A service application processing method for a microservice architecture system

Abstract

The embodiment of the present invention relates to a service application processing method of a microservice architecture system, the method comprising: a gateway interface receives a first service application sent by a client; when it is a login application type, performs a registered user identity verification process; performs a login token and a service interface allocation process; and sends the first token and the first service link back to the client; when it is an application application type, performs a login user identity verification process; performs a client timestamp verification process; performs a gateway signature process; and sends the second service application to the corresponding microservice interface; and sends the first execution result data sent back by the microservice interface back to the client. Through the present invention, the security prevention capability of the microservice architecture system can be improved as a whole.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a service application processing method for a microservice architecture system. Background Art

[0002] Microservice architecture system refers to a system built on the microservice architecture. From the application level, this type of system can be understood as consisting of a front-end client, a middle gateway interface, and a back-end microservice interface. Under normal circumstances, the workflow of each component of the microservice architecture system is as follows: the client is used to provide an operation interface to the user and obtain user input information through the operation interface, and encapsulate the obtained user input information into a corresponding service application in an agreed format and send it to the gateway interface; the gateway interface is used to identify the application type of the client service application. If the application type is a login application type, the corresponding user identity authentication is performed according to the user ID and user password carried in the service application, and a user token and a microservice interface are allocated to the user who passes the verification and returned to the client. If the application type is an application application type, the legal application is first verified according to the user token carried in the service application, and after the verification is passed, the application parameters and application interface carried in the service application are forwarded to the specified microservice interface for application execution and the execution result returned by the microservice interface is returned to the client; the microservice interface is used to receive the application parameters and application interface forwarded by the gateway interface, and call the processing interface corresponding to the application interface to execute the corresponding processing flow according to the input application parameters to obtain the corresponding execution result, and return the obtained execution result to the gateway interface.

[0003] It is not difficult to see from the conventional workflow of each component of the above microservice architecture system that this type of system only performs security checks based on user tokens at the gateway interface, but does not perform any security checks on the microservice interface side (neither checking the legitimacy of the client nor the legitimacy of the gateway). This processing method has great security risks. Once an illegal client or illegal gateway interface bypasses the system's legal gateway interface and directly initiates a service application to each microservice interface in the system, it will cause the risk of system application interface exposure and system data leakage. Summary of the invention

[0004] The purpose of the present invention is to provide a service application processing method for a microservice architecture system in view of the defects of the prior art; on the one hand, the security check method on the gateway interface side is strengthened, and a client timestamp check is added in addition to the traditional login user identity check based on the user token, thereby improving the gateway interface's filtering ability for timed applications; on the other hand, gateway timestamp check, gateway signature check and client signature check are added on the microservice interface side, thereby making up for the implementation defect that each microservice interface in the conventional microservice architecture system does not perform any security check, and improving the security prevention capability of the microservice interface. Through the present invention, the security risk problems such as system application interface exposure and system data leakage caused by microservice interfaces without any security prevention capability can be avoided, and the security prevention capability of the microservice architecture system can be improved as a whole.

[0005] To achieve the above object, an embodiment of the present invention provides a service application processing method for a microservice architecture system, the method comprising:

[0006] The gateway interface of the microservice architecture system receives a first service application sent by any client and extracts a first application type therefrom; the microservice architecture system includes a plurality of the clients, the gateway interface and a plurality of microservice interfaces; the first application type includes a login application type and an application application type;

[0007] When the first application type is a login application type, extracting a first user identifier and a first user password from the first service application; and performing a registered user identity verification process based on the first user identifier and the first user password; if the registered user identity verification process is successful, performing a login token and service interface allocation process for the current logged-in user to generate a corresponding first token, a first token validity period, and a first service link and save them; and sending the first token and the first service link back to the client;

[0008] When the first application type is an application application type, a second user identifier, a second token, a first service application link, a first timestamp, a first authorization key identifier, a first signature data and a first application interface parameter set are extracted from the first service application; and a second service link is extracted from the first service application link; and a login user identity verification process is performed according to the second user identifier, the second token and the first service application link; if the login user identity verification process is successful, a client timestamp verification process is performed according to the first timestamp; if the client timestamp verification process is successful, the current time is obtained as the corresponding second timestamp, and a gateway signature process is performed on the signature original composed of the second timestamp and the first signature data according to a preset gateway signature algorithm to generate corresponding second signature data; and a corresponding second service application composed of the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link; and the first execution result data sent back by the microservice interface is sent back to the client.

[0009] Preferably, the registered user identity verification process according to the first user identifier and the first user password specifically includes:

[0010] The gateway interface queries a preset registered user list, and records the registered user record in the registered user list whose user identification field matches the first user identification and whose user password field matches the first user password as the current matching record; if the current matching record is not empty, it confirms that the registered user identity verification process is successful; the registered user list includes multiple registered user records; the registered user record includes the user identification field and the user password field.

[0011] Preferably, the step of performing a login token and a service interface allocation process for the currently logged-in user to generate and save a corresponding first token, a first token validity period, and a first service link specifically includes:

[0012] The gateway interface obtains the current time as the corresponding current timestamp; and based on a preset token hash algorithm, performs token hash data calculation on the plaintext data consisting of the first user identifier of the currently logged-in user and the current timestamp to generate the corresponding first token;

[0013] The current time is used as the start time of the validity period corresponding to the first token, and the time point obtained by adding the current time and the preset token validity period is used as the end time of the validity period corresponding to the first token, and the obtained validity period start time and validity period end time constitute the validity period of the first token corresponding to the first token;

[0014] Select one of the microservice interfaces from the multiple microservice interfaces as the client microservice interface to be connected to the current client, and use the service link URL information corresponding to the client microservice interface as the corresponding first service link;

[0015] The first user identifier of the currently logged-in user is used as the corresponding first keyword data; the first token, the first token validity period and the first service link constitute the corresponding first keyword attribute data; the obtained first keyword data and the first keyword attribute data constitute the corresponding first key-value pair data; and the first key-value pair data is stored in a preset Redis cache database.

