Microservice system interface authority management and authentication method and related device

Abstract

The invention provides a micro-service system interface authority management and authentication method and a related device, and belongs to the technical field of software engineering. According to the method, a micro-service plug-in is deployed at each micro-service node, the micro-service plug-in automatically collects interface information of a micro-service system and permission description information corresponding to the interface information, and the interface information of the micro-service system and the permission description information corresponding to the interface information are synchronized to all API gateway nodes through a Nacos configuration management center; starting a role permission configuration server, performing unified management on interface permission information, user role information and permission configuration information of the micro-service system in the role permission configuration server, and performing unified distribution on users, roles and permissions; and starting the single-point authentication server, and verifying the user identity in the single-point authentication server. According to the invention, the problem of low integration efficiency of the micro-service system is solved.

Description

Technical Field

[0001] The present invention belongs to the field of software engineering technology, and specifically relates to a microservice system interface authority management and authentication method and related devices. Background Art

[0002] With the widespread adoption of microservices architecture, enterprises have gained greater flexibility and efficiency in application development, deployment, and expansion. However, this microservices architecture also brings many security management challenges.

[0003] In traditional microservice architectures, permission control is typically coarse-grained, with permission policies managed across various services. The binding between interfaces and permissions is not tight enough, making it difficult to unify the overall security policy of the system. Secondly, the ambiguity of data access boundaries means that users lack effective restrictions on the scope of operations on business data, which can easily lead to security risks such as unauthorized access. Furthermore, permission configuration relies on manual maintenance, which is not only complex but also difficult to adapt to rapidly changing business needs. Since each microservice typically needs to independently handle user authentication and authorization, this not only increases the complexity and operational costs of permission management, but also easily leads to inconsistent permission policies between different services, which in turn affects the integration efficiency of the microservice system and may introduce potential security vulnerabilities.

[0004] For example, the patent application document with application publication number CN115277234A discloses a security authentication method and system based on the microservice of the Internet of Things platform. This security authentication method improves the traditional permission authentication that needs to be processed in each microservice, and decouples the processing of permission verification and business logic. However, this security authentication method requires the interface information of the microservice to be manually entered into the permission verification service, which will lead to the problem of low integration efficiency of the microservice system. Summary of the Invention

[0005] The purpose of the present invention is to provide a microservice system interface authority management and authentication method and related devices to solve the problem of low integration efficiency of microservice systems in the prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In a first aspect, the present invention provides a microservice system interface authority management and authentication method, comprising the following steps: Build an API gateway and use it as a unified entry point for external requests. Perform preliminary security checks, flow control, routing forwarding, user authentication, and interface permission control in the API gateway. Build the Nacos configuration management center to store the interface permission information, user role information, and permission configuration information of the microservice system; Deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center. Start the role permission configuration server, in which the interface permission information of the microservice system, user role information, and permission configuration information are centrally managed, and users, roles, and permissions are uniformly allocated; Start the single-point authentication server and verify the user's identity in the single-point authentication server.

[0007] A further improvement of the present invention is that the deployment mode of the API gateway is cluster deployment, single-point deployment, and cluster and single-point simultaneous deployment.

[0008] A further improvement of the present invention is that the interface permission control is specifically implemented through a multi-dimensional dynamic permission control model, which takes the interface of the microservice system as the minimum permission unit, and each permission unit supports the configuration of several data rules.

[0009] A further improvement of the present invention is that the data rule includes a weight coefficient, a conditional expression and a data restriction parameter.

[0010] A further improvement of the present invention is that a microservice plug-in is deployed on each microservice node based on the Spring Boot framework, the Gin framework and the Flask framework.

[0011] A further improvement of the present invention is that the microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, specifically including: The interface information of the microservice system and the permission description information corresponding to the interface information are automatically collected through class loader interception, bytecode enhancement or configuration file injection.

[0012] A further improvement of the present invention is that when verifying the user identity in the single-point authentication server, several verification modes are supported.

