Distributed micro-service authorization authentication method, device, equipment and medium

Abstract

The present disclosure provides a distributed micro-service authorization authentication method, device, equipment and medium. The method comprises: receiving a secondary micro-service access request from a target user; according to the user information of the target user, parsing the user authorization code of the target user, adding the parsed user authorization code to the micro-service access request, in the case that the user authorization code contained in the micro-service access request is authenticated, assigning a service authorization code to the secondary micro-service access request according to the micro-service parameter information of the target micro-service object; receiving the micro-service access request returned by the service prefix authentication entity and added with the service authorization code; in the case that the service authorization code contained in the micro-service access request is authenticated, sending the micro-service access request containing the service authorization code to the service router. The present disclosure can avoid repeated authorization authentication of users and services in the micro-service network architecture, improve communication efficiency and user experience.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a distributed microservice authorization and authentication method, apparatus, device, and medium. Background Technology

[0002] Microservice architecture aims to decouple technical solutions by decomposing functionality into discrete services. With the rise of microservice architecture, identity authentication and authorization schemes are constantly being updated and transformed to adapt to changing architectural requirements. How to achieve efficient and secure service authentication and authorization among dozens or even hundreds of microservices has become a crucial issue.

[0003] In a microservice architecture, an application is broken down into several micro-applications. Each micro-application needs to authenticate access and clearly define the accessing user and their corresponding permissions. However, in related technologies, the server side often adopts a cluster deployment method. This deployment method leads to multiple authentications between users and services, resulting in low communication efficiency, which in turn affects server performance and reduces user experience.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a distributed microservice authorization and authentication method, apparatus, device, and medium, which at least to some extent overcomes the problem of repeated authorization and authentication of users and services in a microservice network architecture in related technologies.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a distributed microservice authorization and authentication method is provided, comprising: receiving a secondary microservice access request from a target user, wherein the secondary microservice access request is a request from the target user to access a target microservice object that is not the first time, the target microservice object including one or more microservices, and the microservice access request including: user information of the target user and microservice parameter information of the target microservice object; parsing out the user authorization code of the target user based on the user information of the target user, adding the parsed user authorization code to the microservice access request, and sending the microservice access request with the added user authorization code to a service prefix authentication entity, so that the service prefix authentication entity can authenticate the microservice access request containing the user authorization code. The system authenticates the user authorization code and, if the user authorization code in the microservice access request is authenticated, assigns a service authorization code to the secondary microservice access request based on the microservice parameter information of the target microservice object, and replaces the user authorization code in the microservice access request with the service authorization code; receives the microservice access request with the added service authorization code returned by the service prefix authentication entity; authenticates the service authorization code in the microservice access request, and, if the service authorization code in the microservice access request is authenticated, sends the microservice access request containing the service authorization code to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

[0008] In some embodiments, before receiving a secondary microservice access request from a target user, the method further includes: receiving a first microservice access request from a target user, wherein the first microservice access request is a request from the target user to access a target microservice object for the first time; sending the first microservice access request from the target user to a service prefix authentication entity, so that the service prefix authentication entity performs secondary microservice access authorization verification on the target user, and in response to the secondary microservice access authorization operation of the target user, assigning a user authorization code to the target user to uniquely identify the target user, wherein the user authorization code is generated based on the user information of the target user.

[0009] In some embodiments, before sending the target user's first microservice access request to the service prefix authentication entity, the method further includes: verifying whether the user information in the microservice access request is consistent with pre-stored user information; if they are inconsistent, sending a registration prompt message to the target user, wherein the registration prompt message is used to prompt the target user to register using the user information.

[0010] In some embodiments, before assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: pre-storing one or more user authorization codes so that a service prefix authentication entity compares the user authorization code contained in the microservice access request with the pre-stored user authorization code to determine whether the user authorization code contained in the microservice access request has passed authentication.

[0011] In some embodiments, after assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: storing the mapping relationship between the user authorization code and the target user's user information based on a preset encryption algorithm.

[0012] In some embodiments, the microservice parameter information of the target microservice object includes: the name of the target microservice object, the interface network address of the target microservice object, and the request parameters of the target microservice object, wherein the request parameters of the target microservice object consist of the user authorization code and the name of the target microservice object.

