An authentication method and device, an electronic device, and a storage medium

Abstract

The present disclosure provides an authentication method and device, electronic equipment and storage medium, the method is applied to the server, comprising: in response to the service request initiated by the user end, obtaining the access token carried by the service request; using the first plug-in contained in the gateway of the server, based on the access token, the service request is authenticated, and the authentication result is obtained; wherein the plug-in parameter of the first plug-in contains the permission information of the service interface corresponding to the service request; in the case where the authentication result indicates that the authentication is passed, using the service interface corresponding to the service request, the request result corresponding to the service request is obtained.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to an authentication method, apparatus, electronic device, and storage medium. Background Technology

[0002] As a unified management platform for resource services, cloud platforms provide computing, networking, and storage capabilities based on hardware and software resources. To ensure the security and confidentiality of access to business services, a secure access authentication and authorization system is typically established during the development of a cloud platform. This allows authorized entities, such as the cloud platform, to access business services within their authorized scope and to deny unauthorized access.

[0003] Generally, permission information for business service requests can be manually entered into a pre-established permission system, and this permission information can be bound to the corresponding user. Then, when a user initiates a business service request, the permission system can be used to authenticate the user's identity and authorize the request. However, this authentication method is complex and requires each business service component to intercept the request for authentication, leading to code intrusion and low development efficiency. Summary of the Invention

[0004] In view of this, this disclosure provides at least one authentication method, apparatus, electronic device, and storage medium.

[0005] Firstly, this disclosure provides an authentication method, which is applied to the server side and includes:

[0006] In response to a service request initiated by the user, obtain the access token carried in the service request;

[0007] Using the first plugin included in the gateway of the server, the service request is authenticated based on the access token to obtain the authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the service request.

[0008] If the authentication result indicates that the authentication is successful, the service interface corresponding to the business service request is used to obtain the request result corresponding to the business service request.

[0009] In the above method, after the user initiates a business service request, the server can respond to the request and obtain the access token carried in the request. Since the plugin parameters of the first plugin in the server's gateway contain the permission information of the service interface corresponding to the business service request, and the user's permissions can be determined through the access token, the first plugin in the gateway can be used to automate the authentication of the business service request in a simple and efficient manner, obtaining the authentication result. If the authentication result indicates success, the service interface corresponding to the business service request can be used to obtain the request result, improving the security of obtaining the request result through the service interface. Here, there is no need to set up a business service component, nor is it necessary to use the server-side business service component to intercept business service requests for authentication, thus achieving decoupling between authentication and business services.

[0010] Meanwhile, because the development and maintenance costs of plugins are low, and the status of plugins can be controlled according to the needs of business services, such as enabling or disabling plugins, the technical complexity of authenticating business service requests can be simplified, the workload and difficulty of sub-products with business service functions accessing the server can be reduced, and development efficiency can be improved.

[0011] In one possible implementation, the step of using a first plugin included in the server-side gateway to authenticate the business service request based on the access token and obtain an authentication result includes:

[0012] Obtain the user's identification information from the access token;

[0013] Using the first plugin included in the server-side gateway, the service request is authenticated based on the user's identification information and the permission information of the service interface corresponding to the service request included in the first plugin, and an authentication result is obtained.

[0014] Here, since the plugin parameters of the first plugin in the gateway contain the permission information of the service interface corresponding to the business service request, when the business service request arrives at the gateway, the first plugin in the gateway can be used to authenticate the business service request based on the user's identification information obtained from the access token and the permission information of the service interface corresponding to the business service request, and obtain the authentication result; without the need for the business service component on the server to intercept the business service request and then authenticate the business service request, the authentication and business service are decoupled, and the efficiency of authenticating business service requests is improved.

[0015] Meanwhile, the first plugin enables the gateway to automatically authenticate business service requests, so that sub-products with business service functions do not need to pay attention to authentication data information during development; and the status of the first plugin can be controlled at any time according to the needs of business services, reducing the workload and difficulty of sub-products with business service functions to access the server, and improving development efficiency.

[0016] In one possible implementation, the first plugin included in the server-side gateway authenticates the business service request based on the user's identification information and the permission information of the service interface corresponding to the business service request included in the first plugin, and obtains the authentication result, including:

[0017] Using the first plugin included in the gateway of the server, based on the identification information of the user terminal, the preset permission information of the user terminal is obtained, and it is determined whether the preset permission information matches the permission information of the service interface.

