the second identification information and the first information summary of the client from the second type of Http request;

Step S107: Determine the second information abstract based on the second identification information, and intercept the second type of page fed back by the cloud platform server in response to the mismatch between the first information abstract and the second information abstract.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct relevant hardware to complete. The program can be stored in a computer-readable storage medium, and the program can be executed when , may include the flow of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM) and the like. The computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

As shown in Figure 2, the present invention is installed on the server side of the website in the form of a module, and the configured keyword list is read in. When a user requests a page containing hyperlinks and other content, the patent module will add A field in the form of hmac=2FAB3C4E5242, the content of the field is encrypted according to the keywords set in advance and the client ip. When the user clicks a hyperlink to access, the server will analyze whether the link has an hmac field, and encrypt the keyword and ip, compare the encrypted content of hmac, if they are equal, the access is allowed, otherwise it is rejected.

In some implementations, the first type of pages includes guide pages that do not need to enable anti-linkage measures; the second type of pages include protected pages or protected page elements that need to enable anti-linkage measures.

Obviously, the client's information cannot be inherently known by the server, so it is necessary to have pages that do not need anti-backlink measures as a guide for accessing pages that need to be protected. On the other hand, it is true that not every page needs the protection of anti-backlink measures, such as the homepage. Generally speaking, backlink homepage is meaningless.

In some implementations, the first identification information and the second identification information include an IP address and a pre-agreed keyword.

The IP address is used to determine whether the same client accesses the first type of page and the second type of page. The IP used by the link-backer to steal the second type of page is obviously different from the IP of the client.

In some implementations, the first message digest and the second message digest include a hashed message authentication code.

The message digest is an irreversible encryption method, which effectively prevents the backlinker from using reverse engineering to modify meaningful information digests to deceive the server.

In some implementations, before listening to the client's first type of Http request to the cloud platform server for the first type of page, the keyword list storing all pre-agreed keywords is first loaded.

In some implementations, while parsing out the second identification information of the client and the first information summary from the second type of Http request, the reference source information of the client is also parsed out; in response to determining that the reference source information does not point to the first type Pages or second-type pages that intercept the second-type pages fed back by the cloud platform server.

The server can enable the traditional referer detection mode while using the cloud platform anti-chain method of the embodiment of the present invention. The referer detection can be set before the reverse link method of the cloud platform, because the referer detection is easy to implement, this method can not improve the reverse link effect, but can further reduce resource consumption, and achieve the same effect as the reverse link in the case of low-level frequent link reverse Effect.

In some embodiments, the first identification information and the second identification information further include time-based information.

In some embodiments, the second type of page includes a plurality of pieces of data scheduled to be acquired at different times; in response to data requests for different pieces of data at different times, according to the data request and based on the information summary based on time-varying information To determine whether to intercept multiple fragmented data.

Adding information based on time changes, such as timestamps, makes each hyperlink have a limited life cycle, which can further improve the effect of backlinks, especially for video streaming backlinks.

The method disclosed according to the embodiment of the present invention can also be implemented as a computer program executed by a CPU, and the computer program can be stored in a computer-readable storage medium. When the computer program is executed by the CPU, the above functions defined in the methods disclosed in the embodiments of the present invention are executed. The above method steps and system units can also be implemented by using a controller and a computer-readable storage medium for storing a computer program that enables the controller to realize the functions of the above steps or units.

As can be seen from the foregoing embodiments, the cloud platform anti-linking method provided by the embodiment of the present invention, by parsing the first identification information of the client from the first type of Http request, sends the first identification information to the second type of page in the first type of page The Http hyperlink editor adds the first information abstract based on the first identification information, parses out the second identification information and the first information abstract of the client from the second type of Http request, and responds to verifying that the first information abstract and the second information abstract are not The technical solution of matching and intercepting the second type of page fed back by the cloud platform server can perform backlink protection for different servers in the cloud platform or different visitors of the same server, reduce server load, and improve security and availability.

It should be pointed out that each step in each embodiment of the above-mentioned cloud platform anti-chain method can be crossed, replaced, added, and deleted. Therefore, these reasonable permutations and combinations should also belong to the cloud platform anti-chain method. protection scope of the invention and should not be limited to the examples described.

Based on the above purpose, the second aspect of the embodiments of the present invention proposes an embodiment of an apparatus for implementing anti-link protection for different servers in the cloud platform or different visitors of the same server. The cloud platform anti-chain device is set on the connection between the cloud platform server and the client, including:

The first collection module is used to listen to the first type of Http request of the client to the cloud platform server for the first type of page, and parse out the first identification information of the client from the first type of Http request;

The challenge module is used to intercept the first type of page fed back by the cloud platform server, edit the Http hyperlinks pointing to the second type of page in the first type of page, add the first information summary based on the first identification information, and edit the The first type of page is sent to the client;

The second acquisition module is used to listen to the second type of Http request of the client to the cloud platform server for the second type of page, and parse out the second identification information and the first information summary of the client from the second type of Http request;

The verification module is configured to determine the second information abstract based on the second identification information, and intercept the second type of page fed back by the cloud platform server in response to the mismatch between the first information abstract and the second information abstract.

The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described generally in terms of their functionality. Whether such functionality is implemented as software or as hardware depends upon the particular application and design constraints imposed on the overall system. Those skilled in the art can implement the described functions in various ways for each specific application, but such implementation decisions should not be interpreted as causing a departure from the scope of the disclosed embodiments of the present invention.

