Authentication model construction method and device, task processing method and device

Abstract

The embodiment of the present specification provides an authentication model construction method and device, a task processing method and device. The authentication model construction method comprises determining a distributed call link corresponding to a target service; analyzing the distributed call link to determine an authentication and authorization mode of a service node in the distributed call link and an association relationship between the service nodes; and constructing an authentication and authorization model of the distributed call link according to the authentication and authorization mode of the service node and the association relationship between the service nodes. The method analyzes the distributed call link corresponding to the target service, determines the authentication and authorization mode of each service node in the distributed call link, and according to the association relationship between each service node and other service nodes, an authentication and authorization model with a directed acyclic structure is made. Subsequently, the authentication and authorization model can be used to form a trusted level security authentication of the service link, and the security of the service is systematically improved.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to an authentication model construction method, an authentication model construction device, a task processing method, and a task processing device. Background Technology

[0002] In distributed systems where business operations continue to grow and microservices expand on a large scale, the granularity and completeness of access control vary among each business node. In this context, the overall business security becomes relatively more vulnerable. For example, a business node can arbitrarily modify its authentication or authorization methods, easily leading to data loss and significantly impacting overall business security. Summary of the Invention

[0003] In view of this, embodiments of this specification provide a method for constructing an authentication model. One or more embodiments of this specification also relate to an authentication model construction apparatus, a task processing method, a task processing device, a computing device, a computer-readable storage medium, and a computer program, to address the technical deficiencies existing in the prior art.

[0004] According to a first aspect of the embodiments of this specification, an authentication model construction method is provided, including:

[0005] Determine the distributed call chain corresponding to the target business;

[0006] The distributed call chain is analyzed to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes;

[0007] Based on the authentication and authorization methods of the business nodes and the relationships between the business nodes, an authentication and authorization model for the distributed call chain is constructed.

[0008] According to a second aspect of the embodiments of this specification, an authentication model construction apparatus is provided, comprising:

[0009] The link determination module is configured to determine the distributed call link corresponding to the target business.

[0010] The link analysis module is configured to analyze the distributed call link to determine the authentication and authorization methods of the business nodes in the distributed call link, as well as the association between the business nodes.

[0011] The model building module is configured to build the authentication and authorization model of the distributed call chain based on the authentication and authorization methods of the business nodes and the association between the business nodes.

[0012] According to a third aspect of the embodiments of this specification, a task processing method is provided, including:

[0013] Receive a task execution request based on a target business, and determine the root node to process the task execution request in the distributed call chain corresponding to the target business according to the task execution request, wherein the root node is any business node in the distributed call chain;

[0014] Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position;

[0015] The task execution request is processed according to the sub-authentication and authorization model.

[0016] The authentication and authorization model is the authentication and authorization model constructed by the above-mentioned authentication and authorization model construction method.

[0017] According to a fourth aspect of the embodiments of this specification, a task processing apparatus is provided, comprising:

[0018] The request receiving module is configured to receive a task execution request based on a target business, and, according to the task execution request, determine the root node for processing the task execution request in the distributed call chain corresponding to the target business, wherein the root node is any business node in the distributed call chain;

[0019] The location determination module is configured to determine the location of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the location;

[0020] The task processing module is configured to process the task execution request according to the sub-authentication and authorization model.

[0021] The authentication and authorization model is the authentication and authorization model constructed by the above-mentioned authentication and authorization model construction method.

[0022] According to a fifth aspect of the embodiments of this specification, a computing device is provided, comprising:

[0023] Memory and processor;

[0024] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the above-mentioned authentication model construction method or task processing method.

[0025] According to a sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores computer-executable instructions, which, when executed by a processor, implement the steps of the above-described authentication model construction method or task processing method.

[0026] According to a seventh aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described authentication model construction method or task processing method.

[0027] One embodiment of this specification implements an authentication model construction method, including determining the distributed call chain corresponding to the target business; analyzing the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain and the association relationships between the business nodes; and constructing the authentication and authorization model of the distributed call chain based on the authentication and authorization methods of the business nodes and the association relationships between the business nodes.

