Dynamic permission management method and system based on permission bits in microservice architecture

Abstract

The present invention proposes a dynamic permission management method and system based on permission bits in a microservice architecture, which relates to the technical field of permission management. The specific scheme includes: treating collected service interfaces as resource points, registering the resource points, and assigning corresponding permission bits and permission values ​​to them; establishing a three-level permission management system of role-function point-resource point through binary OR operation based on the permission bits and permission values ​​of the resource points; authenticating the role to which the user belongs through binary AND operation when a user makes a request for a resource point; the present invention uses a bit algorithm based on base conversion, uses permission bits to compress permission information that needs to be read, greatly reduces the data content that needs to be deserialized, and accelerates the reading of permission information from non-memory; at the same time, uses computer-based AND operation to replace the search algorithm, reduces the execution time of the authentication operation itself, reduces the performance loss caused by complex authentication, and improves the efficiency and security of permission management in the microservice architecture.

Description

Technical Field

[0001] The present invention belongs to the technical field of rights management, and in particular to a method and system for dynamic rights management based on rights bits in a microservice architecture. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In computer systems, a common solution for user rights management is the RBAC (Role Based Access Control) model. Figure 1 As shown in the figure, RBAC introduces the concept of "role", binds permissions to roles, grants permissions to roles, and then binds users to roles so that they can indirectly obtain permissions.

[0004] In a microservices architecture, there are three main problems in authenticating user permissions compared to traditional monolithic applications:

[0005] (1) Collection of interface permissions

[0006] The interfaces that require permission interception are distributed to different services, and these services may be distributed on different servers. It is inconvenient to collect and organize these interfaces.

[0007] (2) Issues with the location of permission verification

[0008] Under the microservice architecture, permissions can be verified in two places depending on the access pressure and the implementation method: unified verification by the API gateway and verification by the microservice itself for specific access. Currently, the implementation on the market can only choose one of the two verification methods, and there is no free switching capability.

[0009] (3)Performance issues with permission verification

[0010] like Figure 2 As shown in the figure, whether authentication is performed at the API gateway layer or the microservice layer, the mainstream solutions currently on the market, such as OAuth2.0, require remote access to the permission center for each verification, which brings two problems:

[0011] 1) Each access involves at least three steps: establishing the underlying communication connection, serialization, and deserialization. This increases the response time and reduces the actual system's TPS.

[0012] 2) Since each user request requires authentication, each request requires accessing the authorization authentication center, which can easily lead to single points of failure and performance bottlenecks.

[0013] To address the above issues, there is an urgent need for an efficient and secure permission management solution under the microservice architecture. Summary of the Invention

[0014] In order to overcome the deficiencies of the above-mentioned prior art, the present invention provides a dynamic permission management method and system based on permission bits under a microservice architecture. Based on a bit algorithm of base conversion, permission bits are used to compress the permission information that needs to be read, greatly reducing the data content that needs to be deserialized, and accelerating the reading of permission information from non-memory; at the same time, computer-based AND operations are used to replace the search algorithm, reducing the execution time of the authentication operation itself, reducing the performance loss caused by complex authentication, and improving the efficiency and security of permission management under the microservice architecture.

[0015] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0016] The first aspect of the present invention provides a dynamic permission management method based on permission bits in a microservice architecture;

[0017] The dynamic permission management method based on permission bits in the microservice architecture includes:

[0018] Treat the collected service interfaces as resource points, register the resource points, and assign corresponding permission bits and permission values ​​to them;

[0019] Based on the permission bits and permission values ​​of resource points, a three-level permission management system of role-function point-resource point is established through binary OR operation;

[0020] When a user makes a request for a resource point, the user's role is authenticated through a binary AND operation.

[0021] Furthermore, the allocation of the corresponding permission bit is to select one bit from a 64-bit binary number as the permission bit of the resource point;

[0022] The permission value is the value of the permission bit, which can be a binary number or a decimal number corresponding to the binary number.

[0023] Furthermore, space bits are introduced to expand the permission bits, and a two-dimensional array [idx, pos] is used to represent a globally unique resource point, where idx is the space bit and pos is the permission bit in the space.