[0013] In a second aspect, the present invention provides a unified interface authority management and authentication system in a microservice architecture, including an API gateway building module, a configuration management center building module, a data acquisition module, a management module, and a user verification module; The API gateway building module is used to build an API gateway, use the API gateway as a unified entrance for external requests, and perform preliminary security checks, flow control, routing forwarding, user identity authentication, and interface permission control in the API gateway; The configuration management center building module is used to build the Nacos configuration management center, and store the interface permission information, user role information and permission configuration information of the microservice system in the Nacos configuration management center; The data acquisition module is used to deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center; The management module is used to start the role authority configuration server, in which the interface authority information of the microservice system, user role information and authority configuration information are uniformly managed, and users, roles and permissions are uniformly allocated; The user verification module is used to start a single-point authentication server and verify the user identity in the single-point authentication server.

[0014] In a third aspect, the present invention provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the microservice system interface authority management and authentication method introduced above are implemented.

[0015] In a fourth aspect, the present invention provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the microservice system interface authority management and authentication method introduced above.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention is an improved invention. Compared with the existing microservice system interface permission management and authentication method, on the one hand, the microservice plug-in of the present invention automatically collects the interface information of the microservice system and the permission information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center. It can be seen that the present invention does not need to manually enter the interface information of the microservice system into the permission verification service. The present invention can not only reduce the manual operation cost through the automated synchronization process, but also reduce the dependence on manual operation, thereby improving the integration efficiency of the microservice system, thereby effectively solving the problem of low integration efficiency of the microservice system in the prior art. On the other hand, the present invention uniformly manages the interface permission information of the microservice system and the user role information and permission configuration information in the role permission configuration server, and uniformly allocates users, roles and permissions. This operation can improve the security controllability and maintainability of the overall microservice system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of the microservice system interface authority management and authentication method of the present invention; Figure 2 A schematic diagram of a unified interface authority management and authentication system in a microservice architecture of the present invention; Figure 3 This is a schematic diagram of a unified interface authority management and authentication method in a microservice architecture in Example 3 of the present invention; Figure 4 This is a schematic diagram of the deployment method of the API gateway of the present invention; Figure 5 This is a schematic diagram of the multi-dimensional dynamic authority control model of the present invention; Figure 6 This is a user role authority allocation schematic diagram of the present invention; Figure 7 This is a flow chart of user identity authentication according to the present invention; Figure 8 Schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0018] In order to further understand the content of the present invention, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the embodiments are only for explaining the present invention and are not intended to limit it.

[0019] The proposed microservice system interface permission management and authentication method deploys a microservice plug-in on each microservice node. The plug-in automatically collects the microservice system's interface information and the corresponding permission description information. The plug-in then synchronizes this information with all API gateway nodes via the Nacos configuration management center. Compared to existing technologies, this method effectively addresses the low integration efficiency of microservice systems.

[0020] Example 1: The flowchart of the microservice system interface authority management and authentication method of the present invention is as follows Figure 1 As shown, the microservice system interface authority management and authentication method of the present invention includes the following steps: S1. Build an API gateway as a unified entry point for external requests, and perform preliminary security checks, traffic control, routing forwarding, user authentication, and interface permission control in the API gateway. S2. Build the Nacos configuration management center, which stores the interface permission information, user role information, and permission configuration information of the microservice system; S3. Deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos Configuration Management Center. S4. Start the role permission configuration server, in which the interface permission information of the microservice system, user role information, and permission configuration information are centrally managed, and users, roles, and permissions are uniformly allocated; S5. Start the single-point authentication server and verify the user's identity in the single-point authentication server.

[0021] Example 2: The schematic diagram of the microservice system interface authority management and authentication system of the present invention is as follows Figure 2 As shown, the microservice system interface authority management and authentication system of the present invention includes an API gateway construction module, a configuration management center construction module, a data acquisition module, a management module and a user verification module.

[0022] The API gateway building module is used to build the API gateway, using the API gateway as a unified entry point for external requests, and performing preliminary security checks, traffic control, routing forwarding, user authentication, and interface permission control in the API gateway.