[0028] Specifically, this method analyzes the distributed call chain corresponding to the target business, clarifies the authentication and authorization method of each business node in the distributed call chain, and creates a directed acyclic authentication and authorization model based on the relationship between each business node and other business nodes. Subsequently, a trusted-level security authentication of the business chain can be formed through this authentication and authorization model, thus systematically improving the security of the business. Attached Figure Description

[0029] Figure 1 This is a schematic diagram illustrating a specific implementation scenario of an authentication model construction method provided in one embodiment of this specification;

[0030] Figure 2 This is a flowchart illustrating an authentication model construction method provided in one embodiment of this specification;

[0031] Figure 3 This is a structural diagram of an authentication and authorization model in an embodiment of the authentication model construction method provided in this specification;

[0032] Figure 4 This is a structural diagram of another authentication and authorization model in an authentication model construction method provided in one embodiment of this specification;

[0033] Figure 5 This is a flowchart of a task processing method provided in one embodiment of this specification;

[0034] Figure 6 This is a schematic diagram of the structure of an authentication model construction device provided in one embodiment of this specification;

[0035] Figure 7This is a schematic diagram of the structure of a task processing device provided in one embodiment of this specification;

[0036] Figure 8 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0037] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0038] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0039] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0040] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0041] Directed Acyclic Graph (DAG): If a directed graph cannot be returned to a vertex by following several edges, then the graph can be understood as a directed acyclic graph (DAG).

[0042] This specification provides a method for constructing an authentication model. One or more embodiments of this specification also relate to an authentication model construction apparatus, a task processing method, a task processing device, a computing device, a computer-readable storage medium, and a computer program, which will be described in detail in the following embodiments.

[0043] See Figure 1 , Figure 1The illustration shows a specific implementation scenario of an authentication model construction method provided according to an embodiment of this specification.

[0044] Figure 1 The system includes a cloud-side device 102 and an end-side device 104. The cloud-side device 102 can be understood as a cloud server. Of course, in another possible implementation, the cloud-side device 102 can also be replaced by a physical server. The end-side device 104 includes, but is not limited to, desktop computers, laptops, etc. For ease of understanding, in the embodiments of this specification, the cloud-side device 102 is a cloud server and the end-side device 104 is a laptop computer as an example for detailed description.

[0045] In practice, the authentication model can be built on the cloud-side device 102. The specific method for building the authentication model is as follows:

[0046] Determine the distributed call chain for executing a specific target business (such as payment or transfer). Then, based on log analysis of the target business or pre-deployment chain analysis, determine each business node in this distributed call chain (e.g., ...). Figure 1 The authentication and authorization methods of business nodes 1, 2, 3, 4, 5, and 6 are defined. The authentication and authorization methods of each node and the corresponding information / fields are assembled. Based on the calling relationship between each business node and other business nodes, a directed acyclic structure authentication model diagram is created, also known as the authentication model.

[0047] When the endpoint device 104 needs to use the authentication model to run the target service, it can call the authentication model generated by the cloud-side device 102. Alternatively, if the endpoint device 104 has sufficient computing resources and capabilities, the authentication model can also be generated and used in the cloud-side device 102. The specific implementation depends on the actual application and is not limited here.

[0048] The authentication model construction method provided in this specification analyzes the distributed call chain corresponding to the target business, clarifies the authentication and authorization method of each business node in the distributed call chain, and creates a directed acyclic authentication and authorization model based on the relationship between each business node and other business nodes. Subsequently, a trusted-level security authentication of the business chain can be formed through this authentication and authorization model, thereby systematically improving the security of the business.

[0049] See Figure 2 , Figure 2 A flowchart of an authentication model construction method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0050] Step 202: Determine the distributed call chain corresponding to the target business.

[0051] Specifically, the target business varies depending on the actual application scenario of the authentication model construction method. For example, if the authentication model construction method is applied to a financial scenario, the target business includes, but is not limited to, transfer, payment, and fund inquiry services. If the authentication model construction method is applied to a library scenario, the target business includes, but is not limited to, book borrowing and book returning services.

[0052] Therefore, different target business processes result in different distributed call chains. Continuing with the previous example, if the target business is a funds inquiry, this distributed call chain can be understood as consisting of at least two business nodes, enabling a distributed call chain for funds inquiries, such as... Figure 1 The link consisting of business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6 can be called a distributed call link. Different target businesses will have different corresponding distributed call links.

[0053] In practical applications, when determining the distributed call chain corresponding to a target business, the business node corresponding to the target business should be identified first, and then the corresponding distributed call chain should be quickly determined based on the business node. The specific implementation method is as follows:

[0054] The determination of the distributed call chain corresponding to the target service includes:

[0055] Identify at least two business nodes that execute the target business, and determine the distributed call chain corresponding to the target business based on the at least two business nodes.

[0056] Specifically, first, determine at least two business nodes corresponding to the subsequent execution of the target business, and then determine the distributed call chain corresponding to the target business based on the at least two business nodes.

[0057] Taking the target business as a fund inquiry business as an example, its corresponding at least two business nodes include, but are not limited to, login business node, user information inquiry business node, bank inquiry system call business node, and third-party credit data acquisition business node; then, the distributed call chain corresponding to the target business can be formed based on the login business node, user information inquiry business node, bank inquiry system call business node, and third-party credit data acquisition business node.

[0058] Step 204: Analyze the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes.

