Authorization authentication method, microservice system, system, device and storage medium

Abstract

The present application relates to the field of computer technology and provides a method for authorization authentication, a microservice system, a system, a device and a storage medium, which are used to solve the technical problem of relying on an external system for authentication in the prior art; the authorization authentication method is applied to a gateway in a microservice platform, and includes: receiving a request message sent by a user, verifying whether the user is a registered consumer according to the request message, and verifying whether the service application requested in the request message can provide the service; when the verification result shows that the user is a registered consumer and the requested service application can provide the service, retrieving the application program interface corresponding to the service application and the user's service quota in the cache according to the request message; when the user's service quota is retrieved and the amount of the service quota is greater than zero, sending the request message to the application program interface.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, microservice system, system, device and storage medium for authority authentication. Background Art

[0002] With the rapid development of the Internet industry, enterprises can quickly integrate system capabilities within the enterprise or even the entire industry through open management platforms, expose existing data and business capabilities in the form of services, provide application program interfaces (APIs) for external consumers, and provide complete service lifecycle management and control capabilities and continuous service operation capabilities.

[0003] At present, the company's main construction plan for the open product management platform is built through a microservice architecture. An independent service is divided as a capability exposure gateway. Before being externally proxied to the upstream service, the request is first proxied to the API capability exposure service for authentication and a series of business authentication operations. The result is returned to the proxy server, the final target address is requested, and the result is returned.

[0004] However, forwarding authentication information to an external system for API capability authentication lengthens the request call chain and relies on the network environment of the authentication system. Once the authentication service goes down, users will not be able to call any interface, which greatly reduces the user experience.

[0005] In view of this, how to perform authentication without relying on external systems has become a technical problem that needs to be solved urgently. Summary of the Invention

[0006] The embodiments of the present invention provide a method, microservice system, system, device and storage medium for authorization authentication, which are used to solve the technical problem that the existing technology requires reliance on external systems for authentication.

[0007] In a first aspect, the present application provides a method for authorization authentication, which is applied to a gateway in a microservice platform, including:

[0008] Receive a request message from a user, verify whether the user is a registered consumer based on the request message, and verify whether the service application requested in the request message can provide the service;

[0009] When the verification result shows that the user is a registered consumer and the requested service application can provide the service, searching the cache for the application program interface corresponding to the service application and the service quota of the user according to the request information;

[0010] When the service quota of the user is retrieved and the amount of the service quota is greater than zero, the request information is sent to the application program interface.

[0011] Optionally, receive request information sent by the user, including:

[0012] Calculating a time offset when the request information is sent to the application program interface;

[0013] When the time deviation is greater than the preset time deviation, rejecting the request information and returning a corresponding error report;

[0014] When the time deviation is less than or equal to the preset time deviation, the request information is received.

[0015] Optionally, verifying whether the user is a registered consumer according to the request information includes:

[0016] Extracting the user's username, encryption algorithm, encryption value and verification value from the request information;

[0017] Query the key agreed upon when the user registered according to the user name;

[0018] An encryption algorithm is used to calculate a hash value corresponding to the key and the encrypted value, and the verification value and the hash value are compared. When the verification value and the hash value are consistent, the user is determined to be a registered consumer; otherwise, the user is determined not to be a registered consumer.

[0019] Optionally, verifying whether the service application requested in the request information can provide the service includes:

[0020] Extracting the service application requested by the user from the request information, and extracting service entity information corresponding to the service application from the cache or database;

[0021] When the service entity information of the service application is extracted from the cache or the database, it is determined that the service application requested in the request information can provide the service; otherwise, it is determined that the service application requested in the request information cannot provide the service.

[0022] Optionally, retrieving the application program interface corresponding to the service application and the service quota of the user from a cache according to the request information includes:

[0023] According to the service application requested by the user in the request information, query the application program interface tree in the cache to obtain the application program interface corresponding to the service application;

[0024] According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache.

