Microservice call authentication method, device, equipment and storage medium

Abstract

The present invention relates to the field of information security technology, and discloses a microservice call authentication method, device, equipment and storage medium, which are used to improve the call authentication efficiency and business operation efficiency of microservices. The microservice call authentication method includes: receiving a microservice call request, obtaining the microservice address of the calling server and the microservice interface to be called; encapsulating a preset mapping list to obtain first configuration information; judging whether the microservice address exists in the first configuration information; if so, reading the microservice name of the calling server from the first configuration information; parsing the second configuration information from the preset configuration file according to the microservice interface to be called, performing authentication according to the microservice name and the second configuration information, and obtaining an authentication result; if the authentication result is successful authentication, sending the response information corresponding to the microservice interface to be called to the calling server.

Description

Technical Field

[0001] The present invention relates to the field of access rules, and in particular to a method, device, equipment and storage medium for microservice call authentication. Background Art

[0002] Microservices is an emerging software architecture that splits a large single application and service into multiple microservices. A microservice strategy can make life easier by scaling a single component instead of the entire application stack to meet service level agreements.

[0003] Under the microservice architecture, the system will be divided into multiple services according to the business, each of which is responsible for a single business. Therefore, it is necessary to ensure the security of each application programming interface (API). In other words, the service is not open, but requires authorization to access, to prevent the interface from being accessed by illegal requests.

[0004] There are many microservice authentication products in the prior art, such as tokens and open authorization oauth. This authentication mechanism can effectively authenticate the call of microservices, but the authentication process and call process are relatively complex, and excessive attention is paid to authentication details, resulting in low business iteration efficiency. That is, after the monolithic system is split into microservices, multiple microservices use the oauth mechanism for call authentication, which reduces business operation efficiency. Summary of the invention

[0005] The main purpose of the present invention is to solve the technical problem that the oauth mechanism is used for call authentication between microservices, which reduces the efficiency of business operation.

[0006] To achieve the above-mentioned object, the first aspect of the present invention provides a method for invoking a microservice, comprising: receiving a microservice invoking request, the microservice invoking request including a microservice address of a calling server and a microservice interface to be called; encapsulating a preset mapping list to obtain first configuration information, the preset mapping list being used to indicate a mapping relationship between a microservice name and a microservice address; judging whether the microservice address of the calling server exists in the first configuration information; if the microservice address of the calling server exists in the first configuration information, reading the microservice name of the calling server from the first configuration information according to the microservice address of the calling server; parsing second configuration information from a preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of a preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice and a name list of the preset microservice; performing authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result; if the authentication result is that the authentication is successful, sending the response information corresponding to the microservice interface to be called to the calling server.

[0007] Optionally, in a first implementation manner of the first aspect of the present invention, the preset mapping list is encapsulated to obtain the first configuration information, and the preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address, including: obtaining a preset mapping list from a preset registration center service according to a preset duration or a preset time through a preset scheduled task, and the preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address; encapsulating the preset mapping list according to a preset format to obtain the first configuration information; and storing the first configuration information in a memory database.

[0008] Optionally, in a second implementation method of the first aspect of the present invention, determining whether the microservice address of the calling server exists in the first configuration information includes: reading the first configuration information from the memory database and parsing the first configuration information; setting the microservice address of the calling server as the target value, and querying the microservice name corresponding to the target value in the parsed first configuration information; determining whether the microservice name corresponding to the target value is a null value; if the microservice name corresponding to the target value is the null value, determining that the microservice address of the calling server does not exist in the first configuration information; if the microservice name corresponding to the target value is not the null value, and the target key is a string set according to a preset rule, determining that the microservice address of the calling server exists in the first configuration information.

[0009] Optionally, in a third implementation manner of the first aspect of the present invention, if the microservice address of the calling server exists in the first configuration information, then reading the microservice name of the calling server from the first configuration information according to the microservice address of the calling server includes: if the microservice address of the calling server exists in the first configuration information, then determining the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server; and setting the microservice name corresponding to the target value as the microservice name of the calling server.

[0010] Optionally, in a fourth implementation method of the first aspect of the present invention, the second configuration information is parsed from a preset configuration file according to the microservice interface to be called, and the second configuration information includes a call authentication configuration prefix of the preset microservice, a call interface that supports wildcards, the authentication type of the preset microservice, and a list of names of the preset microservices. The method includes: concatenating the call authentication configuration prefix of the microservice and the microservice interface to be called according to preset rules; reading the preset configuration file according to the concatenated string to obtain initial configuration information; generating a target regular expression according to the authentication type of the preset microservice; filtering and processing the initial configuration information according to the target regular expression to obtain the second configuration information, and the second configuration information includes the call authentication configuration prefix of the preset microservice, a call interface that supports wildcards, the authentication type of the preset microservice, and a list of names of the preset microservices.