[0018] If a match is found, an authentication result is generated to indicate that the authentication has been successful.

[0019] Here, since the plugin parameters of the first plugin in the gateway contain the permission information of the service interface corresponding to the business service request, the first plugin contained in the gateway on the server side can be used to obtain the user's preset permission information based on the user's identification information, and determine whether the preset permission information matches the permission information of the service interface. If they match, an authentication result is generated to indicate that the authentication has passed. In order to determine whether the user has the permission to request the business service using the service interface corresponding to the business service request based on the authentication result.

[0020] In one possible implementation, after obtaining the access token carried in the service request, the method further includes:

[0021] The access token is authenticated using the second plugin included in the server's gateway to obtain an authentication result;

[0022] The step of using a first plugin included in the server-side gateway to authenticate the business service request based on the access token and obtain an authentication result includes:

[0023] If the authentication result indicates that the authentication is successful, the first plugin included in the gateway on the server side is used to authenticate the business service request based on the access token, and an authentication result is obtained.

[0024] Here, after obtaining the access token carried in the business service request, it is necessary to authenticate whether the user information on the user side is legitimate and valid. Therefore, the second plugin included in the server-side gateway is used to authenticate the access token and obtain the authentication result. In order to determine the validity and accuracy of the access token based on the authentication result, it provides a guarantee for the effectiveness of subsequent authentication using the access token.

[0025] In one possible implementation, the step of generating the first plugin includes:

[0026] Obtain interface information corresponding to at least one service interface; wherein, the interface information includes definition information and permission information;

[0027] Using the third plugin in the server, a permission file is generated based on the interface information corresponding to at least one service interface;

[0028] The file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

[0029] In one possible implementation, the definition information includes: first definition information for describing the request method of the service interface; and / or, second definition information for describing the request parameters of the service interface;

[0030] The permission information includes: first permission information used to describe the operation semantics of resource objects under the service corresponding to the service interface; and second permission information used to control the effective scope of the first permission information.

[0031] Secondly, this disclosure provides an authentication method, which is applied to the user end and includes:

[0032] A service request carrying an access token is sent to the server, so that the server can use a first plugin included in the server's gateway to authenticate the service request based on the access token and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the service request; if the authentication result indicates that the authentication is successful, the service interface corresponding to the service request is used to obtain the request result corresponding to the service request.

[0033] Receive the request result corresponding to the business service request.

[0034] Here, the client initiates a service request carrying an access token to the server. The server, using a first plugin included in its gateway, authenticates the service request based on the access token and obtains an authentication result. If the authentication result indicates successful, the client retrieves the request result corresponding to the service request using the service interface. This allows the client to receive the request result of the service request quickly, improving the client's request efficiency.

[0035] The effects of the following devices, electronic equipment, etc., are described in the instructions above and will not be repeated here.

[0036] Thirdly, this disclosure provides an authentication device for use on a server side, including:

[0037] The first acquisition module is used to acquire the access token carried in the business service request in response to the business service request initiated by the user terminal.

[0038] The authentication module is used to authenticate the business service request based on the access token using a first plugin included in the gateway of the server, and obtain the authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request.

[0039] The second acquisition module is used to acquire the request result corresponding to the business service request by utilizing the service interface corresponding to the business service request when the authentication result indicates that the authentication is successful.

[0040] Fourthly, this disclosure provides an authentication device for use on a user terminal, comprising:

[0041] The request module is used to initiate a business service request carrying an access token to the server, so that the server can use a first plugin included in the server's gateway to authenticate the business service request based on the access token and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request; if the authentication result indicates that the authentication is successful, the request result corresponding to the business service request is obtained using the service interface corresponding to the business service request.

[0042] The receiving module is used to receive the request result corresponding to the business service request.

[0043] Fifthly, this disclosure provides an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, they perform the steps of the authentication method as described in the first aspect or any of the embodiments above, or as described in the second aspect above.

[0044] In a sixth aspect, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the authentication method as described in the first aspect or any of the embodiments above, or as described in the second aspect above.

[0045] To make the above-mentioned objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly described below. These drawings are incorporated in and constitute a part of this specification. They illustrate embodiments conforming to this disclosure and, together with the specification, serve to explain the technical solutions of this disclosure. It should be understood that the following drawings only show some embodiments of this disclosure and should not be considered as limiting the scope. Those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating an authentication method applied to a server provided in an embodiment of this disclosure is shown.

