A distributed gateway-based digital network service access control method and device

Abstract

The embodiment of the present invention provides a distributed gateway-based digital networking service access control method and device, which relates to the field of digital networking technology. The method includes: the business system sends a business request to the local node gateway service, the gateway service obtains the request response returned by the request digital networking service based on the business request, and returns it to the business system; the request digital networking service determines the target digital networking service under the target node based on the request data, sends the request data and the gateway identifier of the target node to the gateway service, the gateway service determines the target node gateway service from the global gateway list based on the gateway identifier of the target node; the target node gateway service obtains the target request response and returns the target request response to the local node gateway service; the local node gateway service sends the target request response to the request digital networking service, and then the request digital networking service returns it to the business system through the local node gateway service, so as to realize efficient collaboration between multi-node digital networking services.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of digital networking technology, and in particular to a method and device for controlling access to digital networking services based on a distributed gateway. Background Art

[0002] Traditional centralized data sharing solutions need to aggregate heterogeneous, heterogeneous, and heterogeneous data, conduct centralized data governance, and provide unified shared access for different consumers. This can meet data sharing needs within a certain range, but lacks unified protocols and standards, and is prone to forming new and larger data islands; at the same time, because it is based on centralized aggregation, governance, and sharing, it does not support direct interconnection and interoperability between data builders and consumers; furthermore, at a time when data has become an asset, it is difficult to truly aggregate data from different fields and organizations.

[0003] The digital network is a virtual data network based on the Internet. Through an open software architecture and standard formats, interfaces, and protocols, it realizes the interconnection and interoperability of heterogeneous, heterogeneous, and heterogeneous data, and then realizes the digital space of "data interconnection, on-demand scheduling, intra-domain autonomy, and inter-domain collaboration" with richer data dimensions, supporting business applications with data elements as the core. It can be said that the digital network is a distributed solution for data sharing based on the Internet, which can be composed of multiple nodes deployed in different geographical locations. Each node is composed of a digital object registry system, a digital object warehouse system, and a digital object identification resolution system to form the infrastructure of the digital network. The data construction party can deploy the digital network node locally, encapsulate the data as a digital object and publish it to the local node, and authorize access to the digital object. Other nodes can discover and access the digital object based on authorization, that is, to achieve autonomous and controllable data sharing.

[0004] The infrastructure of the Internet of Things has completed the construction of the digital space, but lacks the ability to drive business applications more widely and directly (such as the lack of the ability to encapsulate heterogeneous data, the lack of the ability to search for digital objects in the entire domain, the lack of the ability to integrate and analyze digital objects, etc.). Therefore, it is necessary to build Internet of Things services for business applications on top of the infrastructure. Internet of Things services shield the details of the underlying infrastructure, simplify multi-layer networking and digital object management operations, and provide richer data application capabilities.

[0005] At this point, the business system can access the data network by accessing the data network service of this node, thereby achieving more convenient and efficient data sharing and data use. However, there is a lack of efficient access control and collaboration methods and devices for the needs of business systems accessing data network services and the associated data network services accessing data network services of other nodes. Summary of the invention

[0006] The embodiment of the present invention provides a distributed gateway-based data network service access control method and device to achieve efficient collaboration between data network services of multiple nodes in a data network.

[0007] A first aspect of an embodiment of the present invention provides a distributed gateway-based data network service access control method, the method comprising:

[0008] The business system sends the business request to the gateway service of the data network node where the business system is located;

[0009] The gateway service receives the business request, obtains a request response returned by the request data networking service based on the business request, and returns the request response to the business system;

[0010] The requesting digital networking service determines a target digital networking service corresponding to a target digital networking node based on the request data of the business request, wherein the target digital networking node and the digital networking node where the business system is located are two different digital networking nodes;

[0011] The requesting digital networking service sends the request data and the gateway identifier of the target digital networking node to the proxy channel of the gateway service;

[0012] After receiving the request data based on the proxy channel, the gateway service determines the target digital networking node gateway service based on the gateway identifier of the target digital networking node from the global gateway list cached locally by the gateway service;

[0013] The target data network node gateway service obtains the target request response and returns the target request response to the gateway service of the data network node where the business system is located;

[0014] The gateway service of the data network node where the business system is located sends the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located.

[0015] A second aspect of an embodiment of the present invention provides a distributed gateway-based data network service access control device, the device comprising:

[0016] A first request sending module, deployed in the business system, is used to send the business request to the gateway service of the data network node where the business system is located;

[0017] A first response returning module, deployed in the gateway service, for receiving the service request, obtaining a request response returned by the request data networking service based on the service request, and returning the request response to the service system;

[0018] A target service determination module is deployed in the request data networking service, and is used to determine the target data networking service corresponding to the target data networking node based on the request data of the business request, wherein the target data networking node and the data networking node where the business system is located are two different data networking nodes;

[0019] A first data sending module, deployed in the request data networking service, for sending the request data and the gateway identifier of the target data networking node to the proxy channel of the gateway service;

[0020] A gateway service determination module, deployed in the gateway service, for determining the target digital networking node gateway service based on the gateway identifier of the target digital networking node from a global gateway list cached locally by the gateway service after the proxy channel receives the request data;

[0021] A target response acquisition module, deployed in the target data network node gateway service, is used to obtain a target request response and return the target request response to the gateway service of the data network node where the business system is located;

[0022] The second response return module is deployed on the gateway service of the data network node where the business system is located, and is used to send the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located.

[0023] In the distributed gateway-based digital networking service access control method provided in an embodiment of the present invention, the digital networking node gateway service can be used to enable the business system of the node to access the digital networking service of the node and obtain a response, and the target digital networking service corresponding to the target digital networking node determined based on the digital networking service of the node can be implemented through the digital networking node gateway service and the target digital networking node gateway service, so that the digital networking service of the node can access the target digital networking service and obtain a response, thereby achieving efficient collaboration between digital networking services in multiple nodes of the digital networking through communication between gateway services in multiple digital networking nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0025] Figure 1 It is a flow chart of a distributed gateway-based data network service access control method according to an embodiment of the present invention;

[0026] Figure 2 It is a functional schematic diagram of a digital network service gateway system shown in one embodiment of the present invention;

[0027] Figure 3 It is a role diagram of a digital network service gateway system shown in one embodiment of the present invention;

[0028] Figure 4 It is a timing diagram of a digital network gateway synchronization shown in one embodiment of the present invention;

[0029] Figure 5 It is a timing diagram of a business system request in a data network shown in one embodiment of the present invention;

[0030] Figure 6 is a cross-node gateway request timing diagram shown in one embodiment of the present invention;

[0031] Figure 7 It is a structural block diagram of a distributed gateway-based data network service access control device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] As mentioned earlier, the digital network is a distributed solution for data sharing based on the Internet, which consists of different nodes distributed in different regions. Each node consists of the digital network infrastructure (digital object registry system, warehouse system, identity resolution system) and digital network services for business applications. Among them, the objects that are interconnected within the digital network are digital objects that are uniformly abstracted from data resources. Each digital object has a unique identifier, called a digital object identifier, which consists of a prefix and a suffix. The registry system, warehouse system, and identity resolution system for digital objects together constitute the infrastructure of the digital network. The registry system is responsible for storing and managing the metadata of digital objects, the warehouse system is responsible for storing and managing the entities of digital objects, and the identity resolution system is responsible for the registration, allocation, and resolution of identifiers.

[0034] The infrastructure of the Internet of Data has completed the construction of the digital space, but lacks the ability to drive business applications more widely and directly (such as the lack of the ability to encapsulate heterogeneous data, the lack of the ability to search for digital objects in the entire domain, the lack of the ability to integrate and analyze digital objects, etc.). Therefore, it is necessary to build Internet of Data services for business applications on top of the infrastructure. Internet of Data services enable business systems to share and utilize data more conveniently and efficiently based on the Internet of Data, so that data resources can play a greater role based on the Internet of Data. Internet of Data services include networking node services, data site services, data encapsulation services, distributed search services, integrated analysis services, etc.

[0035] Business systems can access the data network more conveniently and efficiently by accessing the data network services of nodes. In addition, data network services also need to access the data network services of other nodes to achieve collaboration among multiple nodes in the data network. For example, the networking node service needs to access the networking node services of the upper and lower nodes to simplify the networking configuration, realize data synchronization and message broadcasting; the data site service needs to access the data site service to which the digital object belongs to complete the application approval and access of cross-node digital objects; the distributed search service needs to access the search and screening data site service to realize the global search of digital objects; the fusion analysis service needs to access the data site service to which the digital object belongs to realize the fusion analysis service of multiple digital objects, etc.

[0036] However, in view of the current demand for digital networking services to access digital networking services of other nodes, it is impossible to achieve efficient collaboration between digital networking services of multiple nodes in the digital networking. Therefore, in order to at least partially solve the above-mentioned problems and one or more of other potential problems, an embodiment of the present invention proposes a digital networking service access control method based on a distributed gateway, based on the service request sent by the business system of this node, the digital networking service of this node determines the target digital networking service corresponding to the target digital networking node based on the request data, and through the gateway service of this digital networking node and the gateway service of the target digital networking node, the digital networking service of this node accesses the target digital networking service and obtains a response, thereby achieving efficient collaboration between digital networking services in multiple nodes in the digital networking through communication between gateway services in multiple digital networking nodes.