[0024] Furthermore, the collected service interface is used as a resource point and the resource point is registered, specifically:

[0025] (1) When a microservice starts, it automatically discovers the local external service interfaces and collects them into a memory collection;

[0026] (2) After the collection is completed, a resource point registration request is sent to the authority authentication center;

[0027] (3) After receiving the resource point registration request, the authority authentication center registers the unregistered resource point and returns the unique number of the resource point and the corresponding authority;

[0028] (4) The microservice receives the data returned by the authentication center and saves it locally for local authentication;

[0029] Furthermore, the unregistered resource points are registered by inserting the resource points in the increasing order of [idx, pos], specifically:

[0030] (1) If the pos value of the latest record is less than or equal to the maximum value of a 64-bit binary number, the idx value is the idx value of the latest record, and the pos value is the pos value of the latest record plus 1;

[0031] (2) If the pos value of the latest record exceeds the maximum value of a 64-bit binary number, the pos value is set to 1, and the idx value is the idx value of the latest record plus 1.

[0032] Furthermore, the three-level authority management system of role-function point-resource point is established through binary OR operation, specifically:

[0033] A function point is associated with multiple resource points. The permission values ​​of the associated resource points are binary-ORed to obtain the permission value of the function point.

[0034] A role is associated with multiple function points. The permission values ​​of the associated function points are binary ORed to obtain the permission value of the role.

[0035] Save the permission values ​​of resource points, function points and roles locally.

[0036] Furthermore, the authentication of the user's role is specifically as follows:

[0037] Get the permission value of the role to which the user belongs, and get the permission value of the resource point to be requested;

[0038] Perform a binary AND operation on the role's permission value and the resource point's permission value;

[0039] Determine whether you have the permission for the resource point based on whether the operation result is equal to the permission value of the resource point.

[0040] Furthermore, the authentication is divided into gateway layer authentication and service layer local authentication, and the layer at which authentication is performed is determined by runtime configuration.

[0041] Furthermore, it also includes permission refresh after permission information changes, specifically:

[0042] The authority authentication center synchronizes the latest resource points, function points, and role information to the cache, and uses the unified configuration center in the microservice framework to send permission change notifications to each service (including the gateway);

[0043] If it is a read cache service, no update is required;

[0044] If it is a memory-reading service, it is necessary to obtain the latest resource points, function points, and role information from the authority authentication center.

[0045] The second aspect of the present invention provides a dynamic permission management system based on permission bits in a microservice architecture.

[0046] The dynamic permission management system based on permission bits in the microservice architecture includes a resource registration module, a system establishment module, and a user authentication module:

[0047] The resource registration module is configured to: register the collected service interfaces as resource points and assign corresponding permission bits and permission values ​​to them;

[0048] The system establishment module is configured to: establish a three-level permission management system of role-function point-resource point based on the permission bits and permission values ​​of resource points through binary OR operation;

[0049] The user authentication module is configured to authenticate the role to which the user belongs through a binary AND operation when the user makes a request for a resource point.

[0050] One or more of the above technical solutions have the following beneficial effects:

[0051] The present invention is based on a bit algorithm of base conversion and uses permission bits to compress the permission information that needs to be read, greatly reducing the data content that needs to be deserialized and accelerating the reading of permission information from non-memory. At the same time, it uses computer-based AND operations to replace the search algorithm, shortening the execution time of the authentication operation itself, reducing the performance loss caused by complex authentication, and improving the efficiency and security of permission management under the microservice architecture.

[0052] The present invention can automatically collect interfaces of different services in real time and perform automatic registration of resource points; it can freely configure or switch gateway layer authentication or service layer authentication as needed, further improving the efficiency of rights management under the microservice architecture.

[0053] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0055] Figure 1 This is a diagram of the existing RBAC permission model.

[0056] Figure 2 This is a diagram of the mainstream authentication solutions on the market.

[0057] Figure 3 This is the RBAC permission model diagram of the present invention.

[0058] Figure 4 Schematic diagram of the permission bits of the present invention.

