A service execution method and device, a storage medium and an electronic device

Abstract

The specification discloses a business execution method and device, a storage medium and an electronic device. The method comprises the following steps: determining a cut aspect program to be deployed and a cut point of a business application program in an application container, the cut aspect program being used to collect to-be-verified information; deploying a cut aspect base in the application container; injecting the cut aspect program into the cut point of the business application program in the application container through the cut aspect base; when receiving to-be-verified information sent by the cut aspect program, obtaining environment information of the application container from a service platform providing the application container; verifying the to-be-verified information according to the environment information and determining a verification result; returning the verification result to the business application program in the application container; and enabling the business application program in the application container to execute a business according to the verification result. By using the cut aspect program to implement access control, the coupling degree of the business application program and the access control program is reduced, the workload is reduced, and the cost is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a business execution method and device, a storage medium and an electronic device. BACKGROUND

[0002] At present, with the rapid development of the Internet, users pay more and more attention to their own privacy data, so the security problem is particularly important.

[0003] In the prior art, there is a zero-trust business execution strategy combining continuous verification and dynamic authorization, and any access needs to be verified.

[0004] In order to build a business application based on the zero-trust business execution strategy, it is necessary to implement zero-trust access control code based on business function code, so as to realize zero-trust business execution, resulting in high coupling degree of business application program and access control program, large workload and high cost for realizing zero-trust business execution.

[0005] Therefore, the present application provides a method for realizing access control by using a security aspect to perform business. SUMMARY

[0006] The business execution method, device, storage medium and electronic device provided by the embodiments of the present application can at least partially solve the problems in the prior art.

[0007] The technical scheme adopted by the present application is as follows:

[0008] The present application provides a business execution method, comprising:

[0009] determining a cutpoint of a business application program in an application container and an aspect program to be deployed, the aspect program being used to collect to-be-verified information required for business execution;

[0010] deploying an aspect pedestal in the application container, and injecting the aspect program at the cutpoint of the business application program in the application container through the aspect pedestal;

[0011] when receiving the to-be-verified information sent by the aspect program, obtaining environment information of the application container from a service platform providing the application container;

[0012] verifying the to-be-verified information according to the environment information, and determining a verification result;

[0013] returning the verification result to the business application program in the application container, so that the business application program in the application container performs business according to the verification result.

[0014] The present application provides a business execution method, comprising:

[0015] in response to a start instruction, injecting, by a pre-deployed aspect base, an aspect program into a join point of a business application program in an application container, the aspect program being used to collect to-be-verified information required by business execution;

[0016] when the aspect program is triggered during business execution, executing the aspect program to obtain the to-be-verified information required by business execution;

[0017] sending the to-be-verified information to a verification system to verify the to-be-verified information by the verification system;

[0018] performing business according to a verification result returned by the verification system.

[0019] The specification provides a business execution apparatus, comprising:

[0020] a determination module configured to determine a to-be-deployed aspect program and a join point of a business application program in an application container, the aspect program being used to collect to-be-verified information required by business execution;

[0021] a deployment module configured to deploy an aspect base in the application container, and inject the aspect program into the join point of the business application program in the application container by the aspect base;

[0022] a receiving module configured to obtain environment information of the application container from a service platform providing the application container when receiving to-be-verified information sent by the aspect program;

[0023] a verification module configured to verify the to-be-verified information according to the environment information, and determine a verification result;

[0024] a returning module configured to return the verification result to the business application program in the application container, so that the business application program in the application container performs business according to the verification result.

[0025] The specification provides a business execution apparatus, comprising:

[0026] an injection module configured to, in response to a start instruction, inject, by a pre-deployed aspect base, an aspect program into a join point of a business application program in an application container, the aspect program being used to collect to-be-verified information required by business execution;

[0027] an obtaining module configured to, when the aspect program is triggered during business execution, execute the aspect program to obtain the to-be-verified information required by business execution;

[0028] a sending module configured to send the to-be-verified information to a verification system to verify the to-be-verified information by the verification system;

[0029] an execution module, configured to execute the business according to the verification result returned by the verification system.

[0030] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the business execution method.

[0031] The present specification provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the business execution method when executing the program.

[0032] The above at least one technical solution adopted by the present specification can achieve the following beneficial effects:

[0033] In the business execution method provided by the present specification, a facet program to be deployed and a point of a business application program in an application container are determined first, the facet program is used to collect to-be-verified information required by business execution, a facet pedestal is deployed in the application container, the facet program is injected into the point of the business application program in the application container through the facet pedestal, when receiving to-be-verified information sent by the facet program, environment information of the application container is obtained from a service platform providing the application container, the to-be-verified information is verified according to the environment information and a verification result is determined, the verification result is returned to the business application program in the application container, and the business application program in the application container executes business according to the verification result. By using the facet program to implement access control, the coupling degree of the business application program and the access control program is reduced, the workload is reduced, the cost is reduced, and the flexibility of access control is improved. BRIEF DESCRIPTION OF DRAWINGS

[0034] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated herein and constitute a part of the application, illustrate embodiments of the application and serve to explain the application without imposing any undue limitation to the application. In the drawings:

[0035] Figure 1 A business execution flowchart is provided in the present specification;

[0036] Figure 2 A business execution flowchart is provided in the present specification;

[0037] Figure 3 A business execution system schematic diagram is provided in the present specification;

[0038] Figure 4 A business execution device schematic diagram is provided in the present specification;

[0039] Figure 5A service execution device schematic diagram provided for the present specification;

[0040] Figure 6 An electronic device schematic diagram for implementing a service execution method provided for the present specification. DETAILED DESCRIPTION

[0041] For the purpose, technical solutions and advantages of the present specification to be clearer, the technical solutions of the present application will be described clearly and completely below in combination with specific embodiments of the present specification and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the specification, all other embodiments obtained by those of ordinary skill in the art without making creative efforts belong to the scope of protection of the present application.

[0042] At present, with the rapid development of Internet technology, a business application program can access various resources required for service execution based on network through method calling, where the resources can be other service programs, and the business application program can be a business application program in a server of a business platform. In order to avoid information leakage, access control technology can be used to verify the access of the business application program. At present, a zero-trust service execution strategy is used to verify the access of the business application program. Zero trust is an access control strategy that continuously verifies and dynamically authorizes all business application programs when they access based on as many trust elements as possible, such as access subject identity, network environment, terminal state, etc. Under this strategy, each access of the business application program needs to be verified, and only when the verification is passed and the corresponding access permission is possessed, the corresponding access result can be obtained. Through continuous verification and dynamic authorization, information leakage is avoided.

[0043] Generally, in order to construct a business application based on a zero-trust business execution strategy, it is necessary to implement a zero-trust access control code based on a business function code, so as to realize zero-trust business execution. During the application development or maintenance process, different developers are usually responsible for the development tasks of the business application program and the access control program respectively. However, this way of implementing a zero-trust access control program based on a business application program has a high coupling degree between the business application program and the access control program, which leads to the need for sufficient communication between the developers responsible for different development tasks in order to realize zero-trust business execution, resulting in a large workload and high time cost. Further, during the version iteration process, whether the business application program is iterated or the access control program is iterated, the developers of both parties need to further adjust the programs they are responsible for based on the modified code in the iteration, so that the zero-trust business execution strategy can always be realized during the iteration process. During the communication and adjustment of the two parties, code faults are prone to occur, resulting in a high risk of code modification, further increasing the workload and increasing the time cost. Moreover, once the program is put into operation, it is difficult to flexibly adjust the access control.

[0044] The present specification provides a business execution method, which reduces the coupling degree between the business application program and the access control program by adopting a security aspect, so that the business application and the security access control can be developed independently, reduces the workload of implementing the access control, improves the flexibility of adjusting the access control, and reduces the cost.

[0045] Among them, the security aspect mentioned above refers to a method of dynamically adding or modifying an aspect program for implementing a security aspect business in the running logic of a business application program without modifying the business application program by adopting an aspect-oriented programming (AOP) manner. This makes it possible to implement security aspect business while decoupling the program implementing security aspect business from the business application program, thereby avoiding the development iteration problem caused by high coupling.

[0046] The aspect program mentioned here is an enhancement program for implementing security aspect business based on business running logic. The aspect program can be injected into the corresponding pointcut of the business application program by adopting an aspect-oriented programming manner. The aspect program is triggered to execute during the execution of the business application program, thereby realizing the required security aspect business function.

[0047] When the business application program executes the business, the business application program usually executes the business through the calling between methods. Therefore, any method in the business application program can be used as the entry point of the aspect program, i.e. the pointcut mentioned above, and the aspect program can be injected into the corresponding pointcut. When the business application program executes to the pointcut, i.e. calls the method of the business application program corresponding to the pointcut, the aspect program injected at the pointcut is executed.

[0048] Generally, the code responsible for injecting aspect programs to the point of the process has high reusability, so the program implementing this process is usually abstracted as a service module, namely, an aspect base. The aspect base can obtain the aspect program to be deployed and the point in the business application from a third party providing security aspect services, and inject the corresponding aspect program at the point in the business application after the application container is started and the environment is set.

[0049] The business application can be a business application in a server of the business platform that provides business services. The business services can be business services provided by the server of the business platform to users, such as query services, payment services, etc. The business services can also be business services provided by a certain server of the business platform to other servers, such as settlement services, etc.

[0050] Of course, as can be known from the above description, in order to decouple the program of the security aspect service from the business application, the present specification uses an aspect-oriented programming manner to make the program of the security aspect service and the business application interweave with each other during business execution, but are parallel to each other and can be independently maintained. Therefore, unlike the business provider of the business application, the third party providing the security aspect service can manage the content involved in the security aspect service through the management platform, such as the configuration of the security aspect service management strategy, the version iteration of the aspect program, the deployment rule configuration of the aspect program, etc. Of course, the provider of the security aspect service can be a third party or a business provider.

[0051] When managing the content involved in the security aspect service, the management platform can record various configuration information, such as the configuration of various strategies, the deployment rule configuration of the aspect program, etc. through a configuration file. So that the aspect base can complete the deployment of the aspect program according to the configuration file, or the management platform can implement the security aspect service according to the configuration file.