[0016] Preferably, the method further comprises:

[0017] The Redis cache database periodically deletes the first key-value pair data whose validity period of the first token has expired.

[0018] Preferably, the processing of verifying the identity of the logged-in user according to the second user identifier, the second token and the first service application link specifically includes:

[0019] The gateway interface obtains the current time as the corresponding current timestamp; and extracts the service link URL information from the first service application link as the current service link; and queries the Redis cache database, and matches the first keyword data with the second user identifier, and the first token of the first keyword attribute data with the second token, and the first service link of the first keyword attribute data with the current service link, and the first token validity period of the first keyword attribute data meets the current timestamp. The first key-value pair data is used as the corresponding matching key-value pair data; if the matching key-value pair data is not empty, it is confirmed that the login user identity verification process is successful.

[0020] Preferably, the performing client timestamp verification processing according to the first timestamp specifically includes:

[0021] The gateway interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the first timestamp to generate a corresponding first time difference; if the first time difference is less than a preset first time difference threshold, it is confirmed that the client timestamp verification process is successful.

[0022] Preferably, before the gateway interface of the microservice architecture system receives the first service application sent by any client, the method further includes:

[0023] When processing user login, the client receives the user identifier and user password input by the user to generate the corresponding first user identifier and the first user password; and sends the first service application corresponding to the first application type, which is a specific login application type, the first user identifier and the first user password to the gateway interface; and upon receiving the first token and the first service link sent back by the gateway interface, confirms that the user login is successful, displays the login success information to the customer, displays the client application interface to the customer, and saves the corresponding first user login record consisting of the first user identifier, the first token and the first service link locally.

[0024] Preferably, after the user successfully logs in, the method further includes:

[0025] The client obtains the interface application interface identifier and the application interface parameter set confirmed and submitted by the current logged-in user through the client application interface; and uses the application interface parameter set as the corresponding first application interface parameter set;

[0026] Query a preset first correspondence table reflecting the correspondence between the interface application interface and the microservice application interface, and record a first correspondence record in the first correspondence table in which the first interface application interface identification field matches the interface application interface identification as a matching correspondence record; and extract the first microservice application interface link field of the matching correspondence record as the corresponding first application interface link; the first correspondence table includes a plurality of the first correspondence records; the first correspondence record includes the first interface application interface identification field and the first microservice application interface link field;

[0027] Recording the first user login record corresponding to the currently logged-in user from the multiple first user login records stored locally as the currently logged-in user record; extracting the first user identifier, the first token, and the first service link of the currently logged-in user record as the corresponding second user identifier, the second token, and the second service link; and forming the corresponding first service application link from the second service link and the first application interface link;

[0028] Acquire the current time as the corresponding first timestamp, and form the corresponding current signature text by the first timestamp and the first application interface parameter set, perform digital digest calculation on the current signature text according to a preset digital digest algorithm to generate corresponding current digest data, and encrypt the current digest data based on a locally preset first authorization key to generate corresponding first signature data; and use the key identifier corresponding to the first authorization key as the corresponding first authorization key identifier;

[0029] The first service application corresponding to the first application type, which is specifically an application application type, the second user identifier, the second token, the first service application link, the first timestamp, the first authorization key identifier, the first signature data and the first application interface parameter set is sent to the gateway interface; and when the first execution result data sent back by the gateway interface is received, the first execution result data is displayed to the currently logged-in user through the client application interface.

[0030] Preferably, after the second service application consisting of the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link, the method further includes:

[0031] The microservice interface receives the second service application sent by the gateway interface, and extracts the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data therefrom; and performs gateway timestamp verification processing according to the second timestamp; if the gateway timestamp verification processing is successful, gateway signature verification processing is performed according to the second timestamp, the first signature number and the second signature data; if the gateway signature verification processing is successful, client signature verification processing is performed according to the first authorization key identifier, the first timestamp, the first application interface parameter set and the first signature data; if the client signature verification processing is successful, application interface call processing is performed according to the first service application link and the first application interface parameter set to generate the corresponding first execution result data; and the first execution result data is sent back to the gateway interface.

[0032] Further, the performing gateway timestamp verification processing according to the second timestamp specifically includes:

[0033] The microservice interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the second timestamp to generate a corresponding second time difference; if the second time difference is less than a preset second time difference threshold, it is confirmed that the gateway timestamp verification process is successful.

[0034] Further, the performing gateway signature verification processing according to the second timestamp, the first signature number and the second signature data specifically includes:

[0035] The microservice interface performs gateway signature processing on the signature original composed of the second timestamp and the first signature data according to a preset gateway signature algorithm to generate corresponding current signature data; and confirms that the gateway signature verification processing is successful when the current signature data matches the second signature data.

[0036] Further, performing client signature verification processing according to the first authorization key identifier, the first timestamp, the first application interface parameter set, and the first signature data specifically includes:

[0037] The microservice interface combines the first timestamp and the first application interface parameter set into a corresponding current signature text; and performs a digital summary calculation on the current signature text according to a preset digital summary algorithm to generate corresponding current summary data; and based on a locally preset first authorization key corresponding to the first authorization key identifier, encrypts the current summary data to generate corresponding current signature data; and confirms that the client signature verification processing is successful when the current signature data matches the first signature data.

[0038] Further, the performing application interface call processing according to the first service application link and the first application interface parameter set to generate the corresponding first execution result data specifically includes:

[0039] The microservice interface extracts the second service link and the first application interface link from the first service application link; and uses its own corresponding service link URL information as the corresponding current service link; if the current service link matches the second service link, the application interface corresponding to the first application interface link is called to execute the corresponding application processing flow according to the first application interface parameter set, and the execution result data returned by the application interface is used as the corresponding first execution result data.