[0059] Figure 5 Schematic diagram of the permission bits or operations of the present invention.

[0060] Figure 6 This is a flow chart of the method of the first embodiment.

[0061] Figure 7 This is a diagram of the authority management system in the first embodiment.

[0062] Figure 8 This is the authentication flow chart of the first embodiment.

[0063] Figure 9 This is a test result chart of 5 concurrent authentication cycles of 2000 times in the first embodiment.

[0064] Figure 10 This is the test result of the first embodiment with 20 concurrent authentications and 500 authentication cycles.

[0065] Figure 11 This is the test result chart of the first embodiment with 50 concurrent authentications and 500 authentication cycles.

[0066] Figure 12 This is a system structure diagram of the second embodiment. DETAILED DESCRIPTION

[0067] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0068] The present invention proposes a rights management solution based on a bit algorithm of base conversion. The bit algorithm of base conversion is first described in detail.

[0069] The present invention still follows the basic RBAC authority model, and the user's authority is indirectly bound through the role; Figure 3The access attributes of resources such as menus, pages, APIs, and products in the system are represented by defining unique corresponding resource points. The implementation of a certain business function is actually the access to a group of resource points, which are represented by function points. Therefore, the role's access to resources depends on whether the role possesses a certain function point, thereby realizing the "user-role-function-resource" authorization model.

[0070] Assign a permission bit to each resource point

[0071] In traditional RBAC, a relationship table is usually defined to store the correspondence between roles and permission sets, thereby associating permissions with roles. However, as the business continues to develop, countless functional points will accumulate, making the data in the relationship table extremely difficult to maintain and use. Therefore, in the design of this invention, a bit algorithm of base conversion is used to replace and solve this problem, while improving storage efficiency and permission determination efficiency.

[0072] In Java, the Long type is a 64-bit signed integer represented in two's complement, which is 64 0s or 1s, such as Figure 4 As shown, each bit can be defined as a permission bit, and up to 64 permission bits can be identified.

[0073] Assume that resource point a has read permission for file c. Bit 0 is used to represent it, i.e. 0x000000000000000000000000000000000000000000000000000000000000000000000001, abbreviated as 0x1, which corresponds to 2 in decimal. 0 =1, which can be expressed as:

[0074] Resource point a represents the read permission for file c, its permission bit is bit 0, and the permission value is 1. Assume that resource point b represents the write permission for file c, represented by bit 1, that is: 0x000000000000000000000000000000000000000000000000000000000000000000000000010, abbreviated as 0x10, which corresponds to 2 in decimal. 1 =2, which can be expressed as:

[0075] Resource point b represents the write permission for file c, its permission bit is bit 1 and the permission value is 2.

[0076] Use binary to determine permissions

[0077] Using the characteristics of binary, permission judgment can be defined as follows: if the permission is granted, the value of the corresponding bit is 1; if the permission is not granted, the value is 0. Therefore, if a function point requires both read and write capabilities for file c, it means that the corresponding permission bit (bit 0) for read permission and the corresponding permission bit (bit 1) for write permission are both 1, that is:

[0078] 0x0000000000000000000000000000000000000000000000000000000000000000000011 is equivalent to performing an “or” operation on the permission value of resource point a and the permission value of resource point b. Figure 5 As shown, the permission value of the function point is 3, that is, the permission value of a function point is the result of the "or" operation of the permission values ​​of the resource points it contains.

[0079] A role may have multiple function points, and the permission value of the role can be obtained by performing an "OR" operation on the permission values ​​of these function points.

[0080] When it is necessary to determine whether a role has a certain permission (i.e., the ability to access a certain resource point), the permission value of the role is ANDed with the permission value of the resource point. If the result is still the permission value of the resource point, it means that the role has the permission; otherwise, it means that the role does not have the permission.

[0081] For example, a role's permission value is 5, which corresponds to 0x101 in binary. The permission value of resource point a (read permission for file c) is 1, which corresponds to 0x1 in binary. The permission value of resource point b (write permission for file c) is 2, which corresponds to 0x10 in binary. Then:

[0082] Operation 5 & 1 = 1, indicating that the file c has read permission;

[0083] Operation 5&2=0, indicating that there is no write permission for file c.

