User terminal authentication method and device, electronic equipment and storage medium

Abstract

The invention provides a user terminal authentication method and device, electronic equipment and a storage medium, relates to the technical field of computers, and is used for loading a role permission list when a service gateway is started and completing authentication of a user service access request according to the loaded role permission list. The method comprises the steps of receiving a service access request of a user terminal under the condition that authentication of the user terminal is passed, reading a first mapping relation, and determining first identity information corresponding to a target user name of the user terminal; the first mapping relation is loaded when the service gateway is started and is used for reflecting identity information corresponding to different user names; reading the second mapping relationship, and determining second identity information allowing access to the to-be-accessed service; the second mapping relation is loaded when the service gateway is started and is used for reflecting service access permissions corresponding to different identity information; and under the condition that the first identity information exists in the second identity information, allowing the user terminal to access the to-be-accessed service.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular, to a user terminal authentication and authorization method, apparatus, electronic device, and storage medium. Background Art

[0002] With the continuous development of cloud platform and microservices technology, distributed architecture has become the mainstream of the new generation of application architectures. In order to protect the security of service interfaces, it is necessary to authenticate and authorize the access to distributed service interfaces. The existing technology stores the permission data of each service interface in a database, and accesses the database through a service gateway to query the interface permissions to confirm whether the user has the permission to access the service.

[0003] However, for the access requests of multiple users, the service gateway needs to frequently access the database to query whether the user has the permission to access the service interface, which makes the authentication and authorization process waste a lot of time and causes resource waste. Summary of the Invention

[0004] This application provides a user terminal authentication and authorization method, apparatus, electronic device, and storage medium, which are used to load a role permission list when the service gateway is started, and complete the authentication and authorization of user service access requests according to the loaded role permission list.

[0005] To achieve the above object, this application adopts the following technical solutions:

[0006] In a first aspect, a user terminal authentication and authorization method is provided, which is applied to a service gateway. The method includes: receiving a service access request from a user terminal when the user terminal authentication is passed; the service access request includes the target user name of the user terminal and the service to be accessed; reading a first mapping relationship to determine the first identity information corresponding to the target user name of the user terminal; the first mapping relationship is loaded when the service gateway is started and is used to reflect the identity information corresponding to different user names; reading a second mapping relationship to determine the second identity information that allows access to the service to be accessed; the second mapping relationship is loaded when the service gateway is started and is used to reflect the service access permissions corresponding to different identity information; when the first identity information exists in the second identity information, allowing the user terminal to access the service to be accessed.

[0007] Optionally, the method further includes: when the service gateway is started, querying the first mapping relationship and the second mapping relationship from the database, and loading the queried first mapping relationship and the second mapping relationship into the cache.

[0008] Optionally, the method further includes: in response to an update message of the database, obtaining the updated first mapping relationship and the second mapping relationship; unloading the first mapping relationship and the second mapping relationship in the current cache, and loading the updated first mapping relationship and the second mapping relationship into the cache.

[0009] Optionally, the method further includes: receiving an authentication request from a user terminal; the authentication request includes a target user name and a login password of the user terminal; verifying the target user name and the login password, and determining that the user terminal is authenticated successfully when the verification is successful.

[0010] In a second aspect, a user terminal authentication and authorization device is provided, which is applied to a service gateway. The authentication and authorization device includes a receiving unit, a determining unit, and a processing unit; the receiving unit is configured to receive a service access request from a user terminal when the user terminal is authenticated successfully; the service access request includes a target user name of the user terminal and a service to be accessed; the determining unit is configured to read a first mapping relationship and determine first identity information corresponding to the target user name of the user terminal; the first mapping relationship is loaded when the service gateway is started, and is used to reflect identity information corresponding to different user names; the determining unit is further configured to read a second mapping relationship and determine second identity information that allows access to the service to be accessed; the second mapping relationship is loaded when the service gateway is started, and is used to reflect service access permissions corresponding to different identity information; the processing unit is configured to allow the user terminal to access the service to be accessed when the first identity information exists in the second identity information.

[0011] Optionally, the processing unit is specifically configured to: when the service gateway is started, query the first mapping relationship and the second mapping relationship from a database, and load the queried first mapping relationship and the second mapping relationship into the cache.

[0012] Optionally, the processing unit is further specifically configured to: in response to an update message of the database, obtain the updated first mapping relationship and the second mapping relationship; unload the first mapping relationship and the second mapping relationship in the current cache, and load the updated first mapping relationship and the second mapping relationship into the cache.

