Client authorization method, storage medium and computer terminal

Abstract

The present invention discloses a client authorization method, storage medium and computer terminal. The method comprises: obtaining authorization information, wherein the authorization information at least comprises: information of multiple clients to be authorized; parsing the authorization information to obtain parsing results, wherein the parsing results comprise: network addresses of multiple clients to be authorized; and authorizing multiple clients to be authorized based on the network addresses. The present invention solves the technical problem in the related art that when a client accesses a server, the authorization efficiency of the client is low.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a client authorization method, a storage medium and a computer terminal. Background Art

[0002] In the prior art, after the server cluster starts authentication, whitelist authorization needs to be implemented using the command line tool provided by the cluster, which has complex parameters and is not easy to understand. At the same time, the whitelist authorization in the prior art only supports authorization through a single network address, and does not support multiple network addresses as a group and authorization in a group dimension. If the number of network addresses in the group changes, it cannot perceive the change, and thus cannot perform whitelist dynamic authorization.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiment of the present invention provides a client authorization method, a storage medium and a computer terminal, so as to at least solve the technical problem in the related art that the authorization efficiency of the client is low when the client accesses the server.

[0005] According to one aspect of an embodiment of the present invention, there is provided a method for authorizing a client, comprising: obtaining authorization information, wherein the authorization information comprises at least information of a plurality of clients to be authorized; parsing the authorization information to obtain a parsing result, wherein the parsing result comprises network addresses of the plurality of clients to be authorized; and authorizing the plurality of clients to be authorized based on the network addresses.

[0006] Optionally, the authorization information is parsed to obtain a parsing result, including: determining network addresses of multiple clients to be authorized from a preset correspondence based on the authorization information, wherein the preset correspondence is used to characterize the correspondence between information of different clients and the network address of the client.

[0007] Optionally, multiple clients to be authorized are authorized based on the network address, including: based on the authorization information, obtaining version information of the target cluster, wherein the target cluster is a network cluster accessed by the multiple clients to be authorized; based on the version information, obtaining historical authorization information, wherein the historical authorization information is the network address of an authorized client, and the authorized client is authorized by the target cluster; based on the historical authorization information, multiple clients to be authorized are authorized.

[0008] Optionally, based on historical authorization information, multiple clients to be authorized are authorized, including: comparing the parsing result with the historical authorization information to obtain a comparison result, wherein the comparison result is used to indicate whether there is a difference between the network addresses of the multiple clients to be authorized and the network addresses of the authorized clients; in response to the comparison result being that the network address is different from the historical authorization information, determining a target client among the multiple clients to be authorized, wherein the network address of the target client is different from the network address of the authorized client; and authorizing the target client.

[0009] Optionally, in response to the comparison result that there is no difference between the network address and the historical authorization information, authorization of the multiple clients to be authorized is stopped.

[0010] Optionally, multiple clients to be authorized are authorized based on the network address, including: based on the authorization information, obtaining type information of the target cluster, the type information is used to represent the category information of messages sent to the target cluster by the multiple clients to be authorized; based on the type information, merging the network addresses to obtain a network address set, wherein the network addresses included in the network address set have the same category information of messages sent by the clients to be authorized; based on the network address, merging the network address set to obtain a target authorization group, wherein the network addresses included in the target authorization group are the same; and based on the target authorization group, authorizing multiple clients to be authorized.

[0011] Optionally, the method further includes: before authorizing the multiple clients to be authorized based on the network address, establishing a target file, the target file being used to indicate authorization of the multiple clients to be authorized; and deleting the target file in response to successful authorization of the multiple clients to be authorized.

[0012] Optionally, authorizing multiple clients to be authorized includes: determining whether a current file exists, the current file is used to indicate that an authorization operation is currently being performed; in response to the current file existing, stopping authorizing the multiple clients to be authorized; in response to the current file not existing, authorizing the multiple clients to be authorized.

[0013] According to another aspect of an embodiment of the present invention, a storage medium is further provided. The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any of the above-mentioned client authorization methods.

