Authentication method, gateway zuul and computer readable storage medium

Abstract

The application provides an authentication method, a gateway zuul and a computer readable storage medium, relates to the field of communication, and can reduce the configuration steps and improve the authentication efficiency. The method comprises the following steps: subscribing and acquiring an interface identifier set of a cache redis and a mapping relationship set of the redis; the interface identifier set comprises interface identifiers of at least one microservice; the mapping relationship set comprises at least one mapping relationship; one mapping relationship comprises a corresponding relationship between one interface identifier and at least one user information; the user information comprises a user identifier; a user request message is acquired; the user request message comprises a target interface identifier and a target user identifier; and the user request is authenticated based on the interface identifier set and the mapping relationship set, so that an authentication result is obtained.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, and in particular to an authentication method, a gateway zuul and a computer readable storage medium. BACKGROUND

[0002] In order to protect the security of a micro-service system, it is usually necessary to authenticate an access request.

[0003] An existing authentication scheme for an access request in a micro-service is usually based on a Spring Security security framework or a Shiro security framework. This scheme needs to go through a plurality of steps of configuring the Spring Security security framework or the Shiro security framework to perform authentication. Since the configuration steps are relatively cumbersome, the efficiency of authentication is reduced. SUMMARY

[0004] The present application provides an authentication method, a gateway zuul and a computer readable storage medium, which can reduce the steps of configuration and improve the efficiency of authentication.

[0005] To achieve the above object, the present application adopts the following technical solutions:

[0006] In a first aspect, an authentication method is provided, which is applied to a zuul. The method comprises the following steps: subscribing to and obtaining an interface identifier set of a cache redis and a mapping relationship set of the redis; the interface identifier set comprises an interface identifier of at least one micro-service, and the mapping relationship set comprises at least one mapping relationship, one mapping relationship comprising a corresponding relationship between one interface identifier and at least one user information, the user information comprising a user identifier; obtaining a user request message; the user request message comprising a target interface identifier and a target user identifier; and authenticating the user request based on the interface identifier set and the mapping relationship set to obtain an authentication result.

[0007] Based on the above scheme, the interface identifier set of the redis and the first mapping relationship set are subscribed to and obtained to authenticate the user request. Compared with the existing scheme which needs a plurality of configuration steps, on the one hand, the present application authenticates the user request based on the obtained interface identifier set of the redis and the first mapping relationship set by subscribing to the interface identifier set of the redis and the first mapping relationship set, and the configuration steps are fewer, and on the other hand, since the zuul subscribes to the interface identifier set of the redis and the first mapping relationship set, when the interface identifier set and the mapping relationship set in the redis are updated subsequently, the redis will broadcast the updated interface identifier set and the first mapping relationship set to the zuul, and the zuul does not need to send an update request message to the redis. In summary, the present application can improve the efficiency of authentication.

[0008] In some embodiments of the first aspect, the method further comprises: determining that the interface identifier set comprises the target interface identifier; and determining that the authentication result is passed in a case where the mapping relationship set comprises a corresponding relationship between the target interface identifier and the target user identifier.

[0009] Based on the scheme, the user request can be authenticated based on the interface identifier set and the mapping relationship to obtain the authentication result.

[0010] In some embodiments of the first aspect, in a case where the authentication result is passed, the method further comprises: sending a first message to a target microservice corresponding to the target interface identifier; and the first message is used to invoke the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

[0011] Based on the scheme, by sending the first message used to invoke the target microservice to the target microservice corresponding to the target interface identifier, the target microservice can process the user request.

[0012] In some embodiments of the first aspect, the method further comprises: determining that the authentication result is not passed in a case where the interface identifier set does not comprise the target interface identifier.

[0013] Based on the scheme, the user request can be authenticated based on the interface identifier set and the mapping relationship to obtain the authentication result.

[0014] In some embodiments of the first aspect, the method further comprises: determining that the interface identifier set comprises the target interface identifier; and determining that the authentication result is not passed in a case where the mapping relationship set does not comprise a corresponding relationship between the target interface identifier and the target user identifier.

[0015] Based on the scheme, the user request can be authenticated based on the interface identifier set and the mapping relationship to obtain the authentication result.

