Method, device and storage medium for calling microservice

Abstract

The application discloses a micro-service calling method and device, equipment and a storage medium. The method comprises the following steps: obtaining a first timestamp when a service discovery request is initiated by a consumer; encrypting the first timestamp and a micro-service identifier of the consumer based on a plurality of secret keys to obtain identity authentication information; sending the identity authentication information and the service discovery request to a registration center to enable the registration center to verify the identity authentication information, and returning a service discovery response result to the consumer if the verification is passed; receiving the service discovery response result returned by the registration center, and calling a micro-service instance of a provider according to the service discovery response result; wherein the service discovery response result comprises a provider address. The technical scheme of the application can improve the security of micro-service calling.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of microservice technology, and in particular to a method, apparatus, device and storage medium for invoking microservices. Background Technology

[0002] Microservice peer-to-peer communication refers to the direct exchange of information between two microservices, where application requests or responses do not need to go through a gateway or other middleware system. Microservice providers register with a registry center, and consumer systems periodically access the registry center to perform service discovery, updating their local provider addresses and directly connecting to the corresponding provider based on the service discovery results, thus achieving peer-to-peer communication.

[0003] The existing registration center's method of verifying the identity of consumers' service discovery requests is simple, which can easily lead to data leakage and is not very secure. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and storage medium for invoking microservices, which can improve the security of microservice invocation.

[0005] According to one aspect of the present invention, a method for invoking microservices is provided, comprising:

[0006] Obtain the first timestamp when the consumer initiates the service discovery request;

[0007] The first timestamp and the consumer's microservice identifier are encrypted using multiple keys to obtain identity authentication information;

[0008] The identity authentication information and the service discovery request are sent to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, a service discovery response result is returned to the consumer.

[0009] The system receives the service discovery response result returned by the registry center and calls the microservice instance of the provider based on the service discovery response result; wherein, the service discovery response result includes the provider address.

[0010] Optionally, the plurality of keys includes three keys: a first key, a second key, and a third key; based on the plurality of keys, the first timestamp and the consumer's microservice identifier are encrypted to obtain identity authentication information, including:

[0011] Decode the ciphertext of the first key to obtain the plaintext of the first key;

[0012] Obtain the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key;

[0013] The plaintext of the second key, the first timestamp, and the microservice identifier of the consumer are combined to obtain combined information;

[0014] The combined information is encrypted using the plaintext of the third key to obtain identity authentication information.

[0015] Optionally, obtaining the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key includes:

[0016] Decode the ciphertext of the second key based on the plaintext of the first key to obtain the plaintext of the second key;

[0017] The ciphertext of the third key is decoded based on the plaintext of the second key to obtain the plaintext of the third key.

[0018] Optionally, the registration center verifies the identity authentication information in the following way:

[0019] The identity authentication information is decrypted based on the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer.

[0020] Obtain the second timestamp at the time of decryption;

[0021] Verify the validity of the plaintext of the second key and the microservice identifier of the consumer.

[0022] Timeliness verification is performed based on the second timestamp and the first timestamp.

[0023] Optionally, the service discovery response result also includes the provider interface and access permission switch status; invoking the provider's microservice instance based on the service discovery response result includes:

[0024] If the access permission switch is in the open state, then obtain the interface with access permission;

[0025] A connection is established with the provider based on the provider's address, and the provider's microservice instance is invoked through an interface with access permissions.

[0026] Optionally, the service discovery response result may also include the canary controller address and canary switch status. Invoking the provider's microservice instance based on the service discovery response result includes:

[0027] If the grayscale switch is in the on state, then the grayscale version information is obtained from the grayscale controller according to the grayscale controller address;

[0028] The microservice instance corresponding to the grayscale version information is invoked based on the service discovery response result.

[0029] Optionally, invoking the provider's microservice instance based on the service discovery response result includes:

[0030] If the grayscale switch is in the off state, and the microservice instance of the calling provider contains two or more versions, then the two or more versions of the microservice instance of the provider will be called based on the load balancing principle.