[0013] In some embodiments, authenticating the service authorization code contained in the microservice access request includes: comparing the service authorization code contained in the microservice access request with one or more pre-stored service authorization codes; if they match, the service authorization code contained in the microservice access request is authenticated; if they do not match, the service authorization code contained in the microservice access request is not authenticated.

[0014] According to another aspect of this disclosure, a distributed microservice authorization and authentication device is also provided, comprising: a first access request receiving module, configured to receive a secondary microservice access request from a target user, wherein the secondary microservice access request is a request from the target user to access a target microservice object that is not the first time, the target microservice object comprising: one or more microservices, and the microservice access request including: user information of the target user and microservice parameter information of the target microservice object; and a service authorization code allocation module, configured to parse the user authorization code of the target user according to the user information of the target user, add the parsed user authorization code to the microservice access request, and send the microservice access request with the added user authorization code to a service prefix authentication entity, so that the service prefix authentication entity can authenticate the microservice access request containing the user authorization code. The system includes a user authorization code for authentication, and if the user authorization code in the microservice access request passes authentication, a service authorization code is assigned to the secondary microservice access request based on the microservice parameter information of the target microservice object, and the user authorization code in the microservice access request is replaced with the service authorization code; a second access request receiving module is used to receive the microservice access request returned by the service prefix authentication entity with the added service authorization code; a target microservice access module is used to authenticate the service authorization code in the microservice access request, and if the service authorization code in the microservice access request passes authentication, send the microservice access request containing the service authorization code to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

[0015] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the distributed microservice authorization and authentication method described in any of the preceding claims by executing the executable instructions.

[0016] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the distributed microservice authorization and authentication method described in any one of the preceding claims.

[0017] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the distributed microservice authorization and authentication method of any of the above.

[0018] The distributed microservice authorization and authentication method, apparatus, device, and medium provided in the embodiments of this disclosure, upon receiving a secondary microservice access request from a target user, parses the target user's user authorization code based on the target user's user information, adds the user authorization code to the microservice access request for authentication, and, if authentication is successful, causes a service prefix authentication entity to allocate a service authorization code to the authentication request to replace the user authorization code. Authentication is then performed based on the service authorization code, and if authentication is successful, the microservice access request is sent to the service router to access the corresponding microservice. This disclosure can avoid duplicate authorization and authentication for users and services in a microservice network architecture through secondary authentication and authorization, improving communication efficiency and user experience.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0021] Figure 1 A schematic diagram of an exemplary application system architecture for a distributed microservice authorization and authentication method in an embodiment of this disclosure is shown.

[0022] Figure 2 A flowchart of a distributed microservice authorization and authentication method according to an embodiment of this disclosure is shown;

[0023] Figure 3 This illustration shows an exemplary application system architecture diagram of another distributed microservice authorization and authentication process in an embodiment of this disclosure;

[0024] Figure 4 A schematic diagram of an optional distributed microservice authorization and authentication device is shown in an embodiment of this disclosure;

[0025] Figure 5 A schematic diagram of an optional distributed microservice authorization and authentication device according to an embodiment of the present disclosure is shown. The device further includes a secondary access request processing module.

[0026] Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0027] Figure 7 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0029] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0030] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0031] Figure 1 This illustration shows an exemplary application system architecture diagram of a distributed microservice authorization and authentication method according to an embodiment of this disclosure. Figure 1 As shown, the system architecture may include microservice A101, microservice B102, service gateway 103, service prefix authentication entity 104, service router 105, and service mesh communication scheduling center 106.

[0032] Among them, microservice A includes microservice A first node 1011, microservice A second node 1012, microservice A third node 1013, and microservice A fourth node 1014; microservice B includes microservice B first node 1021, microservice B second node 1022, microservice B third node 1023, and microservice B fourth node 1024; service gateways include first service gateway 1031, second service gateway 1032, third service gateway 1033, and fourth service gateway 1034; service prefix authentication entities include first service prefix authentication entity 1041, second service prefix authentication entity 1042, third service prefix authentication entity 1043, and fourth service prefix authentication entity 1044; and service routers include first service router 1051, second service router 1052, and third service router 1053.

[0033] In one embodiment of this disclosure, step ① refers to service registration. Specifically, the service prefix or namespace of the microservice is divided on a unit basis, such as the target microservice object Pod, to ensure the uniqueness of the microservice under the Pod. The service gateway performs proxy registration.

