CN105357190A - Method and system for performing authentication on access request - Google Patents

Abstract

The invention discloses a method and system for access request authentication. Wherein, the method includes: the CDN server receives the access request of the access terminal, wherein the access request includes at least a first identifier for identifying the access request; if the first identifier is found in the local cache of the CDN server, the CDN server locally The access request is authenticated, wherein the authentication is used to determine the legitimacy of the access request; if the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to the authentication server for authentication. The invention solves the technical problem that the existing back-to-source authentication anti-hotlinking method only relies on the authentication server to identify hotlinking requests in any case, resulting in excessive load on the authentication server.

Description

Method and system for access request authentication

technical field

The present invention relates to the computer field, in particular to a method and system for access request authentication.

Background technique

With the development of streaming media technology, hotlinking behavior of streaming media is becoming more and more rampant, and the means are becoming more and more sophisticated. Hotlinkers place video resources of other streaming media manufacturers on their own websites to steal video copyrights of regular manufacturers. This behavior will not only cause copyright infringement, but also cause problems such as bandwidth resource exhaustion and server crashes. Video service providers Often methods such as back-to-source authentication and embedding processing modules in the player are used to identify hotlinking requests, and then deny access to hotlinking requests.

It should be noted that the above-mentioned existing anti-leech solutions often have the following problems:

(1) The anti-leeching method of back-to-source authentication only relies on the authentication server to identify the hotlinking request in any case, resulting in an excessive load on the authentication server.

(2) The scheme of encrypting video by embedding a processing module in the player needs to redevelop the player, which consumes resources, and with the complexity of the algorithm, the degree of dependence on hardware is also relatively large.

(3) The above-mentioned anti-leeching scheme will directly reject the hotlinking request when it recognizes the hotlinking request. The consequence of this is that the hotlinking person will soon know that his hotlinking behavior is unreasonable, and then he will do it quickly Out of re hotlinking strategy.

(4) The accuracy rate of the existing access request authentication scheme is low, which easily leads to misjudgment of a legitimate access request as an illegal access request.

For the above-mentioned existing back-to-source authentication anti-hotlinking methods, in any case, only rely on the authentication server to identify the hotlinking request, resulting in the technical problem of excessive load on the authentication server, and no effective solution has been proposed yet.

Contents of the invention

The embodiment of the present invention provides a method and system for access request authentication, to at least solve the problem that the existing back-to-source authentication anti-leech method only relies on the authentication server to identify the hotlink request in any case, resulting in A technical problem with the overload of the authentication server.

According to an aspect of an embodiment of the present invention, a method for authenticating an access request is provided, the method including: a CDN server receiving an access request from an access terminal, where the access request includes at least a first identifier for identifying the access request; if When the first identifier is found in the local cache of the CDN server, the CDN server authenticates the access request locally, wherein the authentication is used to determine the legitimacy of the access request; if the first identifier is not found in the local cache of the CDN server ID, the CDN server sends the access request to the authentication server for authentication.

According to another aspect of the embodiments of the present invention, there is also provided an access request authentication system, the system includes: a client, configured to send an access request of an access terminal, wherein the access request is at least used to identify the first One identifier; the CDN server is used to receive the access request. If the first identifier is found in the local cache of the CDN server, the CDN server will authenticate the access request locally. If the first identifier is not found in the local cache of the CDN server ID, the CDN server forwards the access request, where authentication is used to determine the legitimacy of the access request; the authentication server establishes a communication relationship with the CDN server, and authenticates the access request forwarded by the CDN server.

In this embodiment of the present invention, a CDN server is used to receive an access request from an access terminal, wherein the access request includes at least a first identifier used to identify the access request; if the first identifier is found in the local cache of the CDN server, the CDN server will Locally authenticate the access request, where the authentication is used to determine the legitimacy of the access request; if the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to the authentication server for authentication. It solves the technical problem that the existing back-to-source authentication anti-leeching method only relies on the authentication server to identify the hotlinking request in any case, resulting in an excessive load on the authentication server.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a flowchart of a method for access request authentication according to Embodiment 1 of the present invention;

FIG. 2 is a flow chart of an optional access request authentication method according to Embodiment 1 of the present invention;

FIG. 3 is a flow chart of an optional access request authentication method according to Embodiment 1 of the present invention; and

Fig. 4 is a schematic diagram of an access request authentication system according to Embodiment 2 of the present invention.

detailed description

In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

Embodiment one

According to an embodiment of the present invention, an embodiment of a method for access request authentication is provided. It should be noted that the steps shown in the flow chart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, Also, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

Fig. 1 is a flow chart of a method for access request authentication according to an embodiment of the present invention. As shown in Fig. 1, the method includes the following steps:

In step S12, the CDN server receives the access request from the access terminal, where the access request includes at least a first identifier for identifying the access request.