[0059] Specifically, after determining the distributed call chain corresponding to the target service, this distributed call chain can be analyzed. Based on the analysis results, the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between all business nodes, can be determined. There are two ways to analyze this distributed call chain: one is to analyze the business logs corresponding to the target service to achieve the analysis of the distributed call chain; the other is to analyze the distributed call chain of the target service in advance based on human experience before the entire target service goes live.

[0060] First, let's take the analysis of the distributed call chain corresponding to the target business by analyzing the business logs as an example. The specific implementation method is as follows:

[0061] The analysis of the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes, includes:

[0062] Identify the business logs corresponding to the target business;

[0063] The distributed call chain is analyzed based on the business logs to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes.

[0064] The business logs corresponding to the target business can be understood as business description logs, such as some call descriptions for executing the target business; or business operation logs for the target business, such as some operation records for running the target business.

[0065] Analyzing the distributed call chain based on the business logs, for example, based on the business logs corresponding to the target business, we can clearly determine the function of each business node in the distributed call chain when the target business is executed through the distributed call chain. Subsequently, based on the analysis results of the distributed call chain using the business logs, we can determine the authentication and authorization method of each business node in the distributed call chain and the relationship between each business node and other business nodes.

[0066] For example, if the business node is a login business node, the authentication and authorization method for this business node is based on the authorization certificate; if the business node is a user information query business node, the authentication and authorization method for this business node is based on attribute authorization.

[0067] Taking the above example, if the distributed call chain includes business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6, determine the business log corresponding to the target business, and analyze the distributed call chain based on the business log to determine the authentication and authorization methods of business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6 in the distributed call chain, as well as the association relationships between business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6; that is, which business node calls which business node when certain tasks are executed.

[0068] In the authentication model construction method provided in the embodiments of this specification, by performing a detailed analysis of the business logs corresponding to the target business, the authentication and authorization methods of business nodes in the distributed call chain, as well as the association between each business node and other business nodes in the distributed call chain, can be quickly determined based on the analysis results.

[0069] Secondly, taking the analysis of the business logs corresponding to the target business to analyze the distributed call chain of the target business as an example, a detailed introduction will be given. The specific implementation method is as follows:

[0070] The analysis of the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes, includes:

[0071] Before executing the target business according to the distributed call chain, the distributed call chain is analyzed to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationship between the business nodes.

[0072] Specifically, before executing the target business based on the distributed call chain, the distributed call chain can be analyzed through human experience to determine the authentication and authorization method of each business node in the distributed call chain, as well as the relationship between each business node and other business nodes in the distributed call chain; for example, based on human experience, determine what authentication and authorization method each business node in the distributed call chain will use subsequently, and which upstream and downstream nodes each business node in the distributed call chain is, etc.

[0073] In the authentication model construction method provided in the embodiments of this specification, before the distributed call chain executes the target business, the distributed call chain can be directly analyzed by human experience to accurately and quickly determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationship between each business node and other business nodes in the distributed call chain.

[0074] Step 206: Construct the authentication and authorization model of the distributed call chain based on the authentication and authorization methods of the business nodes and the association between the business nodes.

[0075] Specifically, after determining the authentication and authorization method for each business node in the distributed call chain, and the relationships between business nodes, the authentication and authorization model of the distributed call chain can be constructed based on these methods and relationships. The specific implementation is as follows:

[0076] The step of constructing the authentication and authorization model for the distributed call chain based on the authentication and authorization methods of the business nodes and the relationships between the business nodes includes:

[0077] Based on the authentication and authorization method of the business node, determine the authentication and authorization attribute information corresponding to the authentication and authorization method;

[0078] The authentication and authorization method of the business node and the authentication and authorization attribute information corresponding to the authentication and authorization method are encapsulated to obtain the authentication and authorization result of the business node.

[0079] Based on the relationships between the business nodes, the authentication and authorization results of the business nodes are connected to construct a directed acyclic graph, and the directed acyclic graph is determined as the authentication and authorization model of the distributed call chain.

[0080] The authentication and authorization attribute information corresponding to the authentication and authorization method can be understood as the specific authentication and authorization content corresponding to the authentication and authorization method, such as authentication and authorization credentials, authentication and authorization related information, fields, etc.

[0081] Specifically, firstly, based on the authentication and authorization method of each business node, the authentication and authorization attribute information corresponding to the authentication and authorization method of each business node is determined; then, the authentication and authorization method of each business node and the authentication and authorization attribute information corresponding to the authentication and authorization method of each business node are encapsulated to obtain the authentication and authorization result of each business node; finally, based on the association relationship between each business node and other business nodes, the authentication and authorization results of all business nodes are connected to construct a directed acyclic graph, and this directed acyclic graph is determined as the authentication and authorization model of the distributed call chain.