[0013] Optionally, the receiving unit is specifically configured to: receive an authentication request from a user terminal; the authentication request includes a target user name and a login password of the user terminal; verify the target user name and the login password, and determine that the user terminal is authenticated successfully when the verification is successful.

[0014] In a third aspect, an electronic device is provided, including: a processor and a memory for storing instructions executable by the processor; wherein, the processor is configured to execute the instructions to implement the user terminal authentication and authorization method in the first aspect above.

[0015] In a fourth aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the user terminal authentication method as described in the first aspect above.

[0016] The technical solution provided by the embodiment of the present application brings at least the following beneficial effects: when the service gateway is started, the service gateway loads the first mapping relationship and the second mapping relationship, the first mapping relationship is used to reflect the identity information corresponding to different user names, and the second mapping relationship is used to reflect the service access rights corresponding to different identity information. In the case where the user terminal is authenticated, the service gateway receives the service access request of the user terminal, the service access request includes the target user name of the user terminal and the service to be accessed, and reads the first mapping relationship to determine the first identity information corresponding to the target user name of the user terminal, and reads the second mapping relationship to determine the second identity information that is allowed to access the service to be accessed. In the case where the first identity information exists in the second identity information, the service gateway allows the user terminal to access the service to be accessed, and completes the authentication and authorization operation for the user service access request. Compared with the prior art that stores service interface permission data in a database, every time a user initiates an access request, the service gateway needs to access the database to query whether the requesting user has service interface access rights. When the service gateway is started, the present application loads the first mapping relationship and the second mapping relationship into the service gateway cache. When the user initiates an access request at the terminal, the service gateway reads the first mapping relationship and the second mapping relationship, and can authenticate the access request initiated by the user at the terminal. There is no need to frequently access the database, which reduces the time spent on the authentication process and reduces resource waste. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of the structure of an authentication system provided in the embodiment of the present application Figure 1 ;

[0019] Figure 2 A schematic diagram of the structure of an authentication system provided in the embodiment of the present application Figure 2 ;

[0020] Figure 3 A schematic diagram of a user terminal authentication method provided in an embodiment of the present application Figure 1 ;

[0021] Figure 4 Schematic diagram of a user terminal authentication method provided by an embodiment of the present application;

[0022] Figure 5 Schematic diagram of a user terminal authorization method provided by an embodiment of the present application;

[0023] Figure 6 Flow schematic of a user terminal authentication and authorization method provided by an embodiment of the present application Figure 2 ;

[0024] Figure 7 Flow schematic diagram of a service gateway for real - time updating of the role - permission list provided by an embodiment of the present application;

[0025] Figure 8 Flow schematic of a user terminal authentication and authorization method provided by an embodiment of the present application Figure 3 ;

[0026] Figure 9 Schematic diagram of the structure of a service gateway provided by an embodiment of the present application;

[0027] Figure 10 Schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0028] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0029] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Exactly, using words such as "exemplary" or "for example" aims to present relevant concepts in a specific manner.

[0030] It should also be noted that in the embodiments of the present application, "(English: of)", "corresponding (English: corresponding, relevant)" and "corresponding (English: corresponding)" can sometimes be used interchangeably. It should be pointed out that when not emphasizing their differences, the meanings they express are the same.

[0031] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0032] Before explaining the embodiments of the present application in detail, some relevant technical terms and related technologies involved in the embodiments of the present application are first introduced.

[0033] With the popularity of microservice architecture and the continuous development of cloud platforms and microservice technologies, distributed architecture has become the mainstream of the new generation of application architecture. More and more companies are transforming traditional monolithic applications into microservices, and distributed architecture requires a huge number of servers with various types, and the calls between services have become complicated. In order to ensure the data security of each service and the security of calls between services, it is necessary to authenticate the access to the distributed service interface and verify whether the user has access rights.

[0034] There are generally four existing solutions for different scenarios: single sign-on, distributed session control, client token, and client token combined with application programming interface (API) gateway. Although some technical solutions can now achieve unified permission control of microservices in the service gateway, introduce user attribute information, refine the granularity of resource access, and improve the security of permission management, the above technical solutions store the interface permission data in the database. Every time a user initiates a service access request, the service gateway needs to access the database to query whether the requesting user has access rights to the service interface, which wastes a lot of time in the authentication process and causes unnecessary waste of resources.