[0031] According to another aspect of the present invention, a microservice invocation apparatus is provided, comprising:

[0032] The first timestamp acquisition module is used to obtain the first timestamp when the consumer initiates a service discovery request.

[0033] The identity authentication information acquisition module is used to encrypt the first timestamp and the microservice identifier of the consumer based on multiple keys to obtain identity authentication information;

[0034] The information verification module is used to send the identity authentication information and the service discovery request to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, the system returns a service discovery response result to the consumer.

[0035] The microservice instance invocation module is used to receive the service discovery response result returned by the registry center, and invoke the microservice instance of the provider according to the service discovery response result; wherein, the service discovery response result includes the provider address.

[0036] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0037] At least one processor; and

[0038] A memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the microservice invocation method described in any embodiment of the present invention.

[0040] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the microservice invocation method described in any embodiment of the present invention.

[0041] This invention obtains the first timestamp when a consumer initiates a service discovery request; encrypts the first timestamp and the consumer's microservice identifier using multiple keys to obtain authentication information; sends the authentication information and the service discovery request to a registry center, which verifies the authentication information. If the verification is successful, a service discovery response result is returned to the consumer; the system receives the service discovery response result from the registry center and invokes the provider's microservice instance based on the result; wherein the service discovery response result includes the provider's address. This invention improves the security of microservice invocation. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of a microservice invocation method provided in Embodiment 1 of the present invention;

[0044] Figure 2 This is an example diagram of the microservice instance invocation process provided in Embodiment 1 of the present invention;

[0045] Figure 3 This is a flowchart of a microservice invocation method provided in Embodiment 2 of the present invention;

[0046] Figure 4 This is a schematic diagram of the structure of a microservice invocation device according to Embodiment 3 of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. Detailed Implementation

[0048] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0049] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0050] Example 1

[0051] Figure 1 This is a flowchart of a microservice invocation method according to Embodiment 1 of the present invention. This embodiment is applicable to the invocation of microservice instances. The method can be executed by a microservice invocation device, and specifically includes the following steps:

[0052] Step 110: Obtain the first timestamp when the consumer initiates the service discovery request.

[0053] In this context, the consumer can be understood as the party that needs to invoke the microservice instance. The consumer can initiate a service discovery request. A service discovery request can be understood as a request to invoke the microservice instance. The first timestamp can be understood as the time when the consumer initiates the service discovery request. In this embodiment, the time information when the consumer initiates the service discovery request can be obtained.

[0054] Step 120: Encrypt the first timestamp and the microservice identifier of the consumer based on multiple keys to obtain identity authentication information.

[0055] The multiple keys can include three keys: a first key, a second key, and a third key. The microservice identifier can be the identification information of a microservice, such as a microservice ID or other identification information. Understandably, in this embodiment, when a user registers and applies for a microservice platform, they can obtain information such as the microservice identifier and provider interface permissions. Encryption can be performed using encryption algorithms or other methods. Identity authentication information can be used to authenticate the consumer's identity. This identity authentication information can be obtained by encrypting a first timestamp and the consumer's microservice identifier using multiple keys. In this embodiment, the identity authentication information can be obtained by encrypting the first timestamp and the consumer's microservice identifier using multiple keys.

[0056] In this embodiment, optionally, the plurality of keys includes three keys: a first key, a second key, and a third key. Encrypting the first timestamp and the consumer's microservice identifier based on the plurality of keys to obtain authentication information includes: decoding the ciphertext of the first key to obtain the plaintext of the first key; obtaining the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key; combining the plaintext of the second key, the first timestamp, and the consumer's microservice identifier to obtain combined information; and encrypting the combined information based on the plaintext of the third key to obtain authentication information.

[0057] The multiple keys include three keys: a first key, a second key, and a third key. For example, the first key can be GK; the second key can be PK; and the third key can be WK. Each key in this embodiment includes plaintext and ciphertext. The plaintext of the key can be obtained by decoding the ciphertext. The plaintext of the first key can be obtained by decoding the ciphertext of the first key. In this embodiment, the plaintext of the second key and the plaintext of the third key can be obtained based on the plaintext of the first key. The combined information can be obtained by combining the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer. In this embodiment, the authentication information can be obtained by encrypting the combined information based on the plaintext of the third key.