[0048] Figure 2a This diagram illustrates the definition of interface information in an authentication method provided by an embodiment of the present disclosure.

[0049] Figure 2b This illustration shows a schematic diagram of a permission file in an authentication method provided by an embodiment of the present disclosure;

[0050] Figure 2c This diagram illustrates the code of the first plugin in an authentication method provided by an embodiment of the present disclosure.

[0051] Figure 3 A flowchart illustrating an authentication method applied to a user terminal, provided by an embodiment of this disclosure, is shown.

[0052] Figure 4 This illustration shows a schematic diagram of the authentication process in an authentication method provided by an embodiment of the present disclosure;

[0053] Figure 5 A schematic diagram of the architecture of an authentication device applied to a server provided in an embodiment of this disclosure is shown;

[0054] Figure 6 A schematic diagram of the architecture of an authentication device applied to a user terminal, provided by an embodiment of this disclosure, is shown.

[0055] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0057] As a unified management platform for resource services, cloud platforms provide computing, networking, and storage capabilities based on hardware and software resources. To ensure the security and confidentiality of access to business services, a secure access authentication and authorization system is typically established during the development of a cloud platform. This allows authorized entities, such as the cloud platform, to access business services within their authorized scope and to deny unauthorized access.

[0058] Generally, permission information for business service requests can be manually entered into a pre-established permission system, and this permission information can be bound to the corresponding user. Then, when a user initiates a business service request, the permission system can be used to authenticate the user's identity and authorize the request. However, this authentication method is complex and requires each business service component to intercept the request for authentication, leading to code intrusion and low development efficiency.

[0059] To alleviate the above problems, this disclosure provides an authentication method, apparatus, electronic device, and storage medium.

[0060] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0061] To facilitate understanding of the embodiments of this disclosure, a detailed description of an authentication method disclosed in this disclosure will be provided first. The authentication method provided in this disclosure is generally executed by a computer device with a certain computing capability, such as a terminal device, a server, or other processing devices. In some possible implementations, the authentication method can be implemented by a processor calling computer-readable instructions stored in memory.

[0062] The authentication method provided in this disclosure can be applied to large and complex cloud platform scenarios, such as artificial intelligence (AI) cloud management platforms. The following description focuses on the server-side and provides a relatively detailed explanation of the authentication method provided in this disclosure.

[0063] See Figure 1 The diagram shown is a flowchart of the authentication method provided in this embodiment, including: S101-S103; specifically:

[0064] S101. In response to a business service request initiated by the user, obtain the access token carried in the business service request.

[0065] S102. Using the first plugin contained in the server-side gateway, the business service request is authenticated based on the access token to obtain the authentication result; wherein, the plugin parameters of the first plugin contain the permission information of the service interface corresponding to the business service request.

[0066] S103. If the authentication result indicates that the authentication is successful, use the service interface corresponding to the business service request to obtain the request result corresponding to the business service request.

[0067] In the above method, after the user initiates a business service request, the server can respond to the request and obtain the access token carried in the request. Since the plugin parameters of the first plugin in the server's gateway contain the permission information of the service interface corresponding to the business service request, and the user's permissions can be determined through the access token, the first plugin in the gateway can be used to automate the authentication of the business service request in a simple and efficient manner, obtaining the authentication result. If the authentication result indicates success, the service interface corresponding to the business service request can be used to obtain the request result, improving the security of obtaining the request result through the service interface. Here, there is no need to set up a business service component, nor is it necessary to use the server-side business service component to intercept business service requests for authentication, thus achieving decoupling between authentication and business services.

[0068] Meanwhile, because the development and maintenance costs of plugins are low, and the status of plugins can be controlled according to the needs of business services, such as enabling or disabling plugins, the technical complexity of authenticating business service requests can be simplified, the workload and difficulty of sub-products with business service functions accessing the server can be reduced, and development efficiency can be improved.

[0069] The following provides a relatively detailed explanation of S101-S103.

[0070] Regarding S101:

[0071] During implementation, users can first log in so that the server can respond to the login operation triggered by the user, generate an access token, and send the access token to the user. In subsequent processes, if the user initiates a business service request to the server, the business service request will carry the access token.

