Authorization of service requests in multi-cluster systems

Abstract

The present invention relates to authorization of service requests in a multi-cluster system. A method comprises receiving a dependency chain matrix from each of a plurality of service endpoints in a multi-cluster system, fusing the received dependency chain matrices into a fused data matrix; sharing the fused data matrix as a sidecar module to each of the plurality of service endpoints, receiving a service request for at least one of the plurality of service endpoints by an external user or service, verifying authorization for the service request based on the fused data matrix, and generating a label attached to the service request and passed downstream to the plurality of service endpoints.

Description

Technical Field

[0001] This invention relates to the authorization of service requests in a multi-cluster system. More specifically, this invention relates to a method for tag-based on-the-fly authorization of service dependency chains in a microservice-based multi-cluster ecosystem. Background Technology

[0002] In large-scale, distributed, multi-cluster container-based microservice ecosystems, requests to service endpoints are typically generated by users or by another service. For service requests authorized by the endpoint, multiple microservices can work sequentially or in parallel in the background as a group to complete the request. Service requests must pass an authorization check at each microservice level to be authorized. This process can degrade overall service quality by wasting computation time, consuming excessive memory and network bandwidth, and causing response latency. Therefore, systems and methods to improve this authorization process are well-received in the art. Summary of the Invention

[0003] Embodiments of the present invention relate to a method for authorizing service requests in a multi-cluster system, and associated computer systems and computer program products. One or more processors of the computer system receive a dependency chain matrix from each of a plurality of service endpoints in the multi-cluster system. The one or more processors of the computer system fuse the received dependency chain matrices into a fused data matrix. The one or more processors of the computer system share the fused data matrix as a sidecar module with each of the plurality of service endpoints. The one or more processors of the computer system receive a service request from an external user or service for at least one of the plurality of service endpoints. The one or more processors of the computer system verify authorization of the service request based on the fused data matrix. The one or more processors of the computer system generate tags appended to the service request and pass them downstream to the plurality of service endpoints. Attached Figure Description

[0004] Figure 1 A schematic diagram of a system for authorizing service requests in a multi-cluster system according to an embodiment of the present invention is shown;

[0005] Figure 2 The use according to an embodiment of the present invention is shown. Figure 1 The process flow of the system that authorizes service requests in a multi-cluster system;

[0006] Figure 3A A first service matrix according to an embodiment of the present invention is shown;

[0007] Figure 3B A second service matrix according to an embodiment of the present invention is shown;

[0008] Figure 3C A third service matrix according to an embodiment of the present invention is shown;

[0009] Figure 4A A first dependency chain matrix for inter-cluster authorization is shown according to an embodiment of the present invention;

[0010] Figure 4B A second dependent chain matrix for inter-cluster authorization is shown according to an embodiment of the present invention;

[0011] Figure 5 An embodiment of the invention is shown for use with Figure 1 The entry system for authorizing service requests in a multi-cluster system;

[0012] Figure 6 A method for authorizing service requests in a multi-cluster system according to an embodiment of the present invention is shown;

[0013] Figure 7 This paper illustrates another method for authorizing service requests in a multi-cluster system according to an embodiment of the present invention;

[0014] Figure 8 An embodiment of the invention is shown for use with Figure 1 and 5 A block diagram of a computer system and engine capable of implementing, for example, Figure 2 , 6 And those methods of number 7;

[0015] Figure 9 A cloud computing environment according to an embodiment of the present invention is shown;

[0016] Figure 10 An abstract model layer according to an embodiment of the present invention is shown. Detailed Implementation

