A method and device for verifying authority

Abstract

The present application provides a permission verification method and device, wherein a gateway receives a resource request from a target user, and the resource request carries information about a target function, a target microservice, and a target resource; the gateway verifies the target user's permission to the target function based on the resource request; if the target user has permission to the target function, the resource request is forwarded to the target microservice; the target microservice verifies the target user's access rights to the target resource under the target function based on the resource request. The present application implements fine-grained permission control through a step-by-step permission verification scheme.

Description

Technical Field

[0001] The present application mainly relates to the field of computer technology, and in particular to a permission verification method and device. Background Art

[0002] The microservice architecture generally includes modules such as the registration center, gateway, and microservices. The gateway is the entrance to the entire microservice system, accessing the registration center to call microservices. When a user initiates a request to a microservice, the gateway needs to authenticate the request to verify whether the user has permission to the function.

[0003] However, the current permission verification scheme only verifies at the gateway whether the user has permission for the function, which is a coarse-grained permission control and cannot verify the user's permission to a certain resource under the function, that is, fine-grained permission control. Summary of the invention

[0004] In view of this, the present application provides a permission verification method and device, which verifies the user's permission to the resource under the function in a specific microservice through a step-by-step permission verification scheme, thereby achieving fine-grained permission control.

[0005] On the one hand, an embodiment of the present application first provides a permission verification method, the method comprising:

[0006] The gateway receives a resource request from a target user, where the resource request carries information about a target function, a target microservice, and a target resource;

[0007] The gateway verifies the target user's authority to the target function based on the resource request;

[0008] If the target user has permission for the target function, forward the resource request to the target microservice;

[0009] The target microservice verifies the access rights of the target user to the target resource under the target function based on the resource request.

[0010] Optionally, the method further includes:

[0011] Obtaining user permission information, wherein the user permission information includes a list of common functions and permission information of a specific user;

[0012] The user authority information is processed and integrated and stored in a cache.

[0013] Optionally, the gateway verifies the target user's authority over the target function based on the resource request, including:

[0014] The gateway queries the user authority information in the cache based on the resource request, and verifies the authority of the target user to the target function.

[0015] Optionally, the target microservice verifies the target user's access rights to the target resource under the target function based on the resource request, including:

[0016] The target microservice queries the user permission information in the cache based on the resource request, and verifies the access rights of the target user to the target resource under the target function.

[0017] Optionally, the processing and integrating the user authority information and storing it in a cache includes:

[0018] The user authority information is processed and integrated according to the user dimension, function dimension and resource dimension, and stored in the cache.

[0019] Optionally, the method further includes:

[0020] Based on the resource request, the gateway searches for the target microservice through a registration center to obtain the address of the target microservice;

[0021] The forwarding the resource request to the target microservice includes:

[0022] According to the address of the target microservice, the resource request is forwarded to the target microservice.

[0023] Optionally, the method further includes:

[0024] The service information of the microservice is pre-registered with the registration center so that the registration center can search for the microservice.

[0025] On the other hand, an embodiment of the present application further provides a permission verification device, the device comprising:

[0026] A request receiving module is used for the gateway to receive a resource request from a target user, wherein the resource request carries information about a target function, a target microservice, and a target resource;

[0027] A function verification module, used for the gateway to verify the target user's authority to the target function based on the resource request;

[0028] A request forwarding module, configured to forward the resource request to the target microservice if the target user has permission for the target function;

[0029] The resource verification module is used for the target microservice to verify the access rights of the target user to the target resource under the target function based on the resource request.

[0030] On the other hand, an embodiment of the present application further provides a device, the device comprising: a processor and a memory;

[0031] The memory is used to store instructions;

[0032] The processor is used to execute the instructions in the memory to perform the method described above.

[0033] On the other hand, an embodiment of the present application further provides a computer-readable storage medium, which stores program code or instructions, and when the computer-readable storage medium is run on a computer, enables the computer to execute the method described in the above aspects.

[0034] It can be seen that the embodiments of the present application have the following beneficial effects:

[0035] This application receives the resource request of the target user through the gateway. Based on the resource request, the gateway verifies the target user's permission to the target function. If the target user has permission to the target function, the resource request is forwarded to the target microservice. The target microservice verifies the target user's access rights to the target resource under the target function based on the resource request. This application verifies the target user's functional permissions at the gateway based on the information carried in the resource request. If the functional permission verification passes, the target user's resource permissions under the function are further verified in the specific microservice. Fine-grained permission control is achieved through a step-by-step permission verification solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 A flowchart of a permission verification method provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of a module of a permission verification method provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of a permission verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are described in detail below with reference to the accompanying drawings.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present application. Therefore, the present application is not limited to the specific embodiments disclosed below.