[0011] Optionally, in a fifth implementation manner of the first aspect of the present invention, the authentication is performed according to the microservice name of the calling server and the second configuration information to obtain an authentication result, including: parsing the second configuration information to obtain a name list of the preset microservices; comparing the microservice name of the calling server with the name list of the preset microservices according to a preset string function to obtain a function return value; if the function return value is equal to the first preset value, determining that the authentication result is an authentication failure; if the function return value is greater than or equal to the second preset value, determining that the authentication result is an authentication success; and recording the authentication result, the microservice name of the calling server, and the second configuration information in a preset microservice log.

[0012] Optionally, in a sixth implementation manner of the first aspect of the present invention, before obtaining the microservice call request and parsing the microservice call request to obtain the microservice address of the calling server and the microservice interface to be called, the microservice call authentication method also includes: setting a call authentication flag for the microservice, the call authentication flag for the microservice including a first preset flag and a second preset flag; judging whether to perform authentication-free access according to the call authentication flag of the microservice; if the call authentication flag of the microservice is the first preset flag, determining to perform authentication-free access; if the call authentication flag of the microservice is the second preset flag, determining to perform authenticated access.

[0013] The second aspect of the present invention provides a microservice call authentication device, comprising: a receiving unit, used to receive a microservice call request, the microservice call request including a microservice address of a calling server and a microservice interface to be called; an encapsulation unit, used to encapsulate a preset mapping list to obtain first configuration information, the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; a first judgment unit, used to judge whether the microservice address of the calling server exists in the first configuration information; a processing unit, if the microservice address of the calling server exists in the first configuration information, is used to process the microservice address of the calling server according to the microservice address of the calling server. The microservice name of the calling server is read from the first configuration information; a parsing unit is used to parse the preset configuration file to obtain the second configuration information according to the microservice interface to be called, wherein the second configuration information includes a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice; an authentication unit is used to perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result; a sending unit is used to send the response information corresponding to the microservice interface to be called to the calling server if the authentication result is that the authentication is successful.

[0014] Optionally, in a first implementation method of the second aspect of the present invention, the encapsulation unit is specifically used to: obtain a preset mapping list from a preset registration center service according to a preset duration or a preset time through a preset scheduled task, wherein the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; encapsulate the preset mapping list according to a preset format to obtain first configuration information; and store the first configuration information in a memory database.

[0015] Optionally, in a second implementation method of the second aspect of the present invention, the first judgment unit is specifically used to: read the first configuration information from the memory database and parse the first configuration information; set the microservice address of the calling server as the target value, and query the microservice name corresponding to the target value in the parsed first configuration information; determine whether the microservice name corresponding to the target value is a null value; if the microservice name corresponding to the target value is the null value, determine that the microservice address of the calling server does not exist in the first configuration information; if the microservice name corresponding to the target value is not the null value, and the microservice name corresponding to the target value is a string set according to a preset rule, determine that the microservice address of the calling server exists in the first configuration information.

[0016] Optionally, in a third implementation method of the second aspect of the present invention, the processing unit is specifically used to: if the microservice address of the calling server exists in the first configuration information, determine the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server; and set the microservice name corresponding to the target value as the microservice name of the calling server.

[0017] Optionally, in a fourth implementation manner of the second aspect of the present invention, the encapsulation unit is specifically used to: perform string concatenation of the call authentication configuration prefix of the preset microservice and the microservice interface to be called according to preset rules; read the preset configuration file according to the concatenated string to obtain initial configuration information; generate a target regular expression according to the authentication type of the preset microservice; filter and process the initial configuration information according to the target regular expression to obtain second configuration information, wherein the second configuration information includes the call authentication configuration prefix of the preset microservice, a call interface that supports wildcards, the authentication type of the preset microservice, and a name list of the preset microservices.

[0018] Optionally, in a fifth implementation manner of the second aspect of the present invention, the authentication unit is specifically used to: parse the second configuration information to obtain a name list of the preset microservices; compare the microservice name of the calling server with the name list of the preset microservices according to a preset string function to obtain a function return value; if the function return value is equal to a first preset value, determine that the authentication result is an authentication failure; if the function return value is greater than or equal to a second preset value, determine that the authentication result is an authentication success; and record the authentication result, the microservice name of the calling server and the second configuration information in a preset microservice log.

[0019] Optionally, in a sixth implementation manner of the second aspect of the present invention, the microservice call authentication device further includes: a setting unit, used to set a call authentication flag of the microservice, the call authentication flag of the microservice including a first preset flag and a second preset flag; a second judgment unit, used to judge whether to perform authentication-free access according to the call authentication flag of the microservice; a first determination unit, used to determine whether to perform authentication-free access if the call authentication flag of the microservice is the first preset flag; and a second determination unit, used to determine whether to perform authentication access if the call authentication flag of the microservice is the second preset flag.

[0020] A third aspect of the present invention provides a microservice call authentication device, comprising: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via a line; the at least one processor calls the instructions in the memory so that the microservice call authentication device executes the microservice call authentication method described in the first aspect above.

[0021] A fourth aspect of the present invention provides a computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes the microservice call authentication method described in the first aspect above.