[0037] Hereinafter, specific examples of the present solution will be described in more detail with reference to the accompanying drawings.

[0038] refer to Figure 1 , Figure 1 FIG. 1 is a flow chart of a distributed gateway-based data network service access control method according to an embodiment of the present invention. Figure 1 As shown, the distributed gateway-based data network service access control method of this embodiment may include the following steps:

[0039] Step S11: The business system sends the business request to the gateway service of the data network node where the business system is located.

[0040] In this embodiment, the business system can generate a business request for the data network service and send the business request to the gateway service of the data network node where the business system is located. In this embodiment, a gateway service is deployed in each data network node, and the gateway service is deployed at the entrance of the data network node to accept and process requests from the business system in the node, the data network service in the node, and the gateway service of other data network nodes.

[0041] Step S12: The gateway service receives the business request, obtains a request response returned by the request network service based on the business request, and returns the request response to the business system.

[0042] In this embodiment, the gateway service receives a business request, can parse the business request, determine the request digital networking service corresponding to the business request, and forward the business request to the request digital networking service. The request digital networking service processes the business request and generates a request response, and returns the request response to the gateway service. The gateway service obtains the request response returned by the request digital networking service based on the business request, and can return the request response to the business system.

[0043] Step S13: The requested digital networking service determines a target digital networking service corresponding to a target digital networking node based on the request data of the business request, wherein the target digital networking node and the digital networking node where the business system is located are two different digital networking nodes.

[0044] In this embodiment, the requesting digital network service can determine whether it is necessary to access the digital network services of other digital network nodes based on the request data in the received business request. For example, the distributed search service needs to access the data site services of other digital network nodes for search screening in order to achieve a global search of digital objects. In the case where the requesting digital network service determines that it is necessary to access the digital network services of other digital network nodes based on the request data in the received business request, the requesting digital network service can determine the target digital network service corresponding to the target digital network node based on the request data.

[0045] Among them, the target digital networking service is the digital networking service that needs to be accessed as determined by the requesting digital networking service based on the request data, and the target digital networking node is the digital networking node where the target digital networking service is located. The target digital networking node and the digital networking node where the business system is located are two different digital networking nodes.

[0046] In addition, in one embodiment, not every service request involves multi-node collaboration (collaboration of multiple data network nodes). Therefore, when the requesting data network service determines that it is not necessary to access data network services of other data network nodes based on the request data in the service request, the request response can be directly returned to the service system through the gateway of this node (i.e., the gateway service of the data network node where the service system is located). In a preferred embodiment, when the service request does not involve multi-node collaboration, the request response can also be directly returned to the service system after security verification and routing by the gateway of this node.

[0047] Step S14: the requesting digital networking service sends the request data and the gateway identifier of the target digital networking node to the proxy channel of the gateway service.

[0048] In this embodiment, after the requesting digital networking service determines the target digital networking service, the request data and the gateway identifier of the target digital networking node corresponding to the target digital networking service can be sent to the proxy channel of the gateway service. In an optional implementation, the proxy channel can be a proxy channel.

[0049] Step S15: After receiving the request data based on the proxy channel, the gateway service determines the target digital networking node gateway service based on the gateway identifier of the target digital networking node from the global gateway list cached locally by the gateway service.

[0050] In this embodiment, after the gateway service receives the request data and the gateway identifier of the target data networking node based on the proxy channel, it can determine the target data networking node gateway service based on the gateway identifier of the target data networking node from the global gateway list cached locally by the gateway service. In this embodiment, each gateway service has a global gateway list cached locally, and the global gateway list includes at least the gateway identifier corresponding to the gateway service of each data networking node and the relevant registration information of the data networking service in each data networking node.

[0051] Step S16: The target data network node gateway service obtains the target request response and returns the target request response to the gateway service of the data network node where the business system is located.

[0052] In this embodiment, the target digital networking node gateway service can obtain the request for request data sent by the gateway service of the digital networking node where the business system is located, and then send the request to the target digital networking service. The target digital networking node gateway service can obtain the target request response returned by the target digital networking service, and return the target request response to the gateway service of the digital networking node where the business system is located.

[0053] Step S17: The gateway service of the data network node where the business system is located sends the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located.

[0054] In this embodiment, the gateway service of the data network node where the business system is located can send the received target request response to the requesting data network service, and then the requesting data network service returns the target request response to the gateway service of the data network node where the business system is located. Finally, the gateway service of the data network node where the business system is located returns the target request response to the business system that sent the business request, thereby completing the access between data network services across nodes.

[0055] In this embodiment, not only can the business system of this node access the digital network service of this node through the digital network node gateway service, but the target digital network service corresponding to other digital network nodes determined based on the digital network service of this node can also be accessed by the digital network service of this node to the target digital network service in other digital network nodes through this digital network node gateway service and other digital network node gateway services, thereby achieving efficient collaboration between the digital network services in multiple digital network nodes through communication between the gateway services in multiple digital network nodes.

[0056] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in the method, the above step S12 may specifically include steps S21 to S23, and, before the above step S16, may also include steps S24 to S26:

[0057] Step S21: the gateway service receives the service request, and sends the request data in the service request to the request data networking service corresponding to the service request.

[0058] In this embodiment, the gateway service can receive the business request sent by the business system of this node, and parse the business request to obtain the request data networking service corresponding to the business request, thereby sending the request data in the business request to the request data networking service.

[0059] Among them, the request data network service includes at least one of the following: fusion analysis service, distributed search service, activation directory service, networking node service, data site service, and data encapsulation service. Networking node service: simplifies the configuration operation of the multi-level network of the identity resolution system, and realizes the data synchronization and message broadcasting capabilities between different nodes; data site service: integrates the registry system and the warehouse system, simplifies the management operation of digital objects, and realizes business functions such as application approval; data encapsulation service: provides the encapsulation capability of heterogeneous data; distributed search service: provides the global search capability of digital objects; fusion analysis service: provides the fusion analysis capability of multiple digital objects.

[0060] Step S22: the request data networking service processes the request data of the business request, generates the request response, and returns the request response to the gateway service.

[0061] In this embodiment, after receiving the request data, the request data networking service may process the request data of the business request, generate a request response for the business request, and return the request response to the gateway service.

[0062] Step S23: The gateway service returns the request response to the business system.

[0063] In this embodiment, after receiving the request response, the gateway service may return the request response to the business system that sent the business request.

[0064] Step S24: the gateway service generates a target service request based at least on the gateway identifier of the data networking node where the service system is located, the gateway identifier of the target data networking node and the request data, and sends the target service request to the gateway service of the target data networking node.

[0065] In this embodiment, after the gateway service receives the request data and the gateway identifier of the target digital networking node, it can generate a target business request based on at least the gateway identifier of the digital networking node where the business system is located, the gateway identifier of the target digital networking node and the request data, and send the target business request to the gateway service of the target digital networking node.

[0066] Step S25: The target data networking node gateway service sends the target service request to the target data networking service.

[0067] In this embodiment, the target data networking node gateway service may send the received target service request to the target data networking service.

[0068] Step S26: The target digital networking service generates the target request response based on the target business request, and returns the target request response to the target digital networking node gateway service.

[0069] In this embodiment, the target data networking service may generate a target request response based on the received target service request, and return the target request response to the target data networking node gateway service.

[0070] In combination with the above embodiments, in another implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in the method, the above step S11 may specifically include step S31 and step S32, and the above step S21 may specifically include step S33 to step S36:

[0071] Step S31: The business system generates an identity signature based at least on the business system identifier, the gateway identifier of the data network node where the business system is located, and a timestamp.

[0072] In this embodiment, when generating a service request, the business system may generate an identity signature based on at least the business system identifier, the gateway identifier of the data network node where the business system is located, and the timestamp. In one example, the business system may generate an identity signature based on the business system identifier, the gateway identifier of the data network node where the business system is located, the timestamp, the business system public key, and the signature algorithm corresponding to the gateway of the data network node where the business system is located.

[0073] Step S32: The business system generates the business request based at least on the business system identifier, the identity signature, the timestamp and the request data, and sends the business request to the gateway service of the data network node where the business system is located.

[0074] In this embodiment, the business system can generate a business request based on at least the business system identifier, the generated identity signature, the timestamp and the request data, and send the business request to the gateway service of the data network node where the business system is located.

[0075] Step S33: The gateway service performs a blacklist and whitelist check on the service request based on the service request, and the blacklist and whitelist check at least includes: whether the requested digital network service corresponding to the service request is in the digital network service whitelist that is allowed to access the gateway service.