[0034] In one embodiment of this disclosure, step ② refers to service discovery. Specifically, after the access request between the service gateway and the service prefix authentication entity is authenticated, it is distributed between the service gateway and the service router through a distributed protocol to realize the synchronization of microservice information.

[0035] In one embodiment of this disclosure, step ③ refers to service measurement. Specifically, each service gateway initiates periodic automatic detection to each target microservice according to its needs, and records and reports the detection results.

[0036] In one embodiment of this disclosure, step ④ refers to service scheduling. Specifically, the service mesh centralized scheduling center issues customized forwarding policies to each service gateway and service router along the way based on the quality detection results reported by each service gateway. Among multiple microservice nodes that can provide the same function, the service node with superior performance is selected.

[0037] Those skilled in the art will know that Figure 1 The number of microservices and their subordinate microservice nodes, service gateways, service prefix authentication entities, service routers, and service mesh communication scheduling centers is merely illustrative. Depending on actual needs, there can be any number of microservices and their subordinate microservice nodes, service gateways, service prefix authentication entities, service routers, and service mesh communication scheduling centers. This disclosure does not limit this.

[0038] Under the above system architecture, this disclosure provides a distributed microservice authorization and authentication method, which can be executed by any electronic device with computing power.

[0039] In some embodiments, the distributed microservice authorization and authentication method provided in this disclosure can be executed by the terminal device of the above-described system architecture; in other embodiments, the distributed microservice authorization and authentication method provided in this disclosure can be executed by the server in the above-described system architecture; in still other embodiments, the distributed microservice authorization and authentication method provided in this disclosure can be implemented by the terminal device and the server in the above-described system architecture through interaction.

[0040] Figure 2 This illustration shows a flowchart of a distributed microservice authorization and authentication method according to an embodiment of the present disclosure, such as... Figure 2 As shown, the method includes the following steps:

[0041] S202, Receive a secondary microservice access request from the target user. The secondary microservice access request is a request from the target user to access the target microservice object, which is not the first time. The target microservice object includes one or more microservices. The microservice access request contains the target user's user information and the microservice parameter information of the target microservice object.

[0042] In one embodiment of this disclosure, a secondary microservice access request refers to a user's request to access a target microservice object other than the initial microservice access request; a target microservice object refers to a Pod, which may contain one or more containers, i.e., contain one or more containers; the microservice access request includes user information entered by the target user when logging in and relevant microservice parameter information of the target microservice object.

[0043] S204. Based on the target user's user information, parse the target user's user authorization code, add the parsed user authorization code to the microservice access request, and send the microservice access request with the added user authorization code to the service prefix authentication entity. This allows the service prefix authentication entity to authenticate the user authorization code contained in the microservice access request. If the user authorization code in the microservice access request is successfully authenticated, a service authorization code is assigned to the secondary microservice access request based on the microservice parameter information of the target microservice object, and the user authorization code contained in the microservice access request is replaced with the service authorization code.

[0044] In one embodiment of this disclosure, the user authorization code is an identifier ID applicable to the entire network. The service prefix authentication entity is used to compare the parsed user authorization code with the pre-stored user authorization code. When the comparison matches, it indicates that the authentication is successful. The service prefix authentication entity is also used to assign a service authorization code to the microservice access request that has been successfully authenticated.

[0045] It should be noted that the service prefix authentication entity can be software operating on the service gateway or a separate hardware device; this disclosure does not specifically limit it.

[0046] S206, Receive the microservice access request returned by the service prefix authentication entity with the added service authorization code.

[0047] S208: Authenticate the service authorization code contained in the microservice access request, and if the service authorization code in the microservice access request is successfully authenticated, send the microservice access request containing the service authorization code to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

[0048] In one embodiment of this disclosure, the service authorization code is applicable within the Pod (a service gateway and the devices connected to it). The microservice access request here is used to enable the target user to access the target microservice. The service authorization code in the microservice access request is compared with the pre-stored service authorization code. When the comparison is consistent, it means that the authentication is successful, and the service router can send the microservice access request to the corresponding microservice node.