[0058] Furthermore, the microservice instance invocation process example diagram in this embodiment is as follows: Figure 2 As shown, in this embodiment, when a user accesses the microservice platform for the first time, they need to apply for the corresponding consumer and provider microservice IDs as unique identifiers for the application from the service governance platform, and then select the appropriate access environment based on the application attributes. In this embodiment, after determining the access environment, the user needs to log in to the portal to apply for multiple keys such as GK, PK, and WK for each microservice application. The user saves and configures the GK in the application's configuration file or environment variables, while the PK and WK keys are distributed by the portal to the corresponding registry and configuration center. The portal can be understood as a page or server within the system. The three-layer key symmetric encryption and decryption algorithm used to generate the request identity information in this embodiment is relatively complex, and the PK and WK keys in the three-layer key encryption mode are maintained by the platform. Users are unaware of the PK and WK keys, only needing to save the GK key, greatly reducing the risk of key leakage and making identity verification more reliable.

[0059] In this embodiment, the ciphertext of the first key can be decoded to obtain the plaintext of the first key. Based on the plaintext of the first key, the plaintexts of the second key and the third key can be obtained. The plaintext of the second key, the first timestamp, and the microservice identifier of the consumer are combined to obtain combined information. The combined information is then encrypted based on the plaintext of the third key to obtain the authentication information. This embodiment, through this setup, further enhances the security of the authentication information by using symmetric encryption of the three-layer key system.

[0060] In this embodiment, optionally, obtaining the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key includes: decoding the ciphertext of the second key based on the plaintext of the first key to obtain the plaintext of the second key; and decoding the ciphertext of the third key based on the plaintext of the second key to obtain the plaintext of the third key.

[0061] The plaintext of the second key can be obtained by decoding the ciphertext of the second key based on the plaintext of the first key. Similarly, the plaintext of the third key can be obtained by decoding the ciphertext of the third key based on the plaintext of the second key. For example, in this embodiment, the ciphertext of the key PK can be decoded based on the plaintext of the key GK to obtain the plaintext of the key PK; and the ciphertext of the key WK can be decoded based on the plaintext of the key PK to obtain the plaintext of the key WK.

[0062] In this embodiment, the ciphertext of the second key can be decoded from the plaintext of the first key to obtain the plaintext of the second key; then, the ciphertext of the third key can be decoded from the plaintext of the second key to obtain the plaintext of the third key. With this setup, the plaintext of the keys can be obtained by decoding the ciphertext of the three layers of keys, thereby obtaining authentication information for subsequent verification.

[0063] In this embodiment, optionally, the registration center verifies the identity authentication information by: decrypting the identity authentication information based on the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer; obtaining the second timestamp at the time of decryption; verifying the legality of the plaintext of the second key and the microservice identifier of the consumer; and verifying the timeliness based on the second timestamp and the first timestamp.

[0064] Decryption can be performed using a decryption algorithm or other methods. In this embodiment, the authentication information can be decrypted based on the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer. The second timestamp can be understood as specific time information. In this embodiment, the time information at the time of decryption can be obtained. Legality verification can be understood as comparing the object to be verified to check its legitimacy. In this embodiment, the legality verification of the plaintext of the second key and the microservice identifier of the consumer can be performed by the registry center comparing the plaintext of the second key with the key information in the cache to determine whether it is legitimate. If the comparison result of the plaintext of the second key and the key information in the cache is consistent, it is determined to be legitimate; if the comparison result is inconsistent, it is determined to be illegitimate. Similarly, the registry center can compare the microservice identifier of the consumer with the identifier information in the cache to determine whether it is legitimate. If the comparison result of the microservice identifier of the consumer and the identifier information in the cache is consistent, it is determined to be legitimate; if the comparison result is inconsistent, it is determined to be illegitimate.