[0076] In this embodiment, after receiving the service request, the gateway service needs to perform a blacklist check on the service request. Among them, the blacklist check of this embodiment at least includes: whether the requested digital network service corresponding to the service request is in the digital network service whitelist that is allowed to access the gateway service. In this embodiment, the gateway service locally caches a digital network service whitelist that is allowed to access the gateway service, and the digital network services in the digital network service whitelist have the authority to access the gateway service.

[0077] Step S34: After the gateway service determines that the service request has passed the blacklist and whitelist verification, it matches the corresponding service system private key based on the service system identifier.

[0078] In this embodiment, after the gateway service determines that the service request has passed the blacklist and whitelist verification, it can match the corresponding service system private key based on the service system identifier. Specifically, the global gateway list stores service system private keys and public keys corresponding to multiple service system identifiers, which can be matched based on the service system identifier from the global gateway list cached locally by the gateway service.

[0079] Among them, the gateway service determines that the business request passes the blacklist and whitelist check, which means that the gateway service determines that the requested digital networking service corresponding to the business request is in the digital networking service whitelist that is allowed to access the gateway service. And, if the gateway service determines that the requested digital networking service corresponding to the business request is not in the digital networking service whitelist that is allowed to access the gateway service, it is determined that the blacklist and whitelist check has not passed, and the current digital networking service access control process ends.

[0080] Step S35: The gateway service performs identity signature verification on the business request based on the business system private key, the business system identifier, the gateway identifier of the data network node where the business system is located, the timestamp and the signature algorithm corresponding to the gateway of the data network node where the business system is located, and determines whether the timestamp is invalid.

[0081] In this embodiment, after the gateway service obtains the business system private key, it can perform identity signature verification on the business request based on the business system private key, business system identifier, gateway identifier of the data network node where the business system is located, timestamp, and signature algorithm corresponding to the gateway of the data network node where the business system is located, determine whether the identity signature verification is passed, and determine whether the timestamp is invalid. In this embodiment, a timestamp validity period is set. When it is determined that the judgment moment is within the timestamp validity period, it is determined that the timestamp is not invalid; when it is determined that the judgment moment is not within the timestamp validity period, it is determined that the timestamp is invalid.

[0082] Step S36: When the gateway service determines that the identity signature verification has passed and that the timestamp has not expired, the gateway service sends the request data in the service request to the request data network service corresponding to the service request.

[0083] In this embodiment, the gateway service will send the request data in the business request to the request digital networking service corresponding to the business request only when it is determined that the identity signature verification has passed and the timestamp has not expired; otherwise, the request data in the business request will not be sent to the request digital networking service corresponding to the business request, and the access control process of this digital networking service will be terminated.

[0084] In this embodiment, since the nodes of the digital network may come from different fields and organizations, there is a problem of access distrust between the business system and the digital network services of the nodes, and between the digital network services across nodes. Relevant means of blacklist verification, identity verification and whether the timestamp is invalid are proposed, thereby ensuring access trust in the distributed environment of the digital network.

[0085] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in the method, the above step S33 may specifically include steps S41 to S43, and the "the gateway service determines that the service request passes the black and white list check" in the above step S34 may specifically include step S44:

[0086] Step S41: The gateway service verifies whether the requested digital network service corresponding to the business request is in the digital network service whitelist that is allowed to access the gateway service.

[0087] In this embodiment, the gateway service locally caches the black and white lists of access to the gateway service configured by the backend of the data network gateway corresponding to the gateway service, wherein the black and white lists of access to the gateway service at least include: a white list of data network services that are allowed to access the gateway service, a white list of business systems that are allowed to access the gateway service, and a black list of request IPs that are prohibited from accessing the gateway service. In this embodiment, the gateway service can first verify whether the requested data network service corresponding to the business request is in the white list of data network services that are allowed to access the gateway service.

[0088] Step S42: When the requested data network service is in the data network service whitelist that is allowed to access the gateway service, the gateway service verifies whether the business system is in the business system whitelist that is allowed to access the gateway service.

[0089] In this embodiment, when it is determined that the requested data network service is in the data network service whitelist allowed to access the gateway service, the gateway service may verify whether the business system is in the business system whitelist allowed to access the gateway service.

[0090] Step S43: When the business system is in the white list of business systems allowed to access the gateway service, the gateway service verifies whether the request IP of the business request is in the black list of request IPs prohibited from accessing the gateway service.

[0091] In this embodiment, when it is determined that the business system is in the whitelist of business systems allowed to access the gateway service, the gateway service can check whether the request IP of the business request is in the blacklist of request IPs prohibited from accessing the gateway service.

[0092] Step S44: When the requesting IP of the service request is not in the requesting IP blacklist prohibited from accessing the gateway service, the gateway service determines that the service request passes the blacklist and whitelist verification.

[0093] In this embodiment, the gateway service can determine that the service request passes the blacklist and whitelist verification only when it is determined that the requesting IP of the service request is not in the requesting IP blacklist that is prohibited from accessing the gateway service.

[0094] In combination with the above embodiments, in one implementation, an embodiment of the present invention also provides a distributed gateway-based digital network service access control method. Specifically, in this method, in addition to the above steps, it may also include step S51; the "business system generates the business request based on at least the business system identifier, the identity signature, the timestamp and the request data" in the above step S32 may specifically include step S52; when the gateway service determines that the identity signature verification has passed and the timestamp has not expired, before "sending the request data in the business request to the request digital network service corresponding to the business request" in the above step S21, it may also include steps S53 and S54; and the "sending the request data in the business request to the request digital network service corresponding to the business request" in the above step S21 may specifically include step S55:

[0095] Step S51: The business system encrypts the request data based on the business system identifier, the business system public key, and the signature algorithm and encryption algorithm corresponding to the gateway of the data network node where the business system is located, obtains the encrypted request data, and generates a data signature.

[0096] In this embodiment, the business system will also encrypt the request data based on the business system identifier, business system public key, and the signature algorithm and encryption algorithm corresponding to the gateway of the data network node where the business system is located, obtain the encrypted request data, and generate a data signature.

[0097] Step S52: the business system generates a request header based on the business system identifier, the identity signature, the data signature and the timestamp, generates a request body based on the encrypted request data, and generates the business request based on the request body and the request header.

[0098] In this embodiment, after generating the identity signature and data signature, the business system can generate a request header based on the business system identifier, identity signature, data signature and timestamp; generate a request body based on the encrypted request data, and thus generate a business request based on the request body and request header.

[0099] Step S53: The gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located.

[0100] In this embodiment, when the gateway service determines that the identity signature verification has passed and the timestamp has not expired, it can first determine the business system private key and the signature algorithm corresponding to the gateway of the digital network node where the business system is located based on the global gateway list, and then perform data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the digital network node where the business system is located.

[0101] Step S54: When the gateway service determines that the data verification signature passes, the gateway service decrypts the encrypted request data of the business request based on the business system private key and the encryption algorithm corresponding to the gateway of the data network node where the business system is located to obtain the decrypted request data.

[0102] In this embodiment, when the gateway service determines that the data verification signature passes, it can first determine the encryption algorithm corresponding to the gateway of the digital network node where the business system is located based on the global gateway list, and then decrypt the encrypted request data of the business request based on the business system private key and the encryption algorithm corresponding to the gateway of the digital network node where the business system is located to obtain the decrypted request data.

[0103] Step S55: The gateway service sends the decrypted request data to the request data networking service corresponding to the business request.

[0104] In this embodiment, after obtaining the decrypted request data, the gateway service may send the decrypted request data to the request data networking service corresponding to the business request.

[0105] This embodiment aims to address the problem that the nodes of the current digital network are exposed in the digital network, and there is a risk of data leakage and data tampering between the business system and the digital network services of the node, and between the digital network services across nodes. By encrypting the request data of the business request based on the business system public key, the business system identifier and the signature algorithm corresponding to the gateway of the digital network node where the business system is located, and the gateway service then decrypts the data using the business system private key and the encryption algorithm corresponding to the gateway of the digital network node where the business system is located, the risk of data leakage or tampering between the business system and the digital network services of the node, and between the digital network services across nodes is avoided, thereby ensuring data security.

[0106] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in the method, before the above step S53, step S61 may be further included, and the above step S53 may specifically include step S62:

[0107] Step S61: The gateway service determines a flow control strategy for the requested digital networking service, and performs request flow control for the requested digital networking service according to the flow control strategy for the requested digital networking service.

[0108] In this embodiment, a corresponding flow control strategy is formulated in advance for each data network service. Therefore, after the gateway service determines that the identity authentication is passed and the timestamp is not invalid, it can determine the flow control strategy corresponding to the requested data network service, and perform request flow control for the requested data network service according to the flow control strategy of the requested data network service. For example, the flow control strategy is: if the flow exceeds 10,000 requests within 1 second, it will no longer be accepted, and the response will be directly downgraded and returned.

[0109] Step S62: When the gateway service determines that the business request satisfies the request flow control of the requested data network service, the gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located.