[0035] Moreover, in the prior art solution, when the interface permission data is updated in the database, the service gateway cannot update the interface permission data in real time. The service gateway needs to frequently access the database or restart to synchronize the new permissions, which results in high pressure on the server and low service security.

[0036] In view of the above problems, the present application provides a user terminal authentication and authorization method. When the service gateway is started, the authentication and authorization device calls the service gateway to load the first mapping relationship and the second mapping relationship. The first mapping relationship is used to reflect the identity information corresponding to different user names, and the second mapping relationship is used to reflect the service access permissions corresponding to different identity information. When the user terminal is authenticated successfully, the authentication and authorization device calls the service gateway to receive the service access request of the user terminal, reads the first mapping relationship to determine the first identity information corresponding to the target user name of the user terminal, and reads the second mapping relationship to determine the second identity information that allows access to the service to be accessed. When the first identity information exists in the second identity information, the authentication and authorization device allows the user terminal to access the service to be accessed, and completes the authentication and authorization operation of the user service access request.

[0037] The following describes in detail the user terminal authentication and authorization method provided by the embodiments of the present application with reference to the accompanying drawings.

[0038] The user terminal authentication and authorization method provided by the embodiments of the present application can be applied to an authentication and authorization system. Figure 1 shows a schematic structural diagram of the authentication and authorization system. As Figure 1 shown, the authentication and authorization system 10 includes a service gateway 101 and a terminal 102. Among them, the service gateway 101 and the terminal 102 can be connected by a wired method or a wireless method, and the embodiments of the present application do not limit this.

[0039] In one implementation, an authentication and authorization device is embedded in the service gateway 101, and the service gateway 101 can execute the user terminal authentication and authorization method in the embodiments of the present application through the embedded authentication and authorization device.

[0040] The terminal 102 is used to send a user authentication request including a user name and a login password to the service gateway 101, and receive the authentication result information sent by the service gateway 101 after the service gateway 101 performs an authentication operation. The terminal 102 can also be used to send a service access request of the user to the service gateway 101, and receive the authorization result information sent by the service gateway 101 after the service gateway 101 performs an authorization operation. For the specific user terminal authentication and authorization method, reference can be made to the introduction in the following embodiments, and details are not described here.

[0041] The service gateway 101 is used to receive the user authentication request sent by the terminal 102, perform authentication operations through the embedded authentication and authorization device, and send the authentication result information to the terminal 102. The service gateway 101 can also be used to load the first mapping relationship and the second mapping relationship, and perform authorization operations on the service access request sent by the terminal 102 according to the first mapping relationship and the second mapping relationship. For the specific user terminal authentication and authorization method, reference can be made to the introduction of the following embodiments, which will not be elaborated here.

[0042] The service gateway 101 can be a computer system or device that provides data conversion services. For example, the service gateway 101 can be a router, a firewall, a network switch with layer 3 switching function, a host that enables routing function through software, etc. The specific type of the service gateway 101 is not limited in the embodiments of this application.

[0043] The terminal 102 can be an electronic device with data processing functions. For example, the terminal 102 can be a computer, a tablet computer, a laptop computer, an ultra-mobile personal computer (UMPC), etc. The specific type of the terminal 102 is not limited in the embodiments of this application.

[0044] Exemplarily, as Figure 2 shown, the terminal is deployed with a client, which includes a World Wide Web (web) and an Application (APP). The user can log in to the web or APP on the terminal and send an authentication or authorization request to the service gateway. The service gateway internally includes an authentication module and an authorization module, which can perform authentication or authorization operations on the request sent by the user after receiving the request. Among them, the authentication module can call the authentication service, and the authorization module is connected to the business service. The authentication service provides functions of user verification and encapsulation of identity security tokens (JSON Web Tokens, JWT), and the business service provides an interface for the backend service.

[0045] Figure 3 is a schematic flowchart of a user terminal authentication and authorization method shown according to some exemplary embodiments. In some embodiments, the above user terminal authentication and authorization method can be applied to an authentication and authorization device as Figure 1 shown, or can be applied to other similar devices.

[0046] As Figure 3 shown, the user terminal authentication and authorization method provided by the embodiments of this application includes the following S201 - S204.

[0047] S201. When the user terminal is authenticated, receive the service access request of the user terminal.

[0048] Among them, the service access request includes the target user name of the user terminal and the service to be accessed.