[0065] Timeliness verification can be understood as determining whether the obtained duration exceeds a preset threshold, thereby judging whether it is timely. The preset threshold can be pre-set and can be configured according to actual needs. Specifically, in this embodiment, timeliness verification based on the second timestamp and the first timestamp can be performed by subtracting the first timestamp from the second timestamp, comparing the resulting duration with the preset threshold, and determining whether it exceeds the preset threshold. If the duration exceeds the preset threshold, it is not timely; if the duration does not exceed the preset threshold, it is timely.

[0066] In this embodiment, the authentication information can be decrypted using the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer. By obtaining the second timestamp at the time of decryption, the legality of the plaintext of the second key and the microservice identifier of the consumer are verified, and the timeliness is verified based on the second timestamp and the first timestamp, thereby completing the verification of the authentication information. This embodiment, through legality verification and timeliness verification, ultimately completes the verification of the authentication information, further improving the security of microservice calls.

[0067] Step 130: Send the identity authentication information and the service discovery request to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, return the service discovery response result to the consumer.

[0068] The registry center can verify identity authentication information. The service discovery response result can be the result information returned after successful verification of the identity authentication information. In this embodiment, the identity authentication information and service discovery request can be sent to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, a service discovery response result is returned to the consumer.

[0069] Step 140: Receive the service discovery response result returned by the registry center, and call the microservice instance of the provider according to the service discovery response result.

[0070] The service discovery response result includes the provider's address. Microservice instances may have application version information; for example, each microservice instance may include multiple version information, such as version one, version two, and version three. In this embodiment, the microservice instance of the provider can be invoked based on the provider's address. In this embodiment, the consumer can receive the service discovery response result returned by the registry center and invoke the provider's microservice instance based on the provider's address in the service discovery response result.

[0071] This invention obtains the first timestamp when a consumer initiates a service discovery request; encrypts the first timestamp and the consumer's microservice identifier using multiple keys to obtain authentication information; sends the authentication information and the service discovery request to a registry center, which verifies the authentication information. If the verification is successful, a service discovery response result is returned to the consumer; the system receives the service discovery response result from the registry center and invokes the provider's microservice instance based on the result; wherein the service discovery response result includes the provider's address. This invention improves the security of microservice invocation.

[0072] Example 2

[0073] Figure 3 This is a flowchart of a microservice invocation method according to Embodiment 2 of the present invention. This embodiment is an optimization based on the above embodiment. Specifically, the optimization includes: the service discovery response result further includes the provider interface and access permission switch status; invoking the provider's microservice instance according to the service discovery response result includes: if the access permission switch status is open, obtaining the interface with access permission; establishing a connection with the provider based on the provider address, and invoking the provider's microservice instance through the interface with access permission. Figure 3 As shown, the method in this embodiment specifically includes the following steps:

[0074] Step 310: Obtain the first timestamp when the consumer initiates the service discovery request.

[0075] Step 320: Encrypt the first timestamp and the microservice identifier of the consumer based on multiple keys to obtain identity authentication information.

[0076] Step 330: Send the identity authentication information and the service discovery request to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, return the service discovery response result to the consumer.

[0077] Step 340: Receive the service discovery response result returned by the registry center.

[0078] The service discovery response includes the provider's address. It also includes the provider's interface and its access permission status. The provider interface can include specific callable interfaces. For example, if the returned service discovery response includes provider interfaces A and B, it means that the provider's microservice instance can only be called through interfaces A and B with the appropriate access permissions. The access permission status can be either on or off.

[0079] Step 350: If the access permission switch is in the open state, then obtain the interface with access permission.

[0080] In this embodiment, if the access permission switch is in the "on" state, the user can access the provider interfaces for which they have permission. If the access permission switch is in the "off" state, it indicates that the user has requested access permissions for all provider interfaces and can access all provider interfaces.

[0081] Specifically, in this embodiment, before the consumer application goes online, it needs to apply for the corresponding provider's interface call permission on the service governance platform. The configured interface call permission will be issued to the registration center by the portal backend. The consumer obtains the provider interface and access permission switch status from the service discovery response result. When the access permission switch status is on, the consumer can only call the provider interface with the configured call permission; otherwise, the interface call can be unrestricted.

[0082] Step 360: Establish a connection with the provider based on the provider's address, and call the provider's microservice instance through an interface with access permissions.