[0110] In this embodiment, the gateway service verifies the data signature of the service request based on the signature algorithm corresponding to the business system private key and the gateway of the data network node where the business system is located, only when it is determined that the service request meets the request flow control of the requested data network service. If it is determined that the service request does not meet the request flow control of the requested data network service, the relevant response is directly returned to the business system, and the access control process of this data network service is terminated.

[0111] In this embodiment, the nodes of the data network are exposed to the Internet, and the data network services may be attacked by malicious traffic. At the same time, the nodes themselves may also generate normal traffic peaks, thereby affecting the availability of the data network services. Different traffic control strategies are formulated in advance for different data network services, and traffic control is performed on business requests based on the traffic control strategies, thereby ensuring the availability of the data network services.

[0112] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in the method, after the above step S54, step S71 may be further included, and the above step S55 may specifically include step S72:

[0113] Step S71: The gateway service converts the business request into the service request protocol based on the service request protocol corresponding to the requested digital networking service.

[0114] In this embodiment, the digital networking services may be deployed in different networks and may be built based on different communication protocols. Therefore, each digital networking service in this embodiment supports each node to customize the same or different protocols, such as HTTP protocol, dubbo protocol, grpc protocol, etc., and the gateway service uniformly uses the HTTP protocol. Therefore, the gateway service can convert the business request based on the HTTP protocol into the business request based on the service request protocol corresponding to the request digital networking service.

[0115] Step S72: The gateway service forwards the decrypted request data to the target instance of the requested digital networking service using the service request protocol based on the routing rules and load balancing strategy of the requested digital networking service.

[0116] In this embodiment, different routing rules and load balancing strategies are configured in advance for different digital networking services. In order to support high availability, each digital networking service can have multiple instances. Therefore, after obtaining the decrypted request data, the gateway service determines the routing rules and load balancing strategies for the requested digital networking service, and based on the configured routing rules and load balancing strategies for the requested digital networking service, forwards the decrypted request data to the specific target instance of the requested digital networking service in the form of a service request protocol.

[0117] In this embodiment, digital networking services may be deployed in different networks and may be built based on different communication protocols. There may be communication incompatibility issues between business systems and digital networking services of nodes, and between digital networking services across nodes. Protocol conversion of business requests is performed through network management services, thereby achieving communication compatibility between business systems and digital networking services within a node, and between digital networking services across nodes.

[0118] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in this method, the above step S24 may specifically include steps S81 to S83:

[0119] Step S81: The gateway service encrypts the request data based on the gateway identifier of the target number networking node, the gateway public key of the target number networking node, the signature algorithm and encryption algorithm corresponding to the gateway of the target number networking node, obtains the encrypted target request data, and generates a target data signature.

[0120] In this embodiment, the gateway service can encrypt the received request data based on the gateway identifier of the target number networking node, the gateway public key of the target number networking node, the signature algorithm and encryption algorithm corresponding to the gateway of the target number networking node, obtain the encrypted target request data, and generate the target data signature. Among them, the gateway service can obtain the gateway public key of the target number networking node, the signature algorithm and encryption algorithm corresponding to the gateway of the target number networking node based on the global gateway list.

[0121] Step S82: The gateway service generates a target identity signature based at least on the gateway identifier of the data network node where the business system is located, the gateway identifier of the target data network node, and the current timestamp.

[0122] In this embodiment, the gateway service also generates a target identity signature based on at least the gateway identifier of the data networking node where the business system is located, the gateway identifier of the target data networking node, and the current timestamp. In one example, the gateway service can generate a target identity signature based on the gateway identifier of the data networking node where the business system is located, the gateway identifier of the target data networking node, the timestamp, the gateway public key of the target data networking node, and the signature algorithm corresponding to the gateway of the target data networking node.

[0123] Step S83: The gateway service generates a target request header based on the gateway identifier of the data network node where the business system is located, the target identity signature, the target data signature and the current timestamp, generates a target request body based on the encrypted target request data, and generates the target business request based on the target request body and the target request header.

[0124] In this embodiment, the gateway service can generate a target request header based on the gateway identifier of the data network node where the business system is located, the generated target identity signature, the target data signature and the current timestamp; and generate a target request body based on the encrypted target request data, thereby generating a target business request based on the target request body and the target request header.

[0125] In one embodiment, after the gateway service generates the target business request, the target business request can be sent to the target digital networking node gateway service. Also, after the target digital networking node gateway service receives the target business request, the step of processing the target business request and sending it to the target digital networking service is the same or similar to the step of processing the business request and sending it to the requesting digital networking service after the gateway service of the digital networking node where the business system is located receives the business request in any of the above embodiments, and this embodiment will not go into details. For example, the target digital networking node gateway service successively performs black and white list verification, target identity signature verification and current timestamp expiration judgment, flow control, target data signature verification, data decryption, protocol conversion, routing and load balancing control, etc. on the target business request, thereby forwarding the target business request to the target digital networking service.

[0126] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a method for controlling access to Internet services based on a distributed gateway. Specifically, in addition to the above steps, the method may also include steps S91 to S97:

[0127] Step S91: The gateway backend in the data networking node requests a gateway identifier from the networking node service in the data networking node.

[0128] In this embodiment, the gateway backend in the data network node can register a unique gateway identifier with the networking node service in the data network node, that is, request a gateway identifier from the networking node service in the data network node, and the gateway identifier is a digital object identifier.

[0129] Step S92: The digital network service in the digital network node sends the service registration information to the digital network gateway backend to complete the digital network service registration.

[0130] In this embodiment, the data network service in the data network node can send service registration information to the data network gateway backend in the data network node to complete the registration of the data network service. The service registration information at least includes: service address, service request protocol, instance version and interface definition.

[0131] Step S93: The digital network gateway backend determines first configuration information for the business system in the digital network node.

[0132] In this embodiment, the digital network gateway backend can determine the first configuration information for the business system in the digital network node. The first configuration information at least includes: the business system identifier and the business system public-private key pair of the business system connected to the digital network node. For example, the digital network gateway backend can allocate a business system identifier (digital object identifier) ​​and a business system public-private key pair to the business system connected to the digital network node.

[0133] Step S94: the data networking gateway backend determines second configuration information for the data networking service in the data networking node.

[0134] In this embodiment, the data networking gateway backend may determine the second configuration information for the data networking service in the data networking node, wherein the second configuration information includes at least: routing rules, load balancing strategies, service instances, and flow control strategies for the data networking service in the data networking node. Specifically, the routing rules, load balancing strategies, service instances, and flow control strategies for the data networking service in the data networking node may be generated by the data networking gateway backend based on the configuration.

[0135] Step S95: the digital networking gateway backend determines the third configuration information for the digital networking node gateway in the digital networking node.

[0136] In this embodiment, the digital network gateway backend can also determine the third configuration information for the digital network node gateway in the digital network node. The third configuration information includes at least one or more of the following: a public and private key pair of the digital network node gateway, a digital network service whitelist that allows access to the gateway service corresponding to the digital network node gateway, a digital network gateway whitelist that allows access to the gateway service corresponding to the digital network node gateway, a business system whitelist that allows access to the gateway service corresponding to the digital network node gateway, an encryption algorithm and a signature algorithm corresponding to the digital network node gateway, and a request IP blacklist that prohibits access to the gateway service corresponding to the digital network node gateway.

[0137] Step S96: The digital network gateway backend sends a gateway data synchronization request to the networking node service, and the gateway data synchronization request carries the first configuration information, the second configuration information and the third configuration information, so that the networking node service generates the global gateway list synchronized to the gateway backends of other digital network nodes based on the gateway data synchronization request, and returns it to the digital network gateway backend.

[0138] In this embodiment, after the digital network gateway background determines the first configuration information, the second configuration information and the third configuration information, it can generate a gateway data synchronization request, which carries the first configuration information, the second configuration information and the third configuration information, and send the gateway data synchronization request to the networking node service.

[0139] The networking node service can generate a global gateway list synchronized to the gateway backends of other data networking nodes based on the gateway data synchronization request, and return the global gateway list to the data networking gateway backend, and can return the global gateway list to each data networking gateway backend. The global gateway list carries at least the first configuration information of the business system in each data networking node, the second configuration information of the data networking service in each data networking node, and the third configuration information of the data networking node gateway in each data networking node.

[0140] Step S97: The digital network gateway service pulls the global gateway list from the digital network gateway backend and caches it locally in the gateway service.

[0141] In this embodiment, after the digital network gateway backend receives the global gateway list, the digital network gateway service pulls the global gateway list from the corresponding digital network gateway backend and caches the global gateway list locally in the gateway service.

[0142] In one embodiment, if Figure 2 As shown, Figure 2 FIG. 1 is a functional schematic diagram of a data network service gateway system according to an embodiment of the present invention. Figure 2 In the data network service gateway system, the gateway background and gateway service are composed of the gateway background. The gateway background is both the management center of the gateway and the registration center of the data network service in the node, providing functions such as APP management, service management, instance management, routing management, flow control management, key management, blacklist management, and algorithm management. Among them, service management is to manage the data network service; instance management is to support high availability, and there are multiple different instances of unused data network services; routing management is to configure rules such as business requests; algorithm management is to manage the signature algorithm and / or encryption algorithm of the gateway; and so on.