Specifically, in this solution, the above-mentioned access request may be a URL request, and the above-mentioned first identifier may be an ID contained in the URL request, and the ID is used to identify each access request of the user, and the ID may be generated through the following scheme : When the user accesses the CDN server through the client, the above client can encrypt the URI, timestamp, random number string and KEY of the user's access request using an irreversible encryption algorithm to generate an ID for identifying the above URL request, and then send the The above ID, the timestamp of the plain text and the random number string are inserted behind the URL domain name to generate a unique resource request URL, and then the client sends the resource request URL containing the above ID to the CDN server. It should be noted that, The CDN server in this application may be a CDN node server or a CDN edge server.

It should be noted that the method for generating the ID of the URL request is not limited to the above method, and the ID generation scheme only needs to achieve the uniqueness of the ID.

For example, user A accesses the CDN server through a client (legal client or illegal client), and the URL of user A's access request received by the CDN server includes ID, timestamp, and random number string identifying the access request. User A's access request URL can be the following example: http://wstest.com.cn/a.flv? k=68b329da9893e34099c7d8ad5cb9c940&t=554afcb4&UID=11111111; k is a unique ID, where t is a timestamp, and UID is a random string). What needs to be explained here is that if user A accesses the CDN server through a legal client (such as a portal website), the URL request received by the CDN server is generated by the above-mentioned legal client for the user's access request. When an illegal client (third-party hotlink website) accesses the CDN server, the URL request received by the CDN server is stolen or forged by the illegal client.

It should be noted that the solution of this application only needs to carry out lightweight development on the system client, and does not need to make any changes to the code structure and business logic in the CDN source server. The player in the client can initiate the use of md5sum (time stamp + random number string + KEY) is used as a request for a random directory, so in this solution, the player only needs to do lightweight development, which saves resources for developers.

Step S14, if the first identifier is found in the local cache of the CDN server, the CDN server locally authenticates the access request, where the authentication is used to determine the legitimacy of the access request.

Specifically, in this solution, the above-mentioned CDN server can first query from the local cache, and if the above-mentioned ID is found in the local cache, the above-mentioned CDN server will follow the preset authentication strategy for the user's current access request Perform authentication, that is, determine whether the above-mentioned user's access request is a legal access request or a hotlink access request.

It should be noted that if any user has accessed the CDN server through a normal client (such as a portal website) before, the ID of the legitimate user's access request and the ID corresponding to the ID of the legitimate user's access request will be cached in the CDN server. The IP address of the access terminal, so in the above step S14, if the ID of the access request of the legal user is stored in the local cache of the CDN server, the CDN server can be used to identify the legitimacy of the access request.

Step S16, if the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to the authentication server for authentication.

Specifically, in this solution, if there is no first identifier in the local cache of the CDN server, the CDN server will initiate an authentication request to the authentication server, and the authentication server will authenticate the access request.

In this embodiment, the access request of the access terminal is first received by the CDN server, wherein the access request includes at least a first identifier used to identify the access request; if the first identifier is found in the local cache of the CDN server, the CDN server locally performs the access Request for authentication, where the authentication is used to determine the legitimacy of the access request; if the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to the authentication server for authentication, which solves the problem Some anti-leeching methods for back-to-source authentication only rely on the authentication server to identify the hotlinking request under any circumstances, causing the problem of excessive load on the authentication server.

It should be noted that this solution adopts the mode of local CDN node server judgment + authentication server judgment, which can effectively reduce the pressure on the authentication server.

Optionally, the above-mentioned access request may also include the IP address of the access terminal. In step S14, if the first identifier is found in the local cache of the CDN server, the step of the CDN server authenticating the access request locally may include:

In step S141, the CDN server determines whether at least one IP address cached locally includes the IP address of the access terminal, where at least one IP address has a corresponding relationship with the first identifier.

Step S142, in the case of including, the CDN server determines that the access request is a legitimate request.

Step S143, if not included, the CDN server determines that the access request is a hotlink request.