[0049] As a possible implementation, the service gateway receives an authentication request from the user terminal (the authentication request includes the target user name of the user terminal and the login password), calls the authentication service to verify the target user name and the login password. In the case of verification failure, an error message is returned to the terminal. In the case of successful verification, it is determined that the user terminal is authenticated, and the authentication service is called to query the role list corresponding to the target user name from the database (the role list includes one or more role names corresponding to the target user name), and the above target user name and the corresponding role list are encapsulated into a JWT using the private key and returned to the terminal (the JWT encapsulated with the private key can only be successfully parsed using the public key corresponding to the private key). After receiving the result of successful authentication sent by the service gateway, the user terminal sends a service access request to the service gateway, carrying the obtained JWT, and the service gateway receives the service access request of the user terminal.

[0050] Exemplarily, such as Figure 4 As shown, the service gateway receives an authentication request from the client user, forwards the request for authenticating the client user's user name and password to the authentication service, calls the authentication service to verify the client user's user name and password to verify whether the login is valid. After the verification is completed, the authentication service returns the authentication result to the service gateway, and the service gateway then forwards it to the client. Specifically, when the authentication service shows authentication failure, an authentication failure prompt is returned to the client. When the authentication service shows authentication success, it is determined that the client user is authenticated, that is, the authenticated client user is confirmed as the currently logged-in user, the role list corresponding to the user name of the currently logged-in user is queried from the database, the user name of the user and the corresponding role list are encapsulated into an object and placed in the Payload part of the JWT, and the JWT is encapsulated using the private key, and the encapsulated JWT is returned to the client. Among them, the JWT consists of three parts: Header, Payload, and Signature. The Header contains encryption algorithm and type information; the Payload contains user information, permissions and other data; the Signature is the encryption result of the Header and the Payload.

[0051] Exemplarily, such as Figure 5 As shown, the client sends a service access request to the service gateway carrying the obtained JWT, and the service gateway receives the service access request of the currently logged-in user.

[0052] S202. Read the first mapping relationship and determine the first identity information corresponding to the target user name of the user terminal.

[0053] Among them, the first mapping relationship is loaded when the service gateway starts, and is used to reflect the identity information corresponding to different user names.

[0054] As a possible implementation method, when the service gateway starts, the service gateway queries the first mapping relationship and the second mapping relationship from the database, and loads the queried first mapping relationship and the second mapping relationship into the service gateway cache. After the first mapping relationship and the second mapping relationship are loaded, the service gateway obtains the data in the cache, loads the first mapping relationship and the second mapping relationship, and after receiving the service access request of the client user, resolves the JWT through the public key to obtain the user name of the currently logged-in user and the corresponding first identity information (the role list corresponding to the user name of the currently logged-in user).

[0055] Optionally, the user configures permissions at the application management end: create a user table, a role table, and a permission table in the database (create the permission table according to the access permissions of the distributed service interface), and configure an update permission that can perform add, edit, and delete operations on the data in the user table, role table, and permission table. After the permission configuration is completed, the user performs user authorization and role authorization at the application management end: associate the user table and the role table in the database to obtain the first mapping relationship, that is, the user-role relationship table; associate the role table and the permission table in the database to obtain the second mapping relationship, that is, the role-permission relationship table. Among them, the user table includes user identity identification numbers (Industrial Design, ID), user names, login passwords, etc.; the role table includes role IDs, role names, etc.; the permission table includes access permission IDs for each service interface of the distributed service, permission identification fields (API paths and request methods for accessing services), etc.; the user-role relationship table includes user IDs, user names, role names corresponding to user names, etc.; the role-permission relationship table includes role IDs, role names, service access permissions corresponding to role names, etc.

[0056] Furthermore, when the user completes the creation of the user table, role table, permission table, user-role relationship table, and role-permission relationship table in the database, the service gateway will query the user-role relationship table and the role-permission relationship table from the database when starting up, and load the user-role relationship table and the role-permission relationship table into the cache of the service gateway. After the user-role relationship table and the role-permission relationship table are loaded, the service gateway obtains the data in the cache, loads the role permission list (the role permission list includes the user-role relationship table and the role-permission relationship table), and after receiving the service access request of the client user, resolves the JWT through the public key to obtain the user name of the currently logged-in user and the role list corresponding to the user name of the currently logged-in user.