[0040] The embodiment of the present invention provides a service application processing method for a microservice architecture system; on the one hand, the security check method on the gateway interface side is strengthened, and a client timestamp check is added in addition to the traditional login user identity check based on the user token, thereby improving the gateway interface's filtering ability for timed applications; on the other hand, a gateway timestamp check, a gateway signature check, and a client signature check are added on the microservice interface side, thereby making up for the implementation defect that each microservice interface in the conventional microservice architecture system does not perform any security check, and improving the security prevention capability of the microservice interface. Through the present invention, the security risk problems such as system application interface exposure and system data leakage caused by microservice interfaces without security prevention capabilities are solved, and the overall security prevention capability of the microservice architecture system is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a service application processing method for a microservice architecture system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The embodiment of the present invention provides a service application processing method for a microservice architecture system; the microservice architecture system of the embodiment of the present invention includes multiple clients, a gateway interface and multiple microservice interfaces, each client is connected to the gateway interface respectively, the gateway interface is also connected to each microservice interface, and the Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) is used as the data transmission protocol by default between any client and the gateway interface, and the HTTPS protocol is also used as the data transmission protocol by default between any microservice interface and the gateway interface; the microservice architecture system of the embodiment of the present invention adds a client timestamp check on the gateway interface side, and adds a gateway timestamp check, a gateway signature check and a client signature check on the microservice interface side through the method provided by the embodiment of the present invention, thereby solving the security risk problems such as the exposure of the system application interface and the leakage of system data, and improving the overall security prevention capability of the system; Figure 1 A schematic diagram of a service application processing method for a microservice architecture system provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, this method mainly includes the following steps:

[0044] Step 1: The gateway interface of the microservice architecture system receives a first service application sent by any client and extracts a first application type therefrom;

[0045] Among them, the first application type includes a login application type and an application application type.

[0046] Here, the client of the embodiment of the present invention is an application client, and can also be a WEB client; the first service application sent by the client to the gateway interface includes a first application type, and the first application type has two types: a login application type and an application application type; when the first application type is a login application type, it means that the current service application is used to process user login, so the gateway interface will subsequently go to step 2 to perform operations such as registered user identity verification and login token and service interface allocation; when the first application type is an application application type, it means that the current service application is used to process a specific application request, so the gateway interface will subsequently go to step 3 to perform operations such as login user identity verification, client timestamp verification, gateway digital signature, microservice interface data forwarding, and microservice interface return data reception.

[0047] It should be noted that, in the embodiment of the present invention, the client at the front end of the gateway interface also has two types of implementation steps corresponding to these two types of application types, as shown below.

[0048] Before the gateway interface of the microservice architecture system receives the first service application sent by any client, the method of the embodiment of the present invention further includes:

[0049] When processing user login, the client receives the user identifier and user password input by the user to generate a corresponding first user identifier and first user password; and sends a corresponding first service application consisting of the first application type, which is a specific login application type, the first user identifier and the first user password to the gateway interface; and upon receiving the first token and the first service link sent back by the gateway interface, confirms that the user login is successful, displays the login success message to the customer, displays the client application interface to the customer, and saves the corresponding first user login record consisting of the first user identifier, the first token and the first service link locally.

[0050] Here, the client of the embodiment of the present invention will provide a user login interface to the user by default when processing user login, and obtain the user identification and user password information entered by the user as the corresponding first user identification and first user password through the user login interface; and set the first application type as the login application type; then the first service application is composed of the first application type, the first user identification and the first user password, and the first service application is sent to the gateway interface; after the gateway interface completes the corresponding registered user identity verification and login token and service interface allocation and other operations through subsequent step 2, a user token and corresponding service link URL information, namely the first token and the first service link, will be returned to the client; after receiving the first token and the first service link, the client confirms that the login is successful, and displays the login success information to the customer, activates the client application interface, and locally saves a first user login record composed of the first user identification, the first token and the first service link.

[0051] After successful login, the currently logged-in user can submit the interface application interface identifier and application interface parameter set to the client through interactive operations with the client application interface. For example, a query window is provided on the client application interface. The function of the query window is to search for personnel information by personnel name. The query window provides two interactive components: a personnel name input box and a query submission button. The query submission button is the function submission component of the query window. When the user enters the personnel name in the personnel name input box and clicks the query submission button to submit the query function, the client will obtain an interface application interface identifier and an application interface parameter set through the client application interface. The interface application interface identifier is an identifier information pre-bound to the function submission component (query submission button). The interface application interface identifier corresponds to a service application interface link URL information. The interface parameters required by the service application interface link URL information are the application interface parameter set. The application interface parameter set includes a query parameter. The query parameter consists of a parameter name and a parameter value. The parameter name is the parameter variable name corresponding to the personnel name input box, and the parameter value is the text information of the personnel name input box. After the client obtains the interface application interface identifier and application interface parameter set confirmed and submitted by the currently logged-in user, it will start the service application processing flow with the first application type being the application application type, as shown below for details.

[0052] After the user logs in successfully, the method of the embodiment of the present invention further includes:

[0053] Step A1, the client obtains the interface application interface identifier and the application interface parameter set confirmed and submitted by the current logged-in user through the client application interface; and uses the application interface parameter set as the corresponding first application interface parameter set;

[0054] Step A2, querying a preset first correspondence table reflecting the correspondence between the interface application interface and the microservice application interface, recording a first correspondence record in which the first interface application interface identification field in the first correspondence table matches the interface application interface identification as a matching correspondence record; and extracting the first microservice application interface link field of the matching correspondence record as the corresponding first application interface link;

[0055] Among them, the first correspondence table includes multiple first correspondence records; the first correspondence record includes a first interface application interface identification field and a first microservice application interface link field;

[0056] Here, under normal circumstances, everyone is accustomed to directly binding the service application interface link URL information with each component on the client user interface, wherein the service application interface link URL information is composed of the service link URL information + the application interface link URL information; a problem with this processing method is that once the background service application interface link URL information changes, it is necessary to modify the client application code or web page code component by component, and republish the corresponding client application or client web page; to solve this problem, the embodiment of the present invention decouples the client interface component and the service application interface link URL information by setting a correspondence table, i.e., a first correspondence table, on the client side that can reflect the correspondence between the interface application interface and the microservice application interface, and a first service link obtained at login;