Specifically, in this solution, at least one IP address in the above step S141 is a plurality of IP addresses cached in the CDN server after the legal user sends a resource request to the CDN server through a legal client before. It should be noted that, At least one IP address cached in the CDN server has a corresponding relationship with the first identification (ID). In the cache of the CDN server, multiple IP addresses and the first identifiers (IDs) corresponding to multiple IP addresses are legal. Therefore, after receiving the current user's access request, the CDN server first judges the user's access request ID is the same as the ID cached in the CDN server. In the same case, the CDN server can determine whether the IP address of the current user's access request is the same as the cached IP address. In the same case, the authentication By stating that the current access request is a legitimate request, if the IP address is different, it means that the current access request is an illegal hotlinking request, and the authentication fails. It should be noted that in the cache of the CDN server, a legal ID can Corresponding to multiple IP addresses, as long as the IP address of the user's current access request is included in the above multiple IP addresses, it means that the user's current access request is a legal request, which can avoid misjudgment of the access request due to multiple exit IPs .

What needs to be explained here is that when the ID of the current access request is cached in the CDN server, it does not necessarily mean that the current access request must be a legitimate access request, because the ID may be forged or stolen by the client of the current access user. Preferably, the ID cached in the CDN server and the corresponding multiple IP addresses are legal access requests, therefore, the CDN server can further determine whether the actual IP address of the current access request belongs to the above-mentioned multiple IP addresses.

Optionally, in step S16, if the first identifier is not found in the local cache of the CDN server, the step of the CDN server sending the access request to the authentication server for authentication may include:

Step S161, if the first identifier is not found in the local cache of the authentication server, the authentication server determines that the access request is a legitimate request, and caches the correspondence between the first identifier and the IP address of the access terminal.

Specifically, in this solution, the CDN server can send the current access request (this access request) to the authentication server, and the authentication server will authenticate the current access request. If there is no If the ID of the current access request is found, it means that the current access request is the first access, and the first access request will not be a hotlink request. Therefore, the authentication server determines that the first access request is not a legal request, and caches the ID of the first access And the corresponding relationship between the IP addresses of the access terminals.

Step S162, if the first identifier is found in the local cache of the authentication server, the authentication server judges whether at least one IP address in the local cache includes the IP address of the access terminal, wherein at least one IP address has a correspondence with the first identifier relationship; in the case of including, the authentication server determines that the access request is a legitimate request; in the case of not including, the authentication server determines that the access request is a hotlinking request.

Specifically, in this solution, at least one IP address in the above step S162 may be the legal IP address cached in other CDN servers after the legal user sends a resource request to other CDN servers in the CDN distribution network through a legal client. , and then other CDN servers send the ID of the legal access request and at least one IP address corresponding to the ID to the cache of the authentication server. It should be noted that the ID cached in the authentication server has a corresponding relationship with at least one IP address. In the cache of the authentication server, the ID and at least one corresponding IP address are legal. Therefore, after receiving the current access request forwarded by the current CDN server, the authentication server first judges the ID and authentication of the user's current access request. Whether the ID cached in the server is the same, in the same case, the authentication server can judge whether the IP address of the current user's access request is the same as the cached IP address, in the same case, the authentication passes, indicating that the current The access request is a legal request. If the IP addresses are different, it means that the current access request is an illegal hotlinking request, and the authentication fails. It should be noted that in the cache of the authentication server, a legal ID can correspond to multiple IP addresses. As long as the IP address of the user's current access request is included in the above-mentioned multiple IP addresses, it means that the user's current access request for legitimate requests.

Optionally, in step S16, if the first identifier is not found in the local cache of the CDN server, after the CDN server sends the access request to the authentication server for authentication, the method provided in this embodiment may further include:

Step S17, the authentication server sends the authentication result to the CDN server, wherein the authentication result at least includes: the IP address of the access terminal requesting hotlinking and the IP address of the access terminal requesting legally.

Specifically, in this solution, if the authentication server fails to authenticate the current access request, the IP address of the access terminal requested by hotlinking is sent to the CDN server. If the authentication server authenticates the current access request In the case of passing, the authentication server will also send the IP address of the legally requested access terminal to the CDN server, and the CDN server will process the current access request.

Optionally, after the authentication server sends the authentication result to the CDN server in step S17, the method provided in this embodiment may further include:

In step S18, the CDN server limits the speed or denies access to the IP address of the access terminal requesting hotlinking.

Specifically, in this solution, the CDN server can normally feed back resources to legally requested IP addresses, and reject illegal hotlinking requests.