[0022] In the technical solution provided by the present invention, a microservice call request is received, the microservice call request includes a microservice address of a calling server and a microservice interface to be called; a preset mapping list is encapsulated to obtain first configuration information, the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; it is determined whether the microservice address of the calling server exists in the first configuration information; if the microservice address of the calling server exists in the first configuration information, the microservice name of the calling server is read from the first configuration information according to the microservice address of the calling server; second configuration information is obtained by parsing from a preset configuration file according to the microservice interface to be called, the second configuration information includes a call authentication configuration prefix of a preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice; authentication is performed according to the microservice name of the calling server and the second configuration information to obtain an authentication result; if the authentication result is that the authentication is successful, the response information corresponding to the microservice interface to be called is sent to the calling server. In an embodiment of the present invention, the microservice name of the calling server is determined from the configuration of the registration center service by calling the microservice address of the server, and authentication is performed according to the microservice name of the calling server and preset configuration information to obtain an authentication result, thereby improving the calling authentication efficiency and business operation efficiency of the microservice. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of an embodiment of a method for invoking and authenticating a microservice in an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of another embodiment of a method for invoking and authenticating a microservice in an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of an embodiment of a microservice call authentication device in an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of another embodiment of a microservice call authentication device in an embodiment of the present invention;

[0027] Figure 5 The figure is a schematic diagram of an embodiment of a microservice call authentication device in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The embodiments of the present invention provide a method, apparatus, device and storage medium for microservice call authentication, which are used to determine the microservice name of the calling server from the configuration of the registration center service by calling the microservice address of the server, perform authentication according to the microservice name of the calling server and preset configuration information, obtain an authentication result, and improve the call authentication efficiency and business operation efficiency of the microservice.

[0029] In order to enable those skilled in the art to better understand the solutions of the present invention, the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0030] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the microservice call authentication method in an embodiment of the present invention includes:

[0032] 101. Receive a microservice call request, where the microservice call request includes a microservice address of a calling server and a microservice interface to be called;

[0033] The server receives a microservice call request, which includes the microservice address of the calling server and the microservice interface to be called. For example, the microservice calling the server is A, the microservice address of the calling server is 10.0.0.1, the microservice to be called is B, and the microservice interface to be called is / demo.

[0034] It should be noted that microservices use a set of small services to develop a single application. Each service runs in its own process. Microservices communicate using lightweight mechanisms, such as application programming interfaces that support the Hypertext Transfer Protocol. Microservices are built based on actual business and can be independently deployed through automated deployment mechanisms. They can be implemented in different programming languages ​​and centrally managed using different data storage technologies.

[0035] 102. Encapsulate a preset mapping list to obtain first configuration information, where the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address;

[0036] The server encapsulates the preset mapping list to obtain the first configuration information. The preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address. Further, the server obtains the preset mapping list from the preset registration center service. For example, the called microservice B sends a request to obtain the preset mapping list to the registration center every 30 seconds, and obtains the mapping list between the microservice name and the microservice address as shown below:

[0037] {"microserverA":["10.0.0.1:2233","10.0.0.2:2233"],

[0038] "microserverB":["10.0.1.1:4455","10.0.1.2:4455"]};

[0039] Among them, the microservice name and microservice address are a one-to-many relationship.

[0040] It should be noted that the pre-set registration center service is the address book in the microservice architecture, which records the mapping relationship between microservice names and microservice addresses. In the distributed architecture, different microservices are uniformly registered in the registration center service. The server periodically obtains the list of microservice names and network protocol addresses from the pre-set registration center service, and can update the cached mapping list of microservice names and microservice addresses.

[0041] 103. Determine whether the microservice address of the calling server exists in the first configuration information;

[0042] The server determines whether the microservice address of the calling server is in the first configuration information. For example, if the microservice address of the calling server is 10.0.1.1 and the first configuration information includes 10.0.1.1, the server determines that the microservice address of the calling server is in the first configuration information and executes step 104.

[0043] It can be understood that the server periodically updates the first configuration information because the microservice sends a heartbeat request to the preset registration center service according to the preset duration, and the preset registration center service receives the heartbeat request. When the preset registration center service does not receive the heartbeat request within the preset duration, it is determined that the microservice is dead, and the microservice name and the microservice address are deleted. Correspondingly, the microservice name and the microservice address will also be deleted in the first configuration information.

[0044] 104. If the microservice address of the calling server exists in the first configuration information, read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server;

[0045] If the microservice address of the calling server exists in the first configuration information, the server reads the microservice name of the calling server from the first configuration information according to the microservice address of the calling server. For example, the preset mapping list is {"microserverA":["10.0.0.1:2233","10.0.0.2:2233"],

[0046] "microserverB":["10.0.1.1:4455","10.0.1.2:4455"]}, the microservice address of the calling server is 10.0.0.1:2233, and the server determines that microserverA corresponding to 10.0.0.1:2233 is the microservice name of the calling server.