[0082] See Figure 3 , Figure 3 This document illustrates a structural diagram of an authentication model in an authentication model construction method provided by an embodiment of this specification.

[0083] Figure 3The distributed call chain in the system includes 6 business nodes: business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6.

[0084] The authentication and authorization method for business node 1 is: TYPE: RBAC (role-based access control); the corresponding authentication and authorization attribute information for business node 1 is: ID:Role1\Role2 (role 1, role 2); the authentication and authorization method for business node 2 is: TYPE: Access Token; the corresponding authentication and authorization attribute information for business node 2 is: API: Token1; the authentication and authorization method for business node 3 is: TYPE: RBAC (role-based access control); the corresponding authentication and authorization attribute information for business node 3 is: ID:Role3; the authentication and authorization method for business node 4 is: TYPE: Kerberos (authentication); the corresponding authentication and authorization attribute information for business node 4 is: TGT, where TGT stands for Ticket Granting. Ticket (In some computer security systems, a "Ticket Granting Ticket" or "Ticket Acquisition Ticket" is a small, encrypted identification file with a limited validity period. After authentication, this file is granted to the user by the key distribution center subsystem of an authentication service such as Kerberos to protect data traffic. The TGT file contains the session key, its expiration date, and the user's IP address to prevent the user from being attacked by a man-in-the-middle; that is, the TGT is used to obtain a service ticket from the "Ticket Granting Service"); The authentication and authorization method of business node 5 is: TYPE: Certificate; The authentication and authorization attribute information corresponding to the authentication and authorization method of business node 5 is: Public-Key; The authentication and authorization method of business node 6 is: TYPE: ABAC (ABAC is an access control model for solving trusted relationships in distributed industry applications. It uses the attributes of relevant entities (such as subjects, objects, and environments) as the basis for authorization to study how to perform access control); The authentication and authorization attribute information corresponding to the authentication and authorization method of business node 6 is: ID: Attr1\Attr3 (i.e., attribute 1 and attribute 3).

[0085] The authentication model construction method provided in this specification analyzes the distributed call chain corresponding to the target business, clarifies the authentication and authorization method of each business node in the distributed call chain, and creates a directed acyclic authentication and authorization model based on the relationship between each business node and other business nodes. Subsequently, a trusted-level security authentication of the business chain can be formed through this authentication and authorization model, thereby systematically improving the security of the business.

[0086] In actual business execution, any business node in the distributed call chain can be the execution entry point. Therefore, to facilitate authentication and authorization in subsequent business execution, a directed acyclic graph (DAG) corresponding to each business node can be pre-constructed, i.e., an authentication and authorization model can be built for each business node. This ensures that regardless of which business node acts as the execution entry point, authentication and authorization can be performed according to its corresponding model, improving the security of business execution. The specific implementation method is as follows:

[0087] The step of connecting the authentication and authorization results of the business nodes according to the association relationship between the business nodes to construct a directed acyclic graph includes:

[0088] A target business node is determined from the business nodes, wherein the target business node is any one of the business nodes;

[0089] The target business node is determined as the root node, and the downstream business nodes associated with the target business node are determined as child nodes;

[0090] Based on the association between the root node and the child nodes, the authentication and authorization results of the root node and the child nodes are connected to construct a directed acyclic graph of the target business node.

[0091] The target business node is any one of the business nodes in this distributed call chain.

[0092] Taking business node 2 as an example, the target business node is the business node.

[0093] Specifically, target business node 2 is determined from the distributed call chain, and this target business node 2 is designated as the root node. The downstream business nodes associated with target business node 2 are designated as child nodes, such as... Figure 3 As shown, with the target business node 2 as the root node, the downstream business nodes associated with it—business node 4, business node 5, and business node 6—can all be child nodes. Then, based on the association between the root node and its child nodes, the authentication and authorization structures of the root node and its child nodes are connected to construct a directed acyclic graph (DAG) for the target business node. Similarly, the construction method for the DAGs corresponding to other business nodes in this distributed call chain is the same as that for the target business node, and will not be elaborated further here.

[0094] See Figure 4 , Figure 4 This document illustrates another authentication and authorization model structure diagram in an authentication model construction method provided by an embodiment of this specification.

[0095] Figure 4The distributed call chain in the system includes 6 business nodes: business node 1, business node 2, business node 3, business node 4, business node 5, and business node 6.