In a preferred embodiment, the CDN server does not directly deny access to the IP address of the hotlinking request, but limits the speed, which can play a role in confusing the hotlinking person, making the hotlinking person think that the hotlinking is successful, and can Directly combat hotlinkers' website user experience.

Below this application combines Figure 2 to Figure 3 to describe this solution in a practical application scenario:

This scheme can be applied to a system for preventing illegal hotlinking, and the system for preventing illegal hotlinking may include a client, a CDN server, and an authentication server. The client sends an access request to the CDN node server. The CDN server can authenticate the access request and respond to the client. The client can also forward the access request to the authentication server. The authentication server performs authentication. The access request is authenticated, and the authentication result is fed back to the CDN server, and the CDN server responds to the client according to the authentication result.

Specifically, the client can initiate a URL request with a unique ID (an ID generated by encrypting URI+time stamp+random number string+KEY using an irreversible encryption algorithm), a plaintext timestamp, and a random number string as a directory. On the basis of the CDN distribution function, the CDN server realizes that the edge server locally judges and processes the URL, initiates authentication and processes the authentication result. The authentication server is mainly responsible for judging the authentication request initiated by the CDN edge server module, and delivering the judgment result.

Referring to Figure 2, the steps for the CDN server to authenticate the access request are as follows:

Step S30, the CDN server receives the client's access request.

Step S31, the CDN server judges whether the encryption format in the URL in the access request is correct and whether the timestamp is valid, and if the encryption is incorrect or the timestamp is invalid, execute step S32, and if the encryption format is correct and the timestamp is valid, Execute step S33.

Specifically, the above step S31 performs a time error anti-leeching check on the URL of the access request, mainly including checking whether the encrypted string of the unique ID is correct and whether the time stamp is expired.

Step S32, rejecting the client's access. It should be noted that if the encrypted format or time stamp of the URL of the access request is incorrect, it means that the hotlinking method of the hotlinker is not clever, and the CDN server directly rejects the client's access request .

Step S33, the CDN server judges whether the local cache caches the correspondence between the ID and the IP address, if yes, execute step S34, and if no, execute step S35.

It should be noted that the above-mentioned ID is the ID carried in the URL of the user's access request.

Step S34, the CDN server judges whether the ID and IP address in the local cache are the same as the ID and IP address carried in the URL of the access request, if they are the same, execute step S341, and if not, execute step S342.

Step S341, the authentication passes, and the client responds normally.

Step S342, if the authentication fails, limit the speed of the client

Step S35, the CDN server sends the access request to the authentication server, and the authentication server authenticates the access request.

Specifically, if the correspondence between the ID and IP carried by the URL of the access request is not locally cached in the CDN server, the CDN server initiates an authentication request to the authentication server, and checks the correspondence between the ID and IP carried by the URL. Do local cache processing at the CDN edge node.

Step S36, the CDN server receives the authentication result fed back by the authentication server, and responds to the client according to the authentication result.

Specifically, if the authentication result responded by the authentication server is that the authentication fails, the CDN edge node performs rate-limiting processing on the content responded to the client. Specifically, if the authentication result responded by the authentication server is that the authentication is passed, the CDN server normally responds with content to the client.

As shown in Figure 3, the steps for the authentication server to authenticate the access request may be as follows:

Step S40, the authentication server receives the authentication request sent by the CDN server.

In step S41, the authentication server judges whether the corresponding relationship between the ID and the IP of the access request is cached locally, if yes, execute step S42, and if no, execute step S43.

It should be noted that the above-mentioned ID is the ID carried in the URL of the user's access request.

Step S42, if the ID and IP address cached in the authentication server are the same as the ID and IP address carried in the URL of the access request, execute step S421, and if they are different, execute step S422.

In step S421, the authentication passes, and the authentication server sends the authentication result to the CDN server.

Step S422, the authentication fails, and the authentication server sends the authentication result to the CDN server.

Step S43, when the authentication is passed, the authentication server caches the correspondence between the ID carried in the URL of the access request and the IP address.

Step S44, the authentication server sends the authentication result to the CDN server.

Embodiment two

The embodiment of the present invention also provides a system for access request authentication, the system can be used to implement the method of the first embodiment above, as shown in Figure 4, the system can include: a client 20, a CDN server 22 and an authentication server 24.

The client 20 is configured to send an access request of the access terminal, where the access request is at least used to identify a first identifier of the access request.