[0083] In this embodiment, a connection can be established with the provider based on the provider address in the returned service discovery response, and the provider's microservice instance can be called through an interface with access permissions.

[0084] For example, if only interfaces A and B have access permissions, a connection can be established with the provider based on the provider's address, and the provider's microservice instance can be invoked through interfaces A and B. This embodiment supports interface-level invocation permission configuration, allowing the provider's interfaces to be selectively exposed to consumers, improving the privacy and flexibility of the interfaces.

[0085] In this embodiment, optionally, the service discovery response result may also include the grayscale controller address and grayscale switch status. Calling the provider's microservice instance based on the service discovery response result includes: if the grayscale switch status is on, obtaining grayscale version information from the grayscale controller based on the grayscale controller address; and calling the microservice instance corresponding to the grayscale version information based on the service discovery response result.

[0086] In this embodiment, the service discovery response result may further include the canary controller address and the canary switch status. In this embodiment, the canary controller can be accessed based on its address. The canary switch status may include an on state and a off state. The canary controller may store higher-priority microservice instance versions. In this embodiment, the canary controller may be pre-configured by the user. The canary version information can be understood as the version information of the microservice instance. In this embodiment, the corresponding microservice instance can be determined based on the canary version information. For example, such as... Figure 2 As shown in this embodiment, if the provider application instance has two or more versions, the version number information should be pre-configured in the canary controller, and the corresponding canary information should be written into the instance configuration file or environment variables. This way, the provider will carry the canary version information during registration, and the consumer will obtain this information during service discovery. Based on the obtained canary release information, the consumer can determine the corresponding version of the microservice instance in the canary controller. In this embodiment, the canary controller is used for provider registration in the registry center for consumer service discovery. The canary version information configured by the user in the canary controller is updated in real time, making traffic distribution more flexible and sensitive.

[0087] In this embodiment, if the grayscale switch is in the open state, it indicates that a higher priority version will be called first. The grayscale version information is obtained from the grayscale controller based on the grayscale controller address, and then the microservice instance corresponding to the grayscale version information can be called according to the service discovery response result. If the grayscale switch is in the closed state, it is not necessary to select based on the grayscale version information, and the microservice instance can be called directly based on load balancing.

[0088] Specifically, the canary controller is registered as a public provider in the registry center. All consumers can obtain the canary controller address and canary switch status from the service discovery response. When the canary switch is on, the consumer accesses the canary controller to obtain the canary version information, which allows it to obtain the provider version number and then perform load balancing to the provider instance with the specified version number, thereby realizing the canary release of traffic. Conversely, load balancing is performed to all versions of the provider instance.

[0089] In this embodiment, by setting it up in this way, the gray-scale version information, that is, the microservice instances with priority calls, can be prioritized for load balancing, thereby realizing the gray-scale release of traffic more conveniently.

[0090] In this embodiment, optionally, calling the provider's microservice instance based on the service discovery response result includes: if the gray-scale switch is in the off state and the calling provider's microservice instance contains two or more versions, then calling the provider's two or more versions of microservice instances based on the load balancing principle.

[0091] The load balancing principle can be understood as balancing resource calls based on the resource status of each microservice instance. In this embodiment, if the canary release switch is off and the calling provider's microservice instance contains two or more versions, then the load balancing principle will be used to call the two or more versions of the provider's microservice instance. This configuration allows for load balancing of microservice instances even when the canary release switch is off and the microservice instance has two or more versions, making it easier to achieve load balancing and thus enabling canary release of traffic.

[0092] This invention obtains the first timestamp when a consumer initiates a service discovery request; encrypts the first timestamp and the consumer's microservice identifier using multiple keys to obtain authentication information; sends the authentication information and the service discovery request to a registry center for verification; if verification is successful, the registry center returns a service discovery response result to the consumer; receives the service discovery response result from the registry center, and if the access permission switch is enabled, obtains an interface with access permission; establishes a connection with the provider based on the provider's address, and calls the provider's microservice instance through the access-permitted interface. The service discovery response result also includes the provider's interface and the access permission switch status. This invention improves the security of microservice calls.