[0084] Due to the binary nature, a permission value can represent both the permission of a basic resource point and a set of permission values ​​for a group of permissions. When used as a set, it is called a "permission set." By performing an AND operation on the permission value of a resource point and determining whether the result is still equal to the permission value of the resource point, it can be used to determine whether the user has permission for the resource point.

[0085] Expanding permission bits

[0086] If all 64 bits of a 64-bit binary number are allocated, it can only represent 6 resource points at most. Obviously, 64 resource points are too few for a system. Therefore, the spatial bit i dx is introduced, and a two-dimensional array [i dx, pos] is used to represent a globally unique resource point.

[0087] Among them, i dx represents the number of space bits, and pos represents the permission bits in the space. In Java, i dx and pos are both defined as Long type, that is, 64-bit binary numbers. Whenever the permission bits in a space are full, that is, they are all allocated and no more resource points can be placed, i dx will automatically increase and a new Long type space will be applied for. In this way, the system can have a maximum of (2 64 -1) x 64 resource points. Similarly, this array can store and represent permission sets.

[0088] When performing permission judgment, the permission bits with the same idx in the permission value of the role and the permission value of the resource point are taken out and calculated bitwise. If the result is not 0, it means that the permission of the resource point is obtained. For example:

[0089] The permission set corresponding to the role's permission value is: {[0,-1],[1,1]}, which means that it has the permission to the resource points corresponding to idx=0,pos∈[0,1,2,..,63] and idx=1,pos=0. If the permission value of a resource point is defined as {[1,1]}, the permission of idx=1 is taken, 1&1=1, indicating that it has the permission to the resource point.

[0090] Example 1

[0091] This embodiment discloses a dynamic permission management method based on permission bits in a microservice architecture;

[0092] like Figure 6 As shown in the figure, the dynamic permission management method based on permission bits in the microservice architecture includes:

[0093] Step S1: Register the collected service interfaces as resource points and assign corresponding permission bits and permission values ​​to them. Specifically:

[0094] Step S101: When the microservice is started, it automatically discovers the local external service interfaces and collects them into a memory collection.

[0095] For example, when using SpringMVC in Java, annotations such as @RequestMapping are used to identify the service interface. You can define a task to be executed at startup to automatically collect the interface with the annotation from the currently running code.

[0096] Step S102: After the collection is completed, a resource point registration request is sent to the authority authentication center (a microservice specifically used to manage users and permissions);

[0097] Step S103: After receiving the resource point registration request, the authority authentication center registers the unregistered resource points and finally returns all registered resource points to the microservice, including the resource point number and the corresponding authority;

[0098] (1) Identify unregistered resource points

[0099] The database stores the registered resource point information and uses technical means such as unique index to ensure the uniqueness of identifying resource points (for example, using service group + HTTP method + URL as a unique number to identify the uniqueness of resource points); if the resource point exists in the database, all registered resource point information is returned; if it does not exist, the resource point is registered first, and then all registered resource point information is returned.

[0100] (2) Resource point registration

[0101] Insert resource points in ascending order of [idx,pos], specifically:

[0102] If the pos value of the latest record is less than or equal to the maximum value of a 64-bit binary number, the idx value is the idx value of the latest record, and the pos value is the pos value of the latest record plus 1;

[0103] If the pos value of the latest record exceeds the maximum value of a 64-bit binary number, the pos value is set to 1, and the idx value is the idx value of the latest record plus 1.

[0104] If you use MySQL to store permission bits, please note that the maximum value of unsigned bigint in MySQL 7 is only 263 -1, that is, 9223372036854775807, so the actual available permission bits are only 63 bits.

[0105] It is necessary to use technologies such as distributed caching and database row locks to ensure that idx and pos can still be correctly incremented under concurrency.