The CDN server 22 is used to receive the access request. If the first identifier is found in the local cache of the CDN server, the CDN server locally authenticates the access request. If the first identifier is not found in the local cache of the CDN server, The CDN server forwards the access request, wherein the authentication is used to determine the legitimacy of the access request.

Specifically, in this solution, the above-mentioned access request may be a URL request, and the above-mentioned first identifier may be an ID contained in the URL request, and the ID is used to identify each access request of the user, and the ID may be generated through the following scheme : When the user accesses the CDN server through the client, the above client can encrypt the URI, timestamp, random number string and KEY of the user's access request using an irreversible encryption algorithm to generate an ID for identifying the above URL request, and then send the The above ID, the timestamp of the plain text and the random number string are inserted behind the URL domain name to generate a unique resource request URL, and then the client sends the resource request URL containing the above ID to the CDN server. It should be noted that, The CDN server in this application may be a CDN node server or a CDN edge server.

It should be noted that the method for generating the ID of the URL request is not limited to the above method, and the ID generation scheme only needs to achieve the uniqueness of the ID.

For example, user A accesses the CDN server through a client (legal client or illegal client), and the URL of user A's access request received by the CDN server includes ID, timestamp, and random number string identifying the access request. User A's access request URL can be the following example: http://wstest.com.cn/a.flv? k=68b329da9893e34099c7d8ad5cb9c940&t=554afcb4&UID=11111111; k is a unique ID, where t is a timestamp, and UID is a random string). What needs to be explained here is that if user A accesses the CDN server through a legal client (such as a portal website), the URL request received by the CDN server is generated by the above-mentioned legal client for the user's access request. When an illegal client (third-party hotlink website) accesses the CDN server, the URL request received by the CDN server is stolen or forged by the illegal client.

It should be noted that the solution of this application only needs to carry out lightweight development on the system client, and does not need to make any changes to the code structure and business logic in the CDN source server. The player in the client can initiate the use of md5sum (time stamp + random number string + KEY) is used as a request for a random directory, so in this solution, the player only needs to do lightweight development, which saves resources for developers.

Optionally, in this solution, the above-mentioned CDN server can first query from the local cache, and if the above-mentioned ID is found in the local cache, the above-mentioned CDN server will follow the preset authentication strategy for the user's current visit Request authentication, that is, to determine whether the above-mentioned user's access request is a legal access request or a hotlink access request.

It should be noted that if any user has accessed the CDN server through a normal client (such as a portal website) before, the ID of the legitimate user's access request and the ID corresponding to the ID of the legitimate user's access request will be cached in the CDN server. The IP address of the access terminal, so in the above step S14, if the ID of the access request of the legitimate user is stored in the local cache of the CDN server, the CDN server can be used to identify the legitimacy of the access request. If the local cache of the CDN server The ID of the access request of the legitimate user is stored in the cache, and the CDN server forwards the access request.

The authentication server 24 establishes a communication relationship with the CDN server, and authenticates the access request forwarded by the CDN server.

Specifically, in this solution, if there is no first identifier in the local cache of the CDN server, the CDN server will initiate an authentication request to the authentication server, and the authentication server will authenticate the access request.

In this embodiment, the access request of the access terminal is first received by the CDN server, wherein the access request includes at least a first identifier used to identify the access request; if the first identifier is found in the local cache of the CDN server, the CDN server locally performs the access Request for authentication, where the authentication is used to determine the legitimacy of the access request; if the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to the authentication server for authentication, which solves the problem Some anti-leeching methods for back-to-source authentication only rely on the authentication server to identify the hotlinking request under any circumstances, causing the problem of excessive load on the authentication server.

Optionally, the access request further includes the IP address of the access terminal, wherein the CDN server 22 may include: a first processor configured to determine whether at least one IP address cached locally includes the IP address of the access terminal, wherein at least one The IP address has a corresponding relationship with the first identifier; if it is included, the CDN server determines that the access request is a legal request; if it is not included, the CDN server determines that the access request is a hotlinking request.

Optionally, the authentication server may further include: a second processor, if the first identifier is not found in the local cache of the authentication server, the authentication server determines that the access request is a legal request, and caches the first identifier and the access request. The corresponding relationship between the IP addresses of the terminals; if the first identifier is found in the local cache of the authentication server, the authentication server judges whether at least one IP address in the local cache includes the IP address of the access terminal, wherein at least one IP The address has a corresponding relationship with the first identifier; if it is included, the authentication server determines that the access request is a legitimate request; if it is not included, the authentication server determines that the access request is a hotlinking request.

