An authentication method, device and computer medium of an industrial micro-service system

Abstract

The application discloses an authentication method of an industrial micro-service system, relates to the field of computers, and is applied to a request client in the industrial micro-service system, wherein a unified authorization server generates an access token, and a target industrial server verifies the identity of the request client based on an IP address and a communication port number in the access token. The identity verification of the request client through the IP address and the communication port number can effectively avoid the problem that the access token is used by a third-party system after the access token is leaked, and the validity period of the access token is not limited, so that the situation that a token update request needs to be frequently initiated and the like is avoided, the information leakage caused by the token leakage is effectively avoided without increasing the system load, and the safety and reliability of the authentication process of the industrial micro-service system are ensured. The application further discloses an authentication device of the industrial micro-service system and a computer medium, which have the same beneficial effects as the authentication method of the industrial micro-service system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computers, and in particular to an authentication method of an industrial micro-service system. The present application also relates to an authentication device of an industrial micro-service system and a computer medium. BACKGROUND

[0002] Industrial micro-service is a carrier of an industrial internet platform, and is a software architecture based on a single function component and realized by modular combination to achieve "loose coupling" application development. An industrial micro-service is a small application oriented to a single function and capable of being independently deployed. When applied, multiple industrial micro-services with different functions and isolated from each other can be combined as needed and communicate with each other through an API (Application Programming Interface) and the like, thus forming a large application system with complete functions. In an industrial micro-service system, a Token authentication method is generally used to realize mutual communication and trusted interaction between each other. The Token itself contains all the information required for identity verification, so that the server applied does not need to store relevant information, thereby increasing the availability and scalability of the system and greatly reducing the pressure on the server.

[0003] The current authentication between industrial micro-services is generally based on this client Token scheme. The specific implementation steps are as follows: after user authentication is successful, the server generates an access token and sends it to the industrial micro-service as a request client; the request client stores the access token and carries the access token with each request; the target industrial service receives the access token and verifies it, thereby confirming the user identity and completing the authentication process. Meanwhile, the access token returned by the server to the request client contains a validity period, and if the validity period is exceeded, the access token will be invalid due to expiration. However, due to the stateless nature of Token in the authentication process, this authentication method has the risk of Token leakage. The Token may be used by other third-party application systems within the validity period. If the leaked access token is within the validity period, the third-party application system can use the access token until the validity period ends. How to avoid third-party application systems from using leaked access tokens to initiate business requests is a technical problem that needs to be solved urgently.

[0004] In the prior art, this situation is mainly avoided by shortening the validity period of the access token, thereby reducing the risk caused by the leakage of the access token. However, this method still has the problem that the leaked access token is used by third-party systems, and cannot effectively avoid the risk of information leakage. Moreover, since the validity period of the access token is shortened, it will also cause the problem that token update requests need to be frequently initiated in the normal service process, thereby increasing the overall load of the system. SUMMARY

[0005] The application aims to provide an authentication method, device and computer medium for an industrial micro-service system, which effectively avoids the problem that the access token is used by a third-party system after being leaked, and the validity period of the access token is not limited, so that the information leakage caused by token leakage is effectively avoided without increasing the system load, and the security and reliability of the authentication process of the industrial micro-service system are ensured.

[0006] To solve the above technical problems, the application provides an authentication method for an industrial micro-service system, which is applied to a request client, and the method comprises the following steps of:

[0007] sending the IP address and the communication port number of the request client to the unified authorization server, so that the unified authorization server generates an access token based on the IP address, the communication port number and a preset encryption mode, and the access token comprises the IP address and the communication port number;

[0008] obtaining the access token generated by the unified authorization server;

[0009] establishing a TCP connection with a target industrial service end based on the access token, so that the target industrial service end verifies the identity of the request client based on the IP address and the communication port number in the access token.

[0010] Preferably, the step of sending the IP address and the communication port number of the request client to the unified authorization server comprises the following steps of:

[0011] establishing a TCP connection with the unified authorization server based on the IP address and the communication port number of the request client;

[0012] transmitting the IP address and the communication port number to the unified authorization server.

[0013] Preferably, before the step of generating an access token by the unified authorization server based on the IP address, the communication port number and a preset encryption mode, the method further comprises the following steps of:

[0014] adding a random number to the communication port number to obtain an authorized access port number by the unified authorization server;

[0015] Correspondingly, the step of generating an access token by the unified authorization server based on the IP address, the communication port number and a preset encryption mode comprises the following steps of:

[0016] The unified authorization server generates an access token based on the IP address, the authorized access port number, and a preset encryption method, wherein the access token comprises the IP address and the authorized access port number.

[0017] Preferably, the target industrial service end authenticates the request client based on the IP address and the communication port number in the access token, comprising:

[0018] The target industrial service end obtains the source IP, the source port number, and the access token of the request client through a TCP connection.

[0019] The access token is decrypted based on a preset decryption method corresponding to the preset encryption method.