[0072] The specific process of the server generating an access token is as follows: When a user logs in from their client, the server responds by obtaining the user's identification information, i.e., the username and password entered by the user. It then verifies the identification information based on preset verification conditions to obtain the verification result. For example, verification conditions may include: the username can contain at least one of numbers, letters, and Chinese characters; the username cannot contain symbols; and the password can contain at least one of numbers, letters, and symbols. If the verification result is successful, an access token is generated based on the identification information and sent to the client. This ensures that subsequent service requests initiated by the client are accompanied by the access token. The access token may contain the client's identification information (i.e., a unique string identifying the user or user group), the token's expiration time, and other data, etc.

[0073] In practice, when responding to a business service request initiated by the user, if the business service request does not carry an access token, that is, the server has not successfully obtained an access token, the business service request from the user is directly rejected.

[0074] Regarding S102:

[0075] In implementation, after obtaining the access token carried in the business service request, since the access token can contain the user's identification information, the user's permission information can be obtained based on the user's identification information in the access token. Simultaneously, since the plugin parameters of the first plugin in the server-side gateway contain the permission information of the service interface corresponding to the business service request, it can be determined whether the user's permission information matches the permission information of the service interface corresponding to the business service request. That is, the first plugin can be used to authenticate the business service request based on the access token to obtain the authentication result.

[0076] In practice, after obtaining the access token carried in the business service request, the server can also authenticate the access token first.

[0077] Specifically, after obtaining the access token carried in the business service request, the process also includes: using a second plugin included in the server-side gateway to authenticate the access token and obtain the authentication result.

[0078] Using the first plugin included in the server-side gateway, the service request is authenticated based on the access token to obtain the authentication result. This includes: if the authentication result indicates that the authentication is successful, using the first plugin included in the server-side gateway, the service request is authenticated based on the access token to obtain the authentication result.

[0079] An access token is a string formatted as header information, validity information, and signature information. During implementation, the authentication process can be executed based on the specific development details of the server. One approach, assuming a base access token is stored in the server's database, is to utilize a second plugin included in the server's gateway to determine if a matching base access token is stored in the database. If it exists, an authentication result indicating successful authentication is generated; otherwise, an authentication result indicating failure is generated. This second plugin can be configured according to the actual development needs; for example, it could be an OpenID Connect plugin.

[0080] In another approach, if the base access token is not stored in the server's database (i.e., the server does not store the base access token), a second plugin included in the server's gateway can be used to obtain the header and validity information from the access token. The header and validity information can be hashed to obtain the data to be authenticated. The signature information in the access token can be decrypted to obtain the base authentication data. Then, it is determined whether the data to be authenticated and the base authentication data are consistent. If they are consistent, an authentication result indicating successful authentication is generated; if they are inconsistent, an authentication result indicating failed authentication is generated.

[0081] Furthermore, if the authentication result indicates that the authentication is successful, the first plugin included in the server-side gateway can be used to authenticate the business service request based on the access token, and obtain the authentication result.

[0082] Here, after obtaining the access token carried in the business service request, it is necessary to authenticate whether the user information on the user side is legitimate and valid. Therefore, the second plugin included in the server-side gateway is used to authenticate the access token and obtain the authentication result. In order to determine the validity and accuracy of the access token based on the authentication result, it provides a guarantee for the effectiveness of subsequent authentication using the access token.

[0083] In one possible implementation, if the authentication result indicates successful authentication, a first plugin included in the server-side gateway can be used to authenticate the business service request based on the access token, thereby obtaining an authentication result; specifically, this includes:

[0084] Step A1: Obtain the client's identification information from the access token.

[0085] Step A2: Using the first plugin included in the server-side gateway, the service request is authenticated based on the user's identification information and the permission information of the service interface corresponding to the service request included in the first plugin, and the authentication result is obtained.

[0086] Here, since the plugin parameters of the first plugin in the gateway contain the permission information of the service interface corresponding to the business service request, when the business service request arrives at the gateway, the first plugin in the gateway can be used to authenticate the business service request based on the user's identification information obtained from the access token and the permission information of the service interface corresponding to the business service request, and obtain the authentication result; without the need for the business service component on the server to intercept the business service request and then authenticate the business service request, the authentication and business service are decoupled, and the efficiency of authenticating business service requests is improved.

[0087] Meanwhile, the first plugin enables the gateway to automatically authenticate business service requests, so that sub-products with business service functions do not need to pay attention to authentication data information during development; and the status of the first plugin can be controlled at any time according to the needs of business services, reducing the workload and difficulty of sub-products with business service functions to access the server, and improving development efficiency.