Optionally, the authentication server may further include: a communication device, configured to send the authentication result to the CDN server, wherein the authentication result includes at least: the IP address of the access terminal requesting hotlinking and the IP address of the access terminal legally requesting IP address.

Optionally, the above-mentioned first processor may also be used to limit the speed or deny access to the IP address of the access terminal requesting hotlinking.

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be realized in other ways. Wherein, the device embodiments described above are only illustrative. For example, the division of the units may be a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, read-only memory (ROM, Read-OnlyMemory), random access memory (RAM, RandomAccessMemory), mobile hard disk, magnetic disk or optical disk.

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1. A method for access request authentication, comprising: The CDN server receives an access request from an access terminal, where the access request includes at least a first identifier for identifying the access request; If the first identifier is found in the local cache of the CDN server, the CDN server locally authenticates the access request, where the authentication is used to determine the legitimacy of the access request; If the first identifier is not found in the local cache of the CDN server, the CDN server sends the access request to an authentication server for authentication. 2. The method according to claim 1, wherein the access request further includes the IP address of the access terminal, wherein, if the first identifier is found in the local cache of the CDN server, the The CDN server authenticating the access request locally includes: The CDN server determines whether at least one IP address cached locally includes the IP address of the access terminal, where the at least one IP address has a corresponding relationship with the first identifier; In the case of including, the CDN server determines that the access request is a legal request; If not included, the CDN server determines that the access request is a hotlink request. 3. The method according to claim 1, wherein the CDN server sending the access request to an authentication server for authentication comprises: If the first identifier is not found in the local cache of the authentication server, the authentication server determines that the access request is a legitimate request, and caches the relationship between the first identifier and the IP address of the access terminal. Correspondence between; If the first identifier is found in the local cache of the authentication server, the authentication server determines whether at least one IP address in the local cache includes the IP address of the access terminal, wherein the at least one IP The address has a corresponding relationship with the first identifier; In the case of including, the authentication server determines that the access request is a legitimate request; If not included, the authentication server determines that the access request is a hotlinking request. 4. The method according to claim 3, characterized in that, after the CDN server sends the access request to an authentication server for authentication, the method further comprises: The authentication server sends an authentication result to the CDN server, wherein the authentication result at least includes: the IP address of the access terminal requesting hotlinking and the IP address of the access terminal requesting legally. 5. The method according to claim 4, characterized in that, after the authentication server sends the authentication result to the CDN server, the method further comprises: The CDN server limits the speed or denies access to the IP address of the access terminal of the hotlink request. 6. A system for access request authentication, characterized in that the system comprises: The client is configured to send an access request for accessing the terminal, where the access request is at least used to identify the first identifier of the access request; The CDN server is configured to receive the access request. If the first identifier is found in the local cache of the CDN server, the CDN server authenticates the access request locally. The first identifier is not found in the local cache of the CDN server, and the CDN server forwards the access request, wherein the authentication is used to determine the legitimacy of the access request; The authentication server establishes a communication relationship with the CDN server, and authenticates the access request forwarded by the CDN server. 7. The system according to claim 6, wherein the access request further comprises the IP address of the access terminal, wherein the CDN server comprises: A first processor, configured to determine whether at least one IP address cached locally includes the IP address of the access terminal, where the at least one IP address has a corresponding relationship with the first identifier; In the case of including, the CDN server determines that the access request is a legal request; If not included, the CDN server determines that the access request is a hotlink request. 8. The system according to claim 7, wherein the authentication server comprises: The second processor, if the first identifier is not found in the local cache of the authentication server, the authentication server determines that the access request is a legal request, and caches the first identifier and the access request Correspondence between IP addresses of terminals; If the first identifier is found in the local cache of the authentication server, the authentication server determines whether at least one IP address in the local cache includes the IP address of the access terminal, wherein the at least one IP The address has a corresponding relationship with the first identifier; In the case of including, the authentication server determines that the access request is a legitimate request; If not included, the authentication server determines that the access request is a hotlinking request. 9. The system according to claim 8, wherein the authentication server further comprises: A communication device, configured to send an authentication result to the CDN server, wherein the authentication result at least includes: the IP address of the access terminal requesting hotlinking and the IP address of the access terminal requesting legally. 10. The system according to claim 9, wherein the first processor is further configured to limit the speed or deny access to the IP address of the access terminal of the hotlink request.