[0143] The gateway service directly accepts requests from business systems, node data networking services, and other node gateways. It can achieve high performance based on the Netty framework and clever use of cache, support stateless clustered deployment to achieve high availability, and internal plug-in mechanism to achieve high scalability, providing identity authentication, authorization, current limiting, data encryption and decryption, data tamper-proofing, dynamic routing, protocol conversion, load balancing and other functions. Among them, the data in data encryption and decryption and data tamper-proofing are the request and response data of the entire communication, and dynamic routing means that if the routing rules of the gateway background are changed, the gateway service can update the routing rules in time.

[0144] When business systems access the Internet of Things services of this Internet of Things node, and when Internet of Things services access the Internet of Things services of other Internet of Things nodes, there are the aforementioned access trust issues, data security issues, traffic protection issues, communication compatibility issues, and the resulting construction cost issues: each Internet of Things service needs to solve the above problems, and at the same time, it is also necessary to maintain cross-node Internet of Things service information (such as addresses, protocols, etc.), which results in high construction and maintenance costs.

[0145] Based on the above problems, in one embodiment, a distributed gateway model for data network services is proposed, which can simultaneously support business systems accessing data network services and communication between multi-node data network services. Through the linkage between multi-node gateways, the problems of access trust, data security, traffic protection, communication compatibility, etc. in the distributed environment of the data network are solved. The distributed gateway model is deployed on multiple data network nodes, and each data network node has a gateway layer: the data network service gateway system.

[0146] like Figure 3 As shown, Figure 3 FIG. 1 is a role diagram of a data network service gateway system according to an embodiment of the present invention. Figure 3 In the data network node A and the data network node B, there are business layers, gateway layers, service layers and infrastructure. Among them, the business layer includes multiple APPs, and the APP is the business system in the data network node. The service layer includes multiple data network services, such as: fusion analysis service, distributed search service, activation directory service, networking node service, data site service, data encapsulation service, etc. The infrastructure includes: identity resolution system, registry system and warehouse system. Among them, the business system (APP) in this node, the data network service in this node and the cross-node data network service gateway system can be connected with the data network service gateway system in this node, so as to realize efficient access to multi-node data network services.

[0147] The data network service gateway system, referred to as the gateway, is deployed at the entrance of the data network node to accept and process requests from business systems, data network services within the node, and other node gateways. Figure 3 A business system of the data network node A initiates a data search, and the request is forwarded by the gateway of the data network node A to the distributed search service of the data network node A. The distributed search service of the data network node A accesses the data site service of the data network node B via the gateway of the data network node A and the gateway of the data network node B. For requests from the outside (from the perspective of the node gateway), including business systems and other node gateways, security control is implemented based on identification and public-private key mechanisms, and the request is forwarded to the data network service within the node; for requests from internal data network services, the request is forwarded to the target node gateway by opening a proxy channel to the internal network and locating the gateway based on identification.

[0148] In one embodiment, if Figure 4 As shown, Figure 4 FIG. 1 is a timing diagram of a data network gateway synchronization according to an embodiment of the present invention. Figure 4 The following steps may be included:

[0149] 1. The gateway backend registers a unique gateway identifier (digital object identifier) ​​with the networking node service within the node.

[0150] 2. The networking node service within the node returns the gateway identifier to the gateway background.

[0151] 3. The data network service in the node registers the service with the gateway background, that is, registers the service information (including service address, request protocol, instance version, interface definition, etc.) to the gateway background.

[0152] 4. The administrator can manage and configure through the gateway background: the gateway background generates the public and private key pair of the gateway of this node; allocates APP identification (digital object identification) and APP public and private key pair to the business system connected to this node; configures the whitelist of APP identification and other node gateway identifications that are allowed to access this node; configures the whitelist of network services of this node that are allowed to access and their routing rules, and can route requests to service instances of different versions based on request parameters. In addition, the asymmetric encryption algorithm and signature algorithm of the gateway of this node can be customized, the load balancing strategy and the weight value of the service instance can be configured (configured by the instance management, related to the service configuration resources, the better the configuration and the more resources, the higher the corresponding weight), different flow control strategies can be formulated for different services, and blacklists can be set based on the request IP, etc.

[0153] 5. After the gateway backend is configured, you can use the data synchronization capability of the networking node service to initiate data synchronization of this gateway, and synchronize the basic information of this node gateway (including gateway identification, gateway address, etc.), security configuration information (including gateway public key, asymmetric encryption algorithm, signature algorithm, blacklist and whitelist, etc.) and service registration information to the gateway backend of other nodes.

[0154] 6. The networking node service synchronizes data based on the node-level network to form a global gateway list.

[0155] 7. The gateway backend obtains the global gateway list from the networking node service.

[0156] 8. The networking node service returns the global gateway list to the gateway backend.

[0157] 9. The gateway service periodically pulls the gateway data and the global gateway list (including gateway basic information, security configuration information and service registration information) from the gateway background.

[0158] 10. The gateway backend returns the gateway data and the global gateway list to the gateway service, and the gateway service caches them locally.

[0159] That is to say, the pre-configuration of the data network gateway in this embodiment includes:

[0160] The data network gateway backend requests the gateway identification from the networking node service in the data network node where it is located;

[0161] The data network service in the data network node registers the service information (service address, request protocol, instance version, interface definition) to the data network gateway backend;

[0162] The data network gateway backend generates a gateway public and private key pair, allocates a business system ID and a business system public and private key pair to the business system connected to the data network node, configures the data network service ID of this gateway and the whitelist of other node gateway IDs that are allowed to be accessed, and configures the whitelist and routing rules for running data network services accessing this node;

[0163] The backend of the data network gateway defines the asymmetric encryption algorithm and signature algorithm of the node gateway, configures the weight value of the responsible balancing strategy and service instance, formulates the flow control strategy of different data network services, and configures the blacklist of request IPs;

[0164] The backend of the data network gateway sends a data synchronization request to the networking node service in the data network node to request that the gateway identification, gateway address, gateway public key, asymmetric encryption algorithm and signature algorithm, blacklist and whitelist, and service registration information of the gateway of this node be synchronized to the backend of the gateway of other nodes to obtain the generated global gateway list;

[0165] The data network gateway service periodically pulls the global list from the data network gateway backend and caches it locally in the gateway service.

[0166] In one embodiment, generating a service request in a service system includes:

[0167] The business system encrypts the request data based on the business system identifier, business system public key, asymmetric encryption algorithm, and signature algorithm to obtain the encrypted request data and generate a data signature;

[0168] The business system combines the business system ID, the requested gateway ID (this node gateway ID) and the timestamp to generate an identity signature;

[0169] The request header is organized based on the business system identification, data signature, identity signature and timestamp, and the request body is organized based on the encrypted request data. The business request composed of the request body and request header is sent to the data network gateway service of this node.

[0170] In one embodiment, if Figure 5 As shown, Figure 5 FIG. 1 is a timing diagram of a business system request in a data network according to an embodiment of the present invention. Figure 5 The following steps may be included:

[0171] 1. The user initiates a business request through the APP (business system).

[0172] 2. After the APP generates a business request, it sends the business request (digital object request) to the gateway service of this node.

[0173] 3. After receiving the business request, the gateway service of this node performs blacklist and whitelist verification: verify whether the requesting IP is in the blacklist, verify whether the source identifier (business system identifier) ​​is in the whitelist, and verify whether the requested service is in the whitelist.

[0174] 4. After the gateway service of this node determines that the blacklist and whitelist verification has passed, it performs identity verification: matching the private key based on the source identifier, combining the source identifier, target identifier (this node gateway identifier) ​​and timestamp, based on the specified signature algorithm, performs identity signature verification, and makes a timestamp expiration judgment.

[0175] 5. After the gateway service of this node confirms that the identity authentication has passed, it will limit the flow: according to the flow control strategy matched by the request service, the flow limit is executed. Among them, the gateway service executes the flow limit, and the gateway background configures the flow control.

[0176] 6. After the gateway service of this node confirms that the current limit has passed, data signature verification is performed: based on the matching private key and the specified signature algorithm, data signature verification is performed to prevent data tampering.

[0177] 7. After the gateway service of this node confirms that the data signature verification has passed, it will decrypt the data: data decryption is performed based on the matching private key and the specified asymmetric encryption algorithm.

[0178] 8. The gateway service of this node performs protocol conversion: according to the request protocol registered by the data network service, the request is converted to the specified protocol, supporting http, dubbo, grpc, etc., and can be customized and extended based on the plug-in mechanism.

[0179] 9. The gateway service of this node performs routing and load balancing: based on the configured routing rules and load balancing strategies, the request is forwarded to the specific instance of the service.

[0180] 10. The gateway service of this node sends the business request to the data network service.

[0181] 11. After receiving the request, the data network service of this node processes the request locally and returns the response data to the gateway service of this node.

[0182] 12. The gateway service of this node returns the response data to the APP (the business system that sends the request).