[0057] In the first correspondence table, each first correspondence record corresponds to a function submission component on the client interface, the first interface application interface identifier field stores the interface application interface identifier corresponding to the function submission component, and the first microservice application interface link field stores the application interface link URL information corresponding to the function submission component; in the client's application code or web page code, what is bound to each function submission component is no longer the service application interface link URL information but the interface application interface identifier; each time the background service application interface link URL information changes, there is no need to modify the interface application interface identifier corresponding to each function submission component in the client's application code or web page code, and only the first service link stored locally on the client and the application interface link corresponding to each interface application interface identifier in the first correspondence table need to be updated;

[0058] Step A3, recording the first user login record corresponding to the currently logged-in user from the multiple first user login records stored locally as the currently logged-in user record; extracting the first user identifier, the first token and the first service link of the currently logged-in user record as the corresponding second user identifier, the second token and the second service link; and forming the corresponding first service application link from the second service link and the first application interface link;

[0059] For example, two first user login records are stored locally:

[0060] The first user login record 1 is (the first user ID is 01, the first token is 1234567, and the first service link is "www.test1.com / "),

[0061] The first user login record 2 is (the first user ID is 02, the first token is 2234567, and the first service link is "www.test2.com / ");

[0062] The first user ID corresponding to the currently logged-in user is 02, and the first application interface link obtained in the aforementioned step A2 is "searchbyname / ";

[0063] Then, the current logged-in user record is the first user login record 2, the obtained second user ID is 02, the second token is 2234567, the second service link is "www.test2.com / "; the first service application link composed of the second service link and the first application interface link is "www.test2.com / searchbyname / ";

[0064] Step A4, obtaining the current time as the corresponding first timestamp, and forming the corresponding current signature text by the first timestamp and the first application interface parameter set, and performing digital digest calculation on the current signature text according to the preset digital digest algorithm to generate the corresponding current digest data, and encrypting the current digest data based on the locally preset first authorization key to generate the corresponding first signature data; and using the key identifier corresponding to the first authorization key as the corresponding first authorization key identifier;

[0065] Here, the expression of the signature data generated on the client side, that is, the first signature data, is:

[0066] First signature data = f e (key,data),

[0067] data=f m (Current signature original),

[0068] Current signature original text = first timestamp + first application interface parameter set,

[0069] key is the first authorization key, data is the current summary data, f e () is the encryption algorithm corresponding to the first authorization key, f m () is the preset digital summary algorithm;

[0070] The preset digital digest algorithm on the client side should be consistent with the preset digital digest algorithm on the microservice interface side. The digital digest algorithm can be one of the Secure Hash Algorithm (SHA) family algorithms, or one of the Message-Digest Algorithm (MD) family algorithms, or any other message authentication code algorithm that does not require key intervention; all clients in the embodiment of the present invention will complete client registration on the microservice architecture system in advance. When the system processes the client registration, it will assign an authorization key to each client, that is, the first authorization key stored locally in the client. Each authorization key has a corresponding authorization key identifier, that is, the first authorization key identifier will also be stored locally in the client; in addition, the system will also publish the first authorization key identifier + first authorization key of each registered client on the background microservice interface side, so that the microservice interface can perform signature verification on the client; the first authorization key assigned by the system in the embodiment of the present invention The key types include two categories: symmetric key type and asymmetric key type. Each key type also includes a variety of specific symmetric key encryption algorithms and a variety of specific asymmetric key encryption algorithms. They can be customized according to specific implementation requirements during implementation. Here, each algorithm under each type is not listed one by one. It should be noted that when the system completes the allocation of the first authorization key of the client, the corresponding encryption algorithm will also be specified. Then, each time the client calculates the first signature data, it uses the first authorization key according to the corresponding encryption algorithm to encrypt the current summary data calculated by (first timestamp + first application interface parameter set) and uses the encryption result as the corresponding first signature data.

[0071] Step A5, sending the first service application corresponding to the first application type, which is specifically an application application type, a second user identifier, a second token, a first service application link, a first timestamp, a first authorization key identifier, a first signature data and a first application interface parameter set to the gateway interface; and when receiving the first execution result data sent back by the gateway interface, displaying the first execution result data to the currently logged-in user through the client application interface.

[0072] Here, after the client of the embodiment of the present invention sends the first service application to the gateway interface, the gateway interface will complete the corresponding operations such as login user identity verification, client timestamp verification, gateway digital signature, microservice interface data forwarding and microservice interface return data reception through subsequent step 3, and send the return data of the microservice interface, that is, the first execution result data, back to the client; after receiving the first execution result data, the client displays the result to the currently logged-in user through the client application interface.

[0073] Step 2: When the first application type is a login application type, the gateway interface extracts the first user identifier and the first user password from the first service application; and performs a registered user identity verification process based on the first user identifier and the first user password; if the registered user identity verification process is successful, a login token and service interface allocation process are performed for the current logged-in user to generate a corresponding first token, a first token validity period, and a first service link, and save them; and the first token and the first service link are sent back to the client;

[0074] Here, the current step 2 is a processing step of the gateway interface for the first service application whose first application type is a login application type;

[0075] Specifically comprising: step 21, extracting a first user identification and a first user password from a first service application;

[0076] Here, it can be known from the technical implementation of the client processing user login in the previous article that when the first application type is a login application type, the first service application includes a first user identifier and a first user password in addition to the first application type;

[0077] Step 22, performing a registered user identity verification process according to the first user identifier and the first user password;

[0078] Specifically, the gateway interface queries a preset registered user list, and records a registered user record in the registered user list whose user identification field matches the first user identification and whose user password field matches the first user password as a current matching record; if the current matching record is not empty, confirming that the registered user identity verification process is successful;