[0025] Optionally, searching the application program interface tree in the cache according to the service application requested by the user in the request information to obtain an application program interface corresponding to the service application includes:

[0026] Query the cache for the corresponding service name, request method, and request path according to the service application;

[0027] According to the service name, the root node with the same root node name is queried in the application interface tree, the corresponding secondary node is queried in the tree where the root node is located according to the request method, and the corresponding child node is queried in the child node of the secondary node according to the request path, and the child node of the application interface tree matched by the query is used as the application interface corresponding to the service application.

[0028] Optionally, when the service quota of the user is retrieved and the amount of the service quota is greater than zero, sending the request information to the application program interface includes:

[0029] querying, from the cache, according to the user name of the user and the service application requested in the request information, whether a service quota corresponding to the service application and the user name exists, and querying whether the service quota is greater than zero;

[0030] When the service quota exists and is greater than zero, the amount of the service quota is deducted and the request information is sent to the application program interface.

[0031] Optionally, the amount of the service quota deducted includes:

[0032] The amount of the service quota is deducted according to the expense of the service application, and the deducted service quota is stored in a message queue, so that the service application synchronizes the consumed service quota through the message queue.

[0033] In a second aspect, the present application provides a microservice system, including:

[0034] Client, used to send user request information;

[0035] A gateway, configured to receive the request information sent by the client, perform permission authentication using the method described in any one of the first aspects, and send the authenticated request information to the application program interface;

[0036] The server side is used to receive request information through the application program interface and provide corresponding services to the user.

[0037] In a third aspect, the present application provides a system for authentication of permissions, including:

[0038] A request information verification unit, configured to receive a request message sent by a user, verify whether the user is a registered consumer based on the request message, and verify whether the service application requested in the request message can provide the service;

[0039] a service application calling unit configured to, when the verification result shows that the user is a registered consumer and the requested service application can provide the service, retrieve the application program interface corresponding to the service application and the service quota of the user from the cache according to the request information;

[0040] The request information sending unit is configured to send the request information to an application program interface when the service quota of the user is retrieved and the amount of the service quota is greater than zero.

[0041] Optionally, the request information verification unit is used to:

[0042] Calculating a time offset when the request information is sent to the application program interface;

[0043] When the time deviation is greater than the preset time deviation, rejecting the request information and returning a corresponding error report;

[0044] When the time deviation is less than or equal to the preset time deviation, the request information is received.

[0045] Optionally, the request information verification unit is used to:

[0046] Extracting the user's username, encryption algorithm, encryption value and verification value from the request information;

[0047] Query the key agreed upon when the user registered according to the user name;

[0048] An encryption algorithm is used to calculate a hash value corresponding to the key and the encrypted value, and the verification value and the hash value are compared. When the verification value and the hash value are consistent, the user is determined to be a registered consumer; otherwise, the user is determined not to be a registered consumer.

[0049] Optionally, the request information verification unit is used to:

[0050] Extracting the service application requested by the user from the request information, and extracting service entity information corresponding to the service application from the cache or database;

[0051] When the service entity information of the service application is extracted from the cache or the database, it is determined that the service application requested in the request information can provide the service; otherwise, it is determined that the service application requested in the request information cannot provide the service.

[0052] Optionally, the service application calling unit is used to:

[0053] According to the service application requested by the user in the request information, query the application program interface tree in the cache to obtain the application program interface corresponding to the service application;

[0054] According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache.

[0055] Optionally, the service application calling unit is used to:

[0056] Query the cache for the corresponding service name, request method, and request path according to the service application;

[0057] According to the service name, the root node with the same root node name is queried in the application interface tree, the corresponding secondary node is queried in the tree where the root node is located according to the request method, and the corresponding child node is queried in the child node of the secondary node according to the request path, and the child node of the application interface tree matched by the query is used as the application interface corresponding to the service application.

[0058] Optionally, the request information sending unit is used to:

[0059] querying, from the cache, according to the user name of the user and the service application requested in the request information, whether a service quota corresponding to the service application and the user name exists, and querying whether the service quota is greater than zero;

[0060] When the service quota exists and is greater than zero, the amount of the service quota is deducted and the request information is sent to the application program interface.