Based on the above purpose, the third aspect of the embodiments of the present invention proposes an embodiment of a cloud computing management platform that implements backlink protection for different servers in the cloud platform or different visitors of the same server. The cloud computing management platform includes:

Cloud platform server;

processor; and

The memory stores the program code executable by the processor, and when the program code is executed, the above-mentioned reverse chaining method of the cloud platform is executed.

As can be seen from the foregoing embodiments, the cloud platform anti-chaining device and the cloud computing management platform provided by the embodiments of the present invention, by parsing the first identification information of the client from the first type of Http request, to the pointing information in the first type of page The Http hyperlink editing of the second type of page adds the first information abstract based on the first identification information, parses the second identification information and the first information abstract of the client from the second type of Http request, and responds to the first information abstract and the first information abstract The technical solution of intercepting the second type of page fed back by the server of the cloud platform because the two information summaries do not match can perform backlink protection for different servers in the cloud platform or different visitors of the same server, reduce server load, and improve security and usability.

It should be pointed out that the above-mentioned embodiment of the cloud platform anti-chain device and cloud computing management platform adopts the embodiment of the cloud platform anti-chain method to specifically illustrate the working process of each module. Those skilled in the art can easily think, These modules are applied to other embodiments of the cloud platform anti-chain method. Of course, since each step in the embodiment of the cloud platform anti-chain method can intersect, replace, increase, and delete each other, these reasonable permutations and combinations are different from the cloud platform anti-chain device and cloud computing management platform. It should also belong to the protection scope of the present invention, and the protection scope of the present invention should not be limited to the embodiments.

The above are the exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications can be made without departing from the scope of the disclosed embodiments of the present invention defined in the claims. The functions, steps and/or actions of the method claims in accordance with the disclosed embodiments described herein need not be performed in any particular order. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in an individual form, they may also be understood as a plurality unless explicitly limited to a singular number.

It should be understood that as used herein, the singular form "a" and "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that "and/or" as used herein is meant to include any and all possible combinations of one or more of the associated listed items. The serial numbers of the embodiments disclosed in the above-mentioned embodiments of the present invention are only for description, and do not represent the advantages and disadvantages of the embodiments.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware, and can also be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium. The above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

Those of ordinary skill in the art should understand that: the discussion of any of the above embodiments is exemplary only, and is not intended to imply that the scope (including claims) disclosed by the embodiments of the present invention is limited to these examples; under the idea of the embodiments of the present invention , technical features in the above embodiments or in different embodiments can also be combined, and there are many other changes in different aspects of the embodiments of the present invention as described above, which are not provided in details for the sake of brevity. Therefore, within the spirit and principle of the embodiments of the present invention, any omissions, modifications, equivalent replacements, improvements, etc., shall be included in the protection scope of the embodiments of the present invention.

Claims (10)

1. a cloud platform anti-chain method, is characterized in that, comprises the cloud platform anti-chain module loaded on the cloud platform server to perform the following steps: Listening to the first type of Http request of the client to the cloud platform server for the first type of page, and parsing the first identification information of the client from the first type of Http request; Intercepting the first type of page fed back by the cloud platform server, adding the first information abstract based on the first identification information to the Http hyperlink editing pointing to the second type of page in the first type of page, and editing the edited The first type of page is sent to the client; Listening to the second type of Http request of the client to the cloud platform server for the second type of page, and parsing the second identification information of the client and the first information abstract from the second type of Http request; Determining a second information abstract based on the second identification information, and intercepting the second type of page fed back by the cloud platform server in response to a mismatch between the first information abstract and the second information abstract. 2. The method according to claim 1, wherein the first type of pages includes guide pages that do not need to enable anti-linking measures; the second type of pages includes protection pages or protected pages that need to enable anti-linking measures element. 3. The method according to claim 1, wherein the first identification information and the second identification information include an IP address and a pre-agreed keyword. 4. The method according to claim 3, wherein the first message digest and the second message digest comprise hashed message authentication codes. 5. The method according to claim 3, further comprising: before listening to the first type Http request of the client to the cloud platform server for the first type of page, first loading and storing all pre-agreed A keyword list of said keywords for . 6. The method according to claim 1, further comprising: While parsing out the second identification information and the first information abstract of the client from the second type of Http request, also parse out the reference source information of the client; In response to determining that the reference source information does not point to the first type of page or the second type of page, intercept the second type of page fed back by the cloud platform server. 7. The method according to claim 3, wherein the first identification information and the second identification information further include time-based information. 8. The method according to claim 7, wherein the second type of page includes multiple pieces of data scheduled to be acquired at different times; It also includes determining whether to intercept the plurality of pieces of data in response to data requests for different pieces of data at different times according to the data requests and the information digest based on the time-varying information. 9. A cloud platform anti-chain device, characterized in that it is set on the connection between the cloud platform server and the client, including: The first collection module is used to listen to the first type of Http request of the client to the cloud platform server for the first type of page, and parse out the first identification information of the client from the first type of Http request; The challenge module is used to intercept the first type of page fed back by the cloud platform server, and edit and add the first information abstract based on the first identification information to the Http hyperlink editing pointing to the second type of page in the first type of page , and send the edited first type of page to the client; The second collection module is used to listen to the second type of Http request of the client to the cloud platform server for the second type of page, and parse out the second identification information of the client and the first type from the second type of Http request. information summary; A verification module, configured to determine a second information summary based on the second identification information, and intercept the second type of page fed back by the cloud platform server in response to a mismatch between the first information summary and the second information summary . 10. A cloud computing management platform, characterized in that, comprising: Cloud platform server; processor; and The memory stores program code executable by the processor, and when the program code is executed, the cloud platform reverse chaining method according to any one of claims 1-8 is executed.