[0079] The registered user list includes a plurality of registered user records; the registered user record includes a user identification field and a user password field;

[0080] Here, a registered user list is pre-set on the gateway interface side of the embodiment of the present invention; each registered user record in the registered user list corresponds to a system user who has completed registration, and the user identification field and user password field in the record correspond to the user identification information and user password information of the system user; the user who enters the user identification and user password on the current client is recorded as the current user, and then if the current matching record obtained by the gateway interface querying the registered user list is not empty, it means that there is a registered user record matching the current user in the registered user list, that is, the current user is a legal registered user, and it should be confirmed that the registered user identity verification process is successful; on the contrary, if the current matching record obtained by the gateway interface is empty, it means that there is no registered user record matching the current user in the registered user list, that is, the current user is an unregistered user, and at this time the gateway interface will confirm that the registered user identity verification process has failed, stop executing subsequent steps, and return an error prompt message such as the user is a non-registered user to the client;

[0081] Step 23: If the identity verification of the registered user is successful, a login token and a service interface allocation process are performed for the current logged-in user to generate a corresponding first token, a first token validity period, and a first service link, and save them;

[0082] Specifically, the method comprises: step 231, the gateway interface obtains the current time as the corresponding current timestamp; and based on a preset token hash algorithm, performs token hash data calculation on the plaintext data consisting of the first user identifier of the currently logged-in user and the current timestamp to generate a corresponding first token;

[0083] Here, the expression for the first token is:

[0084] First token = f t (first user ID + current timestamp),

[0085] f t () is a preset token hash algorithm, which may be one of the SHA family algorithms, one of the MD family algorithms, or any other message authentication code algorithm that does not require key intervention;

[0086] Step 232, taking the current time as the start time of the validity period corresponding to the first token, and taking the time point obtained by adding the current time and the preset token validity period as the end time of the validity period corresponding to the first token, and the obtained validity period start time and validity period end time constitute the first token validity period corresponding to the first token;

[0087] Here, the preset token validity period is a preset empirical value; for example, if the token validity period is 15 days and the current time is 2022-01-02, then the validity start time of the first token validity period is 2022-01-02 and the validity end time is 2022-01-17;

[0088] Step 233, selecting a microservice interface from the multiple microservice interfaces as the client microservice interface to be connected to the current client, and using the service link URL information corresponding to the client microservice interface as the corresponding first service link;

[0089] Here, the system of the embodiment of the present invention will store the service link URL information of each microservice interface and the application link list supported by the service link on the gateway interface side, and will also retain the application link list required by the client; the gateway interface of the embodiment of the present invention can also obtain the real-time load flow of each microservice interface; when selecting a microservice interface from multiple microservice interfaces as the client microservice interface connected to the current client, the gateway interface first selects all microservice interfaces that can support the application link list required by the current client as candidate microservice interfaces, and then selects one of the multiple candidate microservice interfaces whose real-time load flow does not exceed the preset flow threshold as the client microservice interface connected to the current client; after determining the client microservice interface, the gateway interface extracts the service link URL information corresponding to the client microservice interface stored locally as the corresponding first service link;

[0090] Step 234, using the first user identifier of the currently logged-in user as the corresponding first keyword data; and forming the corresponding first keyword attribute data from the first token, the first token validity period, and the first service link; and forming the corresponding first key-value pair data from the obtained first keyword data and the first keyword attribute data; and storing the first key-value pair data in a preset Redis cache database;

[0091] Here, the gateway interface of the embodiment of the present invention is also connected to a Redis cache database, which is a Redis cache database used for data caching; after the gateway interface assigns the first token, the first token validity period and the first service link to the currently logged-in user, the data storage structure of the Redis cache database of the embodiment of the present invention is a key-value pair structure, and each key-value pair is composed of a keyword + a keyword attribute; when the gateway interface performs data backup, the first user identifier is used as the first keyword data, the first token + the first token validity period + the first service link are used as the first keyword attribute data, and the first keyword data + the first keyword attribute data form a corresponding key-value pair, that is, the first key-value pair data, and then the first key-value pair data is stored in the Redis cache database; it should be noted that the Redis cache database of the embodiment of the present invention will also regularly delete the first key-value pair data whose validity period has expired, so that the expired login backup data can be deleted in time;

[0092] Step 24: Send the first token and the first service link back to the client.

[0093] Step 3, when the first application type is an application application type, the gateway interface extracts the second user identifier, the second token, the first service application link, the first timestamp, the first authorization key identifier, the first signature data and the first application interface parameter set from the first service application; and extracts the second service link from the first service application link; and performs a login user identity verification process according to the second user identifier, the second token and the first service application link; if the login user identity verification process is successful, the client timestamp verification process is performed according to the first timestamp; if the client timestamp verification process is successful, the current time is obtained as the corresponding second timestamp, and the signature original composed of the second timestamp and the first signature data is gateway signed according to the preset gateway signature algorithm to generate the corresponding second signature data; and the corresponding second service application composed of the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link; and the first execution result data sent back by the microservice interface is sent back to the client;

[0094] Here, the current step 3 is a processing step of the gateway interface for the first service application whose first application type is an application application type;

[0095] Specifically comprising: step 31, extracting a second user identifier, a second token, a first service application link, a first timestamp, a first authorization key identifier, a first signature data and a first application interface parameter set from the first service application; and extracting a second service link from the first service application link;

[0096] Here, it can be known from the technical implementation of the client after the user successfully logs in in the previous text that when the first application type is an application application type, the first service application includes, in addition to the first application type, a second user identifier, a second token, a first service application link, a first timestamp, a first authorization key identifier, a first signature data, and a first application interface parameter set; the first service application link is composed of a second service link and a first application interface link;

[0097] Step 32, performing a login user identity verification process based on the second user identifier, the second token and the first service application link;