[0016] The second aspect provides a zuul for implementing the authentication method of the first aspect. The zuul comprises modules, units, or means corresponding to the above-mentioned method, which can be implemented by hardware, software, or by hardware executing corresponding software. The hardware or software comprises one or more modules or units corresponding to the above-mentioned functions.

[0017] In some embodiments of the second aspect, the zuul comprises: a transceiver and a processing module; the transceiver is configured to subscribe to and acquire a set of interface identifiers of the cache redis and a set of mapping relationships of the redis; the set of interface identifiers comprises at least one interface identifier of a microservice, and the set of mapping relationships comprises at least one mapping relationship, and each mapping relationship comprises a corresponding relationship between an interface identifier and at least one user information, and the user information comprises a user identifier; the processing module is configured to acquire a user request message; the user request message comprises a target interface identifier and a target user identifier; and the processing module is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships to obtain an authentication result.

[0018] In some embodiments of the second aspect, the processing module is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships to obtain an authentication result, and specifically comprises: determining that the set of interface identifiers comprises the target interface identifier; and in a case where the set of mapping relationships comprises a corresponding relationship between the target interface identifier and the target user identifier, determining that the authentication result is authentication passed.

[0019] In some embodiments of the second aspect, in a case where the authentication result is authentication passed, the transceiver is further configured to: send a first message to a target microservice corresponding to the target interface identifier; and the first message is used to invoke the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

[0020] In some embodiments of the second aspect, the processing module is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships to obtain an authentication result, and specifically comprises: in a case where the set of interface identifiers does not comprise the target interface identifier, determining that the authentication result is authentication failed.

[0021] In some embodiments of the second aspect, the processing module is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships to obtain an authentication result, and specifically comprises: determining that the set of interface identifiers comprises the target interface identifier; and in a case where the set of mapping relationships does not comprise a corresponding relationship between the target interface identifier and the target user identifier, determining that the authentication result is authentication failed.

[0022] In a third aspect, a zuul is provided, comprising: at least one processor and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the method provided in the first aspect and any possible implementation thereof.

[0023] In a fourth aspect, a computer readable storage medium is provided, which, when the instructions in the computer readable storage medium are executed by a processor of a zuul, enables the zuul to perform the method provided in the first aspect and any possible implementation thereof.

[0024] In a fifth aspect, a computer program product containing instructions, which, when run on a computer, enables the computer to perform the method provided in the first aspect and any possible implementation thereof, is provided.

[0025] In a sixth aspect, a chip system is provided, comprising: a processor and an interface circuit; the interface circuit is configured to receive a computer program or instructions and transmit to the processor; the processor is configured to execute the computer program or instructions, so that the chip system performs the method provided in the first aspect and any possible implementation thereof.

[0026] The technical effects brought by any implementation of the second aspect to the sixth aspect can be referred to the technical effects brought by different implementations of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 A schematic diagram of an architecture of an authentication system provided in the present application is provided.

[0028] Figure 2 A schematic diagram of a flow of an authentication method provided in the present application is provided.

[0029] Figure 3 A schematic diagram of a flow of another authentication method provided in the present application is provided.

[0030] Figure 4 A schematic diagram of a flow of another authentication method provided in the present application is provided.

[0031] Figure 5 A schematic diagram of a flow of another authentication method provided in the present application is provided.

[0032] Figure 6 A schematic diagram of a structure of a zuul provided in the present application is provided.

[0033] Figure 7 A schematic diagram of a structure of another zuul provided in the present application is provided. DETAILED DESCRIPTION

[0034] In the description of the present application, "a plurality of" means two or more than two, unless otherwise specified. "At least one of the following" or similar expressions means any combination of the items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0035] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, "first", "second" and the like are used to distinguish the same items or similar items with basically the same function and role. Those skilled in the art can understand that "first", "second" and the like do not limit the quantity and execution order, and "first", "second" and the like do not necessarily mean different.

[0036] Meanwhile, in the embodiments of the present application, the words such as "exemplary" or "for example" are used to mean as an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words such as "exemplary" or "for example" are intended to present the relevant concept in a specific manner, for easy understanding.

[0037] It can be understood that the "embodiments" mentioned throughout the specification mean that the specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, the various embodiments throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It can be understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the execution order, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0038] It can be understood that in the present application, "when", "if" and "if" all refer to the corresponding processing under certain objective circumstances, not limited to time, and do not require a judgment action when implemented, nor does it mean that there are other limitations.