[0088] In implementation, since the access token includes the user's identification information, which is a unique string identifying the user, the user's identification information can be obtained from the access token. Furthermore, since the plugin parameters of the first plugin in the gateway contain the permission information of the service interface corresponding to the business service request, the permission information of the service interface corresponding to the business service request can be obtained from the plugin parameters of the first plugin. Therefore, the first plugin contained in the server-side gateway can be used to authenticate the business service request based on the user's identification information and the permission information of the service interface corresponding to the business service request, obtaining the authentication result. This authentication result can then be used to determine whether the user has the permission to request the business service.

[0089] In specific implementation, step A2 involves using the first plugin included in the server-side gateway to authenticate the business service request based on the user's identification information and the permission information of the service interface corresponding to the business service request included in the first plugin, obtaining the authentication result, including:

[0090] Step A21: Using the first plugin included in the server-side gateway, obtain the user's preset permission information based on the user's identification information, and determine whether the preset permission information matches the permission information of the service interface.

[0091] Step A22: If a match is found, an authentication result is generated to indicate that the authentication has passed.

[0092] In implementation, after obtaining the user's identification information from the access token, the first plugin included in the server-side gateway can be used to obtain the user's preset permission information based on the user's identification information. It can then be determined whether the preset permission information matches the service interface's permission information. Specifically, if the service interface's permission information is to write data, and the user's preset permission information includes reading, deleting, and modifying data, it can be determined that the preset permission information does not match the service interface's permission information, and an authentication result indicating authentication failure is generated. If the user's preset permission information includes reading, deleting, and writing data, it can be determined that the preset permission information matches the service interface's permission information, and an authentication result indicating authentication success is generated.

[0093] Here, since the plugin parameters of the first plugin in the gateway contain the permission information of the service interface corresponding to the business service request, the first plugin contained in the gateway on the server side can be used to obtain the user's preset permission information based on the user's identification information, and determine whether the preset permission information matches the permission information of the service interface. If they match, an authentication result is generated to indicate that the authentication has passed. In order to determine whether the user has the permission to request the business service using the service interface corresponding to the business service request based on the authentication result.

[0094] During implementation, the server can generate the first plugin before the user initiates a business service request, so that the authentication process can be executed during the business service request process.

[0095] Specifically, the first plugin can be generated by following these steps:

[0096] Step B1: Obtain interface information corresponding to at least one service interface; wherein, the interface information includes definition information and permission information.

[0097] Step B2: Using a third plugin in the server, generate a permission file based on the interface information corresponding to at least one service interface.

[0098] Step B3: Use the file content in the permissions file as the plugin parameters for initializing the plugin to generate the first plugin.

[0099] During implementation, for each service interface, the permission information of the service interface can be extended when configuring the definition information of the service interface. Here, the definition information can be used to describe the request method and request parameters of the service interface; the permission information can be used to describe the permissions that the service interface has and the scope of the permissions.

[0100] Specifically, the definition information includes: first definition information for describing the request method of the service interface; and / or, second definition information for describing the request parameters of the service interface; the permission information includes: first permission information for describing the operation semantics of resource objects under the service corresponding to the service interface; and second permission information for controlling the effective scope of the first permission information.

[0101] For example, see Figure 2a The interface information definition diagram shown has the following first definition: POST: " / v1 / managementGroups / {parent_name}"; the request method is POST; however, the request method can also be GET, DELETE, Patch, etc. The second definition is body: "management_group"; the request parameter is management_group; however, when the request method is GET or DELETE, the second definition is not included.

[0102] Here, the format of the first permission information can be: service.resource.verb, where service is the service name corresponding to the service interface, resource is the resource object operated on under this service, and verb is the verb that specifically performs the operation on the resource; for example... Figure 2a As shown, the first permission information is permission: "rm.managementGroup.create", which means that the creation of a management group is allowed. The second permission information is scope: " / rm / managementGroups / {parent_name}", which controls the effective scope of the first permission information to the root management group, where {parent_name} represents any sub-management group under the root management group.

[0103] When generating the first plugin, interface information corresponding to at least one service interface can be obtained. This interface information may include definition information and permission information. Furthermore, a third plugin on the server can be used to generate a permission file based on the interface information corresponding to at least one service interface, according to a pre-set data format. Figure 2b As shown, the permissions file content includes: comment, business service path, request method, second permission information (scope), and first permission information (permission). The third plugin used in this embodiment can be the protoc plugin protoc-gen-policy. This third plugin can be developed according to actual needs; it is only illustrated here as an example.