[0014] According to another aspect of an embodiment of the present invention, a computer terminal is provided, including: a processor and a memory, wherein the processor is used to run a program stored in the memory, wherein any one of the above-mentioned client authorization methods is executed when the program is run.

[0015] In an embodiment of the present invention, authorization information is obtained, wherein the authorization information at least includes: information of multiple clients to be authorized; the authorization information is parsed to obtain parsing results, wherein the parsing results include: network addresses of multiple clients to be authorized; and multiple clients to be authorized are authorized based on the network addresses. It is easy to notice that the information of multiple clients to be authorized can be filled in the authorization information, and the network addresses of multiple clients to be authorized can be obtained by parsing the authorization information, thereby achieving the ability to authorize multiple clients to be authorized at the same time, and further, the technical effect of improving the efficiency of authorization can be achieved, thereby solving the technical problem of low efficiency of authorization for clients when clients access servers in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of an optional client authorization method according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of an optional architecture according to an embodiment of the present invention;

[0019] Figure 3a is a flow chart of an optional dynamic authorization according to an embodiment of the present invention;

[0020] Figure 3b is a flowchart of another optional dynamic authorization according to an embodiment of the present invention;

[0021] Figure 3c is a flowchart of another optional dynamic authorization according to an embodiment of the present invention;

[0022] Figure 4 It is a schematic diagram of an optional authorization device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] First, the technical terms or technical terms that appear in the embodiments of the present invention are explained as follows:

[0026] BNS: Baidu Naming Service is a distributed system that can provide a mapping between the information of different clients and the network address of the client.

[0027] Kafka: An open source message queue that can provide asynchronous high-volume writing and distribution of user messages, such as log collection and simultaneous reading of the same data by multiple parties.

[0028] JAAS: Java Authentication and Authorization Service, Java authentication and authorization application program interface, can provide a flexible and scalable mechanism to protect client or server-side Java programs.

[0029] Java's early security framework emphasized protecting users from attacks by downloaded code by verifying the source and author of the code, and protecting the system from user attacks by verifying who is running the code and his / her permissions.

[0030] Topic: that is, the category of messages sent to the target cluster by multiple authorized clients. Each message published to the Kafka cluster has a category, which is called a Topic. (Physically, messages of different Topics are stored separately. Logically, although messages of a Topic are stored on one or more brokers, users only need to specify the Topic of the message to produce or consume data without having to worry about where the data is stored.)

[0031] Producer: can be represented as Producer, responsible for publishing messages to the Kafka cluster.

[0032] Consumer: can be represented as Consumer, which refers to the message consumer and the client that can read messages from the Kafka cluster.

[0033] Consumer Group: Consumer group. Each Consumer belongs to a specific Consumer Group.

[0034] GroupId: The name of the Consumer Group, which uniquely identifies a Consumer Group.

[0035] Database, which can be expressed as Database, is a "warehouse that organizes, stores and manages data according to data structure". It is a collection of large amounts of data that are stored in a computer for a long time, organized, shareable and uniformly managed.

[0036] k8s: kubernetes is an open source system for automated deployment, scaling, and management of containerized applications.

[0037] Deployment: A workload in k8s.

[0038] JSON: JavaScript Object Notation, JS object notation, is a lightweight data exchange format.

[0039] Example 1

[0040] According to an embodiment of the present invention, an embodiment of a client authorization method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] Figure 1 is a flow chart of a client authorization method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0042] Step S102: obtaining authorization information, wherein the authorization information at least includes: information of multiple clients to be authorized.

[0043] The above authorization information may be BNS authorization information, that is, the authorization information may include the network addresses of multiple clients to be authorized, and the mapping relationship between all network addresses and clients. Optionally, the above authorization information may include data information generated when multiple clients to be authorized access a server, including but not limited to: relevant information of multiple clients to be authorized and the servers to be accessed. Among them, the multiple clients to be authorized may include at least one of the following: producer clients and consumer clients. Optionally, the information of multiple clients to be authorized may include at least one of the following: IP (Internet Protocol) addresses of multiple client devices to be authorized, cluster information of server clusters to be accessed by multiple clients to be authorized, configuration information and port information of multiple client devices to be authorized, etc., wherein the configuration information may include but is not limited to the hardware configuration of the client device, and the port information may include but is not limited to the virtual port and physical port of the client.