[0106] Step S104: The microservice receives the result of the registration from the authority center and saves it in memory for local authentication;

[0107] Step S2: Based on the permission bits and permission values ​​of resource points, a three-level permission management system of role-function point-resource point is established through binary OR operation;

[0108] With the permission bits and permission values ​​of resource points, a group of resource points, namely the permission values ​​of function points, can be calculated. Function points and resource points have a one-to-many relationship. With the permission values ​​of function points, a group of function points, namely the permission set of roles, can be calculated. Roles and function points also have a one-to-many relationship, such as Figure 7shown.

[0109] A function point is associated with multiple resource points. The permission values ​​of the associated resource points are binary-ORed to obtain the permission value of the function point.

[0110] A role is associated with multiple function points. The permission values ​​of the associated function points are binary ORed to obtain the permission value of the role.

[0111] After generating the permission values ​​of the function points and roles, the permission authentication center saves all the information of both into the distributed cache for subsequent authentication.

[0112] Step S3: When a user makes a request for a resource point, the user's role is authenticated through a binary AND operation. Regardless of which layer the authentication is performed, the logic is basically the same, such as Figure 8 As shown, specifically:

[0113] (1) Get the permission value of the requested resource point from the cache. If the corresponding resource point does not exist, it will be allowed or rejected according to the default value and returned;

[0114] (2) Query the permission value of the role to which the current user belongs from the cache;

[0115] (3) Perform a binary bitwise AND operation on the permission value of the resource point and the permission value of the role; determine whether the person has the permission to the resource point based on whether the operation result is equal to the permission value of the resource point, that is, if they are equal, access is granted; if they are not equal, access is denied.

[0116] Based on the location where authentication is performed, it is divided into gateway layer authentication and service layer local authentication. The only difference is the method of saving and obtaining permission information. There are three methods to save and read permission set information:

[0117] Save to the memory of the currently running gateway layer or service layer;

[0118] Save to cache (such as Redis middleware);

[0119] Save to the unified configuration center provided by the microservice framework.

[0120] You can use any one of the three methods or use a combination of them. In actual use, the authentication method is made into a public SDK, which is referenced at both the gateway layer and the service layer. The runtime configuration determines which layer to perform authentication on.

[0121] It also includes permission refresh after permission information changes. When the system is running, permission information needs to be refreshed in several situations:

[0122] A new interface is online, that is, a new resource point is registered;

[0123] Manually adjust the role's permissions;

[0124] At this time, the authorization authentication center synchronizes the latest resource point and role information to the cache, and uses the unified configuration center in the microservice framework to send permission change notifications to each service (including the gateway). If it is a service that reads the cache, no update is required. If it is a service that reads the memory, it is necessary to obtain the latest resource point and role information from the authorization authentication center.

[0125] On a 4-core 8G server, three performance tests were performed using JMeter:

[0126] (1) 5 concurrent, 2000 authentication cycles, the test results are as follows Figure 9 As shown in the figure, compared with the 321.6 QPS of traditional authentication, the performance of permission bit authentication is improved to 2233.6 QPS, a 7-fold performance increase.

[0127] (2) 20 concurrent, 500 authentication cycles, test results are as follows Figure 10 As shown in the figure, compared with the 757.7 QPS of traditional authentication, the performance of permission bit authentication is improved to 3770.7 QPS, a 5-fold performance increase.

[0128] (3) 50 concurrent authentications, 500 authentication cycles, test results are as follows Figure 11 As shown in the figure, compared with the 1056.4 QPS of traditional authentication, the performance of permission bit authentication is improved to 4701 QPS, a performance increase of 4 times.

[0129] Therefore, it can be seen that the present invention significantly improves the performance of authentication.

[0130] Example 2

[0131] This embodiment discloses a dynamic permission management system based on permission bits in a microservice architecture;

[0132] like Figure 12 As shown in the figure, the dynamic permission management system based on permission bits in the microservice architecture includes a resource registration module, a system establishment module, and a user authentication module:

[0133] The resource registration module is configured to: register the collected service interfaces as resource points and assign corresponding permission bits and permission values ​​to them;

[0134] The system establishment module is configured to: establish a three-level permission management system of role-function point-resource point based on the permission bits and permission values ​​of resource points through binary OR operation;

[0135] The user authentication module is configured to authenticate the role to which the user belongs through a binary AND operation when the user makes a request for a resource point.