[0023] The configuration management center building module is used to build the Nacos configuration management center, which stores the interface permission information of the microservice system, user role information, and permission configuration information.

[0024] The data collection module is used to deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center.

[0025] The management module is used to start the role permission configuration server, in which the interface permission information of the microservice system, user role information and permission configuration information are uniformly managed, and users, roles and permissions are uniformly allocated.

[0026] The user authentication module is used to start a single-point authentication server and verify the user's identity in the single-point authentication server.

[0027] Example 3: The principle diagram of the microservice system interface authority management and authentication method of the present invention is as follows Figure 3As shown, the microservice system interface authority management and authentication system of the present invention includes the following steps: S1. Build an API gateway and use it as a unified entry point for external requests. Perform preliminary security checks, traffic control, routing forwarding, user authentication, and interface permission control in the API gateway.

[0028] The deployment mode of API gateway (also called API gateway cluster) is cluster deployment, single point deployment and cluster and single point deployment at the same time. The principle diagram of the deployment mode of API gateway of the present invention is as follows: Figure 4 As shown, the following is a detailed description of cluster deployment and single-point deployment: 1. Cluster deployment Cluster deployment is suitable for high-concurrency, large-scale business environments.

[0029] This invention supports a distributed cluster deployment mode, which can perform load balancing scheduling among multiple gateway nodes, significantly improving the system's throughput, availability, and horizontal scalability. The main features of cluster deployment are described as follows: (1) Load balancing By integrating Nginx or other mainstream load balancers, user requests are intelligently distributed to different gateway instances, ensuring that request pressure is evenly distributed among nodes and avoiding single-point performance bottlenecks.

[0030] (2) High availability design Adopting a stateless architecture design, all gateway nodes share a unified configuration center (such as Nacos) and cache system (such as Redis). The failure of any node will not affect the overall service continuity, ensuring the stable operation of the system under abnormal circumstances.

[0031] (3) Elastic expansion and contraction The number of gateway nodes can be increased or decreased according to the actual business load without modifying the existing system architecture or reconfiguring the permission policy, thus meeting the sudden traffic demand during business peak periods while reducing the resource occupation cost during off-peak periods.

[0032] 2. Single point deployment Single-point deployment is suitable for lightweight applications or test environments. This invention supports a simple and efficient single-point deployment mode, which only requires the deployment of a gateway node to complete the entire permission control process, facilitating rapid construction, debugging, and verification functions.

[0033] 3. Unified configuration management supports multiple deployment modes (also known as cluster and single-point deployment) Regardless of the deployment method adopted, the system (also called microservice system) relies on a unified configuration center and caching mechanism to achieve centralized management and real-time synchronization of core metadata such as interface permission information, data rules, and routing configuration, ensuring the consistency and timely effectiveness of permission policies in different deployment environments.

[0034] In this step, the interface authority control is specifically implemented through a multi-dimensional dynamic authority control model. The principle diagram of the multi-dimensional dynamic authority control model of the present invention is as follows: Figure 5 As shown in the figure, the multi-dimensional dynamic permission control model uses the interface of the microservice system (also called microservice) as the minimum permission unit (also called permission point). Each permission unit supports the configuration of several data rules. The permission points are explained in detail below: Each permission point (including permission code, permission name and permission description) corresponds to one or more microservice interfaces. Each microservice system interface includes information such as interface path and request method.

[0035] Permission points can be bound to roles or users to control who can access all interfaces under the permission point.

[0036] The present invention can configure one or more groups of data rules (Data Rules) for the permission point to further refine the access control policy.

[0037] Data rules include weight coefficients, conditional expressions, and data restriction parameters. The following is a detailed description of weight coefficients, conditional expressions, and data restriction parameters: A. Weight coefficient The weight coefficient indicates the priority of a data rule. A larger weight coefficient indicates a higher priority data rule. The weight coefficient is used to resolve conflicts and priority issues between multiple rules under the same permission point.

[0038] When a user obtains different data rules for the same permission point through multiple roles, the system filters out the rule set with the highest priority based on the weight coefficient.