[0042] Currently, in a microservice architecture, the gateway often directly authenticates the received request by querying the database to verify whether the user corresponding to the request has the permission to access the function he needs to access. This permission verification solution has the following problems:

[0043] On the one hand, querying the database to verify permissions and connecting to the database is slow, and the data also needs to be reassembled and combined, which is inefficient;

[0044] On the other hand, only checking whether the user has permission to a function at the gateway is a coarse-grained permission control, which cannot verify the user's permission to a certain resource under the function.

[0045] In order to solve at least one of the above problems, the present application provides a permission verification method and device, which verifies the user's permission to the resource under the function in a specific microservice through a step-by-step permission verification scheme, thereby achieving fine-grained permission control.

[0046] For ease of understanding, a permission verification method and device provided in an embodiment of the present application are described in detail below with reference to the accompanying drawings.

[0047] refer to Figure 1 FIG. 1 is a flowchart of a permission verification method provided by an embodiment of the present application. The method may include the following steps:

[0048] S101: The gateway receives a resource request from a target user, where the resource request carries information about a target function, a target microservice, and a target resource.

[0049] In an embodiment of the present application, the resource request of the target user is a request for accessing the microservice system sent by the service request direction gateway, which may be a request from the outside forwarded by a browser, APP, other systems or the front end of this system. The gateway is the entrance to the entire microservice system and is responsible for forwarding resource requests. The resource request generally includes a URL (Uniform Resource Locator) field and carries message information, etc. According to the resource request and the information it carries, the target function that the target user needs to access, the target microservice for processing or executing the target function, and the target resource information that the target user needs to access can be obtained. Among them, the target microservice is the service provider corresponding to the resource request.

[0050] S102: The gateway verifies the target user's authority to the target function based on the resource request.

[0051] In the embodiment of the present application, the target user's authority to the target function is verified at the gateway based on the resource request. Specifically, the target function's authority verification is performed at the gateway. On the one hand, it is to pre-place the function authority verification, which can prevent unauthorized or even malicious traffic from flowing multiple times in the microservice system; on the other hand, the gateway only verifies the authority of the target function, but does not verify the authority of the target resource, in order to improve the performance of the gateway. Since the information of the target function is reflected in the URL field of the resource request and can be obtained directly, and the information of the target resource is generally contained in the message, obtaining the information of the target resource requires parsing the message field, which is inefficient, so the authority verification of the target function is only performed at the gateway.

[0052] In a possible implementation, the method further includes:

[0053] Obtaining user permission information, wherein the user permission information includes a list of common functions and permission information of a specific user;

[0054] The user authority information is processed and integrated and stored in a cache.

[0055] In an embodiment of the present application, user permission information may be pre-loaded from a location where permission data is persistently stored (eg, a database, a file system, etc.), and then stored in a cache to facilitate fast reading of data.

[0056] Databases, file systems and other locations are storage devices for persistent user permission information. They have a long storage time, but they have slow reading speeds and require secondary processing of data. User permission information mainly consists of two parts: one is a list of public functions, that is, functions that all users have permissions to; the other is permission information for specific users, that is, a list of functions that users have permissions to and resource information under the corresponding functions. Among them, the list of public functions is generally loaded when the system starts, and the permission information for specific users is generally loaded when the user logs in. The permission information in the database may be more complicated. For example, in the "user-role-function" permission model, a joint table query is required to query the role of the user through the user, and then query the corresponding function through the role, in order to further determine whether the user has permission to the function. In a specific system, there may also be tenants, resources, user groups and other items. The permission-related data storage table is more complicated, and the efficiency of permission verification by querying the database is low.

[0057] Cache is an efficient memory based on memory, including but not limited to common caches such as Redis. The data in the cache should be stored in a way that is easy to read quickly, for example:

[0058] In a possible implementation, the processing and integrating the user authority information and storing it in a cache includes:

[0059] The user authority information is processed and integrated according to the user dimension, function dimension and resource dimension, and stored in the cache.

[0060] In the embodiment of the present application, in order to facilitate fast reading, the user permission information can be processed and integrated in advance, stored according to multiple dimensions, and the association between users, functions and resources can be established to facilitate fast search. Specifically, it can also be stored based on the key-value hash storage strategy to facilitate fast search and verification.

[0061] Specifically, during system startup, the public function list is loaded into the cache and set to be persistent; when the user logs in, the persistent user permission information in the database is parsed and integrated into the cache to generate user-related permission information, and a lifetime is set; when the lifetime expires or the user triggers a system exit, the system clears the user-related permission information in the cache; when the user permission information changes or the public function list changes, the update operation of the corresponding cache data is triggered.