[0017] This invention recognizes the existing authorization process for service requests in multi-cluster systems, which utilizes Policy Enforcement Point (PEP), Policy Decision Point (PDP), Policy Information Point (PIP), and Policy Management Point (PAP). In the prior art, a user or external service logs in from an Identity and Access Management System (IAM) and obtains a token (e.g., JWT ID token, OAUTH access token, sam1 token, etc.). The user or external service then attempts to access a protected resource from the service within the multi-cluster system. The PEP intercepts the request sent to the PDP to verify user authorization. The PDP then evaluates the access policy associated with the request (e.g., user information from the user's token), and retrieves attributes associated with the request from the PIP. Based on the policy and underlying attributes, the user is authorized to access the protected resource. The policy is created and managed by the PAP. This process requires each microservice outside the same cluster or integrated multi-cluster system to independently perform authorization checks based on the user's token. This authorization request process occurs at each microservice entry point in the chain, which degrades the overall quality of service. Because microservices are developed and deployed independently by different teams, each of these services handles authorization independently, leading to these problems. Therefore, this invention recognizes that new systems and methods for improving service quality will be well received.

[0018] This invention envisions service endpoints or microservices within a cluster providing or publishing information about cluster authorization levels and permitted operations to a centralized system as part of the service endpoint startup process. This information can be received by the centralized system, which can be the cluster's entry module. The entry module can examine data received from the service endpoints and compile, generate, or aggregate a dependency chain matrix for each service endpoint supported by the cluster. This dependency chain matrix is ​​pre-shared with the sidecar modules of each service in the cluster and changes whenever service endpoint access privileges change. When a request arrives, the entry module is envisioned to verify authorization and generate a permission tag attached to the original request and passed down the chain. Only the centralized system (i.e., the entry module) has the permission to attach tags to requests in this way. Therefore, all requests can pass through either the centralized system or the entry module. If any malformed or misbehaving service attempts to send a request directly to another service without going through the centralized system, the service sidecar module will detect the missing tag and reject the request, thus maintaining the integrity of the overall system.

[0019] Figure 1A schematic diagram of a system 10 for authorizing service requests in a multi-cluster system according to an embodiment of the present invention is shown. System 10 includes a first cluster 12 and a second cluster 14. The first cluster 12 includes an entry computer system 16, which can be considered an entry module, connected to an identity and access management system 18. The entry computer system 16 is also shown communicating with microservices 20, 22, and 24. An external user 26 is shown connected to the first cluster 12 and specifically to its entry computer system 16. Similarly, an external service 28 is also shown connected to the first cluster 12 and specifically to its entry computer system 16.

[0020] Similar to the first cluster 12, the second cluster 14 includes an entry computer system 30, which can be considered as an entry module connected to the identity and access management system 32. The entry computer system 30 is also shown communicating with microservices 34, 36, and 38. An external user 40 is shown connected to the second cluster 14, and specifically to its entry computer system 30. Similarly, an external service 42 is also shown connected to the second cluster 14, and specifically to its entry computer system 30.

[0021] The corresponding access management systems 20 and 22 of the first and second clusters 12 and 14 can be incorporated into the corresponding entry computer systems 16 and 18, or can be separate devices, servers, or computer systems from the corresponding entry computer systems 16 and 18. Although only two clusters 12 and 14 are shown, the system contemplated herein may include many clusters. Moreover, as shown, each cluster 12 and 14 includes three microservices; however, more or fewer microservices are envisioned for each cluster. As shown, various microservices can communicate with one or more other microservices in the same cluster or even in different clusters. Further, as shown, entry computer systems 16 and 18 are operatively communicable, as described below.

[0022] Figure 2 The use according to an embodiment of the present invention is shown. Figure 1 The process 100 describes a method for authorizing service requests in a multi-cluster system. As shown, the processing steps on the left represent steps initiated by services or microservices within the cluster. However, these steps may include additional steps, such as receiving information executed by other components of the cluster, such as an ingress module or computer system. Similarly, the processing steps on the right represent steps initiated by an ingress module or computer system within the cluster.

[0023] As shown in the figure, process flow 100 begins at step 110, thus presenting the system, such as system 10. According to process flow 100, in step 120, different microservices or services in the cluster publish information including a service matrix to the ingress computer system. This information may include service endpoint information, service location, operation, and permission level. This information is received by the cluster's ingress module or computer system. In step 130, the ingress merges the received service matrix to create a dependency chain matrix for publishing back to the microservices or services in the cluster as sidecars. The cluster ingress then publishes this dependency chain matrix as a sidecar 140 for each microservice or service in the cluster. In step 150, the microservice or service waits for updates from the cluster ingress. Upon receiving the sidecar of the dependency chain matrix, in step 160, according to the methods described herein, the microservice or service is ready to serve clients. As shown in the figure, process flow 100 ends at step 170.