[0044] In an optional embodiment, the user can submit authorization information on the operation and maintenance platform of the server to be accessed by the multiple clients to be authorized, wherein the authorization information may include cluster information to be accessed by the multiple clients to be authorized, category information of messages sent by the multiple clients to be authorized, i.e., Topic, and group identity information of the multiple clients to be authorized, i.e., GroupId, etc.

[0045] Optionally, multiple clients to be authorized can access relevant data on the server by sending messages to the server, or can transmit data between the client and the server by sending messages to the server. In an optional embodiment, since the purpose of the client sending messages to the server is different, the categories of the messages sent will also be different. Optionally, when multiple clients to be authorized are consumer clients, since the number of consumers is large, consumers can access in the form of a group, so that the group identity information of multiple clients to be authorized can be added to the authorization information. After the authorization information is successfully uploaded, the operation and maintenance platform can store the information contained in the authorization information in the database. The operation and maintenance platform will retrieve the data once at a certain time and perform subsequent parsing and authorization operations on it.

[0046] Step S104, parsing the authorization information to obtain a parsing result, wherein the parsing result includes: network addresses of multiple clients to be authorized.

[0047] In an optional embodiment, after obtaining the authorization information, the operation and maintenance platform may issue a parsing command. In response to the parsing command, the operation and maintenance platform will perform a parsing operation on the authorization information, thereby obtaining the network addresses of multiple clients to be authorized. Optionally, after obtaining the authorization information, the operation and maintenance platform may generate a parsing command and call a parsing function, or a parsing program, or a parsing tool to parse the authorization information, thereby obtaining the network addresses corresponding to multiple clients to be authorized. Optionally, multiple parsings may be performed on the same authorization information to ensure that the parsing is correct.

[0048] In another optional embodiment, when a parsing tool is used for parsing, the user may also directly input the authorization information into the parsing tool to complete the parsing operation.

[0049] Step S106: Authorize multiple clients to be authorized based on the network address.

[0050] In an optional embodiment, the authorization information is parsed to obtain the network addresses of multiple clients to be authorized. After obtaining the network addresses of multiple clients to be authorized, the authorization operation can be directly performed on the network addresses of multiple clients to be authorized. Optionally, the network addresses corresponding to multiple clients with the same message type sent to the server can be merged to form multiple different network address sets, and the authorization operation is performed on the set as a unit, so that multiple different network addresses can be authorized at the same time, thereby improving the authorization efficiency. After the authorization is successful, the successfully authorized network address can be recorded. In subsequent authorization operations, only the unauthorized network address needs to be authorized, and the authorized network address will no longer need to be authorized repeatedly, thereby realizing dynamic authorization.

[0051] In another optional embodiment, the network addresses corresponding to multiple clients with the same message type sent to the server in the obtained different network addresses can be merged to form multiple different network address sets, and then the network address sets with the same network addresses in the multiple different network address sets can be merged again to form different groups, and then authorization operations are performed on a group basis. Based on the above operations, through two merging processes, more clients to be authorized can be authorized through one authorization operation, thereby further improving the authorization efficiency on the basis of one merging operation.

[0052] Through the above steps, the authorization information is obtained, wherein the authorization information at least includes: information of multiple clients to be authorized; the authorization information is parsed to obtain the parsing result, wherein the parsing result includes: network addresses of multiple clients to be authorized; and multiple clients to be authorized are authorized based on the network addresses. It is easy to notice that the information of multiple clients to be authorized can be filled in the authorization information, and the network addresses of multiple clients to be authorized can be obtained by parsing the authorization information, thereby achieving the ability to authorize multiple clients to be authorized at the same time, and further, the technical effect of improving the efficiency of authorization can be achieved, thereby solving the technical problem of low efficiency of authorization for clients when clients access servers in related technologies.