[0104] Furthermore, the contents of the permissions file can be used as plugin parameters to initialize the plugin, generating the first plugin. For example... Figure 2c The first plugin configuration diagram shown uses the file content comment of the permission file, the business service path path, the request method method, the second permission information scope, and the first permission information permission as plugin parameters to configure the initial plugin and generate the first plugin.

[0105] Regarding S103:

[0106] If the authentication result indicates successful authentication, it means the user client has the permission to request the business service. The user can utilize the service interface corresponding to the business service request to obtain the request result and send it to the user client. If the authentication result indicates failed authentication, it means the user client does not have the permission to request the business service. A request result rejecting the request can be sent to the user client. For example, if the business service request is to access target data at a target address, the request result can include the target data. If the business service request is to write target data to a target address, the request result can include a first feedback message indicating successful writing or a second feedback message indicating writing failure.

[0107] The following description focuses on the user terminal and provides a relatively specific explanation of the authentication method provided in the embodiments of this disclosure.

[0108] See Figure 3 The diagram shown is a flowchart of the authentication method provided in this embodiment, including: S301-S302, specifically:

[0109] S301. Initiate a business service request carrying an access token to the server so that the server can use the first plugin contained in the server's gateway to authenticate the business service request based on the access token and obtain the authentication result; wherein, the plugin parameters of the first plugin contain the permission information of the service interface corresponding to the business service request; if the authentication result indicates that the authentication is successful, use the service interface corresponding to the business service request to obtain the request result corresponding to the business service request.

[0110] S302. Receive the request result corresponding to the business service request.

[0111] In implementation, users can initiate service requests carrying access tokens to the server through the client, such as requesting to create an administration group or modify data. The server can then use a first plugin included in its gateway to authenticate the service request based on the access token and obtain the authentication result. The plugin parameters of the first plugin contain the permission information of the service interface corresponding to the service request. If the authentication result indicates successful authentication, the server uses the service interface corresponding to the service request to obtain the request result. Furthermore, the server can receive the request result corresponding to the service request.

[0112] Here, the client initiates a service request carrying an access token to the server. The server, using a first plugin included in its gateway, authenticates the service request based on the access token and obtains an authentication result. If the authentication result indicates successful, the client retrieves the request result corresponding to the service request using the service interface. This allows the client to receive the request result of the service request quickly, improving the client's request efficiency.

[0113] The following provides a relatively detailed explanation of the authentication and authorization process for user-initiated business service requests.

[0114] See Figure 4 The diagram illustrates the gateway authentication and authorization process implemented through a gateway plugin. The client initiates a business service request carrying an access token to the server. The server obtains the access token carried in the business service request, uses the second plugin oidc included in the server's gateway kong, and calls the authentication interface Identity and Access Management (IAM)-Hydra to authenticate the access token and obtain the authentication result. If the authentication result indicates that the authentication has failed, the authentication result indicating the failure is sent to the client.

[0115] If the authentication result indicates successful authentication, the first plugin authz included in the server-side gateway kong is used to call the authentication interface IAM-Authz. Based on the user's identification information obtained from the access token and the permission information of the service interface corresponding to the business service request obtained from the plugin parameters of the first plugin, the business service request is authenticated to obtain the authentication result. If the authentication result indicates authentication failure, the authentication result indicating authentication failure is sent to the user.

[0116] If the authentication result indicates that the authentication is successful, the service interface corresponding to the business service request is used to obtain the request result corresponding to the business service request, and the request result is sent to the user terminal; the user terminal receives the request result corresponding to the business service request and performs subsequent operations.

[0117] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0118] Based on the same concept, this disclosure also provides an authentication device, which is applied to the server side, see [link to relevant documentation]. Figure 5The diagram shown is an architectural schematic of the authentication device provided in this embodiment of the present disclosure, including a first acquisition module 501, an authentication module 502, and a second acquisition module 503. Specifically:

[0119] The first acquisition module 501 is used to acquire the access token carried in the service request in response to the service request initiated by the user terminal.

[0120] The authentication module 502 is used to authenticate the business service request based on the access token using a first plugin included in the gateway of the server, and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request.

[0121] The second acquisition module 503 is used to acquire the request result corresponding to the business service request by utilizing the service interface corresponding to the business service request when the authentication result indicates that the authentication is successful.