[0093] Example 3

[0094] Figure 4This is a schematic diagram of a microservice invocation device according to Embodiment 3 of the present invention. This device can execute the microservice invocation method provided in any embodiment of the present invention, and possesses the corresponding functional modules and beneficial effects of the execution method. For example... Figure 4 As shown, the device includes:

[0095] The first timestamp acquisition module 410 is used to acquire the first timestamp when the consumer initiates a service discovery request.

[0096] The identity authentication information acquisition module 420 is used to encrypt the first timestamp and the microservice identifier of the consumer based on multiple keys to obtain identity authentication information;

[0097] The information verification module 430 is used to send the identity authentication information and the service discovery request to the registration center so that the registration center can verify the identity authentication information. If the verification is successful, the registration center will return a service discovery response result to the consumer.

[0098] The microservice instance invocation module 440 is used to receive the service discovery response result returned by the registry center and invoke the microservice instance of the provider according to the service discovery response result; wherein, the service discovery response result includes the provider address.

[0099] Optionally, the plurality of keys includes three keys, namely a first key, a second key, and a third key; the identity authentication information acquisition module 420 includes:

[0100] The first plaintext acquisition unit is used to decode the ciphertext of the first key to obtain the plaintext of the first key;

[0101] The second plaintext acquisition unit is used to acquire the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key;

[0102] The combined information acquisition unit is used to combine the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer to obtain combined information;

[0103] The identity authentication information acquisition unit is used to encrypt the combined information based on the plaintext of the third key to obtain identity authentication information.

[0104] Optionally, the second plaintext acquisition unit is specifically used for:

[0105] Decode the ciphertext of the second key based on the plaintext of the first key to obtain the plaintext of the second key;

[0106] The ciphertext of the third key is decoded based on the plaintext of the second key to obtain the plaintext of the third key.

[0107] Optionally, the registration center verifies the identity authentication information in the following way:

[0108] The identity authentication information is decrypted based on the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer.

[0109] Obtain the second timestamp at the time of decryption;

[0110] Verify the validity of the plaintext of the second key and the microservice identifier of the consumer.

[0111] Timeliness verification is performed based on the second timestamp and the first timestamp.

[0112] Optionally, the service discovery response result also includes the provider interface and access permission switch status; the microservice instance invocation module 440 is specifically used for:

[0113] If the access permission switch is in the open state, then obtain the interface with access permission;

[0114] A connection is established with the provider based on the provider's address, and the provider's microservice instance is invoked through an interface with access permissions.

[0115] Optionally, the service discovery response result also includes the grayscale controller address and grayscale switch status. The microservice instance invocation module 440 is specifically used for:

[0116] If the grayscale switch is in the on state, then the grayscale version information is obtained from the grayscale controller according to the grayscale controller address;

[0117] The microservice instance corresponding to the grayscale version information is invoked based on the service discovery response result.

[0118] Optionally, the microservice instance calls module 440, specifically for:

[0119] If the grayscale switch is in the off state, and the microservice instance of the calling provider contains two or more versions, then the two or more versions of the microservice instance of the provider will be called based on the load balancing principle.

[0120] The above-described apparatus can execute the methods provided in all the foregoing embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the above methods. Technical details not described in detail in this embodiment can be found in the methods provided in all the foregoing embodiments of the present invention.

[0121] Example 4

[0122] Figure 5This is a schematic diagram of an electronic device according to Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0123] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0124] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0125] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as microservice invocation methods.

[0126] In some embodiments, the microservice invocation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the microservice invocation method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the microservice invocation method by any other suitable means (e.g., by means of firmware).