[0053] Optionally, the authorization information is parsed to obtain a parsing result, including: determining network addresses of multiple clients to be authorized from a preset correspondence based on the authorization information, wherein the preset correspondence is used to characterize the correspondence between information of different clients and the network address of the client.

[0054] In an optional embodiment, after the operation and maintenance platform obtains the authorization information, it can obtain the mapping relationship between the client and the network address (ie, the preset corresponding relationship mentioned above), and parse the authorization information based on the mapping relationship to determine the client corresponding to each network address.

[0055] In another optional embodiment, based on the mapping relationship between information of different clients and the network address of the client, the authorization information can be parsed using a parsing function, a parsing program or other parsing tools to obtain a parsing result, that is, the network addresses of multiple clients to be authorized.

[0056] Optionally, multiple clients to be authorized are authorized based on the network address, including: based on the authorization information, obtaining version information of the target cluster, wherein the target cluster is a network cluster accessed by the multiple clients to be authorized; based on the version information, obtaining historical authorization information, wherein the historical authorization information is the network address of an authorized client, and the authorized client is authorized by the target cluster; based on the historical authorization information, multiple clients to be authorized are authorized.

[0057] The target cluster may be a server cluster that provides services to users. Optionally, the target cluster may be a Kafka cluster.

[0058] The above version information may be the current version of the target cluster. Different versions of target clusters may use different authorization methods to authorize the client. Optionally, the historical authorization information of the target cluster may be obtained based on the version information of the target cluster. Optionally, after obtaining the current version of the target cluster, the kafka command script corresponding to the version may be used to query the historical authorization information of the target cluster according to the different version information of the target cluster. The historical authorization information may be the information of the authorized client before the current authorization operation, and the information may include the network address of the authorized client, the authorization time, and other information.

[0059] In an optional embodiment, after obtaining the version information of the target cluster, the historical authorization information of the target cluster can be obtained by retrieving the historical data of the target cluster. Or, different scripts are used according to different versions of the target cluster to query the historical authorization information. The historical authorization information may include the historical authorization information of the producer and the historical authorization information of the consumer. Optionally, the historical authorization information may be analyzed to obtain the network address corresponding to the historical authorization information. Based on the network address corresponding to the historical authorization information, it can be determined whether the multiple clients to be authorized have been authorized before the current authorization operation, thereby avoiding repeated authorization, further reducing invalid operations, and improving authorization efficiency.

[0060] Optionally, based on historical authorization information, multiple clients to be authorized are authorized, including: comparing the parsing result with the historical authorization information to obtain a comparison result, wherein the comparison result is used to indicate whether there is a difference between the network addresses of the multiple clients to be authorized and the network addresses of the authorized clients; in response to the comparison result being that the network address is different from the historical authorization information, determining a target client among the multiple clients to be authorized, wherein the network address of the target client is different from the network address of the authorized client; and authorizing the target client.

[0061] The above comparison result may be that the network addresses of the multiple clients to be authorized are different from the network addresses of the authorized clients, or that the network addresses of the multiple clients to be authorized are not different from the network addresses of the authorized clients. Optionally, when the network addresses of the multiple clients to be authorized are exactly the same as the network addresses of the authorized clients, it can be considered that the network addresses of the multiple clients to be authorized are not different from the network addresses of the authorized clients, and when the network addresses of the multiple clients to be authorized are not exactly the same as the network addresses of the authorized clients, it can be considered that the network addresses of the multiple clients to be authorized are different from the network addresses of the authorized clients. Optionally, different comparison results may be presented in the form of voice prompts, or in different colors, which is not limited here.

[0062] The target client may represent a client that has not been authorized before the current authorization operation. Optionally, the target client may be obtained by performing addition and subtraction operations on multiple clients to be authorized.

[0063] In an optional embodiment, after obtaining the historical authorization information, the operation and maintenance platform may generate a comparison command to compare the network addresses corresponding to the multiple clients to be authorized obtained through analysis with the network addresses corresponding to the historical authorization information, and by determining whether the two types of network addresses are the same, it is possible to analyze whether there are differences between the network addresses corresponding to the multiple clients to be authorized and the network addresses included in the historical authorization information, thereby determining whether the network addresses corresponding to the multiple clients to be authorized have been authorized before this authorization operation.