[0052] In practical applications, a business provider usually sets up a machine room including several physical machines or servers, and provides physical resources required by a business application through the physical machines. Of course, one business application can not need all physical resources of a whole physical machine, so generally, a plurality of virtual hosts are run on one physical machine through virtualization technology. The virtual hosts are independent of each other and each enjoys part of physical resources of the physical machine. Then, an application container can be deployed in the virtual host, and a business application is run through the application container. The application container usually contains physical resources allocated to the application container, such as CPU, memory, etc., and a running environment provided to the application container, such as an operating system (OS) or other running environment data, such as a serial number (SN) of the container, an allocated IP (Influential Property), an application name, a tenant, an environment variable, etc. The business application can be deployed in the application container to perform a business.

[0053] In a scenario of performing a business based on a security aspect, a server of the business provider or a third party providing a security aspect business can provide a management and control platform, manage contents involved in the security aspect business through the management and control platform, and deploy an aspect base in the application container, inject an aspect program into a business application in the business application container through the aspect base, and provide support for the security aspect business for the application container of the business provider.

[0054] Therefore, the aspect base can be deployed in the application container of the business provider in advance. Generally, when the application container is started, the operating system provided to the application container can be invoked, and the pre-deployed aspect base is run, the aspect program and a pointcut of the business application are obtained from the management and control platform through the aspect base, and the aspect program is injected into the pointcut of the business application in the application container. In addition, the aspect base can also obtain the aspect program and the pointcut of the business application from the management and control platform during execution of the business application, and inject the aspect program into the pointcut of the business application in the application container.

[0055] Of course, how the aspect base obtains the information required for deploying the aspect program from the management and control platform can be set as required. For example, the required information can be actively pulled from the management and control platform according to a configuration file, or the management and control platform can actively issue the required information for the aspect base to receive.

[0056] After the aspect program is injected into the pointcut of the business application, the business application can trigger the aspect program during execution to realize a corresponding security aspect business function.

[0057] Therefore, in one or more embodiments of the present specification, the security access control procedure can be injected into the business application by the verification system, and the business execution of the business application is accessed by the verification system. Therefore, for the convenience of description, the following will be described only by taking the verification system as the execution subject.

[0058] The technical solutions provided by the embodiments of the present application are described in detail below with reference to the drawings.

[0059] Figure 1 For a business execution flowchart in the present specification, it specifically includes the following steps:

[0060] S100: Determine the aspect program to be deployed and the pointcut of the business application in the application container, the aspect program being used to collect the to-be-verified information required by the business execution.

[0061] Generally, the business application can access various resources required by the business execution through method calls to execute corresponding businesses. Based on this, in one or more embodiments of the present specification, the verification system can determine the aspect program to be deployed and the pointcut of the business application in the application container by means of aspect-oriented programming according to the preset deployment rule, the aspect program being used to collect the to-be-verified information required by the business execution, so that the verification system can verify the business execution according to the collected to-be-verified information, avoiding information leakage.

[0062] Among them, the preset deployment rule can include the aspect program to be deployed, the pointcut of the business application in the application container, and the deployment manner, etc. How to set the specific deployment rule can be determined according to the needs, and the present specification does not limit this. What kind of to-be-verified information the aspect program collects for access control can be determined according to the needs, and the present specification does not limit this either.

[0063] For example, taking the business application calling the database query method to access the database as an example, the verification system can set the method of the business application accessing the database as the pointcut. Then inject the aspect program at the pointcut to deploy the aspect program in the business application, and set the deployment manner as before the method of the business application accessing the database is executed. Then when the business application calls the database query method to access the database, before calling the method of accessing the database, the aspect program will be triggered to perform access verification, and after passing the verification, the method of accessing the database is called to complete the access to the database.

[0064] S102: Deploy the aspect base in the application container, and inject the aspect program at the pointcut of the business application in the application container through the aspect base.

[0065] After the aspect program to be deployed and the join points of the business application program in the application container are determined, the verification system can first deploy the aspect base in the application container, and inject the aspect program into the join points of the business application program in the application container through the aspect base, so as to collect the to-be-verified information required by the business execution through the aspect program.

[0066] Of course, in one or more embodiments of the present specification, there can be multiple versions of the aspect program corresponding to different business execution strategies, and the verification system can deploy the aspect base carrying the preset aspect program deployment rule into the application container, wherein the deployment rule can at least include the correspondence between each business execution strategy of the business application program and each aspect program. Then the target aspect program can be determined from each aspect program by the aspect base according to the current business execution strategy of the business application program in the application container and the correspondence, and finally the target aspect program is injected into each join point of the business application program through the aspect base.

[0067] The aspect base is a service module responsible for deployment rule reading, aspect program loading and other functions. The verification system can pre-set the aspect program deployment rule and issue it to the aspect base, and then deploy the aspect base into the application container to complete the injection of the aspect program through the aspect base. The verification system can also first deploy the aspect base into the application container, and then issue the pre-set aspect program deployment rule to the aspect base to complete the injection of the aspect program through the aspect base. The business execution strategy can be understood as access control with different security levels.