[0061] Optionally, the request information sending unit is used to:

[0062] The amount of the service quota is deducted according to the expense of the service application, and the deducted service quota is stored in a message queue, so that the service application synchronizes the consumed service quota through the message queue.

[0063] In a fourth aspect, the present application provides a device for authorization authentication, including:

[0064] at least one processor, and

[0065] a memory coupled to the at least one processor;

[0066] The memory stores instructions that can be executed by the at least one processor, and the at least one processor performs the method as described in any one of the first aspects by executing the instructions stored in the memory.

[0067] In a fifth aspect, the present application provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for video object segmentation as described in any one of the first aspects.

[0068] The technical solution in the embodiment of the present application has the following beneficial effects: the gateway receives the request information sent by the user, verifies whether the user is a registered consumer based on the request information, and verifies whether the service application requested in the request information can provide the service; when the verification result is that the user is a registered consumer and the requested service application can provide the service, the application program interface corresponding to the service application and the user's service quota are retrieved in the cache based on the request information; when the user's service quota is retrieved and the amount of the service quota is greater than zero, the request information is sent to the application program interface; thereby completing the process of authenticating the user through the gateway without calling an external system, reducing system delays, and improving response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a flowchart of a method for authorization authentication provided by an embodiment of the present application;

[0070] Figure 2 This is a schematic diagram of the structure of a microservice platform provided in an embodiment of the present application;

[0071] Figure 3 This is a schematic diagram of an API tree provided in an embodiment of the present application;

[0072] Figure 4 This is a schematic diagram of the structure of a microservice system provided in an embodiment of the present application;

[0073] Figure 5 This is a structural diagram of a system for authentication of permissions provided in an embodiment of the present application. DETAILED DESCRIPTION

[0074] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the following will provide a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the accompanying drawings. The acquisition, storage, use, and processing of data in the technical solutions of this application comply with the relevant provisions of national laws and regulations.

[0075] In existing technologies, the authentication process is typically completed through a dedicated authorization authentication service. When a user sends a request, the gateway forwards it to the authorization authentication service. After authentication is completed within the authorization authentication service, the corresponding authorization authentication information is returned to the gateway. The gateway then uses the authorization authentication information to address the corresponding service application and sends the request to the service application. This process involves a long request call chain and relies on the authentication system's network environment. If the authentication service goes down, users will be unable to call any interfaces, significantly reducing the user experience.

[0076] To this end, this application provides a method for authorization authentication, which is applied to the gateway in the microservice platform to solve the technical problem of relying on external systems for authentication in the existing technology. Figure 1 , the method comprising:

[0077] 101. Receive a request message sent by a user, verify whether the user is a registered consumer based on the request message, and verify whether the service application requested in the request message can provide the service;

[0078] 102. When the verification result shows that the user is a registered consumer and the requested service application can provide the service, the application program interface corresponding to the service application and the user's service quota are retrieved from the cache according to the request information;

[0079] 103. When the user's service quota is retrieved and the service quota is greater than zero, the request information is sent to the application program interface.

[0080] For example, see Figure 2 , Figure 2 A schematic diagram of the structure of a microservice system provided in an embodiment of the present application, comprising: a client 21, a gateway 22 and a server 23.

[0081] When a user sends a request message 1 through the client 21, the client 21 sends the request message 1 to the gateway 22 of the microservice platform. After receiving the request message 1, the gateway 22 first verifies whether the user is a registered consumer and whether the service application requested by the request message 1 can provide the service.

[0082] Gateway 22 extracts the user's username from Request 1: {UserA}, the encryption algorithm used: {hmac-sha1}, the corresponding encryption value: {512}, and the verification value: {eefaca8b328f160e24defc94caf208f73e9c401b}. Based on the username {UserA}, Gateway 22 searches for the key {a} agreed upon during user registration. The user then enters the encryption value {512} and key {a} into the encryption algorithm {hmac-sha1} for calculation, resulting in a hash value: {eefaca8b328f160e24defc94caf208f73e9c401b}. Gateway 22 compares the calculated hash value {eefaca8b328f160e24defc94caf208f73e9c401b} with the verification value {eefaca8b328f160e24defc94caf208f73e9c401b} extracted from Request 1. The result is that the two are consistent, thus confirming that the user is a registered consumer {User A}. Gateway 22 then extracts the service application requested by the user from Request 1 as {Service Application B}. Gateway 22 searches the cached service application database for {Service Application B} and finds the service entity corresponding to server 23, thus confirming that the service application requested in Request 1 can provide the service.