[0020] If the decryption is successful, it is determined whether the IP address in the access token is consistent with the source IP and whether the communication port number in the access token is consistent with the source port number.

[0021] If the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number, it is determined that the authentication of the request client is passed.

[0022] Preferably, the access token further comprises a validity period, and before determining that the authentication of the request client is passed, further comprising:

[0023] It is determined whether the access token is within the validity period.

[0024] If yes, it is determined that the authentication of the request client is passed.

[0025] Preferably,

[0026] The unified authorization server generates an access token based on the IP address, the communication port number, and a preset encryption method, comprising:

[0027] The unified authorization server generates an access token based on the IP address, the communication port number, and a private key.

[0028] Correspondingly, the access token is decrypted based on a preset decryption method corresponding to the preset encryption method, comprising:

[0029] The access token is decrypted using a public key corresponding to the private key.

[0030] Preferably, before the unified authorization server generates an access token based on the IP address, the communication port number, and a preset encryption method, further comprising:

[0031] Receive the login information and access request from the requesting client;

[0032] Determine whether the login information of the requesting client is valid;

[0033] If so, the access request from the requesting client is deemed successful, and the process proceeds to the step where the unified authorization server generates an access token based on the IP address, the communication port number, and the preset encryption method.

[0034] To address the aforementioned technical problems, this invention also provides an authentication method for an industrial microservice system, applied to a target industrial server. The method includes:

[0035] A TCP connection is established with the requesting client based on the access token sent by the requesting client. The access token is generated by the unified authorization server based on the requesting client's IP address, the requesting client's communication port number, and a preset encryption method.

[0036] The requesting client is authenticated based on the IP address and communication port number in the access token.

[0037] To address the aforementioned technical problems, the present invention also provides an authentication device for an industrial microservice system, comprising:

[0038] Memory, used to store computer programs;

[0039] A processor is used to implement the authentication method of the industrial microservice system described above when executing the computer program.

[0040] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the authentication method for the industrial microservice system described above.

[0041] The application provides an authentication method of an industrial micro-service system, which is applied to a request client in the industrial micro-service system, and a unified authorization server in the industrial micro-service system generates an access token based on a preset encryption mode, the access token comprises an IP address and a communication port number of the request client, and the request client performs business request and other operations by using the access token in a subsequent authentication process with a target industrial service end, and the target industrial service end performs identity authentication on the request client based on the IP address and the communication port number in the access token, the IP address of each server in a local area network is unique, if there are two or more servers with the same IP address, address conflict will be prompted, and the server cannot perform network communication after the address conflict occurs; and one communication port number in the same computer can be bound to only one TCP connection at the same time, and the binding will fail when the situation of attempting to bind again exists; the identity of the industrial micro-service is bound by using the characteristics of the TCP connection, the identity authentication on the request client by using the IP address and the communication port number can effectively avoid the problem that the access token is used by a third-party system after the access token is leaked, and the validity period of the access token is not limited, and the situation of frequently initiating token update requests does not exist, the information leakage caused by the token leakage is effectively avoided without increasing the system load, and the security and reliability of the authentication process of the industrial micro-service system are ensured.

[0042] The application further provides an authentication method, device and computer readable storage medium of an industrial micro-service system, which have the same beneficial effects as the authentication method of the industrial micro-service system. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the prior art and embodiments. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0044] Figure 1 A flowchart of the authentication method of the industrial micro-service system provided by the application;

[0045] Figure 2 A flowchart of the access token generated by the unified authorization server provided by the application;

[0046] Figure 3 A flowchart of the identity authentication performed by the target industrial service end provided by the application;

[0047] Figure 4 A flowchart of another authentication method of the industrial micro-service system provided by the application;

[0048] Figure 5 A structural schematic diagram of an authentication device of an industrial micro-service system provided by the present application. DETAILED DESCRIPTION

[0049] The core of the present application is to provide an authentication method, device and computer medium of an industrial micro-service system, which effectively avoids the problem that the third-party system uses the leaked access token by verifying the identity of the request client through the IP address and communication port number, and the validity period of the access token is not limited, and there is no need to frequently initiate token update requests, etc., effectively avoiding information leakage caused by token leakage without increasing system load, ensuring the security and reliability of the authentication process of the industrial micro-service system.

[0050] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0051] The authentication method of an industrial micro-service system provided by the present application is mainly applied to an industrial micro-service system, related to computer systems, industrial control, and big data related fields, mainly aiming at the security authentication of each industrial micro-service in the industrial internet architecture, i.e., the industrial micro-service system, which can realize trusted interaction between industrial micro-services and effectively avoid the risk that the third-party application system initiates a business request using the leaked access token. The specific implementation mode of the industrial micro-service system and the specific implementation mode of each industrial micro-service are not particularly limited in the present application, which can be adjusted according to user needs and actual application environment. The specific implementation mode is described in detail below.