[0068] For example, the business execution strategy corresponding to the access control with higher security level can require more to-be-verified information to be collected and verified through the aspect program, and the business execution strategy corresponding to the access control with lower security level can require less to-be-verified information to be collected and verified through the aspect program. Different business execution strategies correspond to different aspect programs, and when deploying the aspect program, the specific aspect program to be deployed can be determined according to the needs.

[0069] S104: When receiving the to-be-verified information sent by the aspect program, obtaining environment information of the application container from a service platform providing the application container.

[0070] S106: Verifying the to-be-verified information according to the environment information, and determining a verification result.

[0071] S108: Returning the verification result to the business application program in the application container, so that the business application program in the application container executes the business according to the verification result.

[0072] After the deployment of the aspect program is completed, when the business application executes the business process through the method call, the business executes to the cut point, triggers the execution of the aspect program and collects the to-be-verified information. Based on this, when the verification system receives the to-be-verified information sent by the aspect program, the verification system can obtain the environment information of the application container from the service platform providing the application container. So that subsequent verification of the received to-be-verified information can be performed according to the environment information.

[0073] Wherein, the to-be-verified information is specific to what kind of information can be determined as needed, and the present specification does not limit it. For example, the to-be-verified information can include one or more of the application identity certificate (or digital certificate) used by the business application for identity authentication, the environment data of the application container where the business application is deployed, etc. The service platform providing the application container can be a Platform as a Service (PaaS) platform. The environment information of the application container can be the environment information metadata of the application container obtained from the PaaS platform. Specifically, the environment information can include but is not limited to the serial number of the container, the allocated IP, the application name, the tenant, the environment variable, etc. The PaaS platform usually records the corresponding information of the application container through metadata after providing the application container.

[0074] Then, in one or more embodiments of the present specification, taking the to-be-verified information including the environment data of the application container where the business application is deployed and the application identity certificate of the business application in the application container as an example, the verification system determines whether the environment data of the application container in the to-be-verified information is correct according to the environment information. Specifically, it can be verified by comparison. If the environment data in the to-be-verified information is consistent with the environment information, it means that the running environment of the business application has not been changed and the environment data is correct. If the environment data in the to-be-verified information is inconsistent with the environment information, it means that the running environment of the business application has been changed and the environment data is incorrect, which poses a security risk. There is no need to further verify the application identity certificate, and the business application in the application container can be directly rejected to continue executing the business, that is, the access rights required by the business execution are not granted.

[0075] If the environment data is correct, the verification system can perform application identity authentication on the application identity certificate of the business application in the application container in the to-be-verified information. Specifically, the application identity certificate is authenticated in what way can be determined as needed, and the present specification does not limit it. For example, the digital certificate can be used to complete the identity authentication through digital signature. There are relatively mature identity authentication technologies for this, which will not be described here. If the identity authentication fails, there may be a security risk, and the business application in the application container can be rejected to continue executing the business, that is, the access rights required by the business execution are not granted.

[0076] If the identity authentication passes, the verification system can further authenticate the permissions required by the business application program in the application container for continuing to perform the business according to the preset permission configuration, the environment data, and the application identity, that is, according to the preset permission configuration, determine whether the application identity of the business application program has the permissions required for continuing to perform the business in the running environment, if the authentication result is that the business application program has the permissions required for continuing to perform the business, the verification system can grant the business application program the permissions required for continuing to perform the business, return the authentication result indicating the authorization to the business application program in the application container as the verification result, if the authentication result is that the business application program does not have the permissions required for continuing to perform the business, the verification system can refuse the business application program in the application container to continue to perform the business, return the authentication result indicating the non-authorization to the business application program in the application container as the verification result, so that the business application program in the application container performs the business according to the verification result.

[0077] Based on Figure 1 As shown in the business execution method, the aspect program to be deployed and the pointcut of the business application program in the application container are first determined, the aspect program is used to collect the to-be-verified information required for business execution, the aspect base is deployed in the application container, the aspect program is injected into the pointcut of the business application program in the application container through the aspect base, when the to-be-verified information sent by the aspect program is received, the environment information of the application container is obtained from the service platform providing the application container, the to-be-verified information is verified according to the environment information and a verification result is determined, the verification result is returned to the business application program in the application container, and the business application program in the application container performs the business according to the verification result. By using the aspect program to realize access control, the coupling degree of the business application program and the access control program is reduced, the workload is reduced, the cost is reduced, and the flexibility of access control is improved.

[0078] In addition, in one or more embodiments of the present specification, when the verification system determines the target aspect program from each aspect program according to the current business execution strategy of the business application program in the application container and the corresponding relationship through the aspect base, each pointcut can correspond to the same business execution strategy, that is, each pointcut can inject the same version of aspect program. In one or more embodiments of the present specification, each pointcut can correspond to different business execution strategies, that is, different pointcuts can inject different versions of aspect programs. By flexibly setting the target aspect program corresponding to each pointcut, the flexibility of business execution access control is improved.