[0039] It can be understood that some optional features in the embodiments of the present application can be implemented independently in some scenarios, without relying on other features, such as the scheme currently based on, to solve the corresponding technical problems and achieve the corresponding effects. In some scenarios, it can also be combined with other features according to demand. Correspondingly, the devices given in the embodiments of the present application can also realize these features or functions, which will not be described here.

[0040] In the present application, the same or similar parts between various embodiments can be mutually referred to, unless otherwise specified. In the various embodiments of the present application, and the various implementation methods in the various embodiments, the terms and / or descriptions between different embodiments, and between the various implementation methods in the various embodiments are consistent, and can be mutually referred to, unless otherwise specified and logically conflicted. The technical features in different embodiments, and in the various implementation methods in the various embodiments can be combined to form new embodiments, implementation manners, implementation methods, or implementation methods according to their inherent logical relationship. The following implementation manners of the present application do not constitute a limitation on the protection scope of the present application.

[0041] Security is the top priority of microservices. To ensure the security of microservices, it is usually necessary to authenticate access requests. Existing solutions usually authenticate based on the Spring Security security framework or the Shiro security framework configuration.

[0042] There is a set of filter chains in the Spring Security security framework, and the set of filter chains includes multiple filters. One filter can handle one type of authentication. The authentication method based on the Spring Security security framework needs to configure the Spring Security security framework. The configuration steps are cumbersome, and the official reference manual alone has hundreds of thousands of words. Therefore, the configuration cost is large, and the efficiency is low.

[0043] The Shiro security framework is a lightweight security framework. Since it does not have a cache, it needs to be configured in multiple steps when facing the microservice scenario. Therefore, the configuration cost is also large, and the efficiency is low.

[0044] In summary, the configuration steps of the existing authentication method are cumbersome, resulting in low authentication efficiency.

[0045] Figure 1 The technical scheme of the embodiment of the present application can be applied to the architecture of the authentication system provided by the present application. Figure 1 As shown in the authentication system 10, the authentication system 10 includes a gateway zuul 11 and an electronic device 12. Figure 1

[0046] The zuul 11 is directly or indirectly connected to the electronic device 12. In the connection relationship, a wired connection can be used, or a wireless connection can be used. The present application does not limit this.

[0047] The zuul 11 can be used to receive data from the electronic device 12.

[0048] The electronic device 12 can be used to send data to the zuul 11. ​

[0049] It should be noted that the zuul 11 and the electronic device 12 can be independent devices, or can be integrated into the same device, and the present application does not make specific limitations thereto.

[0050] When the zuul 11 and the electronic device 12 are integrated into the same device, the communication mode between the zuul 11 and the electronic device 12 is the communication between the internal modules of the device. In this case, the communication process between the two is the same as the communication process between the zuul 11 and the electronic device 12 when they are independent of each other.

[0051] In the following embodiments provided by the present application, the present application takes the example of the zuul 11 and the electronic device 12 being independent of each other.

[0052] In actual applications, the authentication method provided by the embodiments of the present application can be applied to the zuul 11, or to the device included in the zuul 11.

[0053] The authentication method provided by the embodiments of the present application will be described below with reference to the appended drawings, taking the example of the authentication method being applied to the zuul 11.

[0054] Figure 2 A flowchart of an authentication method provided by the present application, which is applied to a zuul, as shown in the figure, the authentication method comprises the following steps: Figure 2

[0055] S201, the zuul subscribes and acquires an interface identifier set of a cache redis and a mapping relationship set of the redis.

[0056] The interface identifier set includes at least one interface identifier of a microservice, and the mapping relationship set includes at least one mapping relationship, one mapping relationship includes a corresponding relationship between one interface identifier and at least one user information, and the user information includes a user identifier.

[0057] It should be noted that the interface identifier of the microservice can be interface identifier A, or the interface identifier of the microservice can be interface identifier B, or the interface identifier of the microservice can be interface identifier C, or the interface identifier of the microservice can be other interface identifier, and the present application does not make specific limitations thereto.