[0064] If one or more of the network addresses corresponding to the multiple clients to be authorized have been authorized before this authorization operation, the network address needs to be deleted to determine the target client that finally needs to be authorized. In the subsequent operation process, only the target client needs to be authorized.

[0065] Optionally, in response to the comparison result that there is no difference between the network address and the historical authorization information, authorization of the multiple clients to be authorized is stopped.

[0066] In an optional embodiment, if the network addresses of the multiple clients to be authorized do not differ from the network addresses of the authorized clients, it means that the network addresses of the multiple clients to be authorized have been authorized before this operation, so there is no need to repeat the authorization operation. Optionally, the operation and maintenance platform can issue a stop operation instruction to stop authorizing the multiple clients to be authorized. Alternatively, the operation and maintenance platform can issue an alarm, and the user can terminate this operation.

[0067] Figure 2 is a schematic diagram of an optional architecture according to an embodiment of the present invention, such as Figure 2 As shown, the user first fills in the authorization information to the target cluster operation and maintenance platform. After receiving the authorization information, the target cluster saves it in the database. Noah (an adaptive process that can call a parsing tool to parse the authorization information) can be used to periodically issue authorization tasks to implement authorization operations. After receiving the instruction, the parsing tool can obtain the authorization information from the database, parse it to obtain the parsing result, and the parsing result will also be stored in the database. Optionally, the user can also perform manual execution and directly fill the authorization information into the parsing tool for parsing. After the parsing is completed, the authorization script can be called to perform authorization operations on the parsing results. After the authorization operation is successful, the client can access the target cluster.

[0068] Optionally, multiple clients to be authorized are authorized based on the network address, including: based on the authorization information, obtaining type information of the target cluster, the type information is used to represent the category information of messages sent to the target cluster by the multiple clients to be authorized; based on the type information, merging the network addresses to obtain a network address set, wherein the network addresses included in the network address set have the same category information of messages sent by the clients to be authorized; based on the network address, merging the network address set to obtain a target authorization group, wherein the network addresses included in the target authorization group are the same; and based on the target authorization group, authorizing multiple clients to be authorized.

[0069] In an optional embodiment, after obtaining the network addresses corresponding to multiple clients to be authorized, the same network addresses of messages sent by multiple clients to be authorized to the target cluster can be merged to obtain multiple network address sets. Optionally, the producer only needs to find the same Topic, merge the network addresses with the same Topic into a network address set, thereby forming a one-to-many relationship between the Topic and the network address. Optionally, the consumer needs to find the same Topic and GroupId, merge the network addresses with the same Topic and GroupId, obtain a network address set, thereby forming a one-to-many relationship between the Topic and GroupId and the network address.

[0070] In another optional embodiment, after obtaining multiple network address sets, it is possible to determine whether the network address information contained in each network address set is the same, and merge the network address sets containing the same network address information to obtain a target authorization group. Optionally, in the case of a one-to-many relationship between the producer Topic and the network address, a list of network addresses with the same network address can be searched, and the list of network addresses can be merged into a target authorization group, thereby forming a many-to-many relationship between the Topic and the network address. Optionally, in the case of a one-to-many relationship between the consumer Topic and GroupId and the network address, a list of network addresses with the same network address can be searched, and the list of network addresses can be merged into a target authorization group, thereby forming a many-to-many relationship between the Topic and GroupId and the network address.

[0071] Furthermore, through two merging processes, the network addresses corresponding to the multiple clients to be authorized contained in the authorization information can be grouped according to a certain rule, so that authorization can be performed according to the group dimension, thereby improving the authorization efficiency.

[0072] Optionally, the method further includes: before authorizing the multiple clients to be authorized based on the network address, establishing a target file, the target file being used to indicate authorization of the multiple clients to be authorized; and deleting the target file in response to successful authorization of the multiple clients to be authorized.