[0052] Please refer to Figure 1 , Figure 1 A flowchart of the authentication method of an industrial micro-service system provided by the present application;

[0053] To solve the above technical problems, the present application provides an authentication method of an industrial micro-service system, which is applied to a request client, and the method comprises the following steps:

[0054] S11: sending the IP address and communication port number of the request client to the unified authorization server, so that the unified authorization server generates an access token based on the IP address, communication port number and preset encryption mode, and the access token comprises the IP address and communication port number;

[0055] It can be understood that the access token is generated by the unified authorization server, and the request client needs to provide the IP address (Internet Protocol Address) and the communication port number of the request client required for generating the access token. After obtaining the IP address and the communication port number of the request client, the unified authorization server generates an encrypted access token including the IP address and the communication port number of the request client through a preset encryption method. The encryption method of the access token also has multiple choices, which can be realized through a secret key pair, and the present application does not make special limitation here.

[0056] Specifically, the connection relationship and specific communication method between the request client and the unified authorization server are not particularly limited in the present application, and the data exchange between the two can be realized through multiple ways. The access token can be generated based on JWT (Json Web Token). JWT is a token based on JSON (JavaScript Object Notation) for declaring certain claims on the network. The specific implementation method of generating the access token is not particularly limited in the present application, and can be adjusted according to the actual application requirements. Other contents in the access token are not particularly limited in the present application, and depend on user requirements and other factors.

[0057] The specific process of generating the access token can be as follows: first, obtaining the underlying TCP connection of the authorized access request, binding the host IP of the request client, then generating a random communication port based on the source port of the request connection, further binding the request connection information of the industrial microservice to be authorized, finally, signing and encrypting the request connection information of the industrial microservice and other information together through a private key to generate an access token, and returning the access token to the industrial microservice as the request client waiting for authorization.

[0058] Generally, the IP address of the request client refers to the IP address of the server where the industrial microservice as the request client is located, and the communication port number generally refers to the information of a communication port randomly selected by the request client on the server. For an industrial microservice, the corresponding IP address and communication port number are unique. In the industrial microservice system, a large number of industrial microservices are deployed on the backend server cluster to form a local area network environment, and the IP of each server in the local area network is unique. If there are two or more same server IPs, an address conflict will occur, and the server cannot perform network communication. Moreover, a communication port on the same computer can only be bound by one TCP connection at the same time, and when trying to bind again, it will fail. This realizes the binding of the request client with the IP address and the communication port number, and third-party software cannot perform business requests by operations such as forging IP addresses and communication port numbers, so as to realize the binding of the identity of the request client through the corresponding access token, thereby perfecting the subsequent identity verification process. The specific selection logic and implementation of the communication port number sent by the request client are not particularly limited herein.

[0059] S12: Obtain the access token generated by the unified authorization server.

[0060] It can be understood that the request client needs to carry the access token when performing data communication and other operations with other industrial microservices, and must request other industrial microservices through the IP address and communication port in the access token. The request client can only perform subsequent business requests and other operations after obtaining the access token generated by the unified authorization server, and complete the identity verification with other industrial microservices through the access token, thereby realizing the authentication process of the industrial microservice system.

[0061] Specifically, there are many ways for the request client to obtain the access token from the unified authorization server, which can be realized by establishing a TCP (Transmission Control Protocol) connection, or by other data transmission methods. The specific implementation of obtaining the access token is not particularly limited herein.

[0062] S13: Establish a TCP connection based on the access token and the target industrial service end, so as to perform identity verification on the request client by the target industrial service end based on the IP address and the communication port number in the access token.

[0063] Specifically, the request client can carry the access token to interact information with the target industrial service end, can carry the access token to initiate a business request to the target industrial service end, and the target industrial service end receives the business request signal, establishes a TCP connection with the request client through the IP address and communication port number of the request client in the access token, and then authenticates the request client through the TCP connection to ensure that the request client establishing the connection is consistent with the request client corresponding to the access token, so as to prove that the request client establishing the connection is the correct request client that needs to make the business request. The specific implementation process of the identity authentication also includes multiple steps, which are not particularly limited by the present application.

[0064] This identity authentication method can be used in the RPC (Remote Procedure Call) communication framework based on TCP connection, and the identity of the industrial micro service can be bound by binding the request IP and the request port in the access token and using the TCP connection characteristics, so as to ensure the accuracy and reliability of the identity authentication process. RPC is a protocol that requests services from remote computer programs over a network without understanding the underlying network technology.

[0065] It can be understood that the target industrial service end refers to the target end of the request client initiating a business request, which will authenticate the request client after establishing a connection with the request client. If the identity authentication is passed, the corresponding business processing operation will be performed according to the obtained business request sent by the request client; if the identity authentication is not passed, it is proved that the request client establishing the connection is not the correct request client sending the business request, and an invalid signal can be returned directly or no corresponding operation is performed.

[0066] Specifically, the execution subject of the three steps S11-S13 is the request client, which refers to the industrial micro service in the industrial micro service system as the industrial micro service initiating a business request. For the request client, the specific selection and implementation mode of the unified authorization server and the target industrial service end are not particularly limited by the present application. The same request client can initiate a business request to multiple target industrial service ends, and the specific implementation process is not particularly limited by the present application.