[0057] Exemplarily, such as Figure 5As shown, when the service gateway starts, the service gateway loads the role permission list, and when the client sends a service access request to the service gateway with a JWT, it receives the service access request of the currently logged-in user. After receiving the service access request of the currently logged-in user, the service gateway uses the public key to parse the JWT in the service access request of the currently logged-in user to obtain the user role permissions (the user role permissions include the username of the currently logged-in user and the corresponding role list). When the JWT parsing fails, the service gateway returns an error message to the client. When the JWT parsing is successful, the authentication process is performed according to the obtained user role permissions.

[0058] S203. Read the second mapping relationship and determine the second identity information that is allowed to access the service to be accessed.

[0059] Among them, the second mapping relationship is loaded when the service gateway starts and is used to reflect the service access permissions corresponding to different identity information.

[0060] As a possible implementation method, the service gateway loads the role permission list, determines the second identity information that is allowed to access the service to be accessed (the service to be accessed is the service requested by the currently logged-in user) by reading the role permission relationship table, that is, determines the role name that is allowed to access the service to be accessed.

[0061] Exemplarily, as Figure 5 shown, the service gateway loads the role permission list, and forms a permission identifier by combining the current request path and request method corresponding to the service requested by the currently logged-in user, and compares it with the role permission list loaded by the service gateway, that is, queries the role permission list according to the request path of the service to be accessed, and determines the role name corresponding to the permission required to access the service to be accessed by reading the role permission relationship table.

[0062] Optionally, the service gateway forms a permission identifier by combining the current request path and request method corresponding to the service requested by the currently logged-in user, including: the API path (request_url_path) to be accessed and the request method (request_http_method). The request methods include GET (indicating getting a certain resource), POST (indicating adding a certain resource), HEAD (similar to a GET request, used to obtain headers, and the server only returns the headers in the response and does not return the body part of the resource), PUT (indicating updating a certain resource), DELETE (indicating deleting a certain resource), etc. For example, when the client accesses api / user / a in the GET method, the API path to be accessed request_url_path = / user / a, and the request method request_http_method = GET.

[0063] S204. When the first identity information exists in the second identity information, the user terminal is allowed to access the service to be accessed.

[0064] As a possible implementation, the service gateway reads the user role relationship table and role permission relationship table loaded by the service gateway, determines the first identity information (the username of the currently logged-in user and the corresponding role list) and the second identity information (the name of one or more roles allowed to access the service to be accessed), and then determines whether the first identity information exists in the second identity information. When the first identity information exists in the second identity information, the currently logged-in user is allowed to access the service to be accessed.

[0065] Exemplarily, as Figure 5 shown, after determining the role name corresponding to the permission required to access the service to be accessed, the service gateway, based on the username of the currently logged-in user and the corresponding role list obtained after successfully parsing the JWT, determines whether the role list corresponding to the currently logged-in user contains the role of the request path, that is, determines whether there is at least one role name corresponding to the second identity information in the role list corresponding to the currently logged-in user. If not, the service gateway directly returns a prompt message of unauthorized access to the client; if so, the service gateway forwards the service access request of the currently logged-in user to the corresponding business service. After receiving the service access request of the currently logged-in user, the business service performs business logic processing and returns the processing result to the service gateway, and then the service gateway returns the processing result to the client.

[0066] Exemplarily, assume that the role list corresponding to the currently logged-in user includes role A, role B, and role C, and the second identity information allowing access to the service to be accessed indicates that the roles allowed to access the service to be accessed can be role B, role D, and role E. Since role B, which allows access to the service to be accessed, exists in the role list corresponding to the currently logged-in user, it indicates that the currently logged-in user can access the service to be accessed. The authentication and authorization device calls the service gateway to forward the service access request of the currently logged-in user to the corresponding business service. Similarly, assume that the role list corresponding to the currently logged-in user includes role A, role B, and role C, and the second identity information allowing access to the service to be accessed indicates that the roles allowed to access the service to be accessed can be role D, role E, and role F. Since none of the roles allowing access to the service to be accessed exist in the role list corresponding to the currently logged-in user, the currently logged-in user has no right to access the service to be accessed.

[0067] In one design, in order to be able to update the role permission list loaded by the service gateway in real time, as Figure 6 shown, the user terminal authentication and authorization method provided in the embodiment of the present application may further include the following S301-S302.

[0068] S301. Update the loaded first mapping relationship and second mapping relationship in response to the update message of the database.

[0069] As a possible implementation, the service gateway responds to the update message of the database, obtains the updated first mapping relationship and second mapping relationship, unloads the first mapping relationship and second mapping relationship in the service gateway cache, and loads the updated first mapping relationship and second mapping relationship into the service gateway cache.