[0062] In the embodiment of the present application, on the one hand, the public resource list is stored separately in the cache and can be released without permission verification; on the other hand, the function list of a specific user and the resource information under the corresponding function are stored in the cache, and true / false can be quickly returned when check(user1,func1) is used, and true / false can be quickly returned when check(user1,func1,resource1) is used.

[0063] In a possible implementation, the gateway verifies the target user's authority to the target function based on the resource request, including:

[0064] The gateway queries the user authority information in the cache based on the resource request, and verifies the authority of the target user to the target function.

[0065] In the embodiment of the present application, by querying the user authority information in the cache, fast and efficient access can be achieved during verification.

[0066] S103: If the target user has permission for the target function, forward the resource request to the target microservice.

[0067] In an embodiment of the present application, if the target user does not have permission for the target function, the request is denied for further access to the microservice system, thereby effectively avoiding unauthorized requests or malicious access.

[0068] In a possible implementation, the method further includes:

[0069] Based on the resource request, the gateway searches for the target microservice through a registration center to obtain the address of the target microservice;

[0070] The forwarding the resource request to the target microservice includes:

[0071] According to the address of the target microservice, the resource request is forwarded to the target microservice.

[0072] Specifically, the microservice system includes multiple microservices, and the registration center is where each microservice is registered. After the gateway finds the target microservice and obtains the address, it can forward the request to the target microservice, that is, the service provider corresponding to the resource request, according to the address of the target microservice.

[0073] In a possible implementation, the method further includes:

[0074] The service information of the microservice is pre-registered with the registration center so that the registration center can search for the microservice.

[0075] In the embodiment of the present application, the service information of each microservice can be registered in the registration center in advance after each microservice is started, so that each microservice can be discovered and called.

[0076] It should be noted that in the above embodiments, the registration of the microservice and the storage of the user permission information in the cache are both prerequisite steps for permission verification and do not need to be performed during each permission verification process.

[0077] S104: The target microservice verifies the target user's access rights to the target resource under the target function based on the resource request.

[0078] In an embodiment of the present application, the target user's access rights to the target resource under the target function are verified at the target microservice. If the verification passes, the resource request can access the corresponding target resource; if it fails, an indicator such as false is returned, indicating that the resource request is rejected.

[0079] When the target microservice verifies resource permissions, a common function can be used to implement a method of writing in one place and calling in various places, thereby reducing the intrusion into various business functions of the target microservice; further, it can also be implemented through interceptors and other methods.

[0080] In a possible implementation, the target microservice verifies the target user's access rights to the target resource under the target function based on the resource request, including:

[0081] The target microservice queries the user permission information in the cache based on the resource request, and verifies the access rights of the target user to the target resource under the target function.

[0082] The target microservice verifies the resource permissions of the target user by querying the cache. In the specific embodiment corresponding to step S102, the method in which the gateway verifies the functional permissions of the target user by querying the cache is basically the same, and will not be repeated here.

[0083] The present application also provides a schematic diagram of a module for a permission verification method, see Figure 2 As shown, the connection relationship between the modules in the figure and a specific process of the permission verification method are introduced below.

[0084] As shown in the figure, p0 and p1 are the pre-steps of the permission verification method, and 0-4 are the steps of the permission verification method.

[0085] p0: Each microservice registers service information to the registration center after startup;

[0086] p1: Load and integrate user permission information into the cache in advance. The figure takes the database as an example.

[0087] 0: The service requester sends the resource request to the gateway;

[0088] 1: The gateway queries the cache and verifies the user's permission for the function. If the user does not have permission for the function, the request is rejected; if the user has permission for the function, the subsequent steps are continued;

[0089] 2: The gateway searches for the service provider through the registration center and obtains the address of the service provider;

[0090] 3: The gateway forwards the request to the service provider (microservice S3 is used as an example in the figure);

[0091] 4: Each microservice module verifies the user's access rights to a resource under this function by accessing the cache.

[0092] In the figure, microservices S1, S2, and S3 are modules that provide system business functions, such as system management services, monitoring services, configuration services, etc.

[0093] The embodiment of the present application receives the resource request of the target user through the gateway, and the gateway verifies the target user's authority to the target function based on the resource request; if the target user has the authority to the target function, the resource request is forwarded to the target microservice; the target microservice verifies the target user's access rights to the target resource under the target function based on the resource request. The embodiment of the present application verifies the functional permissions of the target user at the gateway based on the information carried by the resource request, and rejects illegal requests as early as possible to improve the efficiency of the system; if the functional permission verification passes, the resource permissions of the target user under the function are further verified in the specific microservice; through the step-by-step permission verification scheme, fine-grained permission control is achieved.

[0094] Furthermore, the embodiment of the present application also stores the user authority information in a cache in a manner that facilitates fast reading, thereby achieving fast reading of data.