[0096] The authentication and authorization method for business node 1 is: TYPE: RBAC (role-based access control); the corresponding authentication and authorization attribute information for business node 1 is: ID:Role1\Role2 (role 1, role 2); the authentication and authorization method for business node 2 is: TYPE: Access Token; the corresponding authentication and authorization attribute information for business node 2 is: API: Token1; the authentication and authorization method for business node 3 is: TYPE: RBAC (role-based access control); the corresponding authentication and authorization attribute information for business node 3 is: ID:Role3; the authentication and authorization method for business node 4 is: TYPE: Kerberos (authentication); the corresponding authentication and authorization attribute information for business node 4 is: TGT; the authentication and authorization method for business node 5 is... The authentication method for business node 5 is: TYPE:Certificate; the authentication attribute information corresponding to the authentication method of business node 5 is: Public-Key; the authentication method for business node 6 is: TYPE:ABAC (ABAC is a trusted access control model for distributed applications in the industry. It uses the attributes of relevant entities (such as subjects, objects, and environments) as the basis for authorization to study how to perform access control); the authentication attribute information corresponding to the authentication method of business node 6 is: ID:Attr1\Attr3 (i.e., attribute 1 and attribute 3).

[0097] and Figure 3 The difference is, Figure 4 For each business node in this distributed call chain, a corresponding directed acyclic graph has been constructed.

[0098] After constructing the authentication and authorization model corresponding to the target service, the target service can be executed securely based on this model. Subsequently, the security of the target service's execution can be determined by analyzing its runtime logs. The specific implementation method is as follows:

[0099] After constructing the authentication and authorization model for the distributed call chain, the following is also included:

[0100] Receive a task execution request based on the target business, and process the task execution request according to the authentication and authorization model of the distributed call chain.

[0101] Continuing with the previous example, if the target business is a funds inquiry service, then the task execution request for this target business can be understood as a funds inquiry request for a single user. Therefore, upon receiving the task execution request based on the target business, the authentication and authorization model of this distributed call chain can be used to process the task execution request while ensuring security.

[0102] In practical applications, when the target business has only one authentication and authorization model, if the entry point for processing the task execution request is a business node other than the initial business node in the distributed call chain, it is necessary to determine the corresponding business node based on the task execution request. Then, from the entire authentication and authorization model, the position of the corresponding business node within the authentication and authorization model is determined based on the task execution request. This determines the sub-authentication and authorization model corresponding to the business node. Subsequently, the sub-authentication and authorization model corresponding to the business node can be determined based on the task execution request to process the task execution request, thus ensuring the security of task execution request processing. The specific implementation method is as follows:

[0103] The step of processing the task execution request according to the authentication and authorization model of the distributed call chain includes:

[0104] Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain;

[0105] Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position;

[0106] The task execution request is processed according to the sub-authentication and authorization model.

[0107] Continuing with the previous example, if, based on the task execution request, the root node handling the request is determined to be business node 2 in the distributed call chain corresponding to the target business, then the position of business node 2 in the authentication and authorization model of the distributed call chain can be determined. Then, based on this position, the sub-authentication and authorization model corresponding to business node 2 can be determined, and subsequently, the task execution request can be processed according to the sub-authentication and authorization model corresponding to business node 2. The sub-authentication and authorization model corresponding to business node 2 can be referenced... Figure 4 The directed acyclic graph corresponding to business node 2 in the middle.

[0108] If each business node in the distributed call chain corresponding to the target business has its own corresponding authentication and authorization model, then the root node for handling the task execution request can be directly determined in the distributed call chain based on the task execution request. The task processing request can then be processed according to the authentication and authorization model corresponding to that root node, without needing to search in the overall authentication and authorization model corresponding to the starting business node of the distributed call chain. This greatly improves the processing efficiency of the task processing request and saves network resources.

[0109] Specifically, the entry point for handling this task execution request can be the starting business node in the distributed call chain (such as business node 1), or other intermediate business nodes in the distributed call chain (such as business node 2, business node 3, business node 4, business node 5, or business node 6). When each business node in the distributed call chain has its own authentication and authorization model, the overall authentication and authorization model corresponding to the root node can be directly invoked to handle the task execution request, ensuring the security of task execution request processing. The specific implementation method is as follows:

[0110] The step of processing the task execution request according to the authentication and authorization model of the distributed call chain includes:

[0111] Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain;

[0112] Determine the authentication and authorization model corresponding to the root node, and process the task execution request according to the authentication and authorization model corresponding to the root node.

[0113] Continuing with the previous example, such as Figure 4 The above, Figure 4 Each business node in each distributed call chain has its own authentication and authorization model.

[0114] When the root node is business node 2, the authentication and authorization model corresponding to business node 2 can be directly determined, and the task execution request can be processed according to the authentication and authorization model corresponding to the root node.