[0079] Further, in one or more embodiments of the present specification, in step S102, the aspect base is deployed in the application container, and when the aspect point of the business application program in the application container injects the aspect program through the aspect base, the aspect program can collect various to-be-verified information required by business execution through multiple modules. At this time, the verification system can deploy the aspect base in the application container, determine the state corresponding to each module in the aspect program, and for each module, when the state corresponding to the module is an open state, switch the execution state corresponding to the module to the open state through the aspect base, so that the aspect program collects the corresponding to-be-verified information by executing the module when the aspect program is executed. When the state corresponding to the module is a closed state, switch the execution state corresponding to the module to the closed state through the aspect base, so that the aspect program does not execute the module when the aspect program is executed, so that the aspect program does not collect the to-be-verified information corresponding to the module. Finally, the verification system can inject the aspect program into the aspect point of the business application program in the application container through the aspect base. By flexibly adjusting the state of each module in the aspect program, the access control policy can be flexibly adjusted according to the application scenario of the business application program, and the adaptability of access control for different scenarios is improved.

[0080] In addition, in one or more embodiments of the present specification, the verification system can also receive an application identity certificate acquisition request sent by a service platform providing an application container, the application identity certificate acquisition request at least including information of a business application program in the application container and environment data corresponding to the business application program. Therefore, the verification system can generate an application identity certificate of the business application program according to the information of the business application program and the environment data corresponding to the business application program, and issue the application identity certificate to the service platform, so that the service platform deploys the business application program according to the received application identity certificate. Subsequently, the verification system can perform application identity authentication on the application identity certificate in access control.

[0081] Corresponding to Figure 1 According to the business execution method of the verification system side as shown in the present specification, the present specification also provides a business execution method of the application container side, as shown in Figure 2

[0082] Figure 2 For a business execution flowchart in the present specification, it specifically includes the following steps:

[0083] S200: In response to a start instruction, an aspect program is injected into an aspect point of a business application program in an application container through a pre-deployed aspect base, the aspect program being used to collect to-be-verified information required by business execution.

[0084] ​Generally, the business application can be deployed through the application container provided by the PaaS platform, so that the application container can complete the deployment of the business application in response to the start instruction, and complete the deployment of the aspect program by injecting the aspect program into the join point of the business application in the application container through the aspect base in the application container in advance.

[0085] Of course, before injecting the aspect program into the join point of the business application in the application container, the application container can send a deployment data acquisition request to the service platform providing the application container, i.e., the PaaS platform, so that the PaaS platform applies for the application identity certificate of the business application to be deployed to the verification system, and determines the environment data corresponding to the business application, then receives the application identity certificate of the business application issued by the verification system through the PaaS platform, so that the PaaS platform injects the application identity certificate and the environment data into the application container, and finally, the PaaS platform deploys the business application in the application container and performs business execution. The specific injection process of the aspect program can refer to the corresponding description of steps S100 and S102, which will not be described here.

[0086] S202: When the aspect program is triggered during business execution, the aspect program is executed to obtain the to-be-verified information required for business execution.

[0087] After the above-mentioned starting of the application container completes the deployment of the business application and the injection of the aspect program, when the business application accesses various resources required for business execution through method calling to execute corresponding business, the application container can execute the injected aspect program when the aspect program is triggered during business execution, and obtain the to-be-verified information required for business execution through the aspect program. Specifically, the collected to-be-verified information can include the environment data and the application identity certificate injected into the application container by the PaaS platform when the application container is started. The to-be-verified information can be verified by the verification system subsequently.

[0088] S204: Send the to-be-verified information to the verification system to verify the to-be-verified information through the verification system.

[0089] S206: Perform business according to the verification result returned by the verification system.

[0090] After the to-be-verified information required by the business execution is collected by executing the aspect program, the application container can send the to-be-verified information to the verification system to verify the to-be-verified information through the verification system to determine whether the business application program in the application container has the corresponding permission to continue executing the business. If the verification system grants the business application program in the application container the permission required to continue executing the business, the business application program in the application container continues to execute the business. If the verification system does not grant the business application program in the application container the permission required to continue executing the business, the business application program in the application container stops executing the business, and the business application program can be prompted that it does not have the permission required to continue executing the business.

[0091] In one or more embodiments of the present specification, the present specification provides an interaction process between a verification system and an application container.

[0092] S300: The application container sends a deployment data acquisition request to a service platform providing the application container, so that the service platform applies for an application identity certificate of a to-be-deployed business application program from the verification system.

[0093] S302: The verification system receives the application identity certificate acquisition request sent by the service platform providing the application container, generates the application identity certificate of the business application program according to the information of the business application program and the environment data corresponding to the business application program, and issues the application identity certificate to the service platform.

[0094] S304: The application container receives the application identity certificate of the business application program issued by the verification system through the service platform, so that the service platform injects the application identity certificate and the environment data into the application container.

[0095] S306: The verification system determines a to-be-deployed aspect program and a join point of the business application program in the application container, and deploys an aspect pedestal in the application container.

[0096] S308: The application container injects the aspect program into the join point of the business application program in the application container through the pre-deployed aspect pedestal in response to a start instruction.

[0097] S310: The application container triggers the aspect program during the business execution process, executes the aspect program, and acquires to-be-verified information required by the business execution. The to-be-verified information includes environment data of the application container and an application identity certificate of the business application program in the application container.