[0047] 105. Obtain second configuration information by parsing from a preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices;

[0048] The server parses the preset configuration file to obtain the second configuration information according to the microservice interface to be called. The second configuration information includes the call authentication configuration prefix of the preset microservice, the call interface that supports wildcards, the authentication type of the preset microservice, and the name list of the preset microservice. Among them, the preset configuration file is the bootstrap.properties file. For example, the server configures the MSA call authentication information in bootstrap.properties as follows:

[0049] interfaceAuth.authMap. / demo={"type":"m2m","serviceId":"MicroServer1,MicroServer2"}, the server parses and obtains the second configuration information as shown in Table 1:

[0050] Table 1: Second configuration information table

[0051]

[0052] 106. Perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result;

[0053] The server performs authentication based on the microservice name of the calling server and the second configuration information to obtain an authentication result. Authentication refers to verifying whether microservices can be called normally. Specifically, the server determines whether the microservice name of the calling server exists in the second configuration information. Further, the server determines whether the microservice name of the calling server exists in the name list of preset microservices. If the microservice name of the calling server does not exist in the name list of preset microservices, the server determines that the authentication result is an authentication failure. If the microservice name of the calling server exists in the name list of preset microservices, the server determines that the authentication result is an authentication success and executes step 107.

[0054] 107. If the authentication result is successful, the response information corresponding to the microservice interface to be called is sent to the calling server.

[0055] If the authentication result is successful, the server will send the response information corresponding to the microservice interface to be called to the calling server. For example, MSA (also MicroServerA) calls the interface / demo of MSB (also MicroServerB). MSB configures the following configuration in the preset configuration file to implement the interface / demo only for MSA to call. Other calling servers will prompt authentication failure when calling. After the server authentication is successful, the response information corresponding to / demo will be sent to the calling server. The calling server is also a microservice, which further realizes the call authentication between microservices.

[0056] In an embodiment of the present invention, the microservice name of the calling server is determined from the configuration of the registration center service by calling the microservice address of the server, and authentication is performed according to the microservice name of the calling server and preset configuration information to obtain an authentication result, thereby improving the calling authentication efficiency and business operation efficiency of the microservice.

[0057] See also Figure 2Another embodiment of the microservice call authentication method in the embodiment of the present invention includes:

[0058] 201. Obtain a call authentication flag of a microservice, where the call authentication flag of the microservice includes a first preset flag and a second preset flag;

[0059] The server obtains the call authentication flag of the microservice, and the call authentication flag of the microservice includes a first preset flag and a second preset flag, wherein the first is used to indicate that the call of the microservice requires authentication-free access, that is, the call request is made directly without authentication, for example, the first authentication flag includes 00, 10; the second preset flag is used to indicate that the call request of the microservice is authenticated for access, for example, the second authentication flag includes 01, 11, and the specific details are not limited here. Further, the server sets the call authentication flag of the microservice, and the call authentication flag of the microservice includes a first preset flag and a second preset flag; the server determines whether to perform authentication-free access based on the call authentication flag of the microservice; if the call authentication flag of the microservice is the first preset flag, the server determines to perform authentication-free access; if the call authentication flag of the microservice is the second preset flag, the server determines to perform authentication access and executes step 202.

[0060] It is understandable that the call authentication flag of the microservice is set according to the actual business situation, and the call authentication flag of the microservice is stored in a preset file or a preset data table. Optionally, the call authentication flag of the microservice can also be represented by other data or identification strings, which is not limited here.

[0061] 202. When the call authentication flag of the microservice is the first preset flag, a microservice call request is received, where the microservice call request includes a microservice address of a calling server and a microservice interface to be called.

[0062] When the call authentication flag of the microservice is the first preset flag, the server receives a microservice call request, and the microservice call request includes the microservice address of the calling server and the microservice interface to be called. Specifically, the server receives a microservice call request, and the microservice call request includes a hypertext transfer protocol request header, and the hypertext transfer protocol request header includes the microservice address of the calling server and the microservice interface to be called; the server generates an HttpServletRequest object for the microservice call request, and the HttpServletRequest object includes a getRemoteHost() function and a getRequestURI() function; the server obtains the microservice address of the calling server from the hypertext transfer protocol request header through the getRemoteHost() function; the server obtains the microservice interface to be called from the hypertext transfer protocol request header through the getRequestURI() function.

[0063] For example, microservice A and microservice B each include two microservice instances, where the IPs of the two microservice instances in microservice A are 10.0.0.1 and 10.0.0.2, and the IPs of the two microservice instances in microservice B are 10.0.1.1 and 10.0.1.2. When microservice A sends a microservice call request to microservice B, and the call request reaches any instance of microservice B, the server intercepts the HttpServletRequest object by setting a filter, and then obtains the network protocol address of the calling server and the microservice interface to be called in the following way:

[0064] String remoteIp=httpServletRequest.getRemoteHost();

[0065] String uri=request.getRequestURI().