[0115] The authentication model construction method provided in this specification can, based on log analysis of the target business or link analysis before overall deployment, clarify the authentication method of each business node, assemble the authentication method of each business node and the corresponding information / fields to create an authentication model diagram with a directed acyclic structure (DAG). During actual business execution, each business node on the distributed call link retrieves its own position in the authentication model diagram and the sub-DAG based on its current execution position, and performs authentication according to the authentication method and field information corresponding to the current business node's position. The sub-DAG is then passed through to downstream business nodes, and the structure of the DAG cannot be modified during the transmission process. Through this predefined authentication model of the overall distributed call link, a trusted-level security authentication is formed for the distributed call link of the target business, systematically improving the security of the target business.

[0116] See Figure 5 , Figure 5 A flowchart of a task processing method according to an embodiment of this specification is shown, which specifically includes the following steps.

[0117] Step 502: Receive a task execution request based on the target business, and determine the root node for processing the task execution request in the distributed call chain corresponding to the target business according to the task execution request, wherein the root node is any business node in the distributed call chain;

[0118] Step 504: Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position;

[0119] Step 506: Process the task execution request according to the sub-authentication and authorization model.

[0120] The authentication and authorization model is the authentication and authorization model constructed by the above-mentioned authentication and authorization model construction method.

[0121] Specifically, the implementation of steps 502 to 506 can be found in the task processing method in the above embodiments, and will not be repeated here.

[0122] During actual business execution, the business nodes on this distributed call chain retrieve their own authentication model graph position based on the current execution position, determine their corresponding sub-directed acyclic graph, i.e., the sub-authentication and authentication model in the above embodiment, and perform authentication based on the authentication and authentication method and field information corresponding to the current business node's position; then, the sub-directed acyclic graph is passed through to the downstream business nodes, and the structure of the directed acyclic graph cannot be modified during the passing through process.

[0123] The task processing method provided in this specification uses the authentication and authorization model generated by the above-described authentication model construction method to process task execution requests. This allows business nodes on the distributed call chain to retrieve their current location in the authentication model graph and the sub-directed acyclic graph based on their current execution position. Authentication is then performed based on the authentication and authorization method and field information corresponding to the current business node's location. The sub-directed acyclic graph is then passed through to downstream business nodes, and the structure of the directed acyclic graph cannot be modified during this process. Through this predefined authentication and authorization model for the entire distributed call chain, a trusted-level security authentication is formed for the distributed call chain of the target business, systematically improving the security of the target business and the security of task execution request processing.

[0124] Corresponding to the above method embodiments, this specification also provides embodiments of an authentication model construction apparatus. Figure 6 A schematic diagram of an authentication model construction apparatus according to one embodiment of this specification is shown. Figure 6 As shown, the device includes:

[0125] Link determination module 602 is configured to determine the distributed call link corresponding to the target service;

[0126] Link analysis module 604 is configured to analyze the distributed call link to determine the authentication and authorization methods of business nodes in the distributed call link and the association between the business nodes;

[0127] The model building module 606 is configured to build the authentication and authorization model of the distributed call chain based on the authentication and authorization method of the business nodes and the association between the business nodes.

[0128] Optionally, the link determination module 602 is further configured to:

[0129] Identify at least two business nodes that execute the target business, and determine the distributed call chain corresponding to the target business based on the at least two business nodes.

[0130] Optionally, the link analysis module 604 is further configured to:

[0131] Identify the business logs corresponding to the target business;

[0132] The distributed call chain is analyzed based on the business logs to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes.

[0133] Optionally, the link analysis module 604 is further configured to:

[0134] Before executing the target business according to the distributed call chain, the distributed call chain is analyzed to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationship between the business nodes.

[0135] Optionally, the model building module 606 is further configured to:

[0136] Based on the authentication and authorization method of the business node, determine the authentication and authorization attribute information corresponding to the authentication and authorization method;

[0137] The authentication and authorization method of the business node and the authentication and authorization attribute information corresponding to the authentication and authorization method are encapsulated to obtain the authentication and authorization result of the business node.

[0138] Based on the relationships between the business nodes, the authentication and authorization results of the business nodes are connected to construct a directed acyclic graph, and the directed acyclic graph is determined as the authentication and authorization model of the distributed call chain.

[0139] Optionally, the model building module 606 is further configured to:

[0140] A target business node is determined from the business nodes, wherein the target business node is any one of the business nodes;

[0141] The target business node is determined as the root node, and the downstream business nodes associated with the target business node are determined as child nodes;

[0142] Based on the association between the root node and the child nodes, the authentication and authorization results of the root node and the child nodes are connected to construct a directed acyclic graph of the target business node.

[0143] Optionally, the device further includes:

[0144] The task processing module is configured to receive task execution requests based on the target business and process the task execution requests according to the authentication and authorization model of the distributed call chain.

[0145] Optionally, the task processing module is further configured to:

[0146] Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain;

[0147] Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position;

[0148] The task execution request is processed according to the sub-authentication and authorization model.