[0073] The target file may be a file in JSON format or other formats, which is not limited here.

[0074] In an optional embodiment, when performing authorization operations on multiple clients to be authorized, a target file can be created to store the client to be authorized and its corresponding network address information, and a related script can be called to perform the authorization operation. Optionally, after the authorization operation is completed, the successfully authorized network address information can be stored in a database as historical authorization information, and the target file can be deleted.

[0075] Furthermore, during the next authorization operation, only the unauthorized network address needs to be authorized, and the authorized network address does not need to be authorized again, thereby achieving dynamic execution of authorization.

[0076] Optionally, authorizing multiple clients to be authorized includes: determining whether a current file exists, the current file is used to indicate that an authorization operation is currently being performed; in response to the current file existing, stopping authorizing the multiple clients to be authorized; in response to the current file not existing, authorizing the multiple clients to be authorized.

[0077] The above-mentioned current file may be a file corresponding to the ongoing authorization operation. Optionally, the current file may include the network address information of the client performing the authorization operation. Optionally, the current file may be a file in JSON format, or a file in other formats, which is not limited here.

[0078] In an optional embodiment, before performing the authorization operation, it can be determined whether the current file exists. If the current file exists, it means that the target cluster is currently performing an authorization operation, so it is necessary to terminate the authorization operation and wait until the current authorization operation is completed before performing the authorization operation. If the current file does not exist, it means that the authorization operation is currently in progress, and at this time, the authorization operation can be performed.

[0079] Figure 3a is a flow chart of an optional dynamic authorization according to an embodiment of the present invention, such as Figure 3aAs shown, before performing the authorization operation, first determine whether the current file exists. If it exists, it means that the authorization operation is currently in progress, so this operation needs to be terminated. If it does not exist, the target file can be created to prepare for this authorization operation. Optionally, you need to obtain authorization information next, including obtaining the authorization information of producers and consumers. You can query the message types and consumer groups in the database to obtain the authorization information. Next, you need to determine whether the acquisition is successful. If not, you need to terminate this operation. If so, you can continue with subsequent operations, that is, parse the authorization information obtained in the database. At this time, you need to execute the parsing command to parse the authorization information to obtain a series of network addresses. Optionally, in order to ensure that the parsing is correct, you can perform multiple parsings on the same authorization information. After the parsing is completed, you also need to determine whether the parsing is successful. If so, you need to record the network address in the authorization information. If not, you need to mark the authorization information as unavailable, and then update the database.

[0080] Figure 3b is a flowchart of another optional dynamic authorization according to an embodiment of the present invention, such as Figure 3b As shown, after judging whether the parsing operation is successful and drawing a conclusion, it is also necessary to judge whether the network address parsed from the authorization information is the same as the last time. If not, the authorization information can be recorded as pending authorization, and then the version information of the target cluster can be obtained. If so, the version information of the target cluster can be directly obtained. When obtaining the version information of the target cluster, the cluster information in the database can be queried to obtain the version information of all clusters, and then the cluster to be authorized, that is, the target cluster and its version information, can be filtered out. After obtaining the version information of the target cluster, the historical authorization information of the cluster can be concurrently queried and the historical authorization information can be compared with the parsed network address. Optionally, different commands can be called based on different version information to query the historical authorization information, and the command can be executed to generate a permission record. Then, the method for obtaining the network address that needs to be authorized can be called to compare the network address corresponding to the historical authorization information in the network address corresponding to the current permission to obtain the network address that needs to be authorized.

[0081] Figure 3c is a flowchart of another optional dynamic authorization according to an embodiment of the present invention, such as Figure 3cAs shown, after comparing the network address corresponding to the historical authorization information in the network address corresponding to the current permission to obtain the network address that needs to be authorized, the merge command can be called to merge the network addresses of the producer and consumer according to different methods, and a network address set can be obtained. After obtaining the network address set, the network address sets of the producer and consumer can be merged again according to different methods. After the merge is completed, the authorization method can be called to generate an authorization command and execute the authorization command to perform the authorization operation. After the execution is completed, it is also necessary to determine whether the authorization is successful. If not, terminate this operation and wait for the next re-authorization. If so, record the successfully authorized network address in the database and save it to the consumer whitelist and producer whitelist, thereby saving the latest successfully authorized network address and deleting the target file. After the deletion is completed, the operation can be terminated.