[0098] S312: The application container sends the to-be-verified information to the verification system.

[0099] S314: The verification system receives the to-be-verified information sent by the aspect program, and obtains environment information of the application container from a service platform providing the application container.

[0100] S316: The verification system verifies the to-be-verified information according to the environment information, and determines a verification result.

[0101] S318: The verification system returns the verification result to a business application program in the application container.

[0102] S320: The application container performs business according to the verification result returned by the verification system.

[0103] The specific process of each step can be referred to the corresponding description of the server and the terminal as the execution subject, which will not be repeated here.

[0104] In one or more embodiments of the present specification, Figure 3 An access system schematic diagram is provided in the present specification, as shown in the figure, the access system includes a business application system and a verification system. Figure 3 As shown in the figure, the verification system can include a management platform, an aspect base, an aspect program, and a verification server.

[0105] Figure 3 As shown in the figure, the verification system can include a management platform, an aspect base, an aspect program, and a verification server.

[0106] The management platform can be used for policy configuration by an administrator and aspect program management corresponding to different policies. For example, business execution policy configuration including identity authentication policy, environment verification policy, and access authentication policy, and version management and deployment rule management of different versions of aspect programs corresponding to different business execution policies can be performed.

[0107] The aspect base can be used to inject the aspect program into the business application program of the business application system according to the pointcut signature and the pointcut injection rule.

[0108] The aspect program can be used to obtain to-be-verified information required for business execution when triggered to execute in the business execution process, and upload it to the access control server. The to-be-verified information can include environment data of the business container and application identity certificate of the business application program in the business container.

[0109] ​The verification server can be used to issue an application identity certificate for a business application in a business container when a business application system deploys a business application, and receive information to be verified required by a business execution of an aspect program when a business execution trigger executes the aspect program of the business application, and obtain environment information of the application container from a service platform providing the application container, verify the information to be verified according to the environment information, and determine a verification result, so as to return the verification result to the business application in the application container, so that the business application in the application container executes a business according to the verification result. The service platform can be a PaaS platform.

[0110] Taking the information to be verified including environment data of the application container and the application identity certificate of the business application in the application container as an example, the verification server can perform environment verification based on an environment verification policy issued by a management and control platform, according to the environment information of the application container obtained from the PaaS platform and the environment data in the information to be verified. If the environment data is correct, the verification server further performs application identity authentication on the application identity certificate in the information to be verified according to an identity authentication policy. If the identity authentication is passed, the verification server further determines whether the business application has the permission to continue to execute a business according to an access authentication policy. If the business application has the permission to continue to execute the business, the verification server authorizes the business application to continue to execute the business. If the business application does not have the permission to continue to execute the business, the verification server refuses to authorize the business application to continue to execute the business. The verification system returns the authentication result as the verification result to the business application in the application container, so that the business application in the application container executes a business according to the verification result.

[0111] The PaaS platform providing the application container can apply for an application identity certificate corresponding to the business application to the verification server when deploying the business application, and then inject the application identity certificate and environment data corresponding to the application container into the provided application container, so that the verification server can perform access verification according to the environment data of the application container and the application identity certificate.

[0112] The business execution method provided by one or more embodiments of the present specification is based on the same idea. The present specification also provides a corresponding business execution device, as shown in Figure 4 .

[0113] Figure 4 A business execution device provided by the present specification includes:

[0114] The determining module 200 is configured to determine an aspect program to be deployed and a join point of a business application in an application container. The aspect program is configured to collect information to be verified required by a business execution.

[0115] The deployment module 202 is configured to deploy an aspect base in the application container, and inject the aspect program into the join point of the business application program in the application container through the aspect base.

[0116] The receiving module 204 is configured to acquire environment information of the application container from a service platform providing the application container when receiving to-be-verified information sent by the aspect program.

[0117] The verification module 206 is configured to verify the to-be-verified information according to the environment information, and determine a verification result.

[0118] The returning module 208 is configured to return the verification result to the business application program in the application container, so that the business application program in the application container performs business according to the verification result.

[0119] Optionally, the to-be-verified information includes environment data of the application container and an application identity certificate of the business application program in the application container.

[0120] The verification module 206 determines whether the environment data of the application container in the to-be-verified information is correct according to the environment information, performs application identity authentication on the application identity certificate of the business application program in the application container in the to-be-verified information if the environment data is correct, performs authentication on the permission required by the business application program in the application container according to a preset permission configuration, the environment data and the application identity if the application identity authentication is successful, and determines an authentication result as the verification result.

[0121] Optionally, the aspect program includes a plurality of aspect programs, and each aspect program corresponds to a different business execution strategy.

[0122] The deployment module 202 deploys the aspect base carrying a preset aspect program deployment rule into the application container, the deployment rule at least includes a correspondence between each business execution strategy of the business application program and each aspect program, determines a target aspect program from each aspect program according to a current business execution strategy of the business application program in the application container and the correspondence, and injects the target aspect program into each join point of the business application program.

[0123] Optionally, the aspect program is used to collect a plurality of to-be-verified information required by business execution through a plurality of modules.