[0083] Subsequently, gateway 22 searches the cache for the API interface corresponding to server 23. The search result shows that the API interface corresponding to server 23 is API interface B. Since the user's service quota is 5, gateway 22 determines that the user has permission to access the service of server 23. Finally, gateway 22 forwards request information 1 to API interface B, which accesses the service of server 23 through API interface B.

[0084] In an embodiment of the present application, the gateway receives a request message sent by the user, verifies whether the user is a registered consumer based on the request message, and verifies whether the service application requested in the request message can provide the service; when the verification result is that the user is a registered consumer and the requested service application can provide the service, the application program interface corresponding to the service application and the user's service quota are retrieved in the cache based on the request information; when the user's service quota is retrieved and the amount of the service quota is greater than zero, the request message is sent to the application program interface; thereby, the process of authenticating the user is completed through the gateway without calling an external system, reducing system delays, and improving response speed.

[0085] In one possible implementation, the step 101 of receiving the request information sent by the user includes:

[0086] Calculate the time deviation when the request information is sent to the application interface; when the time deviation is greater than the preset time deviation, reject the request information and return a corresponding error report; when the time deviation is less than or equal to the preset time deviation, receive the request information.

[0087] For example, after receiving Request 1, Gateway 22 calculates that the time it takes for Request 1 to be sent from Client 21 to the API interface is 25ms, while the preset sending time is 20ms and the preset time deviation is 3ms. Gateway 22 calculates that the time deviation for Request 1 to be sent to the API interface is 5ms, which is greater than the preset time deviation of 3ms. Therefore, Gateway 22 rejects Request 1 and sends a corresponding error report to Client 21 stating that the time between the client and server is inconsistent.

[0088] After receiving the error report, client 21 performs self-diagnosis and troubleshooting, and then sends request message 1 again to gateway 22. The calculated time taken for request message 1 to be sent from client 21 to the API interface is 19ms, corresponding to a time deviation of 1ms, which is less than the preset time deviation of 3ms. Therefore, gateway 22 receives request message 1 and performs authorization authentication.

[0089] In an embodiment of the present application, the gateway 22 calculates the time deviation between the client 21 and the server 23. Only when the time deviation is within a preset range will it receive the request information and execute the subsequent permission authentication method; when the time deviation exceeds the preset range, the request information is rejected and a corresponding error report is returned, thereby ensuring a stable connection between the client 21 and the server 23, avoiding repeated processing of the same request information due to network fluctuations and other problems, and preventing repeated attacks.

[0090] In one possible implementation, the step 101 of verifying whether the user is a registered consumer based on the request information includes:

[0091] Extract the user's username, encryption algorithm, encryption value and verification value from the request information; query the key agreed upon when the user registered based on the username; use the encryption algorithm to calculate the hash value corresponding to the key and encryption value, compare the verification value and hash value, and when the verification value and hash value are consistent, determine that the user is a registered consumer, otherwise determine that the user is not a registered consumer.

[0092] For example, before a user accesses gateway 22 through client 21, they first register their user identity with gateway 22. During registration, gateway 22 and username A agree on a key {a} for authentication. This key is not transmitted in the request message after registration. When the user sends request message 1 through client 21, the username {usernameA} used during registration is included in the request message. Client 21 also includes {usernameA}, the hash algorithm {hmac-sha1} used for the signature, the encrypted value {512} used for the signature, and the signed verification value {eefaca8b328f160e24defc94caf208f73e9c401b}. Gateway 22 uses the same hashing algorithm {hmac-sha1}, combining the encrypted value {512} with the key {a} agreed upon during registration, to perform a hash operation, resulting in a hash value of {eefaca8b328f160e24defc94caf208f73e9c401b}. Finally, Gateway 22 compares the locally calculated hash value with the verification value in Request Message 1. The two match, indicating that the user who sent Request Message 1 is a registered consumer.