[0067] The application provides an authentication method of an industrial micro-service system, wherein a TCP-based RPC communication framework is used between industrial micro-services, each industrial micro-service is enabled to realize mutual calling between data by carrying an access token, the access token can be generated by a unified authorization service based on a JWT using a private key, and the access token additionally carries an IP address and a communication port number as credentials of the industrial micro-service; when one of the industrial micro-services initiates a business request to another industrial micro-service through the access token, the called industrial micro-service as a target industrial service end can verify the validity of the access token through a public key, and then verify whether the source IP and the source port of the TCP connection initiating the business request are consistent with the registration in the access token, if consistent, the verification is passed, and if inconsistent, the verification is failed.

[0068] By binding the IP address and the communication port number, when other APPs (application, application software) use the leaked access token, if the APPs initiate a request by modifying the IP address in a local area network, IP conflict will be caused, and if the APPs initiate a request using the same port on the same host, the port is already used, so that binding fails, the request cannot be sent, and finally, the risk that the other APPs initiate a business request through the leaked access token is prevented.

[0069] The application provides an authentication method of an industrial micro-service system, which is applied to a request client in the industrial micro-service system, a unified authorization server in the industrial micro-service system generates an access token based on a preset encryption mode, the access token includes an IP address and a communication port number of the request client, and the request client performs a business request and the like through the access token in a subsequent authentication process with a target industrial service end; and the target industrial service end performs identity authentication on the request client based on the IP address and the communication port number in the access token. The IP address of each server in a local area network is unique, if there are two or more servers with the same IP address, address conflict will be prompted, and after the address conflict occurs, the server cannot perform network communication. Moreover, one communication port number in the same computer can be bound by only one TCP connection, and if there is a case of attempting to bind again, the binding will fail. The identity of the industrial micro-service is bound by using the characteristics of the TCP connection, the identity authentication on the request client through the IP address and the communication port number can effectively avoid the problem that the access token is used by a third-party system after the access token is leaked, and the validity period of the access token is not limited, so that the problem of frequently initiating a token update request and the like does not exist. On the premise of not increasing the system load, the information leakage problem caused by the token leakage is effectively avoided, and the security and reliability of the authentication process of the industrial micro-service system are ensured.

[0070] On the basis of the above embodiment,

[0071] As a preferred embodiment, the IP address and the communication port number of the request client are sent to the unified authorization server, including:

[0072] A TCP connection is established between the unified authorization server and the request client based on the IP address and the communication port number of the request client.

[0073] The IP address and the communication port number are transmitted to the unified authorization server.

[0074] It can be understood that in order to generate an access token, the request client needs to send the IP address and the communication port number of the request client to the unified authorization server, and the unified authorization server can directly establish a TCP connection with the request client through the obtained IP address and communication port number of the request client, thereby facilitating the transmission process of the IP address and the communication port number. At the same time, the subsequent request client for obtaining the access token can also be directly realized through the TCP connection established at this time, which is convenient, safe and reliable.

[0075] Specifically, the unified authorization server can directly establish a TCP connection with the request client using the IP address and the communication port number of the request client that needs to be obtained, thereby facilitating the subsequent transmission process of the IP address and the communication port number. And due to the existence of the confirmation mechanism and the retransmission mechanism of the TCP connection, it is guaranteed that the transmission process is reliable and stable, and in the process of data transmission, there will be a window mechanism to determine the size of the transmitted data to achieve the effect of congestion control. After the data transmission is completed, the connection will be disconnected to release system resources, effectively realizing the data connection between the request client and the unified authorization server, which is reliable and stable, and is conducive to the accurate performance of the subsequent authentication process of the industrial micro-service system.

[0076] As a preferred embodiment, before the unified authorization server generates an access token based on the IP address, the communication port number and the preset encryption method, it further includes:

[0077] The unified authorization server adds a random number to the communication port number to obtain an authorized access port number.

[0078] Correspondingly, the unified authorization server generates an access token based on the IP address, the communication port number and the preset encryption method, including:

[0079] The unified authorization server generates an access token based on the IP address, the authorized access port number and the preset encryption method, and the access token includes the IP address and the authorized access port number.

[0080] Considering that the communication port number sent to the unified authorization server is temporarily occupied by the TCP connection between the request client and the unified authorization server after the TCP connection is established between the request client and the unified authorization server, in order to prevent the problem of port conflict that may exist when the TCP connection is subsequently established between the request client and the target industrial server, the unified authorization server adds a random number to the communication port number to obtain an authorized access port number before generating the access token, generally a random number within 100 is selected, and then the access token is generated based on the IP address, the authorized access port number and a preset encryption mode, and the subsequent TCP connection between the request client and the target industrial server is realized through the authorized access port. It can be understood that there are more than one way to obtain the authorized access port number, and other ways can also be used, which are not particularly limited in the present application.