[0183] 13. The APP presents the response data to the user.

[0184] That is to say, in this embodiment, the access to the network service of this node includes:

[0185] The gateway service receives the service request, verifies whether the requesting IP of the service request is in the blacklist, verifies whether the service system identifier carried in the service request is in the whitelist, and verifies whether the requesting service of the service request is in the whitelist;

[0186] After the gateway service determines that the blacklist and whitelist verification of the business request has passed, it matches the private key based on the business system ID, combines the business system ID and the node gateway ID, and performs identity signature verification on the business request based on the configured signature algorithm, and makes an invalidation judgment based on the timestamp;

[0187] After the gateway service confirms that the identity authentication is successful, it determines the flow control strategy corresponding to the requested service and performs flow limiting;

[0188] After the flow limit is passed, data signature verification is performed based on the private key and signature algorithm matched by the business system;

[0189] After the data signature verification is passed, data decryption is performed based on the private key matched by the business system and the target asymmetric encryption algorithm to obtain the decrypted request data.

[0190] Based on the protocol of the requested network service, the protocol is converted to the specified protocol, and based on the routing rules and load balancing strategy of the requested service, the business request is forwarded to the specific instance of the corresponding requested service;

[0191] After receiving the business request, the request service processes the business request locally and returns the response to the corresponding business system through the data network gateway service.

[0192] In one embodiment, if Figure 6 As shown, Figure 6 FIG. 1 is a cross-node gateway request timing diagram shown in an embodiment of the present invention. Figure 6 The following steps may be included:

[0193] 1. When the A node data networking service determines that it needs to request the B node data networking service based on the received request data, it can organize the request data.

[0194] 2. The A node data networking service can request a proxy channel: it needs to carry the B node prefix and organize the request data to be sent to the proxy channel of the A node gateway service according to the specified request format.

[0195] 3. The A-node gateway service locates the target node gateway: After receiving the request, the A-node gateway service proxy channel matches the requested B-node prefix based on the gateway identifier from the locally cached global gateway list to locate the target node gateway (i.e., the B-node gateway service).

[0196] 4. A node gateway service performs data encryption: based on the target node gateway identifier, target node gateway public key and the specified asymmetric encryption algorithm and signature algorithm, the request data is encrypted;

[0197] 5. The A node gateway service generates an identity signature: an identity signature is generated by combining the source identifier (A node gateway identifier), the target identifier (B node gateway identifier) ​​and the timestamp.

[0198] 6. A node gateway service generates a data signature: based on the target node gateway identifier, target node gateway public key and signature algorithm, generates a data signature.

[0199] 7. The A node gateway service organizes the request data: organizes the request header based on the source identification, identity signature, data signature, and timestamp, organizes the request body with the encrypted request data, and generates the request based on the request header and request body.

[0200] 8. The A node gateway service sends the request to the target node gateway (i.e., the B node gateway service).

[0201] 9-15. B-node gateway service and Figure 5 The processing process of the gateway service of this node is the same or similar, which is: blacklist and whitelist verification, identity verification, current limiting, data verification, data decryption, protocol conversion, routing and load balancing, so as to forward the request to the specific instance of the B node data networking service.

[0202] 16. The B-Node Gateway Service sends the request to the B-Node Networking Service.

[0203] 17. After receiving the request, the B-node data networking service processes the request locally and returns the response data to the B-node gateway service.

[0204] 18. The B node gateway service returns the response data to the A node gateway service.

[0205] 19. The A node gateway service returns the response data to the A node network service.

[0206] That is, the access to cross-node Internet services in this embodiment includes:

[0207] The node request service determines the target service corresponding to the target node based on the service request, adds the target node prefix to the service request, and sends the service request to the proxy channel of the node gateway service according to the specified request format;

[0208] After receiving the service request based on the proxy channel, the node gateway service determines the target node gateway service from the locally cached global gateway list based on the gateway identifier matching the requested target node prefix;

[0209] This node gateway service encrypts the request data based on the target node gateway identifier, the target node gateway public key and the specified asymmetric encryption algorithm and signature algorithm, obtains the encrypted request data, and generates a data signature;

[0210] This node gateway service generates an identity signature by combining this node gateway ID, target node gateway ID and timestamp;

[0211] The gateway service of this node organizes the request header based on the gateway identification, identity signature, data signature, and timestamp of this node, organizes the request body with the encrypted request data, and sends the request consisting of the request body and request header to the gateway service of the target node;

[0212] After receiving the business request, the gateway service of the target node repeats the steps of blacklist and whitelist verification, identity verification, current limiting, data verification, data decryption, protocol conversion, routing and load balancing, and sends the request to the target node data networking service. The target node data networking service generates a response and returns the generated response to the target node gateway service-this node gateway service-this node request service-this node gateway service-business system.

[0213] In this embodiment, the digital network service gateway system consists of a gateway background and a gateway service. The gateway background is responsible for configuration and management, and the gateway service accepts and processes requests from inside and outside the node; the gateway background registers the digital object identification of the gateway of this node as the basis for communication authentication between multiple nodes; the gateway background synchronizes gateway data based on the hierarchical network composed of networking node services to form a global gateway list; the gateway service regularly pulls the gateway data of this node and the global gateway list from the gateway background and caches them locally; the gateway service performs identity verification, data verification and data decryption for external requests based on identification and public-private key mechanisms, and forwards the requests to the digital network service in the node; the gateway service performs identity signing, data signing and data encryption for internal requests through a proxy channel open to the internal network of the node based on identification and public-private key mechanisms, locates the target node gateway with the node prefix, and forwards the requests to the target node gateway.

[0214] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0215] Based on the same inventive concept, an embodiment of the present invention provides a distributed gateway-based data network service access control device 700. Figure 7 , Figure 7 FIG. 1 is a structural block diagram of a distributed gateway-based data network service access control device provided by an embodiment of the present invention. Figure 7 As shown, the device 700 includes:

[0216] The first request sending module 701 is deployed in the business system and is used to send the business request to the gateway service of the data network node where the business system is located;

[0217] A first response returning module 702, deployed in the gateway service, is used to receive the service request, obtain a request response returned by the request data networking service based on the service request, and return the request response to the service system;

[0218] A target service determination module 703 is deployed in the request data networking service and is used to determine the target data networking service corresponding to the target data networking node based on the request data of the business request, wherein the target data networking node and the data networking node where the business system is located are two different data networking nodes;

[0219] A first data sending module 704, deployed in the request data networking service, is used to send the request data and the gateway identifier of the target data networking node to the proxy channel of the gateway service;

[0220] A gateway service determination module 705, deployed in the gateway service, is used to determine the target digital networking node gateway service based on the gateway identifier of the target digital networking node from the global gateway list cached locally by the gateway service after receiving the request data based on the proxy channel;

[0221] The target response acquisition module 706 is deployed in the target data network node gateway service, and is used to obtain the target request response and return the target request response to the gateway service of the data network node where the business system is located;

[0222] The second response returning module 707 is deployed on the gateway service of the data network node where the business system is located, and is used to send the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located.

[0223] Optionally, the first response returning module 702 includes:

[0224] A first request receiving module, deployed in the gateway service, is used to receive the service request and send the request data in the service request to the request data networking service corresponding to the service request, wherein the request data networking service includes at least one of the following: fusion analysis service, distributed search service, activation directory service, networking node service, data site service, and data encapsulation service;

[0225] A first response generation module, deployed in the request data networking service, is used to process the request data of the business request, generate the request response, and return the request response to the gateway service;

[0226] A first response sending module, deployed in the gateway service, for returning the request response to the business system;

[0227] The device 700 further includes:

[0228] A first request generation module, deployed in the gateway service, is used to generate a target business request based on at least the gateway identifier of the data network node where the business system is located, the gateway identifier of the target data network node and the request data, and send the target business request to the target data network node gateway service before obtaining the target request response at the target data network node gateway service and returning the target request response to the gateway service of the data network node where the business system is located;

[0229] A first request forwarding module, deployed in the target data networking node gateway service, for sending the target service request to the target data networking service;

[0230] The target response returning module is deployed in the target data networking service, and is used to generate the target request response based on the target business request, and return the target request response to the target data networking node gateway service.

[0231] Optionally, the first request sending module 701 includes:

[0232] A first identity signature generation module, deployed in the business system, for generating an identity signature based on at least a business system identifier, a gateway identifier of a data network node where the business system is located, and a timestamp;

[0233] A business request generation module, deployed in the business system, for generating the business request based at least on the business system identifier, the identity signature, the timestamp and the request data, and sending the business request to the gateway service of the data network node where the business system is located;

[0234] The first request receiving module includes:

[0235] A blacklist verification module is deployed in the gateway service, and is used to perform a blacklist and whitelist verification on the service request based on the service request, wherein the blacklist and whitelist verification at least includes: whether the requested data network service corresponding to the service request is in the data network service whitelist that is allowed to access the gateway service;

[0236] A private key matching module, deployed in the gateway service, for matching the corresponding business system private key based on the business system identifier after determining that the business request has passed the blacklist and whitelist verification;

[0237] An identity signature verification module, deployed in the gateway service, is used to perform identity signature verification on the business request based on the business system private key, the business system identifier, the gateway identifier of the data network node where the business system is located, the timestamp and the signature algorithm corresponding to the gateway of the data network node where the business system is located, and to determine whether the timestamp is invalid;

[0238] The business request sending module is deployed in the gateway service and is used to send the request data in the business request to the request data network service corresponding to the business request when it is determined that the identity signature verification has passed and the timestamp has not expired.