[0124] The deployment module 202 deploys an aspect base in the application container, determines the state corresponding to each module in the aspect program, for each module, when the state corresponding to the module is an open state, switches the execution state corresponding to the module to the open state through the aspect base, and when the aspect program is executed, collects the corresponding to-be-verified information by executing the module; when the state corresponding to the module is a closed state, switches the execution state corresponding to the module to the closed state through the aspect base, and when the aspect program is executed, does not execute the module, so that the aspect program does not collect the to-be-verified information corresponding to the module, and injects the aspect program into a join point of a business application program in the application container through the aspect base.

[0125] Optionally, the apparatus further includes a certificate issuing module 210 configured to receive an application identity certificate acquisition request sent by a service platform providing the application container, the application identity certificate acquisition request including at least information of a business application program in the application container and environment data corresponding to the business application program, generate an application identity certificate of the business application program according to the information of the business application program and the environment data corresponding to the business application program, issue the application identity certificate to the service platform, and enable the service platform to deploy the business application program according to the received application identity certificate.

[0126] Based on the same idea, the present specification also provides a corresponding business execution apparatus, as shown in Figure 5

[0127] Figure 5 A business execution apparatus provided by the present specification includes:

[0128] An injection module 300 is configured to inject an aspect program into a join point of a business application program in an application container through a pre-deployed aspect base in response to a start instruction, the aspect program being configured to collect to-be-verified information required for business execution;

[0129] An acquisition module 302 is configured to execute the aspect program to acquire the to-be-verified information required for business execution when the aspect program is triggered during business execution;

[0130] A sending module 304 is configured to send the to-be-verified information to a verification system to verify the to-be-verified information through the verification system;

[0131] An execution module 306 is configured to execute business according to a verification result returned by the verification system.

[0132] ​Optionally, the apparatus further includes: a certificate application module 308, configured to send a deployment data acquisition request to the service platform providing the application container before injecting the aspect program into the application container's pointcut via a pre-deployed aspect base, causing the service platform to apply to the verification system for an application identity certificate for the business application to be deployed, and to determine the environmental data corresponding to the business application, and to receive the application identity certificate issued by the verification system through the service platform, and to inject the application identity certificate and the environmental data into the application container, thereby deploying the business application in the application container and performing business execution.

[0133] Optionally, the acquisition module 302 executes the aspect ratio procedure to acquire the pre-injected environmental data and the application identity certificate of the business application as verification information required for business execution.

[0134] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The provided business execution method or the above Figure 2 The business execution methods provided.

[0135] This instruction manual also provides Figure 6 The diagram shows the structure of the electronic device. Figure 6 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The provided business execution method or the above Figure 2 The business execution methods provided.

[0136] Of course, in addition to the software implementation method, this specification does not exclude other implementation methods, such as the combination of hardware and software XOR logic devices, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0137] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0138] The controller can be implemented in any suitable way, e.g. the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, e.g. software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91 SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented by means of logic programmed into logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers, etc. to perform the same functions. The controller can thus be considered as a hardware component, and the means comprised therein for performing various functions can be considered as structures within the hardware component. Alternatively, or even, the means for performing various functions can be considered as both a software module implementing a method and a structure within a hardware component.

[0139] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0140] For the sake of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of each unit can be implemented in one or more software and / or hardware in the implementation of the present specification.

[0141] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage etc.) containing computer usable program code.

[0142] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0143] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0144] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0145] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0146] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0147] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0148] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0149] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] The present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0151] The various embodiments described in this specification are described using a numbering of embodiments approach: these are each individually integrated contributions pertaining to different but related aspects of the description. Each of the various embodiments can stand on its own, and each can be combined with the subject matter of other embodiments to produce further embodiments. Where the same numbers appear in different embodiments, such numbers are used for the sake of ease of understanding only and do not imply that the embodiments in which such numbers appear are the same or similar.

[0152] The above only describes the embodiments of the present specification and is not intended to limit the present specification. The present specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A service execution method, comprising: determining a facet program to be deployed and a pointcut of a service application in an application container, the facet program being used to collect information to be verified required for service execution, wherein the information to be verified comprises environment data of the application container and an application identity certificate of the service application in the application container; deploying a facet base in the application container, and injecting the facet program into the pointcut of the service application in the application container through the facet base; when receiving the information to be verified sent by the facet program, obtaining environment information of the application container from a service platform providing the application container; verifying the information to be verified according to the environment information, and determining a verification result, specifically comprising: determining whether the environment data of the application container in the information to be verified is correct according to the environment information; if the environment data is correct, performing application identity authentication on the application identity certificate of the service application in the application container in the information to be verified; returning the verification result to the service application in the application container, so that the service application in the application container executes services according to the verification result. 2.The method of claim 1, wherein the verifying the information to be verified according to the environment information, and determining a verification result, further comprises: if the application identity authentication is successful, authenticating a permission required for the service application in the application container to continue executing services according to a preset permission configuration, the environment data and the application identity, and determining an authentication result as the verification result. 3.The method of claim 1, wherein the facet program comprises a plurality of facet programs, each facet program corresponding to a different service execution strategy; deploying the facet base in the application container, and injecting the facet program into the pointcut of the service application in the application container through the facet base, specifically comprising: deploying the facet base carrying a preset facet program deployment rule to the application container, the deployment rule comprising at least a correspondence between each service execution strategy of the service application and each facet program; determining a target facet program from each facet program according to a current service execution strategy of the service application in the application container and the correspondence; and injecting the target facet program into each pointcut of the service application. 4.The method of claim 1, wherein the facet program is used to collect a plurality of kinds of information to be verified required for service execution through a plurality of modules; deploying the facet base in the application container, and injecting the facet program into the pointcut of the service application in the application container through the facet base, specifically comprising: deploying the facet base in the application container, and determining a state corresponding to each module in the facet program; for each module, when the state corresponding to the module is an open state, switching an execution state corresponding to the module to the open state through the facet base, and the facet program collects corresponding information to be verified by executing the module when the facet program is executed. When the state corresponding to the module is the closed state, the execution state corresponding to the module is switched to the closed state through the aspect base, and the aspect program is not executed when the aspect program is executed, so that the aspect program does not collect the to-be-verified information corresponding to the module; The aspect program is injected into the pointcut of the business application program in the application container through the aspect base.