[0081] In order to prevent the problem of port conflict that may exist when the TCP connection is subsequently established between the request client and the target industrial server, the unified authorization server obtains an authorized access port number before generating the access token, and then generates the access token based on the IP address, the authorized access port number and a preset encryption mode, and the authorized access port is used as the communication port for the TCP connection between the request client and the target industrial server, which avoids the problem of port conflict that may exist when the TCP connection is established between the request client and the unified authorization server and the target industrial server, and is beneficial to the correct performance of the subsequent identity verification process of the target industrial server, and further ensures the implementation of the authentication process of the industrial micro-service system.

[0082] As a preferred embodiment, the target industrial server performs identity verification on the request client based on the IP address and the communication port number in the access token, comprising:

[0083] The target industrial server obtains the source IP, the source port number and the access token of the request client through the TCP connection;

[0084] Decrypt the access token based on a preset decryption mode corresponding to the preset encryption mode;

[0085] If the decryption is successful, it is judged whether the IP address in the access token is consistent with the source IP, and whether the communication port number in the access token is consistent with the source port number;

[0086] If the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number, it is determined that the identity verification of the request client is passed.

[0087] Specifically, the identity authentication process of the target industrial service server to the request client includes multiple steps. First, the access token needs to be decrypted by a preset decryption method corresponding to a preset encryption method to verify the validity of the access token. If the decryption fails, the access token is invalid, and invalid information is returned directly or other operations are performed. If the decryption is successful, the access token is valid, and subsequent identity authentication can be continued. After successful decryption, it can be judged whether the IP address in the access token is consistent with the source IP and whether the communication port number in the access token is consistent with the source port number. If there is inconsistency, it means that the request client establishing the connection is inconsistent with the request client corresponding to the access token. At this time, the request client establishing the connection is not the correct request client, and the identity authentication cannot pass, and invalid operation can be returned to the request client at this time or other operations are directly performed. Only when the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number, it means that the request client establishing the connection at this time is the correct request client, and the identity authentication of the request client is passed, so that the subsequent business request processing process can be carried out.

[0088] It can be understood that the source IP and the source port number refer to the IP address and the communication port number of the request client establishing the connection at this time. By comparing the IP address and the communication port number, it can be confirmed whether the request client binding the access token is consistent with the request client establishing the connection at this time, so as to realize the identity authentication process of the request client.

[0089] Specifically, the identity authentication process of the target industrial service server to the request client includes multiple steps. Through the preset encryption method, the comparison process of the IP address and the communication port number realizes the identity authentication of the request client. By binding the IP address and the communication port number in the access token, the identity of the industrial micro service is bound by using the TCP connection characteristics, so as to solve the problem of using the access token by the third-party application system after the access token is leaked, avoid the risk of access token leakage, ensure the correctness of the request client through multiple verification processes, avoid the risk of information leakage, perfect the authentication process of the industrial micro service system, ensure the accuracy of the authentication process, and improve the security and reliability of the authentication process.

[0090] As a preferred embodiment, the access token further includes a validity period, and before determining that the identity authentication of the request client passes, the following steps are further included:

[0091] determining whether the access token is within the validity period;

[0092] If yes, the step of determining that the identity authentication of the request client passes is entered.

[0093] Considering that the validity period is usually set in the application process of the access token to improve the security of the system, the validity period of the access token is also included in the access token, and a verification process of the validity period of the access token by the target industrial service end is added to ensure that the access token is a valid access token within the validity period. The setting method and specific implementation manner of the validity period of the access token are not particularly limited in the present application, and different types and different periods of validity period can be set according to different business request information and user demand.

[0094] Considering that the validity period is usually set in the application process of the access token to improve the security of the system, the validity period of the access token is also included in the access token, and a verification process of the validity period of the access token by the target industrial service end is added to ensure that the access token is a valid access token within the validity period. The setting method and specific implementation manner of the validity period of the access token are not particularly limited in the present application, and different types and different periods of validity period can be set according to different business request information and user demand.

[0095] As a preferred embodiment,

[0096] The unified authorization server generates the access token based on the IP address, the communication port number and a preset encryption mode, comprising:

[0097] The unified authorization server generates the access token based on the IP address, the communication port number and a private key;

[0098] Correspondingly, the access token is decrypted based on a preset decryption mode corresponding to the preset encryption mode, comprising:

[0099] The access token is decrypted using a public key corresponding to the private key.

[0100] It can be understood that the encryption process of the access token can be implemented using an asymmetric encryption algorithm, the unified authorization server encrypts the access token through the private key, and each industrial micro service of the target industrial service end decrypts through the corresponding public key, thereby realizing the verification of the validity of the access token. The setting method and specific implementation manner of the private key and the public key are not particularly limited in the present application.