[0122] In one possible implementation, the authentication module 502, when authenticating the business service request based on the access token using the first plugin included in the server's gateway and obtaining the authentication result, is used to:

[0123] Obtain the user's identification information from the access token;

[0124] Using the first plugin included in the server-side gateway, the service request is authenticated based on the user's identification information and the permission information of the service interface corresponding to the service request included in the first plugin, and an authentication result is obtained.

[0125] In one possible implementation, the authentication module 502, when authenticating the business service request based on the user's identification information and the permission information of the service interface corresponding to the business service request included in the first plugin of the server-side gateway, and obtaining the authentication result, is used for:

[0126] Using the first plugin included in the gateway of the server, based on the identification information of the user terminal, the preset permission information of the user terminal is obtained, and it is determined whether the preset permission information matches the permission information of the service interface.

[0127] If a match is found, an authentication result is generated to indicate that the authentication has been successful.

[0128] In one possible implementation, the apparatus further includes: an authentication module 504; the authentication module 504, after obtaining the access token carried in the service request, is further configured to:

[0129] The access token is authenticated using the second plugin included in the server's gateway to obtain an authentication result;

[0130] The authentication module 502, when authenticating the business service request based on the access token using the first plugin included in the server-side gateway and obtaining the authentication result, is used for:

[0131] If the authentication result indicates that the authentication is successful, the first plugin included in the gateway on the server side is used to authenticate the business service request based on the access token, and an authentication result is obtained.

[0132] In one possible implementation, the apparatus further includes: a generation module 505; the generation module is used to generate the first plugin:

[0133] Obtain interface information corresponding to at least one service interface; wherein, the interface information includes definition information and permission information;

[0134] Using the third plugin in the server, a permission file is generated based on the interface information corresponding to at least one service interface;

[0135] The file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

[0136] In one possible implementation, the definition information includes: first definition information for describing the request method of the service interface; and / or, second definition information for describing the request parameters of the service interface;

[0137] The permission information includes: first permission information used to describe the operation semantics of resource objects under the service corresponding to the service interface; and second permission information used to control the effective scope of the first permission information.

[0138] Based on the same concept, this disclosure also provides an authentication device, which is applied to a user terminal. See [link to relevant documentation]. Figure 6 The diagram shown is an architectural schematic of the authentication device provided in this embodiment of the present disclosure, including a request module 601 and a receiving module 602. Specifically:

[0139] The request module 601 is used to initiate a business service request carrying an access token to the server, so that the server can use a first plugin included in the server's gateway to authenticate the business service request based on the access token and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request; if the authentication result indicates that the authentication is successful, the request result corresponding to the business service request is obtained using the service interface corresponding to the business service request.

[0140] The receiving module 602 is used to receive the request result corresponding to the business service request.

[0141] In some embodiments, the functions or templates of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0142] Based on the same technical concept, this disclosure also provides an electronic device. (See also...) Figure 7 The diagram shows the structure of an electronic device provided in this embodiment, including a processor 701, a memory 702, and a bus 703. The memory 702 stores execution instructions and includes a main memory 7021 and an external memory 7022. The main memory 7021, also called internal memory, is used to temporarily store computational data in the processor 701 and data exchanged with external memory 7022 such as a hard disk. The processor 701 exchanges data with the external memory 7022 through the main memory 7021. When the electronic device 700 is running, the processor 701 and the memory 702 communicate through the bus 703, causing the processor 701 to execute the following instructions:

[0143] In response to a service request initiated by the user, obtain the access token carried in the service request;

[0144] Using the first plugin included in the gateway of the server, the service request is authenticated based on the access token to obtain the authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the service request.

[0145] If the authentication result indicates that the authentication is successful, the service interface corresponding to the business service request is used to obtain the request result corresponding to the business service request.

[0146] The specific processing flow of the processor 701 can be referred to the description in the above method embodiment, and will not be repeated here.