[0098] Specifically, it includes: the gateway interface obtains the current time as the corresponding current timestamp; and extracts the service link URL information from the first service application link as the current service link; and queries the Redis cache database, and matches the first keyword data with the second user identifier, and the first token of the first keyword attribute data with the second token, and the first service link of the first keyword attribute data with the current service link, and the first token validity period of the first keyword attribute data meets the first key-value pair data of the current timestamp as the corresponding matching key-value pair data; if the matching key-value pair data is not empty, it is confirmed that the login user identity verification process is successful;

[0099] Here, the validity period of the first token meets the current timestamp, which means that the time corresponding to the current timestamp is within the valid period corresponding to the validity period of the first token; if the matching key-value pair data obtained by the gateway interface from the Redis cache database is empty, it means that there is no backup information matching the second user identifier, the second token and the first service application link in the Redis cache database. At this time, the gateway interface will confirm that the login user identity verification process has failed, stop executing subsequent steps and return an error prompt message to the client such as the user login information expires and needs to log in again; the embodiment of the present invention sets the login user identity verification on the gateway interface side to improve the gateway interface's ability to filter expired logins;

[0100] Step 33, if the login user identity verification process is successful, then the client timestamp verification process is performed according to the first timestamp;

[0101] Specifically, the gateway interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the first timestamp to generate the corresponding first time difference; if the first time difference is less than the preset first time difference threshold, confirming that the client timestamp verification process is successful;

[0102] Here, the preset first time difference threshold is a preset empirical value, which is 5 seconds by default; if the interval between the first timestamp and the current time exceeds 5 seconds, the client timestamp check processing fails, and the gateway interface will stop executing subsequent steps and abandon the first service application currently being processed, and send back to the client an error status message indicating that the application has timed out; the embodiment of the present invention adds the client timestamp check on the gateway interface side in order to improve the gateway interface's ability to filter timed-out applications;

[0103] Step 34: If the client timestamp verification process is successful, the current time is obtained as the corresponding second timestamp, and the signature original consisting of the second timestamp and the first signature data is subjected to gateway signature processing according to a preset gateway signature algorithm to generate corresponding second signature data;

[0104] Here, the expression of the signature data generated on the gateway interface side, i.e., the second signature data, in the embodiment of the present invention is:

[0105] Second signature data = f s (second timestamp + first signature data),

[0106] f m () is a preset gateway signature algorithm, which may be one of the SHA family algorithms, one of the MD family algorithms, or any other message authentication code algorithm that does not require key intervention;

[0107] Step 35, a second service application corresponding to the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link;

[0108] Here, the gateway interface extracts the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set from the first service application, and then combines the second timestamp and the second signature data generated by the gateway interface to form a second service application; from the first service application link of the first service application, it can be known that the service link URL information of the corresponding microservice interface this time is the second service link, so the second service application is sent to the microservice interface corresponding to the second service link;

[0109] It should be noted that the processing steps of the microservice interface after receiving the second service application are as follows; after the second service application corresponding to the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link, the method of the embodiment of the present invention also includes:

[0110] Step B1, the microservice interface receives the second service application sent by the gateway interface, and extracts the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data therefrom;

[0111] Step B2, performing gateway timestamp verification processing according to the second timestamp;

[0112] Specifically, the microservice interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the second timestamp to generate the corresponding second time difference; if the second time difference is less than the preset second time difference threshold, confirming that the gateway timestamp verification process is successful;

[0113] Here, the preset second time difference threshold is a preset empirical value, which defaults to 1 second; if the interval between the second timestamp and the current time exceeds 1 second, the gateway timestamp check process fails, and the microservice interface will stop executing subsequent steps and abandon the second service application currently being processed, and send back to the gateway interface an error status message indicating that the application has timed out; the embodiment of the present invention adds the gateway timestamp check on the microservice interface side in order to improve the filtering ability of the microservice interface for timed-out applications;

[0114] Step B3: If the gateway timestamp verification process is successful, a gateway signature verification process is performed according to the second timestamp, the first signature number and the second signature data;

[0115] Specifically, the microservice interface performs gateway signature processing on the signature original composed of the second timestamp and the first signature data according to a preset gateway signature algorithm to generate corresponding current signature data; and confirms that the gateway signature verification processing is successful when the current signature data matches the second signature data;

[0116] Here, the gateway signature algorithm preset on the microservice interface side is consistent with the gateway signature algorithm preset on the network management interface side. The microservice interface recalculates the signature, i.e., the current signature data, based on the signature original composed of the second timestamp and the first signature data through the same gateway signature algorithm; if the current signature data matches the second signature data, it means that the microservice interface and the gateway interface use the same gateway signature algorithm, and thus the legitimacy of the gateway interface currently forwarding the data is determined; conversely, if the current signature data does not match the second signature data, it means that the microservice interface and the gateway interface do not use the same gateway signature algorithm, and thus the illegality of the gateway interface currently forwarding the data is determined. At this time, the microservice interface will stop executing subsequent steps and abandon the second service application currently being processed, and send back to the gateway interface an error status message prompting an unauthorized gateway; the embodiment of the present invention adds the gateway signature check on the microservice interface side in order to improve the microservice interface's ability to prevent access to illegal gateway interfaces;

[0117] Step B4: if the gateway signature verification process is successful, the client signature verification process is performed according to the first authorization key identifier, the first timestamp, the first application interface parameter set and the first signature data;

[0118] Specifically, the microservice interface combines the first timestamp and the first application interface parameter set into a corresponding current signature text; and performs digital summary calculation on the current signature text according to a preset digital summary algorithm to generate corresponding current summary data; and encrypts the current summary data based on a locally preset first authorization key corresponding to the first authorization key identifier to generate corresponding current signature data; and confirms that the client signature verification process is successful when the current signature data matches the first signature data;