[0101] Specifically, the encryption process of the access token is implemented using an asymmetric encryption algorithm, the unified authorization server encrypts the access token through a private key, and each industrial microservice of the target industrial service end decrypts through a corresponding public key, thereby verifying the effectiveness of the access token. Encryption and decryption use two different keys, which are good for confidentiality and high in security, further improving the accuracy of the identity verification process, ensuring the security and reliability of the identity verification process of the target industrial service end to the requesting client, perfecting the authentication process of the industrial microservice system, ensuring the accuracy of the authentication process, and ensuring the security and reliability of the authentication process.

[0102] As a preferred embodiment, before the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption method, the following steps are further included:

[0103] Receiving the login information and access application of the requesting client;

[0104] Determining whether the login information of the requesting client is valid;

[0105] If yes, it is determined that the access application of the requesting client is passed, and the step of generating the access token by the unified authorization server based on the IP address, the communication port number and the preset encryption method is entered.

[0106] It can be understood that the unified authorization server also needs to perform login verification on the requesting client. The requesting client carries its own login information, including AppID and AppSecret, etc., when sending the access application for other industrial microservices that need to be authorized. The unified authorization server parses the AppID and AppSecret in the request content when receiving the access application of the requesting client, and verifies whether they are valid. If not, it is directly returned, and the login verification fails. If valid, the operation of generating the access token is continued.

[0107] Specifically, the process of the unified authorization server performing login verification on the requesting client is added. Whether the requesting client is valid is determined by the login information carried by the requesting client when sending the access application that needs to be authorized, so as to ensure the validity of the requesting client, perfect the authentication process of the industrial microservice system, ensure the accuracy of the authentication process, and ensure the security and reliability of the authentication process.

[0108] Please refer to Figure 2 , Figure 2 A flowchart of the process of generating an access token by a unified authorization server provided by the present application is provided. The approximate steps of generating the access token are described as follows:

[0109] The unified authorization server obtains the request source IP and port, that is, the IP address and bound communication port of the request client, through the TCP connection established between the request client and the unified authorization server after receiving the authorization request of the request client; then the AppID and AppSecret of the request client in the request content are parsed and verified for validity, and if invalid, the request client is directly returned as unauthorized industrial microservice, the authorization of the request client fails, and if valid, the access token is generated; according to the communication port of the request client, a valid new port is generated as the authorized access port by adding a random number within 100; the IP address of the request client and the generated authorized access port are used as the unique identification code of the industrial microservice, and a private key is used to generate an access token, which is used as the IP and port of the request client to access other industrial microservices, thereby effectively preventing the case that the access token is leaked and used by other Apps; after the access token is generated, the generated access token is returned to the request client.

[0110] Please refer to Figure 3 , Figure 3 The flowchart of the identity verification process of the target industrial service provided by the application is shown in the figure; the steps are as follows:

[0111] The industrial microservice as the request client initiates a business request after establishing a connection, at which time the called industrial microservice as the target industrial service initiates the identity verification process of the access token; the called industrial microservice receives the business request and obtains the corresponding request source IP and request source port through the established TCP connection; at the same time, the access token is also obtained and decrypted using the public key to determine whether the access token is valid; if the access token is invalid, the request client is directly returned, and if the access token is valid, the request source IP and request source port registered in the access token are compared with the link information in the actual established TCP connection, including the request source IP and request source port, to determine whether they are consistent; if not, the request client is returned as invalid and the connection is disconnected, and if consistent, the token is verified for expiration; the validity period of the access token is verified, and if expired, the request client is returned as invalid, and if valid, the corresponding business request is processed, and the final business processing result is returned.

[0112] Please refer to Figure 4 , Figure 4 The flowchart of another authentication method of the industrial microservice system provided by the application is shown in the figure; wherein the industrial microservice A refers to the industrial microservice as the request client, the industrial microservice B refers to the industrial microservice as the target industrial service, and the authentication method of the industrial microservice system includes ten steps as shown in the figure.

[0113] To solve the above technical problems, the application further provides an authentication method of an industrial micro-service system, applied to a target industrial service end, and the method comprises the following steps:

[0114] Based on the access token sent by the request client, a TCP connection is established with the request client, and the access token is generated by a unified authorization server based on the IP address of the request client, the communication port number of the request client and a preset encryption mode;

[0115] Based on the IP address and the communication port number in the access token, the identity of the request client is verified.

[0116] It can be understood that the present embodiment takes the target industrial service end as the execution subject to introduce the authentication method of the industrial micro-service system, further improves the authentication process of the industrial micro-service system from the perspective of the target industrial service end, ensures the accurate application of the authentication method of the industrial micro-service system, further improves the authentication process of the industrial micro-service system, ensures the accuracy of the authentication process, and guarantees the security and reliability of the authentication process.

[0117] For the authentication method of the industrial micro-service system provided by the application, please refer to the above method embodiment, and the application will not be described here.

[0118] Please refer to Figure 5 , Figure 5 The application provides a structural schematic diagram of an authentication device of an industrial micro-service system.

[0119] To solve the above technical problems, the application further provides an authentication device of an industrial micro-service system, comprising:

[0120] The memory 1 is used for storing a computer program;

[0121] The processor 2 is used for executing the computer program to realize the steps of the above-mentioned authentication method of the industrial micro-service system.