[0239] Optionally, the gateway service locally caches a blacklist and whitelist of access to the gateway service configured by the backend of the data network gateway corresponding to the gateway service, and the blacklist and whitelist of access to the gateway service at least includes: a whitelist of data network services allowed to access the gateway service, a whitelist of business systems allowed to access the gateway service, and a blacklist of request IPs prohibited from accessing the gateway service;

[0240] The blacklist verification module comprises:

[0241] A first verification module, deployed in the gateway service, for verifying whether the requested data network service corresponding to the business request is in the data network service whitelist that is allowed to access the gateway service;

[0242] A second verification module, deployed in the gateway service, is used to verify whether the business system is in the whitelist of business systems that are allowed to access the gateway service when the requested data network service is in the whitelist of data network services that are allowed to access the gateway service;

[0243] A third verification module, deployed in the gateway service, is used to verify whether the request IP of the business request is in the request IP blacklist prohibited from accessing the gateway service when the business system is in the whitelist of business systems allowed to access the gateway service;

[0244] The private key matching module includes:

[0245] The blacklist verification module is deployed in the gateway service and is used to determine that the service request passes the blacklist and whitelist verification when the request IP of the service request is not in the request IP blacklist prohibited from accessing the gateway service.

[0246] Optionally, the device 700 further includes:

[0247] A data signature module is deployed in the business system, and is used to encrypt the request data based on the business system identifier, the business system public key, and the signature algorithm and encryption algorithm corresponding to the gateway of the data network node where the business system is located, to obtain the encrypted request data and generate a data signature;

[0248] The business request generation module includes:

[0249] A request header and body generation module, deployed in the business system, for generating a request header based on the business system identifier, the identity signature, the data signature and the timestamp, generating a request body based on the encrypted request data, and generating the business request based on the request body and the request header;

[0250] The device 700 further includes:

[0251] A data signature verification module is deployed in the gateway service, and is used to verify the data signature of the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located before sending the request data in the business request to the request data network service corresponding to the business request, when it is determined that the identity signature verification has passed and the timestamp has not expired;

[0252] A data decryption module is deployed in the gateway service, and is used to decrypt the encrypted request data of the business request based on the business system private key and the encryption algorithm corresponding to the gateway of the data network node where the business system is located, to obtain the decrypted request data when it is determined that the data verification signature has passed;

[0253] The service request sending module includes:

[0254] The decrypted data sending module is deployed in the gateway service and is used to send the decrypted request data to the request data networking service corresponding to the business request.

[0255] Optionally, the first request generating module includes:

[0256] A target data encryption module is deployed in the gateway service, and is used to encrypt the request data based on the gateway identifier of the target data networking node, the gateway public key of the target data networking node, the signature algorithm and encryption algorithm corresponding to the gateway of the target data networking node, obtain the encrypted target request data, and generate a target data signature;

[0257] A target identity signature module, deployed in the gateway service, for generating a target identity signature based on at least the gateway identifier of the data network node where the business system is located, the gateway identifier of the target data network node and a current timestamp;

[0258] The target request generation module is deployed in the gateway service and is used to generate a target request header based on the gateway identifier of the data network node where the business system is located, the target identity signature, the target data signature and the current timestamp, generate a target request body based on the encrypted target request data, and generate the target business request based on the target request body and the target request header.

[0259] Optionally, the device 700 further includes:

[0260] A flow control module is deployed in the gateway service, and is used to determine the flow control strategy of the requested digital network service before the gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the digital network node where the business system is located, and perform request flow control for the requested digital network service according to the flow control strategy of the requested digital network service;

[0261] The data signature verification module includes:

[0262] The flow control module is deployed in the gateway service to determine that the business request meets the request flow control of the requested data network service. Based on the signature algorithm corresponding to the private key of the business system and the gateway of the data network node where the business system is located, the data signature of the business request is verified.

[0263] Optionally, the device 700 further includes:

[0264] A protocol conversion module, deployed in the gateway service, for converting the business request into the service request protocol based on the service request protocol corresponding to the requested network service after obtaining the decrypted request data;

[0265] The decrypted data sending module comprises:

[0266] A load balancing module is deployed in the gateway service and is used to forward the decrypted request data to the target instance of the request data networking service using the service request protocol based on the routing rules and load balancing strategy of the request data networking service.

[0267] Optionally, the pretending 700 further includes:

[0268] A gateway identification registration module, deployed in the gateway backend in the data network node, is used to request a gateway identification from the networking node service in the data network node;

[0269] A data network service registration module, a data network service deployed in the data network node, is used to send service registration information to the data network gateway backend to complete the data network service registration, wherein the service registration information includes at least: service address, service request protocol, instance version and interface definition;

[0270] A first information configuration module, deployed in the backend of the digital network gateway, is used to determine first configuration information for the business system in the digital network node, wherein the first configuration information at least includes: a business system identifier and a public and private key pair of the business system connected to the digital network node;

[0271] A second information configuration module, deployed in the backend of the data networking gateway, is used to determine second configuration information for the data networking service in the data networking node, wherein the second configuration information at least includes: routing rules, load balancing strategies, service instances, and flow control strategies for the data networking service in the data networking node;

[0272] A third information configuration module is deployed in the backend of the digital network gateway, and is used to determine the third configuration information for the digital network node gateway in the digital network node; the third configuration information includes at least one or more of the following: a public and private key pair of the digital network node gateway, a white list of digital network services that are allowed to access the gateway service corresponding to the digital network node gateway, a white list of digital network gateways that are allowed to access the gateway service corresponding to the digital network node gateway, a white list of business systems that are allowed to access the gateway service corresponding to the digital network node gateway, an encryption algorithm and a signature algorithm corresponding to the digital network node gateway, and a black list of request IPs that are prohibited from accessing the gateway service corresponding to the digital network node gateway;

[0273] A data synchronization module, deployed in the data network gateway backend, used to send a gateway data synchronization request to the networking node service, the gateway data synchronization request carries the first configuration information, the second configuration information and the third configuration information, so that the networking node service generates the global gateway list synchronized to the gateway backend of other data network nodes based on the gateway data synchronization request, and returns it to the data network gateway backend;

[0274] The data cache module is deployed in the digital network gateway service, pulls the global gateway list from the digital network gateway backend, and caches it locally in the gateway service.

[0275] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0276] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0277] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0278] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0279] The above is a detailed introduction to a distributed gateway-based data network service access control method and device provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A distributed gateway-based data network service access control method, characterized in that: The method comprises: The business system sends the business request to the gateway service of the data network node where the business system is located; The gateway service receives the business request, obtains a request response returned by the request data networking service based on the business request, and returns the request response to the business system; The requesting digital networking service determines a target digital networking service corresponding to a target digital networking node based on the request data of the business request, wherein the target digital networking node and the digital networking node where the business system is located are two different digital networking nodes; The requesting digital networking service sends the request data and the gateway identifier of the target digital networking node to the proxy channel of the gateway service; After receiving the request data based on the proxy channel, the gateway service determines the target digital networking node gateway service based on the gateway identifier of the target digital networking node from the global gateway list cached locally by the gateway service; The target data network node gateway service obtains the target request response and returns the target request response to the gateway service of the data network node where the business system is located; The gateway service of the data network node where the business system is located sends the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located; The gateway service receives the business request, obtains a request response returned by the request data networking service based on the business request, and returns the request response to the business system, including: The gateway service receives the service request, and sends the request data in the service request to the request data networking service corresponding to the service request, wherein the request data networking service includes at least one of the following: fusion analysis service, distributed search service, activation directory service, networking node service, data site service, and data encapsulation service; The request data networking service processes the request data of the business request, generates the request response, and returns the request response to the gateway service; The gateway service returns the request response to the business system; Before the target data network node gateway service obtains the target request response and returns the target request response to the gateway service of the data network node where the business system is located, the method further includes: The gateway service generates a target service request based at least on the gateway identifier of the data network node where the service system is located, the gateway identifier of the target data network node and the request data, and sends the target service request to the gateway service of the target data network node; The target data networking node gateway service sends the target service request to the target data networking service; The target data networking service generates the target request response based on the target business request, and returns the target request response to the target data networking node gateway service.