[0136] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A dynamic permission management method based on permission bits in a microservice architecture, characterized by: include: Treat the collected service interfaces as resource points, register the resource points, and assign corresponding permission bits and permission values ​​to them; Based on the permission bits and permission values ​​of resource points, a three-level permission management system of role-function point-resource point is established through binary OR operation; When a user makes a request for a resource point, the user's role is authenticated through a binary AND operation; The authentication is divided into gateway layer authentication and service layer local authentication, and the layer at which authentication is performed is determined by runtime configuration; The dynamic permission management method based on permission bits in the microservice architecture also includes refreshing permissions after permission information changes, specifically: The permission authentication center synchronizes the latest resource points, function points, and role information to the cache, and uses the unified configuration center in the microservice framework to send permission change notifications to each service; If it is a read cache service, no update is required; If it is a memory-reading service, it is necessary to obtain the latest resource points, function points, and role information from the authority authentication center.

2. The dynamic permission management method based on permission bits in a microservice architecture according to claim 1 is characterized in that: The allocation of the corresponding permission bit is to select one bit from a 64-bit binary number as the permission bit of the resource point; The permission value is the value of the permission bit, which is a decimal number corresponding to a binary number.

3. The dynamic permission management method based on permission bits in a microservice architecture according to claim 1 is characterized in that: The space bit is introduced to expand the permission bit, and a two-dimensional array [idx, pos] is used to represent a globally unique resource point, where idx is the space bit and pos is the permission bit in the space.

4. The dynamic permission management method based on permission bits in a microservice architecture according to claim 3 is characterized in that: The collected service interfaces are used as a resource point and registered as follows: (1) When a microservice starts, it automatically discovers the local external service interfaces and collects them into a memory collection; (2) After the collection is completed, a resource point registration request is sent to the authority authentication center; (3) After receiving the resource point registration request, the authority authentication center registers the unregistered resource point and returns the unique number of the resource point and the corresponding authority value; (4) The microservice receives the data returned by the authentication center and saves it locally for local authentication.

5. The dynamic permission management method based on permission bits in a microservice architecture according to claim 4 is characterized in that: The registration of unregistered resource points is to insert the resource points in the increasing order of [idx, pos], specifically: (1) If the pos value of the latest record is less than or equal to the maximum value of a 64-bit binary number, the idx value is the idx value of the latest record, and the pos value is the pos value of the latest record plus 1; (2) If the pos value of the latest record exceeds the maximum value of a 64-bit binary number, the pos value is set to 1, and the idx value is the idx value of the latest record plus 1.

6. The dynamic permission management method based on permission bits in a microservice architecture according to claim 1, characterized in that: The three-level permission management system of role-function point-resource point is established through binary OR operation, specifically: A function point is associated with multiple resource points. The permission values ​​of the associated resource points are binary-ORed to obtain the permission value of the function point. A role is associated with multiple function points. The permission values ​​of the associated function points are binary ORed to obtain the permission value of the role. Save the permission values ​​of resource points, function points and roles locally.

7. The dynamic permission management method based on permission bits in a microservice architecture according to claim 1, characterized in that: The authentication of the user's role is specifically as follows: Get the permission value of the role to which the user belongs, and get the permission value of the resource point to be requested; Perform a binary AND operation on the role's permission value and the resource point's permission value; Determine whether you have the permission for the resource point based on whether the operation result is equal to the permission value of the resource point.

8. A dynamic permission management system based on permission bits in a microservice architecture using the dynamic permission management method based on permission bits in a microservice architecture according to claim 1, characterized in that: Including resource registration module, system establishment module and user authentication module: The resource registration module is configured to: register the collected service interfaces as resource points and assign corresponding permission bits and permission values ​​to them; The system establishment module is configured to: establish a three-level permission management system of role-function point-resource point based on the permission bits and permission values ​​of resource points through binary OR operation; The user authentication module is configured to authenticate the role to which the user belongs through a binary AND operation when the user makes a request for a resource point.

Images