Use Java and Redis to implement efficient SMS anti-bombing solutions

1. The dangers of text message bombing

• User harassment: Users' mobile phones are flooded with a large number of useless text messages
• Waste of resources: Businesses need to pay for each text message
• System pressure: The SMS interface is occupied by a large number of invalid requests
• Security risks: May be used as an auxiliary means of other attacks

2. Core idea of ​​solution

1. Frequency Limitation

Limit the number of times the same mobile phone number is sent within a unit time

2. Cooling time

Set a cooling period after sending a text message, and it is not allowed to send again during this period.

3. IP restrictions

Limit the frequency of requests for the same IP address

4. Verification code verification

Ensure the correctness of the verification code before allowing the sending of new verification codes

3. Advantages of Redis

• high performance: In-memory database, fast response speed
• Atomic operation: Supports atomic increase and decrease and expired settings
• Persistence: Data can be persisted to disk
• distributed: Support cluster deployment
• Rich data structures: Support strings, hashs, collections, etc.

4. Complete Java implementation

1. Redis configuration

public class RedisConfig {
    @Bean
    public JedisPool jedisPool() {
        JedisPoolConfig poolConfig = new JedisPoolConfig();
        (128);
        return new JedisPool(poolConfig, "redis-host", 6379);
    }
}

2. SMS service core category

@Service
public class SmsService {
    
    private static final int PHONE_LIMIT = 3; // Up to 3 times in 1 minute    private static final int IP_LIMIT = 100; // Up to 100 times within 1 hour    private static final int COOLDOWN = 60; // 60 seconds cooldown time    
    @Autowired
    private JedisPool jedisPool;
    
    public SmsResponse sendCode(String phone, String ip) {
        try (Jedis jedis = ()) {
            // IP restriction check            if (!checkIpLimit(jedis, ip)) {
                return ("IP requests are too frequent");
            }
            
            // Check the frequency of mobile phone number            if (!checkPhoneLimit(jedis, phone)) {
                return ("Operation is too frequent");
            }
            
            // Cooldown time check            if (!checkCooldown(jedis, phone)) {
                return ("Please wait 60 seconds before trying again");
            }
            
            String code = generateCode();
            
            //Storage verification code, valid for 5 minutes            (key(phone, "code"), 300, code);
            // Set the cooldown time            (key(phone, "cooldown"), COOLDOWN, "1");
            
            // Actually send text messages            sendRealSms(phone, code);
            
            return ();
        }
    }
    
    private boolean checkIpLimit(Jedis jedis, String ip) {
        String key = key(ip, "ip-limit");
        Long count = (key);
        if (count == 1) {
            (key, 3600);
        }
        return count <= IP_LIMIT;
    }
    
    // Other auxiliary methods...}

3. Use Lua scripts to ensure atomicity

private boolean checkPhoneLimit(Jedis jedis, String phone) {
    String script = "local current = ('incr', KEYS[1])\n" +
                   "if current == 1 then\n" +
                   "    ('expire', KEYS[1], ARGV[1])\n" +
                   "end\n" +
                   "return current <= tonumber(ARGV[2])";
    
    String key = key(phone, "phone-limit");
    Object result = (script, 1, key, "60", (PHONE_LIMIT));
    return (Long) result == 1;
}

5. Solution optimization suggestions

• Sliding window current limit: Use Redis's ZSET to achieve more precise control
• Multi-dimensional limitations: Combined with device fingerprint and user behavior analysis
• Blacklist mechanism: Add to blacklist malicious IP and mobile phone numbers
• Monitoring alarm: Set up an abnormal traffic alarm mechanism
• Downgrade strategy: Enable local current limit when Redis is not available

6. Performance test data

Test on 4-core 8G server:

7. FAQ

Q: Why choose Redis instead of database?

A: Redis's memory operation characteristics make it particularly suitable for this high-frequency and low-latency counting scenario, with a performance improvement of 10-100 times compared to the database.

Q: How to ensure consistency in a distributed environment?

A: Redis itself is a distributed cache. All counting operations in our solution are atomic and can ensure consistency.

Q: What to do if Redis goes down?

A: Redis persistence and clustering can be configured, and local downgrade schemes can be prepared.

Conclusion

The Redis-based SMS bombing scheme introduced in this article has been verified in actual projects and can effectively prevent more than 99% of SMS bombing attacks. Developers can adjust the current limit threshold and time window parameters according to their own business needs.

Related technology extensions: Spring Cloud Gateway current limiting, distributed current limiting algorithm, machine learning to identify abnormal traffic, etc.

The above is the detailed content of using Java and Redis to achieve efficient SMS anti-bombing solution. For more information about Java Redis SMS anti-bombing, please pay attention to my other related articles!