[0093] When gateway 22 receives request message 2, it extracts the username {User A}, encryption algorithm {h MAC-SHA1}, encryption value {256}, and verification value {faf3189c8fe97df4745d3e10bced4246701389d0}. Gateway 22 then searches for the corresponding key {a} based on {User A}. Then, using the HMAC-SHA1 algorithm with key {a} and encryption value {256}, it calculates the hash value to be {b216ec2ed413e7f0b4011cf a4b08ec9502381d07}. Clearly, the calculated hash value and verification value differ, so gateway 22 determines that the user who sent request message 2 is not a registered consumer.

[0094] In an embodiment of the present application, the gateway 22 verifies the request information sent by the client 21 through a hash algorithm. When the user is not registered or the request information is tampered with, the hash verification cannot be passed, thereby ensuring the security of the request information and the security of the server 23.

[0095] In one possible implementation, the verification in step 101 of whether the service application requested in the request information can provide the service includes:

[0096] Extract the service application requested by the user from the request information, and extract the service entity information corresponding to the service application from the cache or database;

[0097] When the service entity information of the service application is extracted from the cache or database, it is determined that the service application requested in the request information can provide the service; otherwise, it is determined that the service application requested in the request information cannot provide the service.

[0098] For example, the service application requested by the user in the request information 1 received by the gateway 22 is {service application B}, and the gateway 22 retrieves the service entity corresponding to {service application B} in the cached service application database as the server 23, so it is determined that the service application requested by the request information 1 can provide the service.

[0099] When the gateway receives request information 3 indicating that the service application requested by the user is service application A, and the service entity corresponding to {service application A} is not retrieved in the cached service application data, it is determined that the service application requested by request information 3 cannot provide the service.

[0100] In the specific implementation, the corresponding program examples are as follows:

[0101]

[0102]

[0103] In the embodiment of the present application, the gateway 22 can retrieve the service application requested in the request information through the service application data in the cache, thereby determining whether the service application can provide services to the user.

[0104] In one possible implementation, in step 102, retrieving the application program interface corresponding to the service application and the user's service quota from the cache according to the request information includes:

[0105] According to the service application requested by the user in the request information, query the application program interface tree in the cache to obtain the application program interface corresponding to the service application;

[0106] According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache.

[0107] For example, after verifying the request message 1, the gateway 22 searches the cache for the corresponding API interface according to the service application B requested in the request message 1. At the same time, according to {user name A} in the request message 1, it is found that the service quota of the service application B under the user name A is 5 times.

[0108] In an embodiment of the present application, the gateway 22 queries the corresponding API interface and the amount of the service quota corresponding to the user through the service application and user name requested in the request message, thereby determining whether the user can access the corresponding service application.

[0109] In one possible implementation, in step 102, searching the cached application program interface tree based on the service application requested by the user in the request information to obtain the application program interface corresponding to the service application includes:

[0110] Query the corresponding service name, request method, and request path in the cache based on the service application;

[0111] According to the service name, query the root node with the same root node name in the application interface tree, query the corresponding secondary node in the tree where the root node is located according to the request method, query the corresponding child node in the child node of the secondary node according to the request path, and use the child node of the application interface tree matched by the query as the application interface corresponding to the service application.

[0112] For example, the API interface data in the gateway 22 can be stored in the form of an API tree, where the root node is the API name, the second-level node is the API request method, and the third-level and lower nodes are the request path names, and the separator " / " in the request path is used as a delimiter to generate the lower-level nodes. Figure 3 , Figure 3 A schematic diagram of an API tree provided for an embodiment of the present application, wherein the root node of the API tree is {service application B}, the secondary nodes include {POST} and {DELETE}, etc., and the lower-level nodes include {API interface A}, {API interface B} and {API interface Z}, etc.