[0049] As described above, upon receiving a secondary microservice access request from a target user, this embodiment parses the target user's authorization code based on the user information and adds the authorization code to the microservice access request for authentication. If authentication is successful, the service prefix authentication entity assigns a service authorization code to the authentication request to replace the user authorization code. Authentication is then performed based on the service authorization code. If authentication is successful, the microservice access request is sent to the service router to access the corresponding microservice. This embodiment avoids duplicate authorization authentication for users and services in the microservice network architecture through secondary authentication, improving communication efficiency and user experience.

[0050] In one embodiment of this disclosure, the microservices are deployed in a clustered manner using Kubernetes (K8S), where the smallest deployment unit is a Pod (i.e., a microservice object). Service prefix authentication is performed using a service prefix authentication entity to achieve the uniqueness of microservices within a Pod. If other deployment methods are used, the deployment unit is represented by other methods. It should be noted that this disclosure does not specifically limit the deployment method of microservices.

[0051] It should be noted that microservice applications refer to upper-layer applications, such as small, autonomous services like data management, query services, and transaction services, which can be configured according to actual conditions. The selection of microservices in this embodiment is not specifically limited.

[0052] In one embodiment of this disclosure, prior to S202 above, the method further includes: receiving an initial microservice access request from a target user, wherein the initial microservice access request is a request from the target user to access a target microservice object for the first time; sending the initial microservice access request from the target user to a service prefix authentication entity, so that the service prefix authentication entity performs a secondary microservice access authorization verification on the target user, and in response to the secondary microservice access authorization operation of the target user, assigning a user authorization code to the target user to uniquely identify the target user, wherein the user authorization code is generated based on the user information of the target user.

[0053] In one embodiment of this disclosure, the user can be prompted to perform a secondary microservice access authorization operation by displaying a secondary microservice access authorization page or simply through a pop-up prompt. This secondary authentication and authorization avoids duplicate authorization and authentication between the user and the service. It should be noted that this embodiment of the disclosure does not specifically limit the method of probing the user for authorization.

[0054] In one embodiment of this disclosure, before sending the target user's first microservice access request to the service prefix authentication entity, the method further includes: verifying whether the user information in the microservice access request is consistent with the pre-stored user information; if they are inconsistent, sending a registration prompt message to the target user, wherein the registration prompt message is used to prompt the target user to register using the user information.

[0055] It should be noted that the acquisition, storage, use, and processing of user information in this disclosed technical solution comply with the relevant provisions of national laws and regulations. The various types of data, such as personal identity data, operation data, and behavioral data related to individuals, customers, and groups, obtained in this disclosed embodiment have all been authorized.

[0056] In one embodiment of this disclosure, after assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: storing the mapping relationship between the user authorization code and the target user's user information based on a preset encryption algorithm.

[0057] In one embodiment of this disclosure, the user authorization code is an identifier ID that has a mapping relationship with user information, and this mapping relationship can be stored in the system cache; the preset encryption algorithm can use the relevant algorithms of the token, including the SHA-256 secure hash algorithm, the RSA256 encryption algorithm, etc. It should be noted that this disclosure does not specifically limit the type of encryption algorithm used.

[0058] In one embodiment of this disclosure, before assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: pre-storing one or more user authorization codes so that the service prefix authentication entity compares the user authorization code contained in the microservice access request with the pre-stored user authorization code to determine whether the user authorization code contained in the microservice access request has passed authentication.

[0059] In one embodiment of this disclosure, the microservice parameter information of the target microservice object includes: the name of the target microservice object, the interface network address of the target microservice object, and the request parameters of the target microservice object, wherein the request parameters of the target microservice object consist of the user authorization code and the name of the target microservice object.

[0060] In one embodiment of this disclosure, S208 includes: comparing the service authorization code contained in the microservice access request with one or more pre-stored service authorization codes; if they match, the service authorization code contained in the microservice access request is authenticated; if they do not match, the service authorization code contained in the microservice access request is not authenticated.

[0061] In one embodiment of this disclosure, the system cache may pre-store multiple user authorization codes and multiple service authorization codes to facilitate the service prefix authentication entity or service gateway to authenticate and compare the received user authorization codes or service authorization codes.