[0149] Optionally, the task processing module is further configured to:

[0150] Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain;

[0151] Determine the authentication and authorization model corresponding to the root node, and process the task execution request according to the authentication and authorization model corresponding to the root node.

[0152] The authentication model construction device provided in the embodiments of this specification analyzes the distributed call chain corresponding to the target business, clarifies the authentication and authorization method of each business node in the distributed call chain, and creates a directed acyclic authentication and authorization model based on the association between each business node and other business nodes. Subsequently, a trusted-level security authentication of the business chain can be formed through this authentication and authorization model, thereby systematically improving the security of the business.

[0153] The above is an illustrative scheme of an authentication model construction device according to this embodiment. It should be noted that the technical solution of this authentication model construction device and the technical solution of the authentication model construction method described above belong to the same concept. For details not described in detail in the technical solution of the authentication model construction device, please refer to the description of the technical solution of the authentication model construction method described above.

[0154] Corresponding to the above method embodiments, this specification also provides embodiments of a task processing device. Figure 7 A schematic diagram of a task processing apparatus according to one embodiment of this specification is shown. Figure 7 As shown, the device includes:

[0155] The request receiving module 702 is configured to receive a task execution request based on a target business, and determine the root node for processing the task execution request in the distributed call chain corresponding to the target business according to the task execution request, wherein the root node is any business node in the distributed call chain;

[0156] The location determination module 704 is configured to determine the location of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the location;

[0157] Task processing module 706 is configured to process the task execution request according to the sub-authentication and authorization model.

[0158] The authentication and authorization model is the authentication and authorization model constructed by the above-mentioned authentication and authorization model construction method.

[0159] The task processing device provided in this embodiment uses the authentication and authorization model generated by the above-described authentication model construction method to process task execution requests. This allows business nodes on the distributed call chain to retrieve their own authentication model graph position and sub-directed acyclic graph based on their current execution position, and perform authentication according to the authentication and authorization method and field information corresponding to the current business node's position. The sub-directed acyclic graph is then passed through to downstream business nodes, and the structure of the directed acyclic graph cannot be modified during the transmission process. Through this predefined authentication and authorization model for the entire distributed call chain, a trusted-level security authentication is formed for the distributed call chain of the target business, systematically improving the security of the target business and the security of task execution request processing.

[0160] The above is an illustrative scheme of a task processing device according to this embodiment. It should be noted that the technical solution of this task processing device and the technical solution of the task processing method described above belong to the same concept. For details not described in detail in the technical solution of the task processing device, please refer to the description of the technical solution of the task processing method described above.

[0161] Figure 8 A structural block diagram of a computing device 800 according to one embodiment of this specification is shown. The components of the computing device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0162] The computing device 800 also includes an access device 840, which enables the computing device 800 to communicate via one or more networks 860. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 840 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and so on.

[0163] In one embodiment of this specification, the above-described components of the computing device 800 and Figure 8 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 8 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0164] The computing device 800 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 800 can also be a mobile or stationary server.

[0165] The processor 820 is configured to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the aforementioned authentication model construction method or task processing method. The above is an illustrative scheme of a computing device according to this embodiment. It should be noted that the technical solution of this computing device and the technical solution of the aforementioned authentication model construction method or task processing method belong to the same concept. Details not described in detail in the technical solution of the computing device can be found in the description of the technical solution of the aforementioned authentication model construction method or task processing method.

[0166] An embodiment of this specification also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the above-described authentication model construction method or task processing method.

[0167] The above is an illustrative scheme of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium belongs to the same concept as the technical solution of the authentication model construction method or task processing method described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the authentication model construction method or task processing method described above.

[0168] An embodiment of this specification also provides a computer program, wherein when the computer program is executed in a computer, it causes the computer to perform the steps of the above-described authentication model construction method or task processing method.

[0169] The above is an illustrative scheme of a computer program according to this embodiment. It should be noted that the technical solution of this computer program belongs to the same concept as the technical solution of the authentication model construction method or task processing method described above. For details not described in detail in the technical solution of the computer program, please refer to the description of the technical solution of the authentication model construction method or task processing method described above.

[0170] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0171] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0172] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0173] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0174] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for constructing an authentication model, comprising: Determine the distributed call chain corresponding to the target business; The distributed call chain is analyzed to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes; Based on the authentication and authorization methods of the business nodes and the relationships between the business nodes, an authentication and authorization model for the distributed call chain is constructed, including: determining the authentication and authorization attribute information corresponding to the authentication and authorization methods of the business nodes; encapsulating the authentication and authorization methods of the business nodes and the authentication and authorization attribute information corresponding to the authentication and authorization methods to obtain the authentication and authorization results of the business nodes; connecting the authentication and authorization results of the business nodes according to the relationships between the business nodes to construct a directed acyclic graph, and determining the directed acyclic graph as the authentication and authorization model for the distributed call chain. The step of connecting the authentication and authorization results of the business nodes according to the association relationship between the business nodes to construct a directed acyclic graph includes: A target business node is determined from the business nodes, wherein the target business node is any one of the business nodes; the target business node is determined as the root node, and the downstream business nodes associated with the target business node are determined as child nodes; based on the association relationship between the root node and the child nodes, the authentication and authorization results of the root node and the child nodes are connected to construct a directed acyclic graph of the target business node.