[0070] Optionally, when the user updates the role permission configuration in the management terminal, the data in the user-role relationship table and role-permission relationship table in the database will be updated accordingly, and the update message of the database will be sent to the message queue. The service gateway will monitor the message queue. When the service gateway instance detects the update message of the database in the message queue, the service gateway instance queries the latest user-role relationship table and role-permission relationship table from the database, unloads the user-role relationship table and role-permission relationship table loaded in the service gateway cache, and loads the latest user-role relationship table and role-permission relationship table into the service gateway cache.

[0071] Exemplarily, as Figure 7 shown, the user updates the role permission configuration in the management terminal, updates the new role permission data to the role permission list in the database, and sends the update message of the database to the message queue topic. The service gateway will monitor the message queue. When the service gateway instance detects the update message of the database in the message queue, the service gateway instance queries the latest user-role relationship table and role-permission relationship table from the database, and updates the role permission list loaded in the service gateway cache. By the service gateway monitoring the message queue in real time, the dynamic update of the role permission list of the service gateway is realized.

[0072] Exemplarily, the user performs a role permission update operation on the user-role relationship table and role-permission relationship table in the database according to the update permission configured in the database. For example, in the user-role relationship table, a certain user name corresponds to role A and role B. A new corresponding role C can be added to this user name according to the update permission, or role B can be deleted and changed to role D, etc. to complete the update of the user-role relationship table. Similarly, in the role-permission relationship table, a certain service is only allowed to be accessed by role A and role B. The access permission of this service can be changed according to the update permission, so that this service allows role A, role B, and role C to access, or is changed to this service allowing role A and role D to access, etc. to complete the update of the role-permission relationship table.

[0073] S302: When the user terminal passes the authentication, an authentication operation is performed on the service access request of the user terminal according to the reloaded first mapping relationship and the second mapping relationship.

[0074] As a possible implementation method, when the user terminal authentication is passed, the service gateway performs authentication operations on the service access request of the currently logged-in user based on the latest user role relationship table and role permission relationship table loaded in the service gateway cache to confirm whether the currently logged-in user is allowed to access the service to be accessed corresponding to the service access request.

[0075] like Figure 8 As shown, the service gateway authenticates the user's service access request, including: the user configures permissions on the application management side: creates a user table, a role table, and a permission table in the database, and performs role authorization and user authorization on the management side: creates a user role relationship table and a role permission relationship table in the database. When the service gateway is started, it obtains the user role relationship table and the role permission relationship table from the database and loads them into the service gateway cache. When the data of the user role relationship table and the role permission relationship table in the database are updated, the service gateway obtains the update message of the database by monitoring the message queue, obtains the latest user role relationship table and role permission relationship table from the database according to the update message, and updates the latest user role relationship table and role permission relationship table to the service gateway cache.

[0076] Furthermore, when the user initiates a login authentication request on the client, the service gateway authenticates the request. If the authentication fails, the client returns to the login page. If the authentication passes, the service gateway generates a JWT based on the user information of the current logged-in user and the corresponding role list through the private key and returns it to the client. The current logged-in user initiates a service access request to the gateway with the JWT on the client. The service gateway parses the JWT through the public key to obtain the user information and user role list of the current logged-in user. If the service gateway fails to parse, the gateway returns an error message to the client. If the service gateway parses successfully, the gateway authenticates the request path corresponding to the service access request. If the authentication fails, the service gateway returns the authentication failure result to the client. If the authentication succeeds, the service gateway forwards the service access request of the current logged-in user to the backend service for business processing.

[0077] The technical solution provided by the embodiment of the present application brings at least the following beneficial effects: when the service gateway is started, the service gateway loads the first mapping relationship and the second mapping relationship, the first mapping relationship is used to reflect the identity information corresponding to different user names, and the second mapping relationship is used to reflect the service access rights corresponding to different identity information. In the case where the user terminal is authenticated, the service gateway receives the service access request of the user terminal, the service access request includes the target user name of the user terminal and the service to be accessed, and reads the first mapping relationship to determine the first identity information corresponding to the target user name of the user terminal, and reads the second mapping relationship to determine the second identity information that is allowed to access the service to be accessed. In the case where the first identity information exists in the second identity information, the service gateway allows the user terminal to access the service to be accessed, and completes the authentication and authorization operation for the user service access request. Compared with the prior art that stores service interface permission data in a database, every time a user initiates an access request, the service gateway needs to access the database to query whether the requesting user has service interface access rights. When the service gateway is started, the present application loads the first mapping relationship and the second mapping relationship into the service gateway cache. When the user initiates an access request at the terminal, the service gateway reads the first mapping relationship and the second mapping relationship, and can authenticate the access request initiated by the user at the terminal. There is no need to frequently access the database, which reduces the time spent on the authentication process and reduces resource waste.