[0039] If multiple data rules have different weight coefficients, the data rule with the highest weight coefficient will be retained; If multiple rules still exist after filtering based on weight coefficients, they are calculated separately using the logical "OR" and the results are merged; This mechanism can effectively avoid common problems such as mutual exclusion, duplication, and contradiction in permission policies, and improve the stability and consistency of the system.

[0040] B. Conditional Expression A conditional expression is a Boolean expression used to describe dynamic conditions for access control.

[0041] Conditional expressions can reference variables such as user attributes (such as user ID, role, and department) and request context (such as request IP address, time, and device type).

[0042] The system dynamically parses and calculates this expression during the permission verification phase: If the result is True, it means the condition is met and the subsequent operation continues; If the result is False, access is denied directly.

[0043] C. Data restriction parameters (also called append / overwrite parameters) Data restriction parameters are used to dynamically inject or modify interface (also called service interface) request parameters to limit the user's data access scope.

[0044] Data restriction parameter values ​​are generated through custom expressions, which can reference user attributes, request parameters, and system environment variables.

[0045] Data restriction parameter injection methods include request header appending, request body field injection, and query parameter addition.

[0046] S2. Build the Nacos configuration management center to store the interface permission information, user role information, and permission configuration information of the microservice system.

[0047] S3. Deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center.

[0048] In this step, microservice plug-ins are deployed on each microservice node based on the Spring Boot framework, Gin framework, and Flask framework.

[0049] In this step, the microservice plug-in automatically collects the interface information of the microservice system and the corresponding permission description information (such as permission points, permission names, and data rules). Specifically, the collection includes: The interface information of the microservice system and the corresponding permission description information of the interface information are automatically collected through class loader interception, bytecode enhancement or configuration file injection. The following is a detailed description of the process: A. Interface collection and upload plug-in We develop lightweight plug-in modules (microservice plug-ins) using mainstream development languages ​​(such as Java, Go, and Python) and frameworks (such as Spring Boot, Gin, and Flask). These plug-ins are non-invasively integrated into the microservice system, automatically collecting interfaces through classloader interception, bytecode enhancement, and configuration file injection.

[0050] B. Automatically scan interface information when the microservice system starts During the startup of the microservice system, the microservice plug-in automatically performs the following operations: Scan and parse interface definitions: Extract interface metadata from annotations (such as @RequestMapping, @Permission) or YAML / JSON / XML configuration files, including additional information such as the interface path (URL, Uniform Resource Locator), request method (GET / POST, etc.), parameter type and format, and permission point (P).

[0051] C. Structured processing and centralized storage The microservice plug-in standardizes and structures the collected interface information to form a unified data model, such as an interface description object in JSON format, which contains fields such as interface address, parameter structure, required permission points, and data rule expressions.

[0052] The microservice plug-in then synchronizes this information to a centralized storage system, such as Nacos (also called Nacos Configuration Management Center) or Redis.

[0053] D. The permission gateway monitors configuration changes and refreshes the cache in real time The API Gateway permission verification service has a built-in monitoring mechanism that subscribes to the interface permission configuration nodes of Nacos or other configuration centers. When the microservice interface information changes (such as new interfaces, permission changes, and data rule adjustments), the microservice system automatically pulls the interface information of the relevant services and automatically updates the interface permission mapping information in the local cache without restarting the gateway service.

[0054] S4. Start the role permission configuration server, in which the interface permission information of the microservice system, user role information, and permission configuration information are uniformly managed, and users, roles, and permissions are uniformly allocated.

[0055] The process of assigning permissions to user role information in this step is described as follows. Figure 6 As shown: The administrator selects the target role and assigns the required permission points to it (the permission points include one or more service interfaces); If the permission point includes data rules, the administrator also needs to select the applicable data rules for the role; The system binds roles with permission points and selected data rules, and persists them to the permission center; During the authentication process, the API gateway dynamically loads the corresponding control logic based on the data rules bound to the role.