[0147] Furthermore, this disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the authentication method described in the above-described method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0148] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the authentication method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0149] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0150] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0151] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0152] In addition, the functional units in the various embodiments of this disclosure can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0153] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0154] The above are merely specific embodiments of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. An authentication method, characterized in that, Applied to the server side, including: In response to a service request initiated by the user, obtain the access token carried in the service request; Using the first plugin included in the gateway of the server, the service request is authenticated based on the access token to obtain the authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the service request. If the authentication result indicates that the authentication is successful, the service interface corresponding to the business service request is used to obtain the request result corresponding to the business service request. The step of generating the first plugin includes: Obtain interface information corresponding to at least one service interface; wherein, the interface information includes definition information and permission information; for each service interface, when configuring the definition information of the service interface, extend the permission information of the service interface; Using the third plugin in the server, a permission file is generated based on the interface information corresponding to at least one service interface; The file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

2. The method according to claim 1, characterized in that, The step of using a first plugin included in the server-side gateway to authenticate the business service request based on the access token and obtain an authentication result includes: Obtain the user's identification information from the access token; Using the first plugin included in the gateway of the server, the service request is authenticated based on the user's identification information and the permission information of the service interface corresponding to the service request included in the first plugin, and the authentication result is obtained.

3. The method according to claim 2, characterized in that, The first plugin included in the server-side gateway authenticates the business service request based on the user's identification information and the permission information of the service interface corresponding to the business service request included in the first plugin, and obtains the authentication result, including: Using the first plugin included in the gateway of the server, based on the identification information of the user terminal, the preset permission information of the user terminal is obtained, and it is determined whether the preset permission information matches the permission information of the service interface. If a match is found, an authentication result is generated to indicate that the authentication has been successful.

4. The method according to any one of claims 1-3, characterized in that, After obtaining the access token carried in the service request, the method further includes: The access token is authenticated using the second plugin included in the server's gateway to obtain an authentication result; The step of using a first plugin included in the server-side gateway to authenticate the business service request based on the access token and obtain an authentication result includes: If the authentication result indicates that the authentication is successful, the first plugin included in the gateway on the server side is used to authenticate the business service request based on the access token, and an authentication result is obtained.

5. The method according to claim 1, characterized in that, The definition information includes: first definition information for describing the request method of the service interface; and / or, second definition information for describing the request parameters of the service interface; The permission information includes: first permission information used to describe the operation semantics of resource objects under the service corresponding to the service interface; and second permission information used to control the effective scope of the first permission information.

6. An authentication method, characterized in that, Applied to the user end, including: A service request carrying an access token is sent to the server, so that the server can use a first plugin included in the server's gateway to authenticate the service request based on the access token and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the service request; if the authentication result indicates that the authentication is successful, the service interface corresponding to the service request is used to obtain the request result corresponding to the service request. Receive the request result corresponding to the business service request; The generation step of the first plugin includes: the server obtaining interface information corresponding to at least one service interface; wherein the interface information includes definition information and permission information; for each service interface, the server extends the permission information of the service interface when configuring the definition information of the service interface; the third plugin in the server generates a permission file based on the interface information corresponding to at least one service interface; the file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

7. An authentication device, characterized in that, Applied to the server side, including: The first acquisition module is used to acquire the access token carried in the business service request in response to the business service request initiated by the user terminal. The authentication module is used to authenticate the business service request based on the access token using a first plugin included in the gateway of the server, and obtain the authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request. The second acquisition module is used to acquire the request result corresponding to the business service request by utilizing the service interface corresponding to the business service request when the authentication result indicates that the authentication is successful. A generation module is used to generate the first plugin and obtain interface information corresponding to at least one service interface; wherein, the interface information includes definition information and permission information; for each service interface, when configuring the definition information of the service interface, the permission information of the service interface is extended; using the third plugin in the server, a permission file is generated based on the interface information corresponding to at least one service interface; the file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

8. An authentication device, characterized in that, Applied to the user end, including: The request module is used to initiate a business service request carrying an access token to the server, so that the server can use a first plugin included in the server's gateway to authenticate the business service request based on the access token and obtain an authentication result; wherein, the plugin parameters of the first plugin include the permission information of the service interface corresponding to the business service request; if the authentication result indicates that the authentication is successful, the request result corresponding to the business service request is obtained using the service interface corresponding to the business service request. The receiving module is used to receive the request result corresponding to the business service request; The generation step of the first plugin includes: the server obtaining interface information corresponding to at least one service interface; wherein the interface information includes definition information and permission information; for each service interface, the server extends the permission information of the service interface when configuring the definition information of the service interface; the third plugin in the server generates a permission file based on the interface information corresponding to at least one service interface; the file content in the permission file is used as the plugin parameters for initializing the plugin to generate the first plugin.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the authentication method as described in any one of claims 1 to 6 is performed.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the authentication method as described in any one of claims 1 to 6.

Images