[0058] The user identifier can be user identifier D, or the user identifier can be user identifier E, or the user identifier can be user identifier F, or the user identifier can be user identifier G, or the user identifier can be other user identifier, and the present application does not make specific limitations thereto.

[0059] ​As an example, taking the interface identifier as interface identifier A, one mapping relationship can be [interface identifier A-user identifier D, interface identifier A-user identifier E, interface identifier A-user identifier F].

[0060] As another example, taking the interface identifier as interface identifier B, one mapping relationship can be [interface identifier B-user identifier D, interface identifier B-user identifier G, interface identifier B-user identifier F].

[0061] The user information can further include a role identifier corresponding to the user identifier and menu information, so as to determine what role the user corresponding to the user identifier has and what menu the user has.

[0062] The role identifier can be role identifier H, or the role identifier can also be role identifier I, or the role identifier can also be role identifier J, or the role identifier can also be other role identifiers, which are not limited by the present application.

[0063] The menu information can be menu information K, or the menu information can also be menu information L, or the menu information can also be menu information M, or the menu information can also be other menu information, which are not limited by the present application.

[0064] As an example, taking the interface identifier as interface identifier B, in the case where the user information further includes a role identifier corresponding to the user identifier and menu information, one mapping relationship can be [interface identifier B-user identifier D-role identifier I-menu information K, interface identifier B-user identifier G-role identifier H-menu information K, interface identifier B-user identifier F-role identifier I-menu information M].

[0065] Each interface identifier in the interface identifier set in redis can be an interface identifier sent by each microservice to redis.

[0066] Each mapping relationship in the mapping relationship set in redis can be a mapping relationship sent by the permission admin program to redis.

[0067] As a possible implementation manner, zuul sends a subscription request message for locating the interface identifier set in redis and the mapping relationship set in redis to redis, and receives a broadcast message from redis, the broadcast message including the interface identifier set in redis and the mapping relationship set in redis, and zuul obtains the interface identifier set in redis and the mapping relationship set in redis from the message.

[0068] S202, zuul obtains a user request message.

[0069] The user request message includes a target interface identifier and a target user identifier.

[0070] It should be noted that the user request message can be a query request message, or the user request message can be an addition request message, or the user request message can be a login request message, or the user request message can be another request message, and the present application does not make a specific limitation.

[0071] As a possible implementation manner, in combination with Figure 1 The zuul receives a message from the electronic device, and the message includes the user request message. The zuul obtains the user request message from the message.

[0072] In S203, the zuul authenticates the user request based on the interface identifier set and the mapping relationship, and obtains an authentication result.

[0073] It should be noted that the authentication result can be that the authentication is passed, or the authentication result can be that the authentication is not passed, and the present application does not make a specific limitation.

[0074] As a possible implementation manner, the zuul determines whether the target interface identifier and the target user identifier in the user request are included in the interface identifier set or the mapping relationship set, and obtains the authentication result.

[0075] It should be noted that the specific description of this possible implementation manner can be referred to the description in the subsequent part of the specific embodiment of the present application, which will not be described here in detail.

[0076] Based on the scheme, the interface identifier set and the first mapping relationship set of the redis are subscribed and obtained to authenticate the user request. Compared with the existing scheme which needs more configuration steps, on the one hand, the scheme of the present application authenticates the user request by subscribing and based on the obtained interface identifier set and the first mapping relationship set of the redis, and the configuration steps are less, on the other hand, since the zuul subscribes the interface identifier set and the first mapping relationship set of the redis, when the interface identifier set and the mapping relationship set in the redis are updated subsequently, the redis will broadcast the updated interface identifier set and the first mapping relationship set to the zuul, and the zuul does not need to send an update request message to the redis. In summary, the scheme of the present application can improve the efficiency of authentication.

[0077] The above is a general description of the authentication method provided by the present application, and the scheme of the present application will be further described in combination with the drawings.

[0078] In one design, Figure 3 The flowchart of another authentication method provided by the present application is shown in FIG. 2.Figure 3 As shown, the S203 provided in the specific embodiment of the present application can specifically include the following steps:

[0079] S301, the zuul determines that the interface identifier set includes the target interface identifier.

[0080] As a possible implementation, the zuul checks whether the target interface identifier exists in the interface identifier set, and if so, the zuul determines that the interface identifier set includes the target interface identifier.