[0062] In one embodiment of this disclosure, the microservice request parameters included in the microservice request specifically include: user authorization code / service authorization code, microservice application name, microservice network address URL, and microservice request parameters. The user authorization code or service authorization code serves as a service prefix. After successful authentication of the user authorization code, the service prefix authentication device provides the service authorization code to replace the user authorization code. For example, the microservice request parameters can be represented by the following table:

[0063] Table 1

[0064] User / Service Authorization Code Ddabv12hojkhwoa Microservice application name datamanagement Microservice network address https: / / www.DATA.com / Public / linux / ?fr=aladdin#23 Microservice request parameters Ddabv1datamanagement

[0065] The user authorization code or service authorization code can be randomly generated from 9 to 16 characters. The microservice request parameters can be composed of the first six digits of the user authorization code and part of the application name. The microservice application name, microservice network address URL, and microservice request parameters are carried by the service gateway when it initiates the microservice access request.

[0066] As described above, the embodiments of this disclosure can implement the authentication and authorization functions of distributed microservices, thereby improving the service performance of authentication and authorization and enhancing the user experience. Based on the two-factor authentication and authorization under the distributed service mesh, the applicable scope of user authorization authentication and service authorization authentication is distinguished, avoiding duplicate authorization authentication for users and services, thus further improving the service performance of authentication and authorization, enhancing communication efficiency, and improving the user experience.

[0067] Figure 3 This illustration shows an exemplary application system architecture diagram of another distributed microservice authorization and authentication process in an embodiment of this disclosure, such as... Figure 3As shown, the system architecture includes: client 301, service gateway 103, service prefix authentication entity 104, and service router 105.

[0068] The service gateway verifies the validity of the service authorization code prefix carried in the microservice parameter information of the user information and microservice access request. The service prefix authentication entity performs user authorization authentication and service authorization authentication, as well as verifies the validity of the user authorization code carried in the microservice parameter information. If the user authorization code is found to be valid, the service gateway requests service authorization authentication from the service prefix authentication entity. After successful authentication, the service gateway replaces the original user authorization code in the microservice parameter information with the service authorization code and carries the replaced microservice parameter information for service access.

[0069] In one embodiment of this disclosure, a user logs into a microservice application on the client side and accesses the service gateway for the first time. The user can input user information, such as username (or user account) and password. The service gateway authenticates the user information input by receiving an authentication request or login request sent by the client. Successful authentication indicates successful login.

[0070] In one embodiment of this disclosure, after successful login, the service gateway redirects the user to a service prefix authentication entity for user authorization. For example, this can be achieved through page redirection or pop-ups, sending a secondary microservice access request authorization prompt to the user. If the user agrees to the authorization, the service prefix authentication entity assigns a user authorization code to the user as a prefix for the microservice parameter information. This user authorization code is applicable across the entire network. At this point, the mapping relationship between user information and the user authorization code is encrypted using a preset encryption algorithm and stored in the system cache.

[0071] It should be noted that when the service prefix authentication entity assigns user authorization codes, it does not need to follow a specific rule; it can assign them randomly. It only needs to ensure the uniqueness of the user authorization code, that is, the user authorization code corresponds one-to-one with the user information.

[0072] In one embodiment of this disclosure, when a user logs into the service gateway for the second time, the service gateway uses the user information entered during login and a preset encryption algorithm to parse the user authorization code, which is then used as the access prefix in the microservice parameter information. The service gateway then sends the microservice access request carrying the microservice parameter information to the service prefix authentication entity for user authorization code authentication.

[0073] In one embodiment of this disclosure, after receiving a microservice access request, the service prefix authentication entity verifies whether the user authorization code contained therein is valid. Specifically, after obtaining the user authorization code in the microservice access request, it obtains the pre-stored user authorization code from the system cache and compares whether the user authorization code in the microservice access request is consistent with the content of the pre-stored user authorization code. If they are consistent, it proves that it is a valid client request; if they are inconsistent, the client access is prohibited.

[0074] It should be noted that the above-mentioned acquisition of the user authorization code in the microservice access request can be achieved by decoding the microservice parameter information to obtain the user authorization code as a service prefix, or by setting it to only obtain the information of the service prefix position to directly obtain the user authorization code. Different acquisition methods can be adopted according to the actual situation, and this disclosure embodiment does not make specific limitations on this.

[0075] In one embodiment of this disclosure, if the microservice access request is a legitimate service request, a service authorization code is assigned to the microservice access request based on the microservice parameter information (microservice application name, microservice interface URL, microservice request parameters, etc.) carried in the request. The user authorization code is replaced with the service authorization code, and the microservice access request carrying the service authorization code is sent again to the service gateway. This service authorization code applies to the Pod, and the Pod ensures the uniqueness of its microservices.