[0127] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0128] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0129] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0130] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0131] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0132] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0133] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0134] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for invoking a microservice, characterized in that, include: Obtain the first timestamp when the consumer initiates the service discovery request; The first timestamp and the consumer's microservice identifier are encrypted using multiple keys to obtain identity authentication information; The identity authentication information and the service discovery request are sent to the registry center so that the registry center can verify the identity authentication information. If the verification is successful, a service discovery response result is returned to the consumer. The system receives the service discovery response result returned by the registry center and calls the microservice instance of the provider based on the service discovery response result; wherein, the service discovery response result includes the provider address; The plurality of keys includes three keys: a first key, a second key, and a third key. Based on these multiple keys, the first timestamp and the consumer's microservice identifier are encrypted to obtain identity authentication information, including: Decode the ciphertext of the first key to obtain the plaintext of the first key; The plaintext of the second key and the plaintext of the third key are obtained based on the plaintext of the first key; The plaintext of the second key, the first timestamp, and the microservice identifier of the consumer are combined to obtain combined information; The combined information is encrypted based on the plaintext of the third key to obtain identity authentication information; The process of obtaining the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key includes: The ciphertext of the second key is decoded based on the plaintext of the first key to obtain the plaintext of the second key; The ciphertext of the third key is decoded based on the plaintext of the second key to obtain the plaintext of the third key; The first key is saved and configured by the user in the application's configuration file or environment variables, while the second and third keys are issued by the portal to the corresponding registration center and configuration center; the portal can be any page of the system or a server.

2. The method according to claim 1, characterized in that, The registration center verifies the identity authentication information in the following way: The identity authentication information is decrypted based on the plaintext of the third key to obtain the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer. Obtain the second timestamp at the time of decryption; Verify the validity of the plaintext of the second key and the microservice identifier of the consumer. Timeliness verification is performed based on the second timestamp and the first timestamp.

3. The method according to claim 1, characterized in that, The service discovery response also includes the provider interface and access permission switch status; The microservice instance of the provider is invoked based on the service discovery response result, including: If the access permission switch is in the open state, then obtain the interface with access permission; A connection is established with the provider based on the provider's address, and the provider's microservice instance is invoked through an interface with access permissions.

4. The method according to claim 1 or 3, characterized in that, The service discovery response result also includes the canary controller address and canary switch status. Based on the service discovery response result, the provider's microservice instance is invoked, including: If the grayscale switch is in the on state, then the grayscale version information is obtained from the grayscale controller according to the grayscale controller address; The microservice instance corresponding to the grayscale version information is invoked based on the service discovery response result.

5. The method according to claim 4, characterized in that, The microservice instance of the provider is invoked based on the service discovery response result, including: If the grayscale switch is in the off state, and the microservice instance of the calling provider contains two or more versions, then the two or more versions of the microservice instance of the provider will be called based on the load balancing principle.

6. A microservice invocation device, characterized in that, include: The first timestamp acquisition module is used to obtain the first timestamp when the consumer initiates a service discovery request. The identity authentication information acquisition module is used to encrypt the first timestamp and the microservice identifier of the consumer based on multiple keys to obtain identity authentication information; The information verification module is used to send the identity authentication information and the service discovery request to the registration center, so that the registration center can verify the identity authentication information. If the verification is successful, the registration center will return a service discovery response result to the consumer. The microservice instance invocation module is used to receive the service discovery response result returned by the registry center, and invoke the microservice instance of the provider according to the service discovery response result; wherein, the service discovery response result includes the provider address; The plurality of keys includes three keys: a first key, a second key, and a third key; the identity authentication information acquisition module includes: The first plaintext acquisition unit is used to decode the ciphertext of the first key to obtain the plaintext of the first key; The second plaintext acquisition unit is used to acquire the plaintext of the second key and the plaintext of the third key based on the plaintext of the first key; The combined information acquisition unit is used to combine the plaintext of the second key, the first timestamp, and the microservice identifier of the consumer to obtain combined information; An identity authentication information acquisition unit is used to encrypt the combined information based on the plaintext of the third key to obtain identity authentication information; The second plaintext acquisition unit is specifically used for: The ciphertext of the second key is decoded based on the plaintext of the first key to obtain the plaintext of the second key; The ciphertext of the third key is decoded based on the plaintext of the second key to obtain the plaintext of the third key; The first key is saved and configured by the user in the application's configuration file or environment variables, while the second and third keys are issued by the portal to the corresponding registration center and configuration center; the portal can be any page of the system or a server.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the microservice invocation method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the microservice invocation method of any one of claims 1-5.

Images