[0122] The processor 2 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 2 can be implemented in at least one of a hardware form of a DSP (Digital Signal Processor), an FPGA (Field-Programmable Gate Array), a PLA (Programmable Logic Array). The processor 2 can also include a main processor and a coprocessor, the main processor being a processor for processing data in a wake-up state, also known as a central processor; the coprocessor being a low-power processor for processing data in a standby state. In some embodiments, the processor 2 can integrate a GPU (graphics processing unit) for rendering and drawing the content required to be displayed by the display screen. In some embodiments, the processor 2 can further include an AI (Artificial Intelligence) processor for processing machine learning-related computing operations.

[0123] The memory 1 can include one or more computer-readable storage media, which can be non-transitory. The memory 1 can also include a high-speed random access memory, and a non-volatile memory such as one or more disk storage devices, flash memory devices. In the present embodiment, the memory 1 is at least used to store the following computer programs, wherein the computer programs are loaded and executed by the processor 2, and can realize the related steps of the authentication method of the industrial micro-service system disclosed in any one of the preceding embodiments. In addition, the resources stored by the memory 1 can also include an operating system and data, etc., and the storage mode can be temporary storage or permanent storage. The operating system can include Windows, Unix, Linux, etc. The data can include but is not limited to the data of the authentication method of the industrial micro-service system, etc.

[0124] In some embodiments, the authentication device of the industrial micro-service system can further include a display screen, an input / output interface, a communication interface, a power supply, and a communication bus.

[0125] Those skilled in the art can understand that, Figure 5 The structure shown in the figure does not constitute a limitation on the authentication device of the industrial micro-service system, and can include more or fewer components than those shown in the figure.

[0126] For the authentication device of the industrial micro-service system provided by the present application, please refer to the above-mentioned method embodiments, which will not be described here again.

[0127] To solve the above technical problems, the application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program.

[0128] It can be understood that if the method in the above embodiment is implemented in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and performs all or part of the steps of the methods described in the various embodiments of the present application. Specifically, the computer readable storage medium can include, but is not limited to, any type of disk, including floppy disks, optical disks, and mobile hard disks, or any type of medium or device suitable for storing instructions, data, and the like. The present application does not make special limitations here.

[0129] For the computer readable storage medium provided by the present application, please refer to the above method embodiment, and the present application will not be repeated here.

[0130] To solve the above technical problems, the application further provides an authentication system of an industrial micro-service system, applied to a request client, the system comprising:

[0131] The token generation unit is configured to send the IP address and the communication port number of the request client to the unified authorization server, so that the unified authorization server generates an access token based on the IP address, the communication port number, and a preset encryption method, and the access token comprises the IP address and the communication port number.

[0132] The token acquisition unit is configured to acquire the access token generated by the unified authorization server.

[0133] The identity verification unit is configured to establish a TCP connection with the target industrial service end based on the access token, so that the target industrial service end performs identity verification on the request client based on the IP address and the communication port number in the access token.

[0134] As a preferred embodiment, the token generation unit comprises:

[0135] The connection establishment unit is configured to establish a TCP connection with the unified authorization server based on the IP address and the communication port number of the request client.

[0136] The transmission unit is configured to transmit the IP address and the communication port number to the unified authorization server.

[0137] As a preferred embodiment, the unified authorization server comprises:

[0138] The generating authorization port unit is configured to add a random number to the communication port number to obtain an authorized access port number.

[0139] The generating token sub-unit is configured to generate an access token based on the IP address, the authorized access port number and a preset encryption mode, the access token including the IP address and the authorized access port number.

[0140] As a preferred embodiment, the target industrial service end includes:

[0141] The obtaining source unit is configured to obtain the source IP, the source port number and the access token of the request client through the TCP connection.

[0142] The decrypting unit is configured to decrypt the access token based on a preset decryption mode corresponding to the preset encryption mode, and trigger the judging unit if the decryption is successful.

[0143] The judging unit is configured to judge whether the IP address in the access token is consistent with the source IP and whether the communication port number in the access token is consistent with the source port number, and trigger the identity authentication passing unit if the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number.

[0144] The identity authentication passing unit is configured to determine that the identity authentication of the request client is passed.

[0145] As a preferred embodiment, the access token further includes a validity period, and the target industrial service end further includes:

[0146] The validity period judging unit is configured to judge whether the access token is within the validity period, and trigger the identity authentication passing unit if yes.

[0147] For the authentication system of the industrial micro-service system provided by the present application, please refer to the above method embodiment, and the present application will not be described here.

[0148] In the specification, each embodiment is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the related parts can be referred to the method part.

[0149] Those skilled in the art will further realize that the mechanisms of the various examples described herein are capable of being implemented using any number of combinations of the described features. Accordingly, these examples are not limited to the mechanisms described herein, but rather, the intent is to cover all modifications and alternatives equivalent thereto. The preceding description of the examples is illustrative, and not restrictive. Many other examples will be apparent to those of skill in the art upon reviewing the above description. The scope of the examples should, therefore, be determined not with reference to the above description, but instead should be given to the appended claims, along with their full scope of equivalents.