[0076] It should be noted that when assigning service authorization codes to service prefix authentication entities, there is no need to follow a specific rule; random assignment can be used, as long as the uniqueness of the service authorization code is maintained.

[0077] In one embodiment of this disclosure, after receiving a microservice access request carrying a service authorization code, the service gateway verifies whether the service authorization code is valid. Specifically, it obtains the service authorization code in the microservice access request, and compares the service authorization code in the microservice access request with the pre-stored service authorization code obtained from the system cache. If they match, it proves that the client request is valid; if they do not match, the client access is prohibited.

[0078] In one embodiment of this disclosure, if the microservice access request is a legitimate service request, the microservice access request is sent to the service router, so that the service router sends the microservice access request to the service node of the corresponding microservice.

[0079] It should be noted that a preset encryption algorithm can be uniformly set in the service gateway and the service prefix authentication entity. Alternatively, if multiple encryption algorithms exist in the service gateway and the service prefix authentication entity, the microservice access request can also carry its own encryption algorithm. It is only necessary to keep the encryption algorithm used between the service gateway and the service prefix authentication entity consistent. This disclosure does not impose specific limitations on this.

[0080] As described above, upon receiving a secondary microservice access request from a target user, this embodiment parses the target user's authorization code based on the user information and adds the authorization code to the microservice access request for authentication. If authentication is successful, the service prefix authentication entity assigns a service authorization code to the authentication request to replace the user authorization code. Authentication is then performed based on the service authorization code. If authentication is successful, the microservice access request is sent to the service router to access the corresponding microservice. This embodiment avoids duplicate authorization authentication for users and services in the microservice network architecture through secondary authentication, improving communication efficiency and user experience.

[0081] Based on the same inventive concept, this disclosure also provides a distributed microservice authorization and authentication device, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiment, the implementation of this device embodiment can refer to the implementation of the above-described method embodiment, and repeated details will not be elaborated further.

[0082] Figure 4 This diagram illustrates a distributed microservice authorization and authentication device according to an embodiment of the present disclosure, such as... Figure 4 As shown, the device includes: a first access request receiving module 401, a service authorization code allocation module 402, a second access request receiving module 403, and a target microservice access module 404.

[0083] The first access request receiving module 401 is used to receive a secondary microservice access request from the target user. This secondary microservice access request is a request from the target user to access a target microservice object, which is not their first request. The target microservice object includes one or more microservices. The microservice access request contains the target user's user information and the microservice parameter information of the target microservice object. The authorization code replacement module 402 is used to parse the target user's authorization code based on the user information, add the parsed authorization code to the microservice access request, and send the microservice access request with the added authorization code to the service prefix authentication entity. This allows the service prefix authentication entity to authenticate the authorization code contained in the microservice access request and to update the microservice access request accordingly. If the user authorization code in the service access request is authenticated, a service authorization code is assigned to the secondary microservice access request based on the microservice parameter information of the target microservice object, and the user authorization code in the microservice access request is replaced with the service authorization code; the second access request receiving module 403 is used to receive the microservice access request with the added service authorization code returned by the service prefix authentication entity; the target microservice access module 404 is used to authenticate the service authorization code in the microservice access request, and if the service authorization code in the microservice access request is authenticated, send the microservice access request containing the service authorization code to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

[0084] As described above, upon receiving a secondary microservice access request from a target user, this embodiment parses the target user's authorization code based on the user information and adds the authorization code to the microservice access request for authentication. If authentication is successful, the service prefix authentication entity assigns a service authorization code to the authentication request to replace the user authorization code. Authentication is then performed based on the service authorization code. If authentication is successful, the microservice access request is sent to the service router to access the corresponding microservice. This embodiment avoids duplicate authorization authentication for users and services in the microservice network architecture through secondary authentication, improving communication efficiency and user experience.

[0085] In one embodiment of this disclosure, Figure 5 The diagram illustrates an optional distributed microservice authorization and authentication device according to an embodiment of this disclosure. The device further includes an initial access request processing module 405, such as... Figure 5 As shown, module 405 includes: a third access request receiving module 4051 and a user authorization code allocation module 4052.