[0024] Figure 3A A first service matrix 200 according to an embodiment of the present invention is shown. The first service matrix 200 may represent Figure 1 The service matrix of microservice 20 is shown. This information can be provided, published, transmitted, or otherwise sent to the entry computer system 16 for integration with other service matrices from other microservices or services (such as microservices 22, 24). The first service matrix 200 includes four columns of information: the first column 201 indicates the origin of the service request, the second column 202 indicates the requested operation, the third column 203 is the endpoint of the request, and the fourth column 204 indicates which categories of operators have authorization. As shown, the first service matrix 200 includes the authorization process for service requests from internal and external sources.

[0025] Figure 3B A second service matrix 210 according to an embodiment of the present invention is shown. The second service matrix 210 may represent Figure 1 The service matrix of microservice 22 is shown. This information can be provided, published, transmitted, or otherwise sent to the entry computer system 16 for integration with other service matrices from other microservices or services (such as microservices 20, 24). Similar to the first service matrix 200, the second service matrix 210 includes four columns of information: the first column 211 indicates the origin of the service request, the second column 212 indicates the requested operation, the third column 213 is the endpoint of the request, and the fourth column 214 indicates which categories of operators have authorization. As shown, the second service matrix 210 includes an authorization process for service requests from internal and external sources.

[0026] Figure 3C A third service matrix 220 according to an embodiment of the present invention is shown. The third service matrix 220 may represent Figure 1The service matrix of microservice 24 is shown. This information can be provided, published, transmitted, or otherwise sent to the entry computer system 16 for integration with other service matrices from other microservices or services (such as microservices 20, 24). Similar to the first service matrix 200, the second service matrix 210 includes four columns of information: the first column 211 indicates the origin of the service request, the second column 212 indicates the requested operation, the third column 213 is the endpoint of the request, and the fourth column 214 indicates which categories of operators have authorization. As shown, the second service matrix 210 includes an authorization process for service requests from internal and external sources.

[0027] Although not shown, any microservice in system 10 (such as microservices 34, 36, 38) may each include a service matrix similar to the service matrices 200, 210, 220 described above. The service matrices described herein may be provided by and received by the corresponding entry computer systems 16, 30 by the microservices 20, 22, 24, 34, 36, 38.

[0028] The service matrix provided to the corresponding entry computer systems 16 and 30 can thus be compiled, allowing tags to be applied by entry computer systems 16 and 30 to any incoming service request in the manner described herein. The service matrix can be compiled by entry computer systems 16 and 30 into a dependency chain matrix, whereby the dependency chain matrix includes all information provided to entry computer systems 16 and 30 by each individual device. In addition to compiling this information, entry computer systems 16 and 30 may also have information related to inter-cluster authorization, such as... Figure 4A and Figure 4B As shown.

[0029] Figure 4A A first dependency chain matrix 250 for inter-cluster authorization is illustrated according to an embodiment of the present invention. The first dependency chain matrix 250 may be a dependency chain matrix that compiles, merges, aggregates, or otherwise places together service matrices provided to a first entry computer system 16 of a first cluster 12. The first dependency chain matrix 250 includes columns for different resources. The matrix includes three rows of labels. For each of the different resources and for a given label, the columns are filled with authorization operation permissions. For example, for the resource / v1 / storage, and labels C1:221, C1:331, authorization operations are allowed for read (R) and update (U), but not for create (C) or delete (D). For each cell in the matrix, different authorization types may include create, read, update, delete (CRUD) operations associated with a potential service request; however, other authorization types may be used in other systems.