[0081] For example, the target interface identifier is interface identifier A, and the interface identifier set is [interface identifier A, interface identifier B, interface identifier C]. The zuul checks that the interface identifier A exists in the interface identifier set, and determines that the interface identifier set includes the target interface identifier.

[0082] S302, the zuul determines that the authentication result is authentication passed in the case that the mapping relationship set includes the corresponding relationship between the target interface identifier and the target user identifier.

[0083] As a possible implementation, the zuul checks whether the corresponding relationship between the target interface identifier and the target user identifier exists in the mapping relationship set, and if so, the zuul determines that the authentication result is authentication passed.

[0084] For example, the target interface identifier is interface identifier A, and the target user identifier is user identifier F. The mapping relationship set includes the mapping relationship [interface identifier A-user identifier D, interface identifier A-user identifier E, interface identifier A-user identifier F]. The zuul checks that the corresponding relationship between the interface identifier A and the user identifier F exists in the mapping relationship. The zuul determines that the authentication result is authentication passed.

[0085] Based on the scheme, the scheme of authenticating the user request based on the interface identifier set and the mapping relationship to obtain the authentication result can be realized.

[0086] In one design, in the case that the user request is authenticated, the authentication method provided by the present application can further include:

[0087] The zuul sends a first message to the target microservice corresponding to the target interface identifier.

[0088] The first message is used to call the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

[0089] It should be noted that the first message can be a call message, or the first message can be a call request message, or the first message can be a microservice call message, or the first message can be a message with other names, and the present application does not make specific limitations.

[0090] Based on the scheme, by sending the first message for calling the target microservice to the target interface identifier corresponding to the target microservice, the target microservice can process the user request.

[0091] In one design, the S203 provided by the specific embodiment of the present application can specifically include:

[0092] The zuul determines that the authentication result is authentication failure when the interface identifier set does not include the target interface identifier.

[0093] As a possible implementation manner, the zuul checks whether the target interface identifier exists in the interface identifier set, and if not, the zuul determines that the authentication result is authentication failure.

[0094] For example, taking the target interface identifier as interface identifier A, if the interface identifier set is [interface identifier B, interface identifier C], the zuul checks that the interface identifier A does not exist in the interface identifier set, and the zuul determines that the authentication result is authentication failure.

[0095] Based on the scheme, the scheme of authenticating the user request based on the interface identifier set and the mapping relationship to obtain the authentication result can be implemented.

[0096] In one design, Figure 4 For the flowchart of another authentication method provided by the present application, as shown in Figure 4 The S203 provided by the specific embodiment of the present application can specifically include the following steps:

[0097] S401, the zuul determines that the interface identifier set includes the target interface identifier.

[0098] As a possible implementation manner, the zuul checks whether the target interface identifier exists in the interface identifier set, and if yes, the zuul determines that the interface identifier set includes the target interface identifier.

[0099] For example, taking the target interface identifier as interface identifier A, if the interface identifier set is [interface identifier A, interface identifier B, interface identifier C], the zuul checks that the interface identifier A exists in the interface identifier set, and the zuul determines that the interface identifier set includes the target interface identifier.

[0100] S402, in a case where the mapping relationship set does not include the corresponding relationship between the target interface identifier and the target user identifier, the zuul determines that the authentication result is authentication failure.

[0101] As a possible implementation, the zuul checks whether the mapping relationship set includes the corresponding relationship between the target interface identifier and the target user identifier, and if not, the zuul determines that the authentication result is authentication failure.

[0102] For example, the target interface identifier is interface identifier A, and the target user identifier is user identifier F. If the mapping relationship set includes mapping relationship [interface identifier A-user identifier D, interface identifier A-user identifier E], the zuul checks that the mapping relationship does not include the corresponding relationship between interface identifier A and user identifier F. The zuul determines that the authentication result is authentication failure.

[0103] Based on the scheme, the user request can be authenticated based on the interface identifier set and the mapping relationship to obtain the authentication result.

[0104] In one design, Figure 5 For another authentication method provided by the application, a flowchart is shown as Figure 5 The authentication method provided by the application can specifically include the following steps:

[0105] S501, each microservice sends an interface identifier to redis.

[0106] It should be noted that each microservice sends its own interface identifier to redis when starting.