[0113] In actual implementation, in order to prevent other API exposed addresses from being attacked and to facilitate the response to large-scale service requests, the API can be cached locally. The corresponding program example is as follows:

[0114]

[0115]

[0116] When gateway 22 receives request information 1 requesting {service application B}, it first queries service application B in the root node, then queries the corresponding secondary node according to the requested service type {POST}, and finally queries the lower-level node after the secondary node according to the requested path, and obtains the corresponding node as {API interface B}, so API interface B is used as the API corresponding to request information 1.

[0117] In the specific implementation, the corresponding program example is as follows:

[0118]

[0119]

[0120]

[0121] In actual applications, since the API request is different from the service, and the API request contains some parameters, the API is not unique, so the gateway 22 cannot directly obtain a unique API to respond to the API request, but can only obtain all APIs under the corresponding service and then match them. In this process, the gateway 22 needs to traverse all APIs under the service, which not only takes up a lot of resources, but also brings a lot of service time. The present application can use a tree structure to cache APIs under the same service, and preferably a prefix tree can be used for implementation. The prefix tree can use the service name as the root node, the second-level node is the request API method type, and the third-level and lower nodes are divided according to the request path with the path separator " / ", and are generated as nodes according to the order; when searching, the common prefix of the string is used for comparative search to reduce the search time, reduce the string comparison, and improve the query efficiency.

[0122] In the embodiment of the present application, the gateway 22 avoids traversing all APIs during query through the setting of the API tree, saving a large amount of memory resource consumption, and due to the characteristics of the tree, the efficiency in searching and finding is also improved, which also improves the efficiency of API search.

[0123] In one possible implementation, in step 103, when the user's service quota is retrieved and the service quota is greater than zero, sending the request information to the application program interface includes:

[0124] According to the user's username and the service application requested in the request information, query the cache to see whether the service quota corresponding to the service application and the username exists, and query whether the service quota is greater than zero;

[0125] When the service quota exists and is greater than zero, the service quota amount is deducted and the request information is sent to the application interface.

[0126] For example, gateway 22 retrieves the service application {Service Application B} and username {User Name A} from request message 1. Therefore, gateway 22 retrieves the service quota information from the cached Redis. The query result shows that the service quota for service application B under user A is 5 times, which is greater than zero. Therefore, gateway 22 deducts the corresponding service quota to 4 times and forwards request message 1 to API interface B.

[0127] In the embodiment of the present application, the gateway 22 can also obtain the user's service quota through the cache, thereby completing the billing and deduction work, reducing manpower requirements and improving work efficiency.

[0128] In one possible implementation, the amount of service quota deduction in step 103 includes:

[0129] The amount of the service quota is deducted according to the expenditure of the service application, and the deducted service quota is stored in the message queue, so that the service application can synchronize the consumed service quota through the message queue.

[0130] For example, to ensure data consistency and stability, in actual applications, we can set up a final database, and the server 23 obtains user consumption data and service quotas from the final database. The gateway 22 will deduct the user's service quota recorded in the cache based on the service application's overhead, reducing the original 5 times to 4 times, and then send the updated service quota of user A {User A: Service Application B Service Quota = 4 times} to the queue. The final database reads the service quota change information from the queue and updates the service quota in the database to {User A: Service Application B Service Quota = 4 times}.

[0131] In the embodiment of the present application, the gateway 22 sends the updated service quota information to the server 23 through the queue, thereby ensuring the consistency and stability of the data and avoiding the risk of data errors.

[0132] Based on the same inventive concept, this application also provides a microservice system, see Figure 4 , Figure 4 A schematic diagram of the structure of a microservice system provided in an embodiment of the present application includes:

[0133] Client 41, used to send user request information;

[0134] The gateway 42 is used to receive the request information sent by the client, perform authorization authentication using any of the above authorization authentication methods, and send the authenticated request information to the application program interface;

[0135] The server side 43 is used to receive request information through the application program interface and provide corresponding services to users.