[0056] S5. Start the single-point authentication server and verify the user's identity in the single-point authentication server.

[0057] The process of verifying the user identity in the single point authentication server in this step is described as follows. Figure 7 As shown: a. User authentication and token issuance The user submits identity credentials (such as username / password and OAuth2 token) through the single-sign-on service (SSO). After verification, the server generates a security token (JWT) containing user information (such as user ID, role, and department) and returns it to the client.

[0058] b. Client carries token request interface When the client calls the microservice interface, it appends the JWT to the request header (e.g. Authorization: Bearer <token>) and initiates a request to the API Gateway.

[0059] c.API Gateway verifies token validity After receiving the request, the API Gateway obtains the JWT from the message header. If it is empty, it returns a login error. It then verifies the validity of the JWT. If it is invalid (for example, expired or tampered), it directly returns a 401 error (returning a 401 indicates an unauthorized client error). If valid, the user's basic information (such as user ID, role, department, etc.) is parsed for subsequent authentication.

[0060] d. Extract service and interface information Extract the target microservice ID and specific interface path (path1) from the request.

[0061] e. Check routing configuration Determine whether routing rules have been configured in the gateway based on the microservice ID. If not, a "service not configured" error is returned. If configured, proceed to the next step.

[0062] f. Interface permission check (whitelist mechanism) Search the local cache or database for the permission identifier (P1) corresponding to the interface (path1). If P1 is empty, no permission is required and the access is allowed. If it exists, the permission verification process begins.

[0063] g. Permission matching verification Based on the user's role or user ID, query the permission list they have. If the permission point P1 is included, the permission verification is passed; otherwise, return 403.

[0064] h. Data rule judgment and processing If data rules are configured for permission point P1, perform the following operations: a) Conditional expression evaluation If a conditional expression (such as based on role, department, time, value, etc.) is configured in the data rule, dynamic calculation is performed.

[0065] If the expression result is True, continue execution; otherwise, return 403 (returning 403 means no permission, execution is denied).

[0066] If no expression is configured, it defaults to True.

[0067] b) Multi-rule logic processing If there are multiple data rules, filter them according to the weight (take the one with the highest weight). If there are multiple rules after filtering, process them according to the logical "OR" and any rule that is met will pass.

[0068] i. Dynamic injection of request parameters If the data rule defines restriction parameters (such as filter conditions, maximum number of entries, etc.), the parameter value expression is calculated first, and then the calculated parameter value is written to the request header or request body in an appended or overwritten manner.

[0069] j. Gateway issues anti-bypass Token To prevent the client from bypassing the gateway and directly accessing the microservice, the gateway generates a temporary signature token. The temporary signature token includes the request timestamp, user ID, microservice ID, interface path, and tamper-proof signature.

[0070] Add this token to the request header for verification by downstream microservices.

[0071] k. Request routing to target microservice According to the routing configuration, the request is forwarded to the corresponding microservice interface.

[0072] l. Microservice secondary authentication After receiving the request, the microservice verifies the Token issued by the gateway through the global interceptor: If verification fails (illegal signature, timeout, etc.), return 401; If successful, continue executing the business logic.

[0073] The present invention also adopts two performance optimization strategies and security reinforcement measures, which are described in detail below: 2 performance optimization strategies: Caching strategy: Use memory cache (local cache + Redis) to store frequently used permission data to reduce the number of database queries.

[0074] Load balancing strategy: Enable multiple API gateway instances and use a load balancer to distribute requests to different authentication and authorization service instances to improve system throughput.

[0075] Security reinforcement measures: Token Security: Use strong encryption algorithms to protect token contents and regularly rotate keys to prevent long-term security threats.

[0076] Rate Limiting & Throttling: Limit the access frequency of malicious users and protect the system from denial of service attacks.

[0077] Security Monitoring: Integrates intrusion detection systems (IDS) and log analysis tools to detect abnormal behavior in a timely manner.