[0107] S502, the permissionadmin program sends at least one mapping relationship to redis.

[0108] It should be noted that the permissionadmin program sends the mapping relationship to redis when adding, deleting or changing the mapping relationship.

[0109] S503, the zuul subscribes and obtains the interface identifier set of redis and the mapping relationship set of redis.

[0110] It should be noted that the specific description of this step can refer to the description in S201 above, and the application will not be repeated here.

[0111] S504, the zuul obtains a user request message.

[0112] It should be noted that the specific description of this step can refer to the description in S202 above, and the application will not be repeated here.

[0113] S505, the zuul performs authentication on the user request based on the interface identifier set and the mapping relationship, and determines whether the authentication is passed.

[0114] It should be noted that the specific description of this step can refer to the description in S203 described above, and the present application will not be repeated here.

[0115] S506, in the case where the authentication is passed, the zuul sends a first message to a target microservice corresponding to the target interface identifier.

[0116] It should be noted that the first message is used to call the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

[0117] The first message can be a call message, or the first message can also be a call request message, or the first message can also be a microservice call message, or the first message can also be a message with other names, and the present application does not make specific limitation.

[0118] S507, in the case where the authentication is not passed, the zuul sends a second message to the electronic device.

[0119] It should be noted that the second message is used to indicate that the authentication result is that the authentication is not passed.

[0120] The second message can be an authentication failure message, or the second message can also be an authentication failure message, and the present application does not make specific limitation.

[0121] The above mainly introduces the scheme provided by the embodiments of the present application from the perspective of the zuul performing the authentication method. In order to realize the above functions, the zuul contains the corresponding hardware structure and / or software module for executing each function. Those skilled in the art should easily realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0122] The embodiments of the present application can divide the function modules of the zuul according to the above method examples. For example, each function module can be divided according to each function, or two or more functions can be integrated in one processing module. The above integrated module can be realized in the form of hardware or in the form of a software function module. Optionally, the division of the modules in the embodiments of the present application is illustrative, and is only a logical function division. In actual implementation, another division mode can be used. In addition, the "module" here can refer to a specific application-specific integrated circuit (ASIC), a circuit, a processor and a memory executing one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions.

[0123] In the case of adopting the function module division, Figure 6 A structure diagram of a zuul is shown. As Figure 6 shown, the zuul 60 includes a transceiver module 601 and a processing module 602.

[0124] In some embodiments, the zuul 60 can also include a storage module (not shown in the figure) for storing program instructions and data. Figure 6

[0125] The transceiver module 601 is configured to subscribe to and obtain a set of interface identifiers of a cache redis and a set of mapping relationships of the redis. The set of interface identifiers includes at least one interface identifier of a microservice, and the set of mapping relationships includes at least one mapping relationship. One mapping relationship includes a corresponding relationship between one interface identifier and at least one user information. The user information includes a user identifier. The processing module 602 is configured to obtain a user request message. The user request message includes a target interface identifier and a target user identifier. The processing module 602 is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships, and obtain an authentication result.

[0126] Optionally, the processing module 602 is further configured to perform authentication on the user request based on the set of interface identifiers and the set of mapping relationships, and obtain an authentication result. Specifically, the processing module 602 is configured to determine that the set of interface identifiers includes the target interface identifier, and determine that the authentication result is passed when the set of mapping relationships includes a corresponding relationship between the target interface identifier and the target user identifier.

[0127] Optionally, when the authentication result is passed, the transceiver module 601 is further configured to send a first message to a target microservice corresponding to the target interface identifier. The first message is used to call the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

[0128] ​Optionally, the processing module 602 is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain an authentication result, specifically including: in a case where the interface identifier set does not include the target interface identifier, determining that the authentication result is authentication failure.

[0129] Optionally, the processing module 602 is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain an authentication result, specifically including: determining that the interface identifier set includes the target interface identifier; and in a case where the mapping relationship set does not include a corresponding relationship between the target interface identifier and the target user identifier, determining that the authentication result is authentication failure.

[0130] All related contents of each step involved in the method embodiments described above can be cited to the function description of the corresponding function module, which will not be repeated here.