5. The method of claim 1, further comprising: receiving an application identity certificate acquisition request sent by a service platform providing the application container, the application identity certificate acquisition request including at least information of a business application program in the application container and environment data corresponding to the business application program; generating an application identity certificate of the business application program according to the information of the business application program and the environment data corresponding to the business application program; issuing the application identity certificate to the service platform, so that the service platform deploys the business application program according to the received application identity certificate.

6. A business execution method, the method comprising: in response to a start instruction, injecting an aspect program into a pointcut of a business application program in an application container through a pre-deployed aspect base, the aspect program being used to collect to-be-verified information required for business execution; wherein the to-be-verified information includes environment data of the application container and an application identity certificate of the business application program in the application container; when the aspect program is triggered during business execution, executing the aspect program to obtain the to-be-verified information required for business execution; sending the to-be-verified information to a verification system to verify the to-be-verified information through the verification system; executing business according to a verification result returned by the verification system; wherein the verification system verifies the to-be-verified information in the following manner: obtaining environment information of the application container from a service platform providing the application container, and determining whether the environment data of the application container in the to-be-verified information is correct according to the environment information; if the environment data is correct, performing application identity authentication on the application identity certificate of the business application program in the application container in the to-be-verified information.

7. The method of claim 6, before injecting the aspect program into the pointcut of the business application program in the application container through the pre-deployed aspect base, the method further comprising: sending a deployment data acquisition request to a service platform providing the application container, so that the service platform applies for an application identity certificate of a to-be-deployed business application program from the verification system, and so that the service platform determines environment data corresponding to the business application program; receiving the application identity certificate of the business application program issued by the verification system through the service platform, so that the service platform injects the application identity certificate and the environment data into the application container; deploying the business application program in the application container and performing business execution.

8. The method of claim 7, executing the aspect program to obtain the to-be-verified information required for business execution specifically comprises: The aspect program is executed to obtain the pre-injected environment data and the application identity certificate of the business application program as to-be-verified information required for business execution. 9.A business execution apparatus, comprising: a determination module configured to determine an aspect program to be deployed and an aspect point of a business application program in an application container, the aspect program being configured to collect to-be-verified information required for business execution, wherein the to-be-verified information comprises environment data of the application container and an application identity certificate of the business application program in the application container; a deployment module configured to deploy an aspect base in the application container, and inject the aspect program at the aspect point of the business application program in the application container through the aspect base; a receiving module configured to obtain environment information of the application container from a service platform providing the application container when receiving to-be-verified information sent by the aspect program; a verification module configured to verify the to-be-verified information according to the environment information and determine a verification result, specifically comprising: determining whether the environment data of the application container in the to-be-verified information is correct according to the environment information; and if the environment data is correct, performing application identity authentication on the application identity certificate of the business application program in the application container in the to-be-verified information; a returning module configured to return the verification result to the business application program in the application container, so that the business application program in the application container executes business according to the verification result. 10.A business execution apparatus, comprising: an injection module configured to inject an aspect program into an aspect point of a business application program in an application container through a pre-deployed aspect base in response to a start instruction, the aspect program being configured to collect to-be-verified information required for business execution, wherein the to-be-verified information comprises environment data of the application container and an application identity certificate of the business application program in the application container; an obtaining module configured to execute the aspect program to obtain the to-be-verified information required for business execution when the aspect program is triggered during business execution; a sending module configured to send the to-be-verified information to a verification system to verify the to-be-verified information through the verification system; an execution module configured to execute business according to a verification result returned by the verification system; wherein the verification system verifies the to-be-verified information in the following manner: obtaining environment information of the application container from a service platform providing the application container, and determining whether the environment data of the application container in the to-be-verified information is correct according to the environment information; if the environment data is correct, performing application identity authentication on the application identity certificate of the business application program in the application container in the to-be-verified information. 11.A computer readable storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the method of any one of claims 1-8.

12. An electronic device comprising a memory, a processor, and a computer program stored on the memory and loadable on the processor, the processor implementing the method of any of claims 1 to 8 when executing the program.

Images