[0082] Example 2

[0083] According to another aspect of an embodiment of the present invention, an authorization device is also provided, which can execute the authorization method of the client in the above embodiment. The specific implementation method and preferred application scenario are the same as the above embodiment and will not be repeated here.

[0084] Figure 4 is a schematic diagram of an optional authorization device according to an embodiment of the present invention, such as Figure 4 As shown, the device comprises:

[0085] The acquisition module 402 is used to acquire authorization information, wherein the authorization information at least includes: information of multiple clients to be authorized;

[0086] The parsing module 404 is used to parse the authorization information to obtain a parsing result, wherein the parsing result includes: network addresses of multiple clients to be authorized;

[0087] The authorization module 406 is used to authorize multiple clients to be authorized based on the network address.

[0088] Optionally, the parsing module 404 includes: a first determination unit, configured to determine network addresses of multiple clients to be authorized from a preset correspondence based on the authorization information, wherein the preset correspondence is used to characterize the correspondence between information of different clients and the network address of the client.

[0089] Optionally, the authorization module 406 includes: a first acquisition unit, used to obtain version information of the target cluster based on the authorization information, wherein the target cluster is a network cluster accessed by multiple clients to be authorized; a second acquisition unit, used to obtain historical authorization information based on the version information, wherein the historical authorization information is the network address of an authorized client, and the authorized client is authorized by the target cluster; the first authorization unit, used to authorize multiple clients to be authorized based on the historical authorization information.

[0090] Optionally, the first authorization unit includes: a comparison subunit, used to compare the parsing result with the historical authorization information to obtain a comparison result, wherein the comparison result is used to indicate whether there is a difference between the network addresses of multiple clients to be authorized and the network addresses of authorized clients; a determination subunit, used to determine a target client among the multiple clients to be authorized in response to the comparison result being that the network address is different from the historical authorization information, wherein the network address of the target client is different from the network address of the authorized client; and an authorization subunit, used to authorize the target client.

[0091] Optionally, the device further comprises: a stopping module, configured to stop authorizing the plurality of clients to be authorized in response to a comparison result indicating that there is no difference between the network address and the historical authorization information.

[0092] Optionally, the authorization module 406 includes: a third acquisition unit, used to acquire type information of the target cluster based on the authorization information, the type information is used to represent the category information of messages sent to the target cluster by multiple clients to be authorized; a first merging unit, used to merge the network addresses based on the type information to obtain a network address set, wherein the network addresses included in the network address set correspond to the same category information of messages sent by the clients to be authorized; a second merging unit, used to merge the network address set based on the network addresses to obtain a target authorization group, wherein the network addresses included in the target authorization group are the same; and a second authorization unit, used to authorize multiple clients to be authorized based on the target authorization group.

[0093] Optionally, the device also includes: an establishment module, used to establish a target file before authorizing multiple clients to be authorized based on the network address, the target file is used to indicate the authorization of multiple clients to be authorized; a deletion module, used to delete the target file in response to successful authorization of multiple clients to be authorized.

[0094] Optionally, the authorization module 406 includes: a second determination unit, used to determine whether the current file exists, and the current file is used to indicate that an authorization operation is currently being performed; a stop unit, used to stop authorizing multiple clients to be authorized in response to the existence of the current file; and a third authorization unit, used to authorize multiple clients to be authorized in response to the non-existence of the current file.

[0095] Example 3

[0096] According to another aspect of an embodiment of the present invention, a storage medium is further provided. The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any of the above-mentioned client authorization methods.

[0097] Example 4

[0098] According to another aspect of an embodiment of the present invention, a computer terminal is provided, including: a processor and a memory, wherein the processor is used to run a program stored in the memory, wherein any one of the above-mentioned client authorization methods is executed when the program is run.