2. The distributed gateway-based data network service access control method according to claim 1 is characterized in that: The business system sends the business request to the gateway service of the data network node where the business system is located, including: The business system generates an identity signature based at least on the business system identifier, the gateway identifier of the data network node where the business system is located, and a timestamp; The business system generates the business request based at least on the business system identifier, the identity signature, the timestamp and the request data, and sends the business request to the gateway service of the data network node where the business system is located; The sending of the request data in the service request to the request data networking service corresponding to the service request includes: The gateway service performs a blacklist and whitelist check on the service request based on the service request, wherein the blacklist and whitelist check at least includes: whether the requested data network service corresponding to the service request is in the data network service whitelist that is allowed to access the gateway service; After the gateway service determines that the service request passes the blacklist and whitelist verification, it matches the corresponding service system private key based on the service system identifier; The gateway service performs identity signature verification on the business request based on the business system private key, the business system identifier, the gateway identifier of the data network node where the business system is located, the timestamp and the signature algorithm corresponding to the gateway of the data network node where the business system is located, and determines whether the timestamp is invalid; When determining that the identity signature verification has passed and determining that the timestamp has not expired, the gateway service sends the request data in the business request to the request data networking service corresponding to the business request.

3. The distributed gateway-based data network service access control method according to claim 2 is characterized in that: The gateway service locally caches a blacklist and whitelist of access to the gateway service configured by the backend of the data network gateway corresponding to the gateway service, and the blacklist and whitelist of access to the gateway service at least includes: a whitelist of data network services allowed to access the gateway service, a whitelist of business systems allowed to access the gateway service, and a blacklist of request IPs prohibited from accessing the gateway service; The gateway service performs a blacklist and whitelist check on the service request based on the service request, including: The gateway service verifies whether the requested data network service corresponding to the business request is in the data network service whitelist that is allowed to access the gateway service; In the case where the requested data network service is in the data network service whitelist that is allowed to access the gateway service, the gateway service verifies whether the business system is in the business system whitelist that is allowed to access the gateway service; In the case where the business system is in the whitelist of business systems allowed to access the gateway service, the gateway service verifies whether the requesting IP of the business request is in the blacklist of requesting IPs prohibited from accessing the gateway service; The gateway service determines that the service request passes the blacklist and whitelist verification, including: In the case that the requesting IP of the service request is not in the requesting IP blacklist prohibited from accessing the gateway service, the gateway service determines that the service request passes the blacklist and whitelist verification.

4. The distributed gateway-based data network service access control method according to claim 2 is characterized in that: The method further comprises: The business system encrypts the request data based on the business system identifier, the business system public key, and the signature algorithm and encryption algorithm corresponding to the gateway of the data network node where the business system is located, obtains the encrypted request data, and generates a data signature; The business system generates the business request based at least on the business system identifier, the identity signature, the timestamp and the request data, including: The business system generates a request header based on the business system identifier, the identity signature, the data signature and the timestamp, generates a request body based on the encrypted request data, and generates the business request based on the request body and the request header; When the gateway service determines that the identity signature verification is passed and the timestamp is not invalid, before sending the request data in the service request to the request data network service corresponding to the service request, the method further includes: The gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located; When the gateway service determines that the data verification signature passes, the gateway service decrypts the encrypted request data of the business request based on the business system private key and the encryption algorithm corresponding to the gateway of the data network node where the business system is located to obtain the decrypted request data; The sending of the request data in the service request to the request data networking service corresponding to the service request includes: The gateway service sends the decrypted request data to the request data networking service corresponding to the business request.

5. The distributed gateway-based data network service access control method according to claim 4 is characterized in that: The gateway service generates a target service request based at least on the gateway identifier of the data network node where the service system is located, the gateway identifier of the target data network node and the request data, including: The gateway service encrypts the request data based on the gateway identifier of the target digital networking node, the gateway public key of the target digital networking node, the signature algorithm and encryption algorithm corresponding to the gateway of the target digital networking node, obtains the encrypted target request data, and generates a target data signature; The gateway service generates a target identity signature based at least on the gateway identifier of the data network node where the business system is located, the gateway identifier of the target data network node and the current timestamp; The gateway service generates a target request header based on the gateway identifier of the data network node where the business system is located, the target identity signature, the target data signature and the current timestamp, generates a target request body based on the encrypted target request data, and generates the target business request based on the target request body and the target request header.

6. The distributed gateway-based data network service access control method according to claim 4 is characterized in that: Before the gateway service performs data signature verification on the service request based on the service system private key and the signature algorithm corresponding to the gateway of the data network node where the service system is located, the method further includes: The gateway service determines a flow control strategy for the requested digital networking service, and performs request flow control for the requested digital networking service according to the flow control strategy for the requested digital networking service; The gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located, including: When the gateway service determines that the business request satisfies the request flow control of the requested data network service, the gateway service performs data signature verification on the business request based on the business system private key and the signature algorithm corresponding to the gateway of the data network node where the business system is located.

7. The distributed gateway-based data network service access control method according to claim 4 is characterized in that: After obtaining the decrypted request data, the method further includes: The gateway service converts the business request into the service request protocol based on the service request protocol corresponding to the requested digital networking service; The gateway service sends the decrypted request data to the request data networking service corresponding to the business request, including: The gateway service forwards the decrypted request data to the target instance of the request data networking service using the service request protocol based on the routing rules and load balancing strategy of the request data networking service.

8. The distributed gateway-based data network service access control method according to any one of claims 1 to 7, characterized in that: The method further comprises: The gateway backend in the data network node requests a gateway identifier from the networking node service in the data network node; The data network service in the data network node sends service registration information to the data network gateway backend to complete the data network service registration, and the service registration information at least includes: service address, service request protocol, instance version and interface definition; The data network gateway backend determines first configuration information for the business system in the data network node, the first configuration information at least including: a business system identifier and a public and private key pair of the business system connected to the data network node; The data networking gateway backend determines second configuration information for the data networking service in the data networking node, wherein the second configuration information includes at least: routing rules, load balancing strategies, service instances, and flow control strategies for the data networking service in the data networking node; The digital network gateway backend determines third configuration information for the digital network node gateway in the digital network node; the third configuration information includes at least one or more of the following: a public and private key pair of the digital network node gateway, a digital network service whitelist that is allowed to access the gateway service corresponding to the digital network node gateway, a digital network gateway whitelist that is allowed to access the gateway service corresponding to the digital network node gateway, a business system whitelist that is allowed to access the gateway service corresponding to the digital network node gateway, an encryption algorithm and a signature algorithm corresponding to the digital network node gateway, and a request IP blacklist that is prohibited from accessing the gateway service corresponding to the digital network node gateway; The data networking gateway backend sends a gateway data synchronization request to the networking node service, and the gateway data synchronization request carries the first configuration information, the second configuration information, and the third configuration information, so that the networking node service generates the global gateway list synchronized to the gateway backends of other data networking nodes based on the gateway data synchronization request, and returns it to the data networking gateway backend; The digital network gateway service pulls the global gateway list from the digital network gateway backend and caches it locally in the gateway service.

9. A distributed gateway-based data network service access control device, characterized in that: The device comprises: A first request sending module, deployed in the business system, is used to send the business request to the gateway service of the data network node where the business system is located; A first response returning module, deployed in the gateway service, for receiving the service request, obtaining a request response returned by the request data networking service based on the service request, and returning the request response to the service system; A target service determination module is deployed in the request data networking service, and is used to determine the target data networking service corresponding to the target data networking node based on the request data of the business request, wherein the target data networking node and the data networking node where the business system is located are two different data networking nodes; A first data sending module, deployed in the request data networking service, for sending the request data and the gateway identifier of the target data networking node to the proxy channel of the gateway service; A gateway service determination module, deployed in the gateway service, for determining the target digital networking node gateway service based on the gateway identifier of the target digital networking node from a global gateway list cached locally by the gateway service after the proxy channel receives the request data; A target response acquisition module, deployed in the target data network node gateway service, is used to obtain a target request response and return the target request response to the gateway service of the data network node where the business system is located; A second response return module, deployed in the gateway service of the data network node where the business system is located, is used to send the target request response to the request data network service, and then the request data network service returns the target request response to the business system through the gateway service of the data network node where the business system is located; A first request generation module, deployed in the gateway service, is used to generate a target business request based on at least the gateway identifier of the data network node where the business system is located, the gateway identifier of the target data network node and the request data, and send the target business request to the target data network node gateway service before obtaining the target request response at the target data network node gateway service and returning the target request response to the gateway service of the data network node where the business system is located; A first request forwarding module, deployed in the target data networking node gateway service, for sending the target service request to the target data networking service; A target response returning module, deployed in the target data networking service, is used to generate the target request response based on the target service request, and return the target request response to the target data networking node gateway service; The first response returning module includes: A first request receiving module, deployed in the gateway service, is used to receive the service request and send the request data in the service request to the request data networking service corresponding to the service request, wherein the request data networking service includes at least one of the following: fusion analysis service, distributed search service, activation directory service, networking node service, data site service, and data encapsulation service; A first response generation module, deployed in the request data networking service, is used to process the request data of the business request, generate the request response, and return the request response to the gateway service; The first response sending module is deployed in the gateway service and is used to return the request response to the business system.

Images