[0086] The third access request receiving module 4051 is used to receive the first microservice access request from the target user, wherein the first microservice access request is the target user's first request to access the target microservice object; the user authorization code allocation module 4052 is used to send the target user's first microservice access request to the service prefix authentication entity, so that the service prefix authentication entity performs secondary microservice access authorization verification on the target user, and in response to the target user's secondary microservice access authorization operation, allocates a user authorization code to the target user to uniquely identify the target user, wherein the user authorization code is generated based on the target user's user information.

[0087] In one embodiment of this disclosure, the module further includes: a user information verification module 4053, used to verify whether the user information is consistent with the pre-stored user information based on the user information of the target user in the microservice access request; if they are inconsistent, a registration prompt message is sent to the target user, wherein the registration prompt message is used to prompt the target user to register using the user information.

[0088] In one embodiment of this disclosure, the user authorization code allocation module 4052 is further configured to pre-store one or more user authorization codes, so that the service prefix authentication entity compares the user authorization code contained in the microservice access request with the pre-stored user authorization code to determine whether the user authorization code contained in the microservice access request has passed authentication.

[0089] In one embodiment of this disclosure, the user authorization code allocation module 4052 is further configured to store the mapping relationship between the user authorization code and the user information of the target user based on a preset encryption algorithm.

[0090] In one embodiment of this disclosure, the microservice parameter information of the target microservice object includes: the name of the target microservice object, the interface network address of the target microservice object, and the request parameters of the target microservice object, wherein the request parameters of the target microservice object consist of the user authorization code and the name of the target microservice object.

[0091] In one embodiment of this disclosure, the target microservice access module 404 is further configured to compare the service authorization code contained in the microservice access request with one or more pre-stored service authorization codes; if they match, the service authorization code contained in the microservice access request is authenticated; if they do not match, the service authorization code contained in the microservice access request is not authenticated.

[0092] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0093] The following reference Figure 6 To describe an electronic device 600 according to such an embodiment of the present disclosure. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0094] Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Referring below... Figure 6 To describe an electronic device 600 according to such an embodiment of the present disclosure. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0095] like Figure 6 As shown, the electronic device 600 is manifested in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, and a bus 630 connecting different system components (including storage unit 620 and processing unit 610).

[0096] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 610 can perform the following steps of the above method embodiment: receiving a secondary microservice access request from a target user, wherein the secondary microservice access request is a request from the target user to access a target microservice object that is not the first time, the target microservice object including one or more microservices, and the microservice access request including the target user's user information and the target microservice object's microservice parameter information; parsing the target user's user authorization code based on the target user's user information, adding the parsed user authorization code to the microservice access request, and sending the microservice access request with the added user authorization code to a service prefix authentication entity, so that the service prefix authentication entity can verify the information contained in the microservice access request. The system authenticates the user authorization code. If the user authorization code in the microservice access request is successfully authenticated, it assigns a service authorization code to the secondary microservice access request based on the microservice parameter information of the target microservice object, and replaces the user authorization code in the microservice access request with the service authorization code. It receives the microservice access request with the added service authorization code returned by the service prefix authentication entity. It authenticates the service authorization code in the microservice access request, and if the service authorization code in the microservice access request is successfully authenticated, it sends the microservice access request containing the service authorization code to the service router. The service router is used to route the microservice access request to the microservice node running the corresponding microservice.

[0097] Storage unit 620 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 6201 and / or cache memory 6202, and may further include a read-only memory (ROM) 6203.

[0098] Storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0099] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0100] Electronic device 600 can also communicate with one or more external devices 640 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 600, and / or with any device that enables electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. As shown, network adapter 660 communicates with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0101] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0102] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described distributed microservice authorization and authentication method.

[0103] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. Figure 7 This illustration shows a schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure, such as... Figure 7 As shown, the computer-readable storage medium stores a program product 700 capable of implementing the methods described above. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0104] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0105] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0106] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0107] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0108] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0109] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0110] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0111] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A distributed microservice authorization and authentication method, characterized in that, include: Receive a secondary microservice access request from a target user, wherein the secondary microservice access request is a request from the target user to access a target microservice object that is not the first time, and the target microservice object includes one or more microservices, and the microservice access request includes the user information of the target user and the microservice parameter information of the target microservice object; Based on the user information of the target user, the user authorization code of the target user is parsed out, the parsed user authorization code is added to the microservice access request, and the microservice access request with the added user authorization code is sent to the service prefix authentication entity so that the service prefix authentication entity can authenticate the user authorization code contained in the microservice access request. If the user authorization code contained in the microservice access request is successfully authenticated, a service authorization code is assigned to the secondary microservice access request according to the microservice parameter information of the target microservice object, and the user authorization code contained in the microservice access request is replaced with the service authorization code. Receive the microservice access request returned by the service prefix authentication entity, which includes the service authorization code; The service authorization code contained in the microservice access request is authenticated, and if the service authorization code in the microservice access request is successfully authenticated, the microservice access request containing the service authorization code is sent to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