[0066] Furthermore, when the call authentication flag of the microservice is the first preset flag, it is used to indicate that when the preset registration center service is abnormal, the call request of the microservice performs authentication-free access, that is, no authentication is required and the call is made directly. The server determines whether to perform authentication-free access based on the call authentication flag of the microservice. Specifically, the server compares the call authentication flag of the microservice with the first preset flag or the second preset flag; when the call authentication flag of the microservice is equal to the second preset flag, the server determines that the call authentication flag of the microservice is the second preset flag; when the call authentication flag of the microservice is equal to the first preset flag, the server determines that the call authentication flag of the microservice is the first preset flag.

[0067] 203. Encapsulate a preset mapping list to obtain first configuration information, where the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address;

[0068] The server encapsulates the preset mapping list to obtain the first configuration information. The preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address. Specifically, the server obtains the preset mapping list from the preset registration center service according to the preset duration or preset time through the preset scheduled task. The preset mapping list includes a mapping list of microservice names and microservice addresses. For example, the called microservice B sends a request to obtain the mapping list to the registration center every 30 seconds, and obtains the mapping list of microservice names and microservice addresses as shown below:

[0069] {"microserverA":["10.0.0.1:2233","10.0.0.2:2233"],

[0070] "microserverB":["10.0.1.1:4455","10.0.1.2:4455"]};

[0071] Among them, the microservice name and microservice address are a one-to-many relationship.

[0072] Secondly, the server encapsulates the preset mapping list according to the preset format to obtain the first configuration information; then, the server stores the first configuration information in the memory database, and further, the server caches the first configuration information through the remote dictionary server (redis), which is the memory database.

[0073] It should be noted that the pre-set registration center service is the address book in the microservice architecture, which records the mapping relationship between microservice names and microservice addresses. In the distributed architecture, different microservices are uniformly registered in the registration center service. The server periodically obtains the list of microservice names and network protocol addresses from the pre-set registration center service, and updates the mapping list of microservice names and microservice addresses cached in the memory database.

[0074] 204. Determine whether the microservice address of the calling server exists in the first configuration information;

[0075] The server determines whether the microservice address of the calling server exists in the first configuration information. Specifically, the server reads the first configuration information from the memory database and parses the first configuration information; the server sets the microservice address of the calling server as the target value, and queries the microservice name corresponding to the target value in the parsed first configuration information; the server determines whether the microservice name corresponding to the target value is a null value; if the microservice name corresponding to the target value is a null value, the server determines that the microservice address of the calling server does not exist in the first configuration information; if the microservice name corresponding to the target value is not a null value, and the microservice name corresponding to the target value is a string set according to a preset rule, the server determines that the microservice address of the calling server exists in the first configuration information.

[0076] It is understandable that an in-memory database is a database that directly operates on data in memory. Compared with disks, the data read and write speed of memory is several orders of magnitude higher. Storing data in memory can greatly improve application performance compared to accessing it from disk. Therefore, the server reads data faster in the in-memory database, and microservices run more efficiently.

[0077] 205. If the microservice address of the calling server does not exist in the first configuration information, it is determined that the authentication fails;

[0078] If the microservice address of the calling server does not exist in the first configuration information, it is determined that the authentication fails. That is to say, when it is detected that the microservice address of the calling server does not exist in the first configuration information, it indicates that the microservice calling request is an invalid request. Further, when the server determines that the authentication fails, the server records the corresponding microservice calling request, the microservice address of the calling server, the microservice interface to be called, the authentication time, and the reason for the authentication failure in a preset data table for statistical analysis. At the same time, the server executes step 209.

[0079] 206. If the microservice address of the calling server exists in the first configuration information, read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server;

[0080] If the microservice address of the calling server exists in the first configuration information, the server reads the microservice name of the calling server from the first configuration information according to the microservice address of the calling server. Further, if the microservice address of the calling server exists in the first configuration information, the server determines the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server; the server sets the microservice name corresponding to the target value as the microservice name of the calling server, for example, the preset mapping list includes {"microserverA":["10.0.0.1:2233","10.0.0.2:2233"] and "microserverB":["10.0.1.1:4455","10.0.1.2:4455"]}, wherein the microservice address of the calling server is 10.0.0.1:2233, and the server determines that the microserverA corresponding to 10.0.0.1:2233 is the microservice name of the calling server.

[0081] 207. Obtain second configuration information by parsing from a preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices;

[0082] The server parses the preset configuration file to obtain the second configuration information according to the authentication type of the microservice, and the second configuration information includes the call authentication configuration prefix of the preset microservice, the call interface that supports wildcards, the authentication type of the preset microservice, and the name list of the preset microservice. Among them, the preset configuration file is the bootstrap.properties file. Specifically, the server concatenates the call authentication configuration prefix of the preset microservice and the microservice interface to be called according to the preset rules; the server reads the preset configuration file according to the concatenated string to obtain the initial configuration information; the server generates a target regular expression according to the authentication type of the preset microservice; the server filters and processes the initial configuration information according to the target regular expression to obtain the second configuration information, and the second configuration information includes the call authentication configuration prefix of the preset microservice, the call interface that supports wildcards, the authentication type of the preset microservice, and the name list of the preset microservice. For example, the server configures the MSA call authentication information in bootstrap.properties as follows:

[0083] interfaceAuth.authMap. / demo={"type":"m2m","serviceId":"MicroServer1,MicroServer2"}, further, the server parses and obtains the second configuration information as shown in Table 1.