[0136] Based on the same inventive concept, this application also provides a system for authentication of permissions, see Figure 5 , Figure 5 A schematic diagram of the structure of a permission authentication system provided in an embodiment of the present application includes:

[0137] The request information verification unit 51 is used to receive the request information sent by the user, verify whether the user is a registered consumer according to the request information, and verify whether the service application requested in the request information can provide the service;

[0138] The service application calling unit 52 is configured to retrieve the application program interface corresponding to the service application and the user's service quota from the cache according to the request information when the verification result shows that the user is a registered consumer and the requested service application can provide the service;

[0139] The request information sending unit 53 is configured to send the request information to the application program interface when the service quota of the user is retrieved and the amount of the service quota is greater than zero.

[0140] In one possible implementation, the request information verification unit 51 is configured to:

[0141] Calculate the time offset when the request information is sent to the application interface;

[0142] When the time deviation is greater than the preset time deviation, the request information is rejected and a corresponding error report is returned;

[0143] When the time deviation is less than or equal to the preset time deviation, the request information is received.

[0144] In one possible implementation, the request information verification unit 51 is configured to:

[0145] Extract the user's username, encryption algorithm, encryption value, and verification value from the request information;

[0146] Query the key agreed upon when the user registered based on the username;

[0147] Use the encryption algorithm to calculate the hash value corresponding to the key and the encrypted value, compare the verification value and the hash value, and when the verification value and the hash value are consistent, determine that the user is a registered consumer; otherwise, determine that the user is not a registered consumer.

[0148] In one possible implementation, the request information verification unit 51 is configured to:

[0149] Extract the service application requested by the user from the request information, and extract the service entity information corresponding to the service application from the cache or database;

[0150] When the service entity information of the service application is extracted from the cache or database, it is determined that the service application requested in the request information can provide the service; otherwise, it is determined that the service application requested in the request information cannot provide the service.

[0151] In one possible implementation, the service application calling unit 52 is configured to:

[0152] According to the service application requested by the user in the request information, query the application program interface tree in the cache to obtain the application program interface corresponding to the service application;

[0153] According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache.

[0154] In one possible implementation, the service application calling unit 52 is configured to:

[0155] Query the corresponding service name, request method, and request path in the cache based on the service application;

[0156] According to the service name, query the root node with the same root node name in the application interface tree, query the corresponding secondary node in the tree where the root node is located according to the request method, query the corresponding child node in the child node of the secondary node according to the request path, and use the child node of the application interface tree matched by the query as the application interface corresponding to the service application.

[0157] In a possible implementation manner, the request information sending unit 53 is configured to:

[0158] According to the user's username and the service application requested in the request information, query the cache to see whether the service quota corresponding to the service application and the username exists, and query whether the service quota is greater than zero;

[0159] When the service quota exists and is greater than zero, the service quota amount is deducted and the request information is sent to the application interface.

[0160] In a possible implementation manner, the request information sending unit 53 is configured to:

[0161] The amount of the service quota is deducted according to the expenditure of the service application, and the deducted service quota is stored in the message queue, so that the service application can synchronize the consumed service quota through the message queue.

[0162] Based on the same inventive concept, an embodiment of the present invention provides a device for authorization authentication, including:

[0163] At least one processor, the processor is used to implement the above-mentioned permission authentication steps provided in the embodiment of the present application when executing the computer program stored in the memory.

[0164] Optionally, the processor may specifically be a central processing unit, an application specific integrated circuit (English: Application Specific Integrated Circuit, abbreviated as: ASIC), or one or more integrated circuits for controlling program execution.

[0165] Optionally, the data integrity protection device further includes a memory connected to at least one processor, and the memory may include a read-only memory (ROM), a random access memory (RAM), and a disk memory. The memory is used to store data required by the processor during operation, that is, it stores instructions that can be executed by at least one processor. At least one processor executes the instructions stored in the memory to execute the above Figure 1 The method shown in FIG.

[0166] An embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer executes the steps of the above-mentioned method for authority authentication.