[0030] Figure 4BA second dependency chain matrix 260 for inter-cluster authorization is illustrated according to an embodiment of the present invention. The second dependency chain matrix 260 may be a dependency chain matrix that compiles, merges, aggregates, or otherwise combines service matrices provided to the second entry computer system 30 of the second cluster 14. The second dependency chain matrix 260 contains columns for different resources. The matrix includes three rows of labels. For each of the different resources and for a given label, the columns are filled with authorized operation licenses. For example, for resource / v1 / cluster and labels C2:551, C2:661, authorized operation licenses may not be available for any CRUD operation. Similarly, for resource / v1 / node and label C2:552, authorized operations are allowed for creation (C), read (R), and update (U), but not for deletion (D).

[0031] When the first cluster 12 wants to access a server in the second cluster 14, the first and second dependency chain matrices 250 and 260 can be used for inter-cluster authorization, and vice versa. For example, if a service in the first cluster 12 wants to access a server in the second cluster 14, then the ingress computer system 16 will attach a tag specific to the second cluster 14 before sending a request to the second cluster 14. This tag will be understood by the second cluster 14. Therefore, when the two clusters 12, 14 and their ingress computer systems 16, 30 merge to form their dependency chain matrices 250, 260, the two clusters 12, 14 and their ingress computer systems 16, 30 have exchanged tags to attach when a request goes from one cluster to the other. Therefore, the present invention allows information exchange based on tags provided by the respective ingress computer systems 16, 30, instead of requiring one hop (device) for each authorization request processed.

[0032] Figure 5 An embodiment of the invention is shown for use with Figure 1 The entry computer system 16 of system 10 authorizes service requests in a multi-cluster system. As shown, the entry computer system 16 can be connected to various other devices and systems within system 10 via network 50. The entry computer system 16 is shown connected via network 50 to external users 26 and external services 28, as well as other clusters 14. Other clusters 14 may include… Figure 1 The cluster shown exhibits various features, including a separate entry computer system or module, additional microservices, etc. The entry computer system 16 is also incorporated into a first cluster 12, which further includes microservices 20, 22, 24, and IAM18 connected via a cluster-inclusive network in network 50.

[0033] Network 50 can be any group of two or more computer systems linked together, and can include one or more separate networks. Network 50 can represent, for example, the Internet. Network 50 can be any type of computer network known to those skilled in the art. Examples of computer networks that can be embodied by network 50 may include LANs, WANs, campus local area networks (CANs), home networks (HANs), metropolitan area networks (MANs), enterprise networks, cloud computing networks (physical or virtual), such as the Internet, cellular communication networks such as GSM or CDMA networks, or mobile communication data networks. In some embodiments, the architecture of network(s) 50 can be a peer-to-peer network, while in other embodiments, network(s) 50 can be organized as a client / server architecture.

[0034] Embodiments of the entry computer system 16 may include a modular structure 60, comprising a receiving module 61, a fusion module 62, a sharing module 63, an authentication module 64, and a tag generation module 65. A “module” can refer to a hardware-based module, a software-based module, or a combination of hardware and software. Embodiments of hardware-based modules may include self-contained components such as chipsets, application-specific circuitry, and one or more memory devices, while software-based modules may be part of or linked to program code containing specific programming instructions that can be loaded into the memory devices of the computer system 120. Modules (whether hardware, software, or a combination thereof) may be designed to implement or perform one or more specific functions or routines. Each module may be a separate component of the entry computer system 16. In other embodiments, more than one module may be a single combined computer program or hardware module. Furthermore, in some embodiments, the entry computer system 16 may be a modular part of another computer system server or computer infrastructure.

[0035] Embodiments of the receiving module 61 may include one or more components of hardware and / or software program code for obtaining, retrieving, collecting, or otherwise receiving information from external user 26, external service 28, microservices 20, 22, 24, IAM 18 in cluster 12, or devices from other clusters 14. In exemplary embodiments, the receiving module 61 may be configured to receive a dependency chain matrix from each of the service endpoints in a multi-cluster system including microservices 20, 22, 24. Furthermore, the receiving module 61 may be configured to receive updated dependency chain matrices from the service endpoints based on triggering events, as discussed herein. Further still, the receiving module 61 may be configured to receive fused data matrices from other ingress computer systems from other clusters in the multi-cluster system.