[0078] Example 4: See also Figure 8 As shown, the present invention also provides an electronic device 100 for a microservice system interface authority management and authentication method; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0079] The memory 101 can be used to store the computer program 103. The processor 102 implements the steps of the microservice system interface authority management and authentication method described in Example 2 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created according to the use of the electronic device 100 (such as audio data). In addition, the memory 101 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device.

[0080] The at least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100 and connects various parts of the entire electronic device 100 using various interfaces and lines.

[0081] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a microservice system interface authority management and authentication method, and the processor 102 can execute the plurality of instructions to implement: Build an API gateway and use it as a unified entry point for external requests. Perform preliminary security checks, flow control, routing forwarding, user authentication, and interface permission control in the API gateway. Build the Nacos configuration management center to store the interface permission information, user role information, and permission configuration information of the microservice system; Deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center. Start the role permission configuration server, in which the interface permission information of the microservice system, user role information, and permission configuration information are centrally managed, and users, roles, and permissions are uniformly allocated; Start the single-point authentication server and verify the user's identity in the single-point authentication server.

[0082] Example 5: If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0083] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0085] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0086] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.< / token>

Claims

1. A microservice system interface authority management and authentication method, characterized in that: The following steps are involved: Build an API gateway and use it as a unified entry point for external requests. Perform preliminary security checks, flow control, routing forwarding, user authentication, and interface permission control in the API gateway. Build the Nacos configuration management center to store the interface permission information, user role information, and permission configuration information of the microservice system; Deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information corresponding to the interface information to all API gateway nodes through the Nacos configuration management center. Start the role permission configuration server, in which the interface permission information of the microservice system, user role information, and permission configuration information are centrally managed, and users, roles, and permissions are uniformly allocated; Start the single-point authentication server and verify the user's identity in the single-point authentication server.

2. The microservice system interface authority management and authentication method according to claim 1, characterized in that: The API gateway can be deployed in clusters, single-point deployment, or both.

3. The microservice system interface authority management and authentication method according to claim 1, characterized in that: The interface permission control is specifically implemented through a multi-dimensional dynamic permission control model. The multi-dimensional dynamic permission control model takes the interface of the microservice system as the minimum permission unit, and each permission unit supports the configuration of several data rules.

4. The microservice system interface authority management and authentication method according to claim 3 is characterized in that: The data rules include weight coefficients, conditional expressions and data restriction parameters.

5. The microservice system interface authority management and authentication method according to claim 1, characterized in that: Microservice plug-ins are deployed on each microservice node based on the Spring Boot framework, Gin framework, and Flask framework.

6. The microservice system interface authority management and authentication method according to claim 1, characterized in that: The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, specifically including: The interface information of the microservice system and the permission description information corresponding to the interface information are automatically collected through class loader interception, bytecode enhancement or configuration file injection.

7. The microservice system interface authority management and authentication method according to claim 1, characterized in that: When verifying user identity in a single-point authentication server, several verification methods are supported.

8. A microservice system interface authority management and authentication system, characterized in that: Including API gateway construction module, configuration management center construction module, data collection module, management module and user verification module; The API gateway building module is used to build an API gateway, use the API gateway as a unified entrance for external requests, and perform preliminary security checks, flow control, routing forwarding, user identity authentication, and interface permission control in the API gateway; The configuration management center building module is used to build the Nacos configuration management center, and store the interface permission information, user role information and permission configuration information of the microservice system in the Nacos configuration management center; The data acquisition module is used to deploy a microservice plug-in on each microservice node. The microservice plug-in automatically collects the interface information of the microservice system and the permission description information corresponding to the interface information, and synchronizes the interface information of the microservice system and the permission description information of the interface information to all API gateway nodes through the Nacos configuration management center; The management module is used to start the role authority configuration server, in which the interface authority information of the microservice system, user role information and authority configuration information are uniformly managed, and users, roles and permissions are uniformly allocated; The user verification module is used to start a single-point authentication server and verify the user identity in the single-point authentication server.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the microservice system interface authority management and authentication method described in any one of claims 1 to 7 are implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the microservice system interface authority management and authentication method described in any one of claims 1 to 7 are implemented.

Images