[0119] Here, the digital digest algorithm, the first authorization key, and the encryption algorithm of the first authorization key preset on the microservice interface side are consistent with the digital digest algorithm, the first authorization key, and the encryption algorithm of the first authorization key preset on the client side. The microservice interface recalculates the signature, that is, the current signature data, through the same signature calculation process as the client. If the current signature data matches the first signature data, it means that the microservice interface and the client use the same digital digest algorithm, the same first authorization key, and the same key encryption algorithm, and thus the legitimacy of the client currently initiating the service application is determined; conversely, if the current signature data does not match the first signature data, it means that the microservice interface and the client do not use the same digital digest algorithm, or the same first authorization key, or the same key encryption algorithm, and thus the illegality of the client currently initiating the service application is determined. At this time, the microservice interface will stop executing subsequent steps and abandon the second service application currently being processed, and send back to the gateway interface an error status message prompting the unauthorized client; the embodiment of the present invention adds the client signature check on the microservice interface side to improve the microservice interface's ability to prevent illegal clients from accessing;

[0120] Step B5: if the signature verification process of the client is successful, an application interface call process is performed according to the first service application link and the first application interface parameter set to generate corresponding first execution result data;

[0121] Specifically, the microservice interface extracts the second service link and the first application interface link from the first service application link; and uses the service link URL information corresponding to itself as the corresponding current service link; if the current service link matches the second service link, the application interface corresponding to the first application interface link is called to execute the corresponding application processing flow according to the first application interface parameter set, and the execution result data returned by the application interface is used as the corresponding first execution result data;

[0122] Here, the application interface called by the microservice interface can be a local function, class or library program calling interface, or it can be the service application link URL information of another microservice interface; when the application interface is a local function, class or library program calling interface, the first application interface parameter set is the input parameter of the corresponding function, class or library program calling interface; when the application interface is the service application link URL information of another microservice interface, the first application interface parameter set is the application parameter in the service application initiated to the service application link URL information; regardless of whether the application interface is a local function, class or library program calling interface or the service application link URL information of another microservice interface, after completing the execution of the corresponding application processing flow according to the input first application interface parameter set, the application interface will return a return data, namely the first execution result data;

[0123] Step B6, sending the first execution result data back to the gateway interface;

[0124] Here, the microservice interface receives the first execution result data returned by the above application interface and immediately sends it back to the gateway interface;

[0125] Step 36: The gateway interface sends the first execution result data sent back by the microservice interface to the client.

[0126] In summary, the embodiment of the present invention provides a method for processing service applications in a microservice architecture system; on the one hand, the security check method on the gateway interface side is strengthened, and a client timestamp check is added in addition to the traditional login user identity check based on the user token, thereby improving the gateway interface's ability to filter timed applications; on the other hand, a gateway timestamp check, a gateway signature check, and a client signature check are added on the microservice interface side, thereby making up for the implementation defect that each microservice interface in the conventional microservice architecture system does not perform any security check, and improving the security prevention capability of the microservice interface. Through the present invention, the security risk problems such as system application interface exposure and system data leakage caused by microservice interfaces without any security prevention capability are solved, and the overall security prevention capability of the microservice architecture system is improved.

[0127] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0128] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0129] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A service application processing method for a microservice architecture system, characterized in that: The method comprises: The gateway interface of the microservice architecture system receives a first service application sent by any client and extracts a first application type therefrom; the microservice architecture system includes a plurality of the clients, the gateway interface and a plurality of microservice interfaces; the first application type includes a login application type and an application application type; When the first application type is a login application type, extracting a first user identifier and a first user password from the first service application; and performing a registered user identity verification process based on the first user identifier and the first user password; if the registered user identity verification process is successful, performing a login token and service interface allocation process for the current logged-in user to generate a corresponding first token, a first token validity period, and a first service link and save them; and sending the first token and the first service link back to the client; When the first application type is an application application type, extract the second user identifier, the second token, the first service application link, the first timestamp, the first authorization key identifier, the first signature data and the first application interface parameter set from the first service application; and extract the second service link from the first service application link; and perform a login user identity verification process according to the second user identifier, the second token and the first service application link; if the login user identity verification process is successful, perform a client timestamp verification process according to the first timestamp; if the client timestamp verification process is successful, obtain the current time as the corresponding second timestamp, and perform a gateway signature process on the signature original composed of the second timestamp and the first signature data according to a preset gateway signature algorithm to generate the corresponding second signature data; and send the corresponding second service application composed of the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data to the microservice interface corresponding to the second service link; and send the first execution result data sent back by the microservice interface to the client; After the second service application consisting of the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data is sent to the microservice interface corresponding to the second service link, the method further includes: The microservice interface receives the second service application sent by the gateway interface, and extracts the first service application link, the first timestamp, the first authorization key identifier, the first signature data, the first application interface parameter set, the second timestamp and the second signature data therefrom; and performs gateway timestamp verification processing according to the second timestamp; if the gateway timestamp verification processing is successful, gateway signature verification processing is performed according to the second timestamp, the first signature number and the second signature data; if the gateway signature verification processing is successful, client signature verification processing is performed according to the first authorization key identifier, the first timestamp, the first application interface parameter set and the first signature data; if the client signature verification processing is successful, application interface call processing is performed according to the first service application link and the first application interface parameter set to generate the corresponding first execution result data; and the first execution result data is sent back to the gateway interface.

2. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing of the registered user identity verification process according to the first user identifier and the first user password specifically includes: The gateway interface queries a preset registered user list, and records the registered user record in the registered user list whose user identification field matches the first user identification and whose user password field matches the first user password as the current matching record; if the current matching record is not empty, it confirms that the registered user identity verification process is successful; the registered user list includes multiple registered user records; the registered user record includes the user identification field and the user password field.

3. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The process of performing the login token and service interface allocation process for the currently logged-in user to generate and save the corresponding first token, first token validity period and first service link specifically includes: The gateway interface obtains the current time as the corresponding current timestamp; and based on a preset token hash algorithm, performs token hash data calculation on the plaintext data consisting of the first user identifier of the currently logged-in user and the current timestamp to generate the corresponding first token; The current time is used as the start time of the validity period corresponding to the first token, and the time point obtained by adding the current time and the preset token validity period is used as the end time of the validity period corresponding to the first token, and the obtained validity period start time and validity period end time constitute the validity period of the first token corresponding to the first token; Select one of the microservice interfaces from the multiple microservice interfaces as the client microservice interface to be connected to the current client, and use the service link URL information corresponding to the client microservice interface as the corresponding first service link; The first user identifier of the currently logged-in user is used as the corresponding first keyword data; the first token, the first token validity period and the first service link constitute the corresponding first keyword attribute data; the obtained first keyword data and the first keyword attribute data constitute the corresponding first key-value pair data; and the first key-value pair data is stored in a preset Redis cache database.

4. The service application processing method of the microservice architecture system according to claim 3, characterized in that: The method further comprises: The Redis cache database periodically deletes the first key-value pair data whose validity period of the first token has expired.

5. The service application processing method of the microservice architecture system according to claim 3, characterized in that: The performing of the login user identity verification process according to the second user identifier, the second token and the first service application link specifically includes: The gateway interface obtains the current time as the corresponding current timestamp; and extracts the service link URL information from the first service application link as the current service link; and queries the Redis cache database, and matches the first keyword data with the second user identifier, and the first token of the first keyword attribute data with the second token, and the first service link of the first keyword attribute data with the current service link, and the first token validity period of the first keyword attribute data meets the current timestamp. The first key-value pair data is used as the corresponding matching key-value pair data; if the matching key-value pair data is not empty, it is confirmed that the login user identity verification process is successful.

6. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing client timestamp verification processing according to the first timestamp specifically includes: The gateway interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the first timestamp to generate a corresponding first time difference; if the first time difference is less than a preset first time difference threshold, it is confirmed that the client timestamp verification process is successful.

7. The service application processing method of the microservice architecture system according to claim 1, characterized in that: Before the gateway interface of the microservice architecture system receives a first service application sent by any client, the method further includes: When processing user login, the client receives the user identifier and user password input by the user to generate the corresponding first user identifier and the first user password; and sends the first service application corresponding to the first application type, which is a specific login application type, the first user identifier and the first user password to the gateway interface; and upon receiving the first token and the first service link sent back by the gateway interface, confirms that the user login is successful, displays the login success information to the customer, displays the client application interface to the customer, and saves the corresponding first user login record consisting of the first user identifier, the first token and the first service link locally.

8. The service application processing method of the microservice architecture system according to claim 7, characterized in that: After the user successfully logs in, the method further includes: The client obtains the interface application interface identifier and the application interface parameter set confirmed and submitted by the current logged-in user through the client application interface; and uses the application interface parameter set as the corresponding first application interface parameter set; Query a preset first correspondence table reflecting the correspondence between the interface application interface and the microservice application interface, and record a first correspondence record in the first correspondence table in which the first interface application interface identification field matches the interface application interface identification as a matching correspondence record; and extract the first microservice application interface link field of the matching correspondence record as the corresponding first application interface link; the first correspondence table includes a plurality of the first correspondence records; the first correspondence record includes the first interface application interface identification field and the first microservice application interface link field; Recording the first user login record corresponding to the currently logged-in user from the multiple first user login records stored locally as the currently logged-in user record; extracting the first user identifier, the first token, and the first service link of the currently logged-in user record as the corresponding second user identifier, the second token, and the second service link; and forming the corresponding first service application link from the second service link and the first application interface link; Acquire the current time as the corresponding first timestamp, and form the corresponding current signature text by the first timestamp and the first application interface parameter set, perform digital digest calculation on the current signature text according to a preset digital digest algorithm to generate corresponding current digest data, and encrypt the current digest data based on a locally preset first authorization key to generate corresponding first signature data; and use the key identifier corresponding to the first authorization key as the corresponding first authorization key identifier; The first service application corresponding to the first application type, which is specifically an application application type, the second user identifier, the second token, the first service application link, the first timestamp, the first authorization key identifier, the first signature data and the first application interface parameter set is sent to the gateway interface; and when the first execution result data sent back by the gateway interface is received, the first execution result data is displayed to the currently logged-in user through the client application interface.

9. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing gateway timestamp verification processing according to the second timestamp specifically includes: The microservice interface obtains the current time as the corresponding current timestamp; and calculates the time difference between the current timestamp and the second timestamp to generate a corresponding second time difference; if the second time difference is less than a preset second time difference threshold, it is confirmed that the gateway timestamp verification process is successful.

10. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing gateway signature verification processing according to the second timestamp, the first signature number and the second signature data specifically includes: The microservice interface performs gateway signature processing on the signature original composed of the second timestamp and the first signature data according to a preset gateway signature algorithm to generate corresponding current signature data; and confirms that the gateway signature verification processing is successful when the current signature data matches the second signature data.

11. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing client signature verification processing according to the first authorization key identifier, the first timestamp, the first application interface parameter set, and the first signature data specifically includes: The microservice interface combines the first timestamp and the first application interface parameter set into a corresponding current signature text; and performs a digital summary calculation on the current signature text according to a preset digital summary algorithm to generate corresponding current summary data; and based on a locally preset first authorization key corresponding to the first authorization key identifier, encrypts the current summary data to generate corresponding current signature data; and confirms that the client signature verification processing is successful when the current signature data matches the first signature data.

12. The service application processing method of the microservice architecture system according to claim 1, characterized in that: The performing application interface call processing according to the first service application link and the first application interface parameter set to generate the corresponding first execution result data specifically includes: The microservice interface extracts the second service link and the first application interface link from the first service application link; and uses its own corresponding service link URL information as the corresponding current service link; if the current service link matches the second service link, the application interface corresponding to the first application interface link is called to execute the corresponding application processing flow according to the first application interface parameter set, and the execution result data returned by the application interface is used as the corresponding first execution result data.

Images