[0131] In a case where the functions of the function modules described above are implemented in the form of hardware, Figure 7 A structure diagram of a zuul is shown. As Figure 7 shown, the zuul 70 includes a processor 701, a memory 702 and a bus 703. The processor 701 and the memory 702 can be connected through the bus 703.

[0132] The processor 701 is the control center of the zuul 70, which can be one processor or a general term of multiple processing elements. For example, the processor 701 can be a general central processing unit (CPU), or other general-purpose processors, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0133] As an embodiment, the processor 701 can include one or more CPUs, such as the CPU 0 and the CPU 1 shown in Figure 7 .

[0134] The memory 702 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to this.

[0135] As a possible implementation, the memory 702 can exist independently of the processor 701, or the memory 702 can be connected to the processor 701 through the bus 703, for storing instructions or program codes. When the processor 701 invokes and executes the instructions or program codes stored in the memory 702, the authentication method provided by the embodiments of the present application can be implemented.

[0136] In another possible implementation, the memory 702 can also be integrated with the processor 701.

[0137] The bus 703 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For the sake of presentation, Figure 7 Only one thick line is used to represent the bus in the figure, but it does not mean that there is only one bus or only one type of bus.

[0138] It should be noted that, Figure 7 The structure shown does not constitute a limitation on the zuul 70. In addition to Figure 7 the components shown, the zuul 70 can include more or fewer components than shown, or combine some components, or different component arrangements.

[0139] As an example, in combination with Figure 6 , the functions implemented by the transceiver module 601 and the processing module 602 in the zuul 60 are the same as the functions of the processor 701 in the Figure 7 .

[0140] Optionally, as Figure 7 shown, the zuul 70 provided by the embodiments of the present application can also include a communication interface 704.

[0141] The communication interface 704 is used to connect with other devices through a communication network. The communication network can be an Ethernet, a wireless access network, a wireless local area network (WLAN), or the like. The communication interface 704 can include a receiving unit for receiving data, and a sending unit for sending data.

[0142] In a possible implementation, in the zuul 70 provided by the embodiments of the present application, the communication interface 704 can also be integrated in the processor 701, which is not limited by the embodiments of the present application.

[0143] As a possible product form, the zuul of the embodiments of the present application can also be implemented using one or more field programmable gate arrays (FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.

[0144] From the above description of the embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of functional units is exemplified. In actual application, the above-mentioned functions can be completed by different functional units according to needs, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. The specific working process of the above-mentioned system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0145] The embodiments of the present application also provide a computer readable storage medium having stored thereon a computer program or instructions, which, when executed by a computer, cause the computer to perform each of the steps in the method flow illustrated by the foregoing method embodiments.

[0146] The embodiments of the present application provide a computer program product containing instructions, which, when executed on a computer, cause the computer to perform each of the steps in the method flow illustrated by the foregoing method embodiments.

[0147] The embodiments of the present application provide a chip system, comprising: a processor and an interface circuit; the interface circuit is used to receive a computer program or instructions and transmit to the processor; the processor is used to execute the computer program or instructions, so that the chip system performs each of the steps in the method flow illustrated by the foregoing method embodiments.

[0148] The computer readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a register, a hard disk, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. A processor in association with software can be used to program the memory device to function in a particular manner, such that the processor can employ the associated software to facilitate the described functionality. In some embodiments, the memory device can be considered to be a computer readable storage medium. The memory device can also be considered to be a tangible computer readable storage medium. The functioning of the software can be enabled by programming the memory device, such as with one or more sequences of instructions, also called computer program code, that can be executed by the processor using the operating system to perform the functions of the computer program.

[0149] Since the zuul, the computer readable storage medium, and the computer program product provided by the embodiment can be applied to the above-mentioned authentication method provided by the embodiment, the technical effects that can be obtained by the zuul, the computer readable storage medium, and the computer program product are also referable to the above-mentioned method embodiments, and the embodiments of the present application will not be described here.