[0167] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0168] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0169] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0170] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0171] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for authorization authentication, applied to a gateway in a microservice platform, characterized in that: include: Receive a request message from a user, verify whether the user is a registered consumer based on the request message, and verify whether the service application requested in the request message can provide the service; When the verification result shows that the user is a registered consumer and the requested service application can provide the service, query the cache for the corresponding service name, request method, and request path according to the service application requested by the user in the request information; Searching the application program interface tree for a root node whose root node name is the same as the service name, searching the tree where the root node is located for a secondary node with the same request method, searching the child nodes of the secondary node for a corresponding child node according to the request path, and using the child node of the application program interface tree that matches the query as the application program interface corresponding to the service application; According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache; wherein the root node of the application program interface tree is the name of the application, the second-level node is the request method of the application, and the third-level and lower nodes are the request path of the application; When the service quota of the user is found and the amount of the service quota is greater than zero, the request information is sent to the application program interface.

2. The method according to claim 1, wherein Receive request information sent by users, including: Calculating a time offset when the request information is sent to the application program interface; When the time deviation is greater than the preset time deviation, reject the request information and return a corresponding error report; When the time deviation is less than or equal to the preset time deviation, the request information is received.

3. The method according to claim 1, wherein Verifying whether the user is a registered consumer according to the request information includes: Extracting the user's username, encryption algorithm, encryption value and verification value from the request information; Query the key agreed upon when the user registered according to the user name; An encryption algorithm is used to calculate a hash value corresponding to the key and the encrypted value, and the verification value and the hash value are compared. When the verification value and the hash value are consistent, the user is determined to be a registered consumer; otherwise, the user is determined not to be a registered consumer.

4. The method according to claim 1, wherein Verifying whether the service application requested in the request information can provide the service, including: Extracting the service application requested by the user from the request information, and extracting service entity information corresponding to the service application from the cache or database; When the service entity information of the service application is extracted from the cache or the database, it is determined that the service application requested in the request information can provide the service; otherwise, it is determined that the service application requested in the request information cannot provide the service.

5. The method according to claim 1, wherein When the service quota of the user is found and the amount of the service quota is greater than zero, the request information is sent to the application program interface, including: querying, from the cache, according to the user name of the user and the service application requested in the request information, whether a service quota corresponding to the service application and the user name exists, and querying whether the service quota is greater than zero; When the service quota exists and is greater than zero, the amount of the service quota is deducted and the request information is sent to the application program interface.

6. The method according to claim 5, wherein The amount of deduction from the service quota includes: The amount of the service quota is deducted according to the expense of the service application, and the deducted service quota is stored in a message queue, so that the service application synchronizes the deducted service quota through the message queue.

7. A microservice system, characterized in that: include; Client, used to send user request information; A gateway, configured to receive the request information sent by the client, perform permission authentication using the method according to any one of claims 1 to 6, and send the authenticated request information to the application program interface; The server side is used to receive request information through the application program interface and provide corresponding services to the user.

8. A system for authority authentication, characterized in that: include: A request information verification unit, configured to receive a request message sent by a user, verify whether the user is a registered consumer based on the request message, and verify whether the service application requested in the request message can provide the service; a service application calling unit configured to, when the verification result shows that the user is a registered consumer and the requested service application can provide the service, query the cache for the corresponding service name, request method, and request path according to the service application requested by the user in the request information; Searching the application program interface tree for a root node whose root node name is the same as the service name, searching the tree where the root node is located for a secondary node with the same request method, searching the child nodes of the secondary node for a corresponding child node according to the request path, and using the child node of the application program interface tree that matches the query as the application program interface corresponding to the service application; According to the user name in the request information, the service quota corresponding to the user name is searched in the service quota information in the cache; wherein the root node of the application program interface tree is the name of the application, the second-level node is the request method of the application, and the third-level and lower nodes are the request path of the application; The request information sending unit is used to send the request information to the application program interface when the service quota of the user is queried and the amount of the service quota is greater than zero.

9. A device for authority authentication, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor performs the method according to any one of claims 1 to 6 by executing the instructions stored in the memory.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images