[0036] Still referencing Figure 1Embodiments of computer system 120 may further include a fusion module 62. Embodiments of fusion module 62 may include one or more components of hardware and / or software program code configured to fuse the received dependency chain matrix into a fusion data matrix, an authorization table, a dependency chain matrix, etc. (such as...) Figure 4A and 4B (Matrix 250, 260 shown). The fusion module 62 can package the fused data matrix into a sidecar for implementation or distribution by the sharing module 63.

[0037] Embodiments of shared module 63 may include one or more components of hardware and / or software program code for sharing, providing, transmitting, publishing, or otherwise giving the fusion data matrix authorization table, dependency chain matrix, etc., as a sidecar module to each of the multiple service endpoints in the cluster.

[0038] Embodiments of the verification module 64 may include one or more components of hardware and / or software program code for verifying authorization of the service request by, for example, attaching an appropriate tag to the service request so that the tag can be checked by a sidecar module provided at the service endpoint.

[0039] An embodiment of the tag generation module 65 may include one or more components of hardware and / or software program code for generating tags for attaching to service requests, the tags being consistent with the fused data matrix created by the fusion module 62.

[0040] See also Figure 5 An embodiment of the entry computer system 16 may be equipped with a memory device 72 and a processor 70. The memory device 72 may store information required by the processor 70 to perform its operations. The processor 141 may be configured to perform tasks associated with the entry computer system 16 described above.

[0041] Figure 6A method 400 for authorizing service requests in a multi-cluster system according to an embodiment of the present invention is illustrated. According to method 400, a first step 402 includes receiving a dependency chain matrix (such as dependency chain matrices 200, 210, 220) from each of multiple service endpoints (such as microservices 20, 22, 24) in a multi-cluster system (such as multi-cluster system 10) by one or more processors of a computer system (such as entry computer system 14 or other entry modules). The dependency chain matrix may include multiple supported service endpoints along with authorization levels and permitted operations. Furthermore, step 402 may occur as part of a startup process. Additionally, each in the dependency chain matrix may include a service endpoint among multiple service endpoints, a create, read, update, delete (CRUD) operation associated with the potential service request, a category for the type of external user associated with the potential service request, and an authorization tag for attaching to the potential service request.

[0042] Method 400 includes step 404 where one or more processors of a computer system fuse a received dependency chain matrix into a fused data matrix (such as fused data matrix 250). Method 400 includes step 406 where one or more processors of the computer system share the fused data matrix as a sidecar module (such as sidecar module 140) to each of a plurality of service endpoints. Method 400 includes step 408 where one or more processors of the computer system receive a service request from an external user or service (such as external user 26 or service 28) to at least one of the plurality of service endpoints. Method 400 includes step 410 where one or more processors of the computer system verify authorization of the service request based on the fused data matrix, and step 410 where one or more processors of the computer system generate tags (such as labels) appended to the service request and pass them downstream to the plurality of service endpoints. Figures 4A to 4B Step 412 (as shown in the label).

[0043] Method 400 may include step 414: when a triggering event occurs, one or more processors of the computer system receive an updated dependency chain matrix from one of the multiple service endpoints. For example, the triggering event may be a restart of one of the multiple service endpoints, a change in the service endpoint hosted by one of the multiple service endpoints, or a change in the authorization requirements for one of the multiple service endpoints. Finally, method 400 may include step 416: when an updated sidecar module is attached to each of the multiple service endpoints, one or more processors of the computer system, after receiving the updated dependency chain matrix, determine based on the received updated dependency chain matrix that the multi-cluster system is ready to process new service requests.