[0084] 208. Perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result;

[0085] The server performs authentication based on the microservice name of the calling server and the second configuration information to obtain an authentication result. Authentication refers to verifying whether microservices can be called normally. Specifically, the server parses the second configuration information to obtain a name list of preset microservices; the server compares the microservice name of the calling server with the name list of preset microservices according to the preset string function to obtain a function return value. For example, the name list of preset microservices is MicroServer1, MicroServer2, and the preset string function is indexOf(). If the name of the microservice calling the server is MicroServer1, the server obtains a function return value of 0; if the name of the microservice calling the server is MicroServer2, the server obtains a function return value of 13; if the name of the microservice calling the server is MicroServer3, the server obtains a function return value of -1; if the function return value is equal to the first preset value, it is determined that the authentication result is an authentication failure, and the server executes step 209, wherein the first preset value includes -1; if the function return value is greater than or equal to the second preset value, the server determines that the authentication result is an authentication success, and the server executes step 210, wherein the second preset value includes 0; the server records the authentication result, the microservice name of the calling server, and the second configuration information in the preset microservice log.

[0086] 209. If the authentication result is authentication failure, a warning message is sent via email or SMS;

[0087] If the authentication result is authentication failure, the server sends an alarm message via email or SMS. Specifically, the server reads the target person's email address or mobile phone number from a preset data table; the server sends an alarm message based on the target person's email address or mobile phone number so that the target person can respond and handle it in time.

[0088] Optionally, the server regularly performs statistical analysis on microservice call requests that fail authentication and obtains analysis reports to facilitate tracking of authentication failure issues.

[0089] 210. If the authentication result is successful, the response information corresponding to the microservice interface to be called is sent to the calling server.

[0090] If the authentication result is successful, the server sends the response information corresponding to the microservice interface to be called to the calling server. For example, MSA (MicroServerA) calls the interface / demo of MSB (MicroServerB). MSB configures the following configuration in the preset configuration file to implement the interface / demo call only to MSA, and other calling servers will fail, as shown below:

[0091] interfaceAuth.authMap. / demo = {"type":"m2m","serviceId":"MSA"}. After the server successfully authenticates, it sends the response information corresponding to / demo to the calling server, which is also a microservice, to further implement the call authentication between microservices.

[0092] In an embodiment of the present invention, the microservice name of the calling server is determined from the configuration of the registration center service by calling the microservice address of the server, and authentication is performed according to the microservice name of the calling server and preset configuration information to obtain an authentication result, thereby improving the calling authentication efficiency and business operation efficiency of the microservice.

[0093] The above describes the call authentication method of the microservice in the embodiment of the present invention. The following describes the call authentication device of the microservice in the embodiment of the present invention. Figure 3 , an embodiment of a microservice call authentication device in an embodiment of the present invention includes:

[0094] The receiving unit 301 is used to receive a microservice call request, where the microservice call request includes a microservice address of a calling server and a microservice interface to be called;

[0095] An encapsulation unit 302 is used to encapsulate a preset mapping list to obtain first configuration information, where the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address;

[0096] The first determination unit 303 is used to determine whether the microservice address of the calling server is in the first configuration information;

[0097] Processing unit 304 is used to read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server if the microservice address of the calling server exists in the first configuration information;

[0098] A parsing unit 305 is used to parse the preset configuration file to obtain second configuration information according to the microservice interface to be called, where the second configuration information includes a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice;

[0099] An authentication unit 306 is used to perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result;

[0100] The sending unit 307 is used to send the response information corresponding to the microservice interface to be called to the calling server if the authentication result is successful.

[0101] In an embodiment of the present invention, the microservice name of the calling server is determined from the configuration of the registration center service by calling the microservice address of the server, and authentication is performed according to the microservice name of the calling server and preset configuration information to obtain an authentication result, thereby improving the calling authentication efficiency and business operation efficiency of the microservice.

[0102] See also Figure 4 Another embodiment of the microservice call authentication device in the embodiment of the present invention includes:

[0103] The receiving unit 301 is used to receive a microservice call request, where the microservice call request includes a microservice address of a calling server and a microservice interface to be called;

[0104] An encapsulation unit 302 is used to encapsulate a preset mapping list to obtain first configuration information, where the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address;

[0105] The first determination unit 303 is used to determine whether the microservice address of the calling server is in the first configuration information;

[0106] The processing unit 304 is used to read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server if the microservice address of the calling server exists in the first configuration information;

[0107] The parsing unit 305 is used to parse the preset configuration file to obtain second configuration information according to the microservice interface to be called, where the second configuration information includes a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice;

[0108] An authentication unit 306 is used to perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result;

[0109] The sending unit 307 is used to send the response information corresponding to the microservice interface to be called to the calling server if the authentication result is successful.