[0078] The above embodiments mainly introduce the solutions provided by the embodiments of the present application from the perspective of the device (equipment). It is understandable that in order to implement the above method, the device or equipment includes hardware structures and / or software modules corresponding to the execution of each method flow, and these hardware structures and / or software modules corresponding to the execution of each method flow can constitute a material information determination device. It should be easy for those skilled in the art to realize that, in combination with the algorithm steps of each example described in the embodiments invented herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0079] The embodiment of the present application can divide the functional modules of the device or equipment according to the above method example. For example, the device or equipment can divide each functional module corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0080] Figure 9 It is a schematic structural diagram of a service gateway shown according to an exemplary embodiment. Referring to Figure 9 As shown, the service gateway 40 provided in the embodiment of the present application includes a receiving unit 401, a determining unit 402, and a processing unit 403.

[0081] The receiving unit 401 is configured to receive a service access request from a user terminal when the user terminal authentication is passed; the service access request includes the target user name of the user terminal and the service to be accessed; the determining unit 402 is configured to read a first mapping relationship and determine the first identity information corresponding to the target user name of the user terminal; the first mapping relationship is loaded when the service gateway is started and is used to reflect the identity information corresponding to different user names; the determining unit 402 is further configured to read a second mapping relationship and determine the second identity information that is allowed to access the service to be accessed; the second mapping relationship is loaded when the service gateway is started and is used to reflect the service access permissions corresponding to different identity information; the processing unit 403 is configured to allow the user terminal to access the service to be accessed when the first identity information exists in the second identity information.

[0082] Optionally, the processing unit 403 is specifically configured to: when the service gateway is started, query the first mapping relationship and the second mapping relationship from the database, and load the queried first mapping relationship and the second mapping relationship into the cache.

[0083] Optionally, the processing unit 403 is further specifically configured to: in response to an update message of the database, obtain the updated first mapping relationship and the second mapping relationship; unload the first mapping relationship and the second mapping relationship in the current cache, and load the updated first mapping relationship and the second mapping relationship into the cache.

[0084] Optionally, the receiving unit 401 is specifically configured to: receive an authentication request from the user terminal; the authentication request includes the target user name and the login password of the user terminal; verify the target user name and the login password, and determine that the user terminal authentication is passed when the verification is successful.

[0085] Figure 10 It is a schematic structural diagram of an electronic device provided by the present application. As Figure 10 , the electronic device 50 may include at least one processor 501 and a memory 502 for storing instructions executable by the processor. Among them, the processor 501 is configured to execute the instructions in the memory 502 to implement the user terminal authentication and authorization method in the above embodiment.

[0086] In addition, the electronic device 50 may further include a communication bus 503 and at least one communication interface 504.

[0087] The processor 501 may be a central processing unit (CPU), a microprocessing unit, an ASIC, or one or more integrated circuits for controlling the execution of the program of the solution of the present application.

[0088] The communication bus 503 may include a path for transmitting information between the above components.

[0089] The communication interface 504 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0090] The memory 502 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or may also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor 501 through a bus. The memory may also be integrated with the processor 501.

[0091] Among them, the memory 502 is used to store the instructions for executing the solution of the present application and is controlled by the processor 501 to execute. The processor 501 is used to execute the instructions stored in the memory 502, thereby implementing the functions in the method of the present application.

[0092] As an example, in combination with Figure 9 , the functions implemented by the receiving unit 401, the determining unit 402, and the processing unit 403 in the serving gateway 40 are the same as those of the processor 501 in Figure 10 .

[0093] In a specific implementation, as an embodiment, the processor 501 may include one or more CPUs, such as Figure 10 the CPU0 and CPU1 in

[0094] In a specific implementation, as an embodiment, the electronic device 50 may include multiple processors, such as Figure 10 the processor 501 and the processor 507 in []. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0095] In a specific implementation, as an embodiment, the electronic device 50 may further include an output device 505 and an input device 506. The output device 505 communicates with the processor 501 and can display information in various ways. For example, the output device 505 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 506 communicates with the processor 501 and can accept input from a user object in various ways. For example, the input device 506 may be a mouse, a keyboard, a touch screen device, or a sensing device, etc.