2. The distributed microservice authorization and authentication method according to claim 1, characterized in that, Before receiving a secondary microservice access request from the target user, the method further includes: Receive the first microservice access request from the target user, wherein the first microservice access request is the target user's first request to access the target microservice object; The first microservice access request of the target user is sent to the service prefix authentication entity, so that the service prefix authentication entity performs a second microservice access authorization verification on the target user, and in response to the second microservice access authorization operation of the target user, assigns a user authorization code to the target user to uniquely identify the target user, wherein the user authorization code is generated based on the user information of the target user.

3. The distributed microservice authorization and authentication method according to claim 2, characterized in that, Before sending the target user's initial microservice access request to the service prefix authentication entity, the method further includes: Based on the user information of the target user in the microservice access request, verify whether the user information is consistent with the pre-stored user information; If there is a discrepancy, a registration prompt message is sent to the target user, wherein the registration prompt message is used to prompt the target user to register using the user information.

4. The distributed microservice authorization and authentication method according to claim 2, characterized in that, Before assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: One or more user authorization codes are pre-stored so that the service prefix authentication entity can compare the user authorization codes contained in the microservice access request with the pre-stored user authorization codes to determine whether the user authorization codes contained in the microservice access request have passed authentication.

5. The distributed microservice authorization and authentication method according to claim 2, characterized in that, After assigning a user authorization code to the target user to uniquely identify the target user in response to the target user's secondary microservice access authorization operation, the method further includes: Based on a preset encryption algorithm, the mapping relationship between the user authorization code and the target user's user information is stored.

6. The distributed microservice authorization and authentication method according to claim 1, characterized in that, The microservice parameter information of the target microservice object includes: the name of the target microservice object, the interface network address of the target microservice object, and the request parameters of the target microservice object, wherein the request parameters of the target microservice object consist of the user authorization code and the name of the target microservice object.

7. The distributed microservice authorization and authentication method according to claim 1, characterized in that, Authentication of the service authorization code contained in the microservice access request includes: The service authorization code contained in the microservice access request is compared with one or more pre-stored service authorization codes; If they match, the service authorization code contained in the microservice access request is authenticated. If they are inconsistent, the service authorization code contained in the microservice access request has not been authenticated.

8. A distributed microservice authorization and authentication device, characterized in that, include: The first access request receiving module is used to receive a secondary microservice access request from a target user, wherein the secondary microservice access request is a request from the target user to access the target microservice object that is not the first time, and the target microservice object includes one or more microservices, and the microservice access request includes the user information of the target user and the microservice parameter information of the target microservice object; The service authorization code allocation module is used to parse the user authorization code of the target user based on the user information of the target user, add the parsed user authorization code to the microservice access request, and send the microservice access request with the added user authorization code to the service prefix authentication entity, so that the service prefix authentication entity can authenticate the user authorization code contained in the microservice access request. If the user authorization code contained in the microservice access request is successfully authenticated, the module allocates a service authorization code to the secondary microservice access request based on the microservice parameter information of the target microservice object, and replaces the user authorization code contained in the microservice access request with the service authorization code. The second access request receiving module is used to receive the microservice access request returned by the service prefix authentication entity with the service authorization code added. The target microservice access module is used to authenticate the service authorization code contained in the microservice access request, and if the service authorization code contained in the microservice access request is successfully authenticated, to send the microservice access request containing the service authorization code to the service router, wherein the service router is used to route the microservice access request to the microservice node running the corresponding microservice.

9. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the distributed microservice authorization and authentication method according to any one of claims 1 to 7 by executing the executable instructions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the distributed microservice authorization and authentication method according to any one of claims 1 to 7.

Images