[0044] Figure 7Another method 450 for authorizing service requests in a multi-cluster system according to an embodiment of the present invention is illustrated. Method 450 may be a method separate from method 400, or may be additional steps that may be performed by method 400 according to different embodiments contemplated herein. Method 450 includes step 452 of receiving a second fused data matrix from an entry module, such as entry module 30, from different clusters in a multi-cluster system, such as cluster 14, by one or more processors of a computer system. Method 450 may include step 454 of sending the fused data matrix to the entry modules in the different clusters of the multi-cluster system by one or more processors of the computer system. Method 450 may also include step 456 of synchronizing the fused data matrix and the second fused data matrix with the entry modules in the different clusters by one or more processors of the computer system to generate an inter-cluster tag matrix.

[0045] Furthermore, method 450 may include step 458, in response to a received inter-cluster service request requesting service in different clusters, a step 458, whereby one or more processors of the computer system search in an inter-cluster tag matrix, and step 460, based on the inter-cluster tag matrix, a step 460, whereby one or more processors of the computer system verify inter-cluster authorization for the inter-cluster service request. Finally, method 450 may include step 462, whereby one or more processors of the computer system generate an inter-cluster tag attached to the inter-cluster service request and passed downstream.

[0046] Figure 8 An embodiment of the invention is shown for use with Figure 1 A block diagram of a computer system 500 comprising system 10 or computer system 100, wherein the computer system is capable of implementing, for example... Figure 2 , 6 And those methods in 7. Computer system 500 typically includes a processor 591, an input device 592 coupled to the processor 591, an output device 593 coupled to the processor 591, and memory devices 594 and 595, both coupled to the processor 591. Input devices 592, output devices 593, and memory devices 594 and 595 may each be coupled to the processor 591 via a bus. The processor 591 can perform calculation and control functions of computer 500, including using... Figure 1 The authorization system for service requests in a multi-cluster system of 3, to be authorized by Figure 2 , 6In accordance with the embodiments specified in 7, the instructions of the tools and programs included in computer code 597 for implementing a method for authorizing service requests in a multi-cluster system are executed, wherein the instructions of computer code 597 can be executed by processor 591 via memory device 595. Computer code 597 may include software or program instructions that implement one or more algorithms to implement a method for authorizing service requests in a multi-cluster system, as described in detail above. Processor 591 executes computer code 597. Processor 591 may include a single processing unit, or may be distributed across one or more locations (e.g., on a client and a server).

[0047] Memory device 594 may include input data 596. Input data 596 includes any input required by computer code 597. Output device 593 displays output from computer code 597. Either or both of memory devices 594 and 595 may be used as a computer-usable storage medium (or program storage device) having a computer-readable program embodied therein and / or other data stored therein, wherein the computer-readable program includes computer code 597. Typically, the computer program product (or alternatively, article of manufacture) of computer system 500 may include the computer-usable storage medium (or the program storage device).

[0048] Memory devices 594 and 595 include any known computer-readable storage medium, including those described in detail below. In one embodiment, cache memory elements of memory devices 594 and 595 may provide temporary storage for at least some program code (e.g., computer code 597) to reduce the number of times code must be retrieved from mass storage when executing instructions of computer code 597. Furthermore, similar to processor 591, memory devices 594 and 595 may reside in a single physical location comprising one or more types of data storage, or may be distributed across multiple physical systems in different forms. Further, memory devices 594 and 595 may include data distributed across, for example, a local area network (LAN) or a wide area network (WAN). Additionally, memory devices 594 and 595 may include an operating system (not shown) and may include… Figure 8 Other systems not shown.

[0049] In some embodiments, the computer system 500 may be further coupled to an input / output (I / O) interface and a computer data storage unit. The I / O interface may include any system for exchanging information to or from input device 592 or output device 593. Input device 592 may, in particular, be a keyboard, mouse, etc. Output device 593 may, in particular, be a printer, plotter, display device (e.g., computer screen), magnetic tape, removable hard disk, floppy disk, etc. Memory devices 594 and 595 may, in particular, be hard disks, floppy disks, magnetic tapes, optical storage such as CDs or DVDs, dynamic random access memory (DRAM), read-only memory (ROM), etc. A bus provides a communication link between each component in the computer 500 and may include any type of transmission link, including electrical, optical, wireless, etc.