[0095] Based on the above permission verification method, the present application embodiment also provides a permission verification device, referring to Figure 3 As shown, this figure is a schematic diagram of a permission verification device provided by an embodiment of the present application. The device may include:

[0096] Request receiving module 201, used for the gateway to receive a resource request from a target user, wherein the resource request carries information of a target function, a target microservice, and a target resource;

[0097] A function verification module 202, configured for the gateway to verify the target user's authority to the target function based on the resource request;

[0098] A request forwarding module 203 is used to forward the resource request to the target microservice if the target user has permission for the target function;

[0099] The resource verification module 204 is used for the target microservice to verify the access rights of the target user to the target resource under the target function based on the resource request.

[0100] In a possible implementation, the device further includes a permission information storage module, which is used to:

[0101] Obtaining user permission information, wherein the user permission information includes a list of common functions and permission information of a specific user;

[0102] The user authority information is processed and integrated and stored in a cache.

[0103] In a possible implementation, the function verification module is specifically used for: the gateway queries the user authority information in the cache based on the resource request, and verifies the authority of the target user to the target function.

[0104] In a possible implementation, the resource verification module is specifically used to:

[0105] The target microservice queries the user permission information in the cache based on the resource request, and verifies the access rights of the target user to the target resource under the target function.

[0106] In a possible implementation, the permission information storage module is specifically used to:

[0107] The user authority information is processed and integrated according to the user dimension, function dimension and resource dimension, and stored in the cache.

[0108] In a possible implementation, the device further includes an address acquisition module, which is used to: based on the resource request, the gateway searches for the target microservice through a registration center to obtain the address of the target microservice; the request forwarding module is specifically used to:

[0109] According to the address of the target microservice, the resource request is forwarded to the target microservice.

[0110] In a possible implementation, the device further includes a microservice registration module, which is used to:

[0111] The service information of the microservice is pre-registered with the registration center so that the registration center can search for the microservice.

[0112] Based on the above permission verification method, the embodiment of the present application further provides a device, which may include: a processor and a memory;

[0113] A memory for storing instructions;

[0114] The processor is used to execute the instructions in the memory and perform the permission verification method described above.

[0115] Based on the above permission verification method, an embodiment of the present application further provides a computer-readable storage medium, which stores program code or instructions. When the computer-readable storage medium is run on a computer, the computer executes the permission verification method described above.

[0116] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0117] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0118] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0119] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0120] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A permission verification method, characterized in that: The method comprises: The gateway receives a resource request from a target user, where the resource request carries information about a target function, a target microservice, and a target resource; The gateway verifies the target user's authority to the target function based on the resource request; If the target user has permission for the target function, forward the resource request to the target microservice; The target microservice verifies the access rights of the target user to the target resource under the target function based on the resource request.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining user permission information, wherein the user permission information includes a list of common functions and permission information of a specific user; The user authority information is processed and integrated and stored in a cache.

3. The method according to claim 2, characterized in that The gateway verifies the target user's authority to the target function based on the resource request, including: The gateway queries the user authority information in the cache based on the resource request, and verifies the authority of the target user to the target function.

4. The method according to claim 2, characterized in that: The target microservice verifies the target user's access rights to the target resource under the target function based on the resource request, including: The target microservice queries the user permission information in the cache based on the resource request, and verifies the access rights of the target user to the target resource under the target function.

5. The method according to claim 2, characterized in that: The processing and integration of the user authority information and storing it in a cache includes: The user authority information is processed and integrated according to the user dimension, function dimension and resource dimension, and stored in the cache.

6. The method according to claim 1, characterized in that The method further comprises: Based on the resource request, the gateway searches for the target microservice through a registration center to obtain the address of the target microservice; The forwarding the resource request to the target microservice includes: According to the address of the target microservice, the resource request is forwarded to the target microservice.

7. The method according to claim 6, characterized in that The method further comprises: The service information of the microservice is pre-registered with the registration center so that the registration center can search for the microservice.

8. A permission verification device, characterized in that: The device comprises: A request receiving module is used for the gateway to receive a resource request from a target user, wherein the resource request carries information about a target function, a target microservice, and a target resource; A function verification module, used for the gateway to verify the target user's authority to the target function based on the resource request; A request forwarding module, configured to forward the resource request to the target microservice if the target user has permission for the target function; The resource verification module is used for the target microservice to verify the access rights of the target user to the target resource under the target function based on the resource request.

9. A device, characterized in that: The device comprises: a processor and a memory; The memory is used to store instructions; The processor is used to execute the instructions in the memory to perform the method of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes or instructions, which, when executed on a computer, enable the computer to execute the method of claims 1 to 7.

Images