[0110] Optionally, the encapsulation unit 302 may also be specifically used for:

[0111] Obtain a preset mapping list from a preset registration center service according to a preset duration or preset time through a preset scheduled task. The preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address;

[0112] Encapsulating the preset mapping list according to a preset format to obtain first configuration information;

[0113] The first configuration information is stored in the memory database.

[0114] Optionally, the first determining unit 303 may also be specifically configured to:

[0115] Reading the first configuration information from the memory database and parsing the first configuration information;

[0116] Set the microservice address of the calling server as the target value, and query the microservice name corresponding to the target value in the parsed first configuration information;

[0117] Determine whether the microservice name corresponding to the target value is an empty value;

[0118] If the microservice name corresponding to the target value is a null value, it is determined that the microservice address of the calling server does not exist in the first configuration information;

[0119] If the microservice name corresponding to the target value is not a null value, and the target key is a string set according to a preset rule, it is determined that the microservice address of the calling server exists in the first configuration information.

[0120] Optionally, the processing unit 304 may also be specifically configured to:

[0121] If the microservice address of the calling server exists in the first configuration information, then determine the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server;

[0122] Set the microservice name corresponding to the target value to the microservice name of the calling server.

[0123] Optionally, the parsing unit 305 may also be specifically configured to:

[0124] Concatenate the microservice call authentication configuration prefix and the microservice interface to be called according to the preset rules;

[0125] Read the preset configuration file according to the concatenated character string to obtain the initial configuration information;

[0126] Generate the target regular expression according to the authentication type of the microservice;

[0127] The initial configuration information is filtered and processed according to the target regular expression to obtain second configuration information, where the second configuration information includes a call authentication configuration prefix for preset microservices, a call interface supporting wildcards, an authentication type for preset microservices, and a name list of preset microservices.

[0128] Optionally, the authentication unit 306 may also be specifically configured to:

[0129] Parse the second configuration information to obtain a list of names of preset microservices;

[0130] Compare the microservice name of the calling server with the name list of preset microservices according to the preset string function to obtain the function return value;

[0131] If the function return value is equal to the first preset value, the authentication result is determined to be authentication failure;

[0132] If the function return value is greater than or equal to the second preset value, the authentication result is determined to be successful authentication;

[0133] The authentication result, the name of the microservice calling the server, and the second configuration information are recorded in the preset microservice log.

[0134] Optionally, the microservice call authentication device further includes:

[0135] A setting unit 308 is used to obtain a call authentication flag of a microservice, where the call authentication flag of a microservice includes a first preset flag and a second preset flag;

[0136] The second judgment unit 309 is used to judge whether to perform authentication-free access according to the call authentication flag of the microservice;

[0137] A first determining unit 310 is used to determine authentication-free access if the call authentication flag of the microservice is a first preset flag;

[0138] The second determining unit 311 is used to determine to perform authentication access if the call authentication flag of the microservice is the second preset flag.

[0139] In an embodiment of the present invention, the microservice name of the calling server is determined from the configuration of the registration center service by calling the microservice address of the server, and authentication is performed according to the microservice name of the calling server and preset configuration information to obtain an authentication result, thereby improving the calling authentication efficiency and business operation efficiency of the microservice.

[0140] above Figure 3 and Figure 4 The call authentication device for the microservice in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The call authentication device for the microservice in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0141] Figure 51 is a schematic diagram of the structure of a microservice call authentication device provided by an embodiment of the present invention. The microservice call authentication device 500 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 501 (for example, one or more processors) and a memory 509, and one or more storage media 508 (for example, one or more mass storage devices) storing application programs 507 or data 506. Among them, the memory 509 and the storage medium 508 can be short-term storage or permanent storage. The program stored in the storage medium 508 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the microservice call authentication device. Furthermore, the processor 501 can be configured to communicate with the storage medium 508 to execute a series of instruction operations in the storage medium 508 on the microservice call authentication device 500.

[0142] The microservice call authentication device 500 may also include one or more power supplies 502, one or more wired or wireless network interfaces 503, one or more input and output interfaces 504, and / or one or more operating systems 505, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will appreciate that Figure 5 The structure of the microservice call authentication device shown in the figure does not constitute a limitation on the microservice call authentication device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0143] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0144] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0145] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A microservice call authentication method, characterized in that: include: Receive a microservice call request, wherein the microservice call request includes a microservice address of a calling server and a microservice interface to be called; Encapsulating a preset mapping list to obtain first configuration information, wherein the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; Determine whether the microservice address of the calling server exists in the first configuration information, wherein the microservice address is a target value; If the microservice address of the calling server exists in the first configuration information, then read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server; Parsing the second configuration information from the preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice; Perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result; If the authentication result is successful, the response information corresponding to the microservice interface to be called is sent to the calling server; Wherein, if the microservice address of the calling server exists in the first configuration information, then reading the microservice name of the calling server from the first configuration information according to the microservice address of the calling server includes: if the microservice address of the calling server exists in the first configuration information, then determining the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server; setting the microservice name corresponding to the target value as the microservice name of the calling server; The second configuration information is obtained by parsing from a preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of a preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices, including: string concatenating the call authentication configuration prefix of the preset microservice and the microservice interface to be called according to preset rules; reading the preset configuration file according to the concatenated string to obtain initial configuration information; generating a target regular expression according to the authentication type of the preset microservice; filtering and processing the initial configuration information according to the target regular expression to obtain the second configuration information, the second configuration information including a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices.