[0150] The above description of disclosed examples allows one of ordinary skill in the art to make and use the application. Modifications of those examples will be obvious to those of ordinary skill in the art, and the generic principles defined herein can be applied to other examples without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the examples shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An authentication method of an industrial microservice system, characterized by, The method applied to a request client comprises: sending an IP address and a communication port number of the request client to a unified authorization server, so that the unified authorization server generates an access token based on the IP address, the communication port number and a preset encryption mode, the access token comprising the IP address and the communication port number; obtaining the access token generated by the unified authorization server; establishing a TCP connection with a target industrial server based on the access token, so that the target industrial server authenticates the request client based on the IP address and the communication port number in the access token; sending the IP address and the communication port number of the request client to the unified authorization server comprises: establishing a TCP connection with the unified authorization server based on the IP address and the communication port number of the request client; transmitting the IP address and the communication port number to the unified authorization server; wherein the communication port number is information of a communication port bound to the request client, and for one industrial microservice, the corresponding IP address and communication port number are both unique; the target industrial server authenticates the request client based on the IP address and the communication port number in the access token comprises: the target industrial server obtains a source IP, a source port number and the access token of the request client through the TCP connection; decrypts the access token based on a preset decryption mode corresponding to the preset encryption mode; if the decryption is successful, judges whether the IP address in the access token is consistent with the source IP and whether the communication port number in the access token is consistent with the source port number; if the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number, it is determined that the authentication of the request client is passed; before the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode, it further comprises: the unified authorization server adds a random number to the communication port number to obtain an authorized access port number; correspondingly, the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode comprises: the unified authorization server generates the access token based on the IP address, the authorized access port number and the preset encryption mode, the access token comprising the IP address and the authorized access port number; the access token further comprises a validity period, and before it is determined that the authentication of the request client is passed, it further comprises: judging whether the access token is within the validity period; if yes, entering the step of determining that the authentication of the request client is passed.

2. The authentication method of the industrial microservice system according to claim 1, wherein the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode comprises: the unified authorization server generates the access token based on the IP address, the communication port number and a private key; ​ Correspondingly, the access token is decrypted based on a preset decryption mode corresponding to the preset encryption mode, and the method comprises the steps of: Decrypting the access token using a public key corresponding to the private key.

3. The authentication method of an industrial microservice system according to any one of claims 1 to 2, characterized in that, Before the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode, the method further comprises the steps of: Receiving login information and an access application of the request client; Determining whether the login information of the request client is valid; If yes, determining that the access application of the request client is passed, and entering the step of generating the access token by the unified authorization server based on the IP address, the communication port number and the preset encryption mode.

4. An authentication method of an industrial microservice system, characterized by, The method is applied to a target industrial server, and the method comprises the steps of: Based on the access token sent by the request client, a TCP connection is established between the request client and the target industrial server, wherein the access token is generated by a unified authorization server based on an IP address of the request client, a communication port number of the request client and a preset encryption mode; wherein the request client establishes a TCP connection with the unified authorization server based on the IP address and the communication port number of the request client, and transmits the IP address and the communication port number to the unified authorization server; Based on the IP address and the communication port number in the access token, the request client is authenticated; The communication port number is information of a communication port bound to the request client, and for one industrial microservice, the corresponding IP address and communication port number are unique; The target industrial server authenticates the request client based on the IP address and the communication port number in the access token, and the method comprises the steps of: The target industrial server obtains a source IP, a source port number and the access token of the request client through the TCP connection; The access token is decrypted based on a preset decryption mode corresponding to the preset encryption mode; If the decryption is successful, it is determined whether the IP address in the access token is consistent with the source IP, and whether the communication port number in the access token is consistent with the source port number; If the IP address in the access token is consistent with the source IP and the communication port number in the access token is consistent with the source port number, it is determined that the authentication of the request client is passed. Before the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode, the method further comprises the steps of: The unified authorization server adds a random number to the communication port number to obtain an authorized access port number; Correspondingly, the unified authorization server generates the access token based on the IP address, the communication port number and the preset encryption mode, and the method comprises the steps of: The unified authorization server generates the access token based on the IP address, the authorized access port number and the preset encryption mode, and the access token comprises the IP address and the authorized access port number; The access token further comprises a validity period, and before it is determined that the authentication of the request client is passed, the method further comprises the steps of: Determining whether the access token is within the validity period; If yes, go to the step of determining that the request client authentication is passed.

5. An authentication apparatus of an industrial microservice system, characterized by, Comprise: A memory for storing a computer program; A processor for implementing the steps of the authentication method of the industrial micro-service system according to any one of claims 1 to 4 when executing the computer program.

6. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the authentication method of the industrial micro-service system according to any one of claims 1 to 4.

Images