[0050] The I / O interface allows computer system 500 to store information (e.g., data or program instructions, such as program code 597) on a computer data storage unit (not shown) and retrieve information from the computer data storage unit. The computer data storage unit includes known computer-readable storage media as described below. In one embodiment, the computer data storage unit may be a non-volatile data storage device, such as a disk drive (i.e., a hard disk drive) or an optical disk drive (e.g., a CD-ROM drive that receives CD-ROM discs). In other embodiments, the data storage unit may include a knowledge base or data repository 75, such as... Figure 5 As shown.

[0051] As those skilled in the art will understand, in a first embodiment, the invention may be a method; in a second embodiment, the invention may be a system; and in a third embodiment, the invention may be a computer program product. Any component of an embodiment of the invention may be deployed, managed, serviced, etc., by a service provider that provides systems and methods for deploying or integrating computing infrastructure regarding authorized service requests in a multi-cluster system. Thus, one embodiment of the invention discloses a process for supporting a computer infrastructure, wherein the process includes providing at least one support service for at least one of the integration, hosting, maintenance, and deployment of computer-readable code (e.g., program code 597) in a computer system (e.g., computer 500) including one or more processors 591, wherein the processor executes instructions contained in the computer code 597, causing the computer system to provide an authorization system for service requests in a multi-cluster system. Another embodiment discloses a process for supporting a computer infrastructure, wherein the process includes integrating computer-readable program code into a computer system including a processor.

[0052] The integration step includes storing program code in a computer-readable storage device of a computer system using a processor. When executed by the processor, the program code implements a method for authorizing service requests in a multi-cluster system. Thus, the present invention discloses a process for supporting, deploying, and / or integrating computer infrastructure, integrating, hosting, maintaining, and deploying computer-readable code into a computer system 500, wherein the code, combined with the computer system 500, enables the execution of a method for authorizing service requests in a multi-cluster system.

[0053] The computer program product of the present invention includes one or more computer-readable hardware storage devices having computer-readable program code stored therein, the program code containing instructions executable by one or more processors of a computer system to implement the method of the present invention.

[0054] The computer system of the present invention includes one or more processors, one or more memories, and one or more computer-readable hardware storage devices, wherein the one or more hardware storage devices contain program code executable by the one or more processors via the one or more memories to implement the method of the present invention.

[0055] This invention can be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0056] Computer-readable storage media can be tangible devices capable of retaining and storing instructions used by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0057] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device or to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the corresponding computing / processing device.

[0058] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of this invention.

[0059] This document describes various aspects of the invention with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0060] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0061] These computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, thereby causing these instructions to perform on the computer, other programmable apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0062] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than indicated in the figures. For example, depending on the functions involved, two consecutively shown blocks may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0063] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings stated herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0064] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0065] The characteristics are as follows:

[0066] On-demand self-service: Cloud consumers can automatically and unilaterally configure computing power, such as server time and network storage, as needed, without human interaction with the service provider.

[0067] Extensive network access: Capabilities are available through the network and accessed via standard mechanisms that facilitate the use of heterogeneous thin client platforms or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0068] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0069] Rapid elasticity: Capacity can be provided quickly and flexibly (in some cases, automatically) to shrink rapidly and expand rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0070] Measurement services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0071] The service model is as follows:

[0072] Software as a Service (SaaS): This provides consumers with the ability to use a provider's applications running on cloud infrastructure. These applications can be accessed from different client devices via a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0073] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created by the consumer or acquired using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of possible application hosting environments.

[0074] Infrastructure as a Service (IaaS): This provides consumers with the capability to offer processing, storage, networking, and other basic computing resources, where consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0075] The deployment model is as follows:

[0076] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0077] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0078] Public cloud: Cloud infrastructure that is available to the public or large industry groups and is owned by organizations that sell cloud services.

