Method and system for realizing unified identity authentication strategy for micro-service architecture

Abstract

The invention discloses a method and a system for realizing a unified identity authentication strategy for a micro-service architecture, and the method comprises the following steps that: a public gateway receives an identity authentication or login request sent by a client or a user, and forwards the identity authentication or login request to authentication service; received identity authentication or login requests are responded and authentication service recognizes user identities; the passing of the user identities is responded and a an access token is generated by the authentication service; the authentication service sends the access token to a public cache and sends a returned access token to a public gateway, and the public cache stores the access token; and the returned access token by the public gateway is received and the returned access token is sent to the user. The invention provides a convenient and simpler method to realize the unified identity authentication of the client access in the micro-service architecture, so that legitimacy and security of the access to each micro-service in the micro-service architecture are ensured.

Description

technical field [0001] The invention relates to a unified identity authentication strategy in a distributed system architecture, in particular to a method and system for realizing a unified identity authentication strategy oriented to a microservice architecture. Background technique [0002] Microservice architecture is an architectural concept that aims to decouple solutions by decomposing functionality into discrete services. Compared with traditional applications, the microservice architecture pattern splits a large single application and service into several or even dozens of supporting microservices, which can extend a single component instead of the entire application stack to meet the service level agreement. [0003] At present, the microservice architecture is widely used in the Internet field. Large-scale Internet platforms have adopted the microservice architecture to process hundreds of millions of user requests under high concurrency, thus ensuring the normal o...

AI Technical Summary

Problems solved by technology

[0005] 1. At the level of microservice architecture, whether the public gateway is deployed on a single node or in a cluster, it needs to perform session consistency and synchronization processing. For large-scale concurrent requests, the pressure on the gateway server is relatively large in terms of session creation and session consistency processing , the load capacity can be improved by increasing the cluster deployment of gateway service nodes, but it also increases the complexity of the associated configuration between business microservice nodes and gateways

[0006] 2. At present, the login of this identity authentication strategy only relies on the session id generated by the server. The client’s request carries the session id. If the server has this id, it is considered that the request comes from the corresponding login client. The principle is simple, but If the session id is intercepted, the request can be forged, so there is a serious security risk

[0007] 3. In the above solution, the two processing methods for web page requests and API interface requests are based on the session mechanism. The user's login verification, login maintenance, and logout all require the service to maintain the session by creating a session and maintaining the session state. A large number of session storage and synchronization in the distributed architecture increase the computing resource consumption of the server. With the continuous increase of concurrency, the pressure on the public gateway service is also increased. If the capacity is not expanded in time, there is a risk of downtime

[0008] 4. Based on the access session and the session retention method by writing back the cookie, since the cookie is dependent on the domain name, it is not applicable to the access of the third-party system

Images