[0099] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0100] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0103] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0105] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A client authorization method, characterized in that: include: Acquire authorization information, wherein the authorization information at least includes: information of multiple clients to be authorized; Parsing the authorization information to obtain a parsing result, wherein the parsing result includes: network addresses of the multiple clients to be authorized; Authorizing the multiple clients to be authorized based on the network addresses; Based on the network address, the multiple clients to be authorized are authorized, including: based on the authorization information, obtaining type information of the target cluster, the type information is used to represent category information of messages sent to the target cluster by the multiple clients to be authorized; based on the type information, merging the network addresses to obtain a network address set, wherein the network addresses included in the network address set have the same category information of messages sent by the clients to be authorized; based on the network address, merging a set of network addresses with the same network addresses to obtain a target authorization group, wherein the target authorization group contains a set of network addresses with the same network addresses; based on the target authorization group, the multiple clients to be authorized are authorized.

2. The method according to claim 1, characterized in that Parse the authorization information to obtain parsing results, including: Based on the authorization information, the network addresses of the plurality of clients to be authorized are determined from a preset correspondence relationship, wherein the preset correspondence relationship is used to characterize the correspondence between the information of different clients and the network addresses of the clients.

3. The method according to claim 1, characterized in that Authorizing the multiple clients to be authorized based on the network address includes: Based on the authorization information, obtaining version information of a target cluster, wherein the target cluster is a network cluster to be accessed by the multiple clients to be authorized; Based on the version information, historical authorization information is acquired, wherein the historical authorization information is a network address of an authorized client, and the authorized client is authorized by the target cluster; Based on the historical authorization information, the multiple clients to be authorized are authorized.

4. The method according to claim 3, characterized in that: Authorizing the multiple clients to be authorized based on the historical authorization information includes: Comparing the parsing result with the historical authorization information to obtain a comparison result, wherein the comparison result is used to indicate whether there is a difference between the network addresses of the plurality of clients to be authorized and the network address of the authorized client; In response to the comparison result being that the network address is different from the historical authorization information, determining a target client among the multiple clients to be authorized, wherein the network address of the target client is different from the network address of the authorized client; The target client is authorized.

5. The method according to claim 4, characterized in that: In response to the comparison result that there is no difference between the network address and the historical authorization information, authorizing the multiple clients to be authorized is stopped.

6. The method according to claim 1, characterized in that: The method further comprises: Before authorizing the plurality of clients to be authorized based on the network address, establishing a target file, wherein the target file is used to indicate authorization for the plurality of clients to be authorized; In response to the multiple clients to be authorized being authorized successfully, deleting the target file.

7. The method according to claim 1, characterized in that Authorizing the multiple clients to be authorized includes: Determine whether a current file exists, wherein the current file is used to indicate that an authorization operation is currently being performed; In response to the current file existing, stopping authorization for the multiple clients to be authorized; In response to the current file not existing, authorizing the multiple clients to be authorized.

8. A client authorization device, characterized in that: include: An acquisition module, used to acquire authorization information, wherein the authorization information at least includes: information of multiple clients to be authorized; A parsing module, used to parse the authorization information to obtain a parsing result, wherein the parsing result includes: network addresses of the multiple clients to be authorized; An authorization module, used for authorizing the multiple clients to be authorized based on the network address; Among them, the authorization module is also used to obtain the type information of the target cluster based on the authorization information, and the type information is used to represent the category information of the messages sent by the multiple clients to be authorized to the target cluster; based on the type information, the network addresses are merged to obtain a network address set, wherein the network addresses included in the network address set correspond to the same category information of the messages sent by the clients to be authorized; based on the network address, the network address set containing the same network address is merged to obtain a target authorization group, wherein the target authorization group contains a network address set with the same network address; based on the target authorization group, the multiple clients to be authorized are authorized.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any one of the client authorization methods of claims 1 to 7.

10. A computer terminal, characterized in that: include: A processor and a memory, wherein the processor is used to run a program stored in the memory, wherein the program executes any one of the client authorization methods of claims 1 to 7 when running.

Images