[0096] Those skilled in the art can understand that Figure 10 the structure shown in [] does not constitute a limitation on the electronic device 50, and it may include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0097] In addition, the present application also provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device can execute the user terminal authentication and authorization method provided in the above embodiments.

[0098] In addition, the present application also provides a computer program product, including computer instructions. When the computer instructions run on the electronic device, the electronic device executes the user terminal authentication and authorization method provided in the above embodiments.

[0099] Those skilled in the art will readily think of other implementation schemes of the present application after considering the specification and practicing the invention here. The present application aims to cover any variations, uses, or adaptive changes of the present application. These variations, uses, or adaptive changes follow the general principles of the present application and include the common general knowledge or conventional technical means in the technical field not invented by the present application. The specification and the embodiments are only regarded as exemplary, and the true scope and spirit of the present application are pointed out by the claims.

Claims

1. A user terminal authentication and authorization method, characterized in that Applied to a service gateway, the method includes: When the user terminal is authenticated successfully, receiving a service access request from the user terminal; the service access request includes the target user name of the user terminal and the service to be accessed; Reading a first mapping relationship to determine first identity information corresponding to the target user name of the user terminal; the first mapping relationship is loaded when the service gateway starts up and is used to reflect identity information corresponding to different user names; Reading a second mapping relationship to determine second identity information that is allowed to access the service to be accessed; the second mapping relationship is loaded when the service gateway starts up and is used to reflect service access permissions corresponding to different identity information; When the first identity information exists in the second identity information, allowing the user terminal to access the service to be accessed.

2. The method according to claim 1, wherein The method further includes: When the service gateway starts up, querying the first mapping relationship and the second mapping relationship from a database, and loading the queried first mapping relationship and second mapping relationship into a cache.

3. The method according to claim 2, wherein The method further includes: In response to an update message of the database, obtaining the updated first mapping relationship and second mapping relationship; Unloading the first mapping relationship and the second mapping relationship in the current cache, and loading the updated first mapping relationship and second mapping relationship into the cache.

4. The method according to claim 1, characterized in that, The method further includes: Receiving an authentication request from the user terminal; the authentication request includes the target user name of the user terminal and a login password; Verifying the target user name and the login password, and when the verification is successful, determining that the user terminal is authenticated successfully.

5. A user terminal authentication and authorization device, characterized in that, Applied to a service gateway, the authentication and authorization device includes a processing unit, a receiving unit, and a determining unit; The receiving unit is configured to, when the user terminal is authenticated successfully, receive a service access request from the user terminal; the service access request includes the target user name of the user terminal and the service to be accessed; The determining unit is configured to read a first mapping relationship to determine first identity information corresponding to the target user name of the user terminal; The first mapping relationship is loaded when the service gateway starts up and is used to reflect identity information corresponding to different user names; The determining unit is further configured to read a second mapping relationship to determine second identity information that is allowed to access the service to be accessed; The second mapping relationship is loaded when the service gateway starts up and is used to reflect service access permissions corresponding to different identity information; The processing unit is configured to, when the first identity information exists in the second identity information, allow the user terminal to access the service to be accessed.

6. The authentication and authorization device according to claim 5, characterized in that The processing unit is specifically configured to: when the service gateway starts up, query the first mapping relationship and the second mapping relationship from a database, and load the queried first mapping relationship and second mapping relationship into a cache.

7. The authentication and authorization device according to claim 6, characterized in that The processing unit is further specifically configured to: in response to an update message of the database, obtain the updated first mapping relationship and the second mapping relationship; unload the first mapping relationship and the second mapping relationship in the current cache, and load the updated first mapping relationship and the second mapping relationship into the cache.

8. The authentication and authorization device according to claim 5, characterized in that The receiving unit is specifically configured to: receive an authentication request of the user terminal; the authentication request includes a target user name and a login password of the user terminal; verify the target user name and the login password, and determine that the user terminal is authenticated successfully when the verification is successful.

9. An electronic device, characterized in that, Comprising: A processor and a memory for storing instructions executable by the processor; wherein, the processor is configured to execute the instructions to implement the user terminal authentication and authorization method according to any one of claims 1-4.

10. A computer-readable storage medium having instructions stored thereon, characterized in that, When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the user terminal authentication and authorization method according to any one of claims 1-4.

Images