[0150] Although the present application has been described in connection with the various embodiments thereof with reference to the drawings, it will be apparent to those skilled in the art that other variations and modifications of the disclosed embodiments can be understood and effected within the scope of the application, which is defined in the appended claims, depending on the content of the following claims and the principles of patent law. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite articles "a" or "an" do not exclude a plurality. A single processor or other unit can fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0151] Although the present application has been described in connection with certain specific features and embodiments thereof, it is to be understood that it is provided as an exemplification of the application and is not intended to limit the scope of the application, which is defined in the claims. Various modifications and changes can be made thereto without departing from the spirit and scope of the application. Accordingly, it is intended that all such modifications and changes be included within the scope of the application as claimed. Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An authentication method, characterized in that, Applied to the gateway Zuul, the method includes: The system subscribes to and retrieves a set of interface identifiers and a set of mapping relationships in Redis. The set of interface identifiers includes at least one interface identifier of a microservice, and the set of mapping relationships includes at least one mapping relationship. Each mapping relationship includes a correspondence between an interface identifier and at least one piece of user information, where the user information includes a user identifier. The mapping relationship is sent to Redis by the permissionadmin program. The permissionadmin program sends the mapping relationship to Redis when adding, deleting, or modifying a mapping relationship. Obtain the user request message; the user request message includes the target interface identifier and the target user identifier; The user request is authenticated based on the set of interface identifiers and the set of mapping relationships to obtain the authentication result.

2. The method according to claim 1, characterized in that, The authentication of the user request based on the interface identifier set and the mapping relationship set, to obtain the authentication result, specifically includes: It is determined that the interface identifier set includes the target interface identifier; If the mapping relationship set includes the correspondence between the target interface identifier and the target user identifier, the authentication result is determined to be authentication passed.

3. The method according to claim 1 or 2, characterized in that, If the authentication result is successful, the method further includes: A first message is sent to the target microservice corresponding to the target interface identifier; the first message is used to invoke the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

4. The method according to claim 1, characterized in that, The authentication of the user request based on the interface identifier set and the mapping relationship set, to obtain the authentication result, specifically includes: If the target interface identifier is not included in the set of interface identifiers, the authentication result is determined to be authentication failure.

5. The method according to claim 1, characterized in that, The authentication of the user request based on the interface identifier set and the mapping relationship set, to obtain the authentication result, specifically includes: It is determined that the interface identifier set includes the target interface identifier; If the mapping set does not include the correspondence between the target interface identifier and the target user identifier, the authentication result is determined to be authentication failure.

6. A gateway Zuul, characterized in that, The zuul includes: a transceiver module and a processing module; The transceiver module is used to subscribe to and obtain a set of interface identifiers for the Redis cache and a set of mapping relationships for the Redis cache. The set of interface identifiers includes at least one interface identifier for a microservice, and the set of mapping relationships includes at least one mapping relationship. Each mapping relationship includes a correspondence between an interface identifier and at least one piece of user information, where the user information includes a user identifier. The mapping relationship is sent to Redis by the permissionadmin program. The permissionadmin program sends the mapping relationship to Redis when adding, deleting, or modifying a mapping relationship. The processing module is used to obtain user request messages; the user request messages include target interface identifiers and target user identifiers; The processing module is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain the authentication result.

7. The zuul according to claim 6, characterized in that, The processing module is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain an authentication result, specifically including: It is determined that the interface identifier set includes the target interface identifier; If the mapping relationship set includes the correspondence between the target interface identifier and the target user identifier, the authentication result is determined to be authentication passed.

8. The zuul according to claim 6 or 7, characterized in that, If the authentication result is successful, the transceiver module is further configured to: A first message is sent to the target microservice corresponding to the target interface identifier; the first message is used to invoke the target microservice corresponding to the target interface identifier, and the target microservice is used to process the user request message.

9. The zuul according to claim 6, characterized in that, The processing module is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain an authentication result, specifically including: If the target interface identifier is not included in the set of interface identifiers, the authentication result is determined to be authentication failure.

10. The zuul according to claim 6, characterized in that, The processing module is further configured to authenticate the user request based on the interface identifier set and the mapping relationship set, and obtain an authentication result, specifically including: It is determined that the interface identifier set includes the target interface identifier; If the mapping set does not include the correspondence between the target interface identifier and the target user identifier, the authentication result is determined to be authentication failure.

11. A gateway Zuul, characterized in that, The zuul includes: a processor coupled to a memory for storing programs or instructions, which, when executed by the processor, cause the zuul to perform the method as described in any one of claims 1 to 5.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed, they cause the computer to perform the method as described in any one of claims 1 to 5.

Images