[0079] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public clouds) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0080] Cloud computing environments are service-oriented, focusing on statefulness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0081] See now Figure 9 An illustrative cloud computing environment 50 is shown. As illustrated, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate. These local computing devices include, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services that cloud consumers do not need to maintain on their local computing devices. It should be understood that... Figure 9The types of computing devices 54A, 54B, 54C, and 54N shown are intended to be illustrative only, and computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connection (e.g., using a web browser).

[0082] See now Figure 10 This demonstrates the use of cloud computing environments 50 (see [link]). Figure 9 This provides a set of functional abstractions. It should be understood beforehand. Figure 10 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0083] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0084] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0085] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0086] Workload layer 90 provides examples of functions that can be utilized in a cloud computing environment. Examples of workloads and functions that can be provided from this layer include: sending and receiving 91; convergence 92; authentication 93; authorization 94; tag generation 95; and sidecar sharing 96.

[0087] While embodiments of the invention have been described herein for illustrative purposes, many modifications and variations will become apparent to those skilled in the art. Therefore, the appended claims are intended to cover all such modifications and variations that fall within the true spirit and scope of the invention.

[0088] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements to technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for authorizing service requests in a multi-cluster system, comprising: The dependency chain matrix is ​​received by one or more processors of the computer system from each of the multiple server endpoints in the multi-cluster system; The received dependency chain matrix is ​​fused into a fused data matrix by one or more processors of the computer system; The fused data matrix is ​​shared as a sidecar module to each of the plurality of service endpoints by one or more processors of the computer system. The one or more processors of the computer system receive service requests from external users or services to at least one of the plurality of service endpoints. The authorization for the service request is verified by one or more processors of the computer system based on the fused data matrix; as well as The computer system generates tags that are attached to the service request and passed downstream to the plurality of service endpoints.

2. The method according to claim 1, wherein, The dependency chain matrix includes the supported plurality of service endpoints along with authorization levels and permitted operations, and wherein the dependency chain matrix is ​​received by one or more processors of the computer system from each of the plurality of service endpoints in the multi-cluster system as part of the startup process.

3. The method according to claim 1, further comprising: The computer system receives an updated dependency chain matrix from one of the plurality of service endpoints under the following conditions: One of the multiple service endpoints is restarted; The service endpoint hosted by one of the multiple service endpoints has changed; or The authorization requirements for one of the multiple service endpoints have changed.

4. The method according to claim 1, wherein, Each of the dependency chain matrix includes: The service endpoints among the plurality of service endpoints; Create, read, update, and delete operations associated with potential service requests; The category of the type of external user associated with the potential service request; and An authorization tag used to attach to the potential service request.

5. The method of claim 4, further comprising: When an updated sidecar module is attached to each of the plurality of service endpoints, the one or more processors of the computer system determine, based on the received updated dependency chain matrix, that the multi-cluster system is ready to process the new service request.

6. The method of claim 1, further comprising: The computer system receives a second fusion data matrix from different clusters in the multi-cluster system via the entry module; The computer system's one or more processors send the fused data matrix to the entry modules in the different clusters of the multi-cluster system; as well as The computer system's one or more processors synchronize the fused data matrix and the second fused data matrix with the entry modules in the different clusters to generate an inter-cluster label matrix.

7. The method of claim 6, further comprising: In response to the received inter-cluster service request for services in different clusters, the one or more processors of the computer system search the inter-cluster tag matrix; The one or more processors of the computer system verify the inter-cluster authorization for the inter-cluster service request based on the inter-cluster tag matrix; as well as The computer system generates inter-cluster tags that are attached to the inter-cluster service request and passed downstream.

8. A computer system, comprising: One or more processors; One or more memory devices are coupled to the one or more processors; as well as One or more computer-readable storage devices coupled to the one or more processors, wherein the one or more storage devices contain program code executable by the one or more processors via the one or more storage devices to implement the method for authorizing service requests in a multi-cluster system as described in any one of claims 1-7.

9. A computer program product for authorizing service requests in a multi-cluster system, the computer program product comprising: Computer-readable program code, which is executed by one or more processors of a computer system to cause the computer system to perform the method as described in any one of claims 1-7.

Images