2. The microservice call authentication method according to claim 1, characterized in that: The preset mapping list is encapsulated to obtain the first configuration information, wherein the preset mapping list is used to indicate the mapping relationship between the microservice name and the microservice address, including: Obtain a preset mapping list from a preset registration center service according to a preset duration or preset time through a preset scheduled task, wherein the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; Encapsulating the preset mapping list according to a preset format to obtain first configuration information; The first configuration information is stored in a memory database.

3. The microservice call authentication method according to claim 2, characterized in that: The determining whether the microservice address of the calling server exists in the first configuration information includes: Reading the first configuration information from the memory database and parsing the first configuration information; The microservice address of the calling server is set as the target value, and the microservice name corresponding to the target value is searched in the parsed first configuration information; Determine whether the microservice name corresponding to the target value is a null value; If the microservice name corresponding to the target value is the null value, determining that the microservice address of the calling server does not exist in the first configuration information; If the microservice name corresponding to the target value is not the null value, and the microservice name corresponding to the target value is a character string set according to a preset rule, it is determined that the microservice address of the calling server exists in the first configuration information.

4. The microservice call authentication method according to claim 1, characterized in that: The authentication is performed according to the microservice name of the calling server and the second configuration information, and the authentication result obtained includes: Parsing the second configuration information to obtain a name list of the preset microservices; Compare the microservice name of the calling server with the name list of the preset microservices according to a preset string function to obtain a function return value; If the function return value is equal to the first preset value, determining that the authentication result is an authentication failure; If the function return value is greater than or equal to a second preset value, determining that the authentication result is successful authentication; The authentication result, the microservice name of the calling server, and the second configuration information are recorded in a preset microservice log.

5. The microservice call authentication method according to any one of claims 1 to 4, characterized in that: Before receiving the microservice call request, the microservice call authentication method further includes: Setting a call authentication flag of a microservice, wherein the call authentication flag of the microservice includes a first preset flag and a second preset flag; Determine whether to perform authentication-free access according to the call authentication flag of the microservice; If the call authentication flag of the microservice is the first preset flag, it is determined to perform authentication-free access; If the call authentication flag of the microservice is the second preset flag, it is determined to perform authentication access.

6. A microservice call authentication device, characterized in that: The microservice call authentication device includes: A receiving unit, configured to receive a microservice call request, wherein the microservice call request includes a microservice address of a calling server and a microservice interface to be called; An encapsulation unit, used to encapsulate a preset mapping list to obtain first configuration information, wherein the preset mapping list is used to indicate a mapping relationship between a microservice name and a microservice address; A first judgment unit is used to judge whether the microservice address of the calling server exists in the first configuration information, wherein the microservice address is a target value; a processing unit, configured to read the microservice name of the calling server from the first configuration information according to the microservice address of the calling server, if the microservice address of the calling server exists in the first configuration information; A parsing unit, configured to parse the preset configuration file according to the microservice interface to be called to obtain second configuration information, wherein the second configuration information includes a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservice; An authentication unit, used to perform authentication according to the microservice name of the calling server and the second configuration information to obtain an authentication result; A sending unit, for sending the response information corresponding to the microservice interface to be called to the calling server if the authentication result is successful authentication; Wherein, if the microservice address of the calling server exists in the first configuration information, then reading the microservice name of the calling server from the first configuration information according to the microservice address of the calling server includes: if the microservice address of the calling server exists in the first configuration information, then determining the microservice name corresponding to the target value from the first configuration information according to the microservice address of the calling server; setting the microservice name corresponding to the target value as the microservice name of the calling server; The second configuration information is obtained by parsing from a preset configuration file according to the microservice interface to be called, the second configuration information including a call authentication configuration prefix of a preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices, including: string concatenating the call authentication configuration prefix of the preset microservice and the microservice interface to be called according to preset rules; reading the preset configuration file according to the concatenated string to obtain initial configuration information; generating a target regular expression according to the authentication type of the preset microservice; filtering and processing the initial configuration information according to the target regular expression to obtain the second configuration information, the second configuration information including a call authentication configuration prefix of the preset microservice, a call interface supporting wildcards, an authentication type of the preset microservice, and a name list of the preset microservices.

7. A microservice call authentication device, characterized in that: The microservice call authentication device includes: a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor calls the instruction in the memory so that the microservice call authentication device executes the microservice call authentication method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the microservice call authentication method according to any one of claims 1 to 5 is implemented.

Images