2. The authentication model construction method according to claim 1, wherein determining the distributed call chain corresponding to the target service includes: Identify at least two business nodes that execute the target business, and determine the distributed call chain corresponding to the target business based on the at least two business nodes.

3. The authentication model construction method according to claim 1 or 2, wherein analyzing the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain and the association relationships between the business nodes includes: Identify the business logs corresponding to the target business; The distributed call chain is analyzed based on the business logs to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationships between the business nodes.

4. The authentication model construction method according to claim 1 or 2, wherein analyzing the distributed call chain to determine the authentication and authorization methods of the business nodes in the distributed call chain and the association relationships between the business nodes includes: Before executing the target business according to the distributed call chain, the distributed call chain is analyzed to determine the authentication and authorization methods of the business nodes in the distributed call chain, as well as the relationship between the business nodes.

5. The authentication model construction method according to claim 1, further comprising, after constructing the authentication and authorization model of the distributed call chain: Receive a task execution request based on the target business, and process the task execution request according to the authentication and authorization model of the distributed call chain.

6. The authentication model construction method according to claim 5, wherein processing the task execution request according to the authentication and authorization model of the distributed call chain includes: Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain; Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position; The task execution request is processed according to the sub-authentication and authorization model.

7. The authentication model construction method according to claim 5, wherein processing the task execution request according to the authentication and authorization model of the distributed call chain includes: Based on the task execution request, in the distributed call chain, a root node for processing the task execution request is determined, wherein the root node is any business node in the distributed call chain; Determine the authentication and authorization model corresponding to the root node, and process the task execution request according to the authentication and authorization model corresponding to the root node.

8. An authentication model construction apparatus, comprising: The link determination module is configured to determine the distributed call link corresponding to the target business. The link analysis module is configured to analyze the distributed call link to determine the authentication and authorization methods of the business nodes in the distributed call link, as well as the association between the business nodes. The model building module is configured to build the authentication and authorization model of the distributed call chain based on the authentication and authorization methods of the business nodes and the association between the business nodes; The model building module is further configured to: determine the authentication and authorization attribute information corresponding to the authentication and authorization method of the business node; encapsulate the authentication and authorization method of the business node and the authentication and authorization attribute information corresponding to the authentication and authorization method to obtain the authentication and authorization result of the business node; connect the authentication and authorization results of the business nodes according to the association relationship between the business nodes to construct a directed acyclic graph, and determine the directed acyclic graph as the authentication and authorization model of the distributed call link; The model building module is further configured to determine a target business node from the business nodes, wherein the target business node is any one of the business nodes; to determine the target business node as the root node, and to determine the downstream business nodes associated with the target business node as child nodes; Based on the association between the root node and the child nodes, the authentication and authorization results of the root node and the child nodes are connected to construct a directed acyclic graph of the target business node.

9. A task processing method, comprising: Receive a task execution request based on a target business, and determine the root node to process the task execution request in the distributed call chain corresponding to the target business according to the task execution request, wherein the root node is any business node in the distributed call chain; Determine the position of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the position; The task execution request is processed according to the sub-authentication and authorization model. The authentication and authorization model is the authentication and authorization model constructed by the authentication and authorization model construction method described in any one of claims 1-4.

10. A task processing apparatus, comprising: The request receiving module is configured to receive a task execution request based on a target business, and, according to the task execution request, determine the root node for processing the task execution request in the distributed call chain corresponding to the target business, wherein the root node is any business node in the distributed call chain; The location determination module is configured to determine the location of the root node in the authentication and authorization model of the distributed call chain, and determine the sub-authentication and authorization model corresponding to the root node based on the location; The task processing module is configured to process the task execution request according to the sub-authentication and authorization model. The authentication and authorization model is the authentication and authorization model constructed by the authentication and authorization model construction method described in any one of claims 1-4.

11. A computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the authentication model construction method according to any one of claims 1 to 7 or the task processing method according to claim 9.

12. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the authentication model construction method of any one of claims 1 to 7 or the task processing method of claim 9.

13. A computer program product comprising computer instructions that, when executed by a processor, implement the steps of the authentication model construction method of any one of claims 1 to 7 or the task processing method of claim 9.

Images