A unified service bus USB system based on authorization relationship

Abstract

The present invention provides a unified service bus (USB) system based on authorization relationships, belonging to the field of information security technology. The system comprises: a first acquisition module for acquiring metadata of the unified service bus (USB), creating a RESTful API interface, and determining the calling relationships between services; a definition module for defining a clear transmission protocol based on the calling relationships between services; a second acquisition module for determining the user ID and password of a client unit, sending a request to a service registration center, and searching for a service instance and its location based on the request; a transmission module for initiating a service call request based on the location of the service instance, obtaining the authentication and authorization result of the request, and transmitting the authentication and authorization result through data encryption according to the transmission protocol; and an audit and recording module for auditing and logging the service calling process. The system solves the problem that traditional device management methods cannot meet growing needs, and that the authorization relationships between various devices are complex and the authorization process is unsafe, making the implementation of a service bus difficult.

Description

Technical Field

[0001] The present invention relates to the technical field of information security, and in particular to a unified service bus (USB) system based on authorization relationships. Background Art

[0002] With the continuous development of USB technology, more and more devices need to communicate through the service bus.

[0003] However, with the rapid development of Internet of Things technology, the number of various devices and terminals continues to increase. Traditional device management methods can no longer meet the growing demand. In addition, due to the complex authorization relationships of various devices, the efficiency of data transmission cannot be guaranteed, and the authorization process is unsafe, which makes the implementation of the service bus more difficult.

[0004] Therefore, the present invention proposes a unified service bus (USB) system based on authorization relationship. Summary of the Invention

[0005] The present invention provides a unified service bus USB system based on authorization relationships, which is used to solve the defects in the prior art that traditional device management methods can no longer meet the growing demand, and due to the complex authorization relationships of various devices, the efficiency of data transmission cannot be guaranteed, and the authorization process is unsafe, which makes the implementation of the service bus difficult.

[0006] In one aspect, the present invention provides a unified service bus (USB) system based on authorization relationships, comprising:

[0007] The first acquisition module: obtains the meta information of the unified service bus USB, creates a RESTful API interface according to the meta information, and determines the calling relationship between services;

[0008] Definition module: defines a clear transmission protocol based on the calling relationship between the services;

[0009] The second acquisition module: determines the user ID and password of the customer unit and sends a service discovery request to the service registration center or discovery service. It then searches for available service instances based on the request and obtains the location of the service instances.

[0010] Transmission module: Initiates a service call request based on the location of the service instance and obtains the authentication and authorization result of the request, and encrypts and transmits the authentication and authorization result according to the transmission protocol;

[0011] Audit and logging module: audits and logs the calling process of the service, so that the system can trace and analyze the source when security issues occur.

[0012] According to the unified service bus USB system based on authorization relationship provided by the present invention, the first acquisition module includes:

[0013] Calling unit: calls the API provided by the unified service bus or sends an HTTP request;

[0014] A first acquiring unit: acquiring a list and detailed information of USB devices according to the provided API or sending an HTTP request;

[0015] A second acquiring unit: acquiring the meta information of the unified service bus USB according to the list and detailed information of the device;

[0016] Construction unit: builds API documentation and tests API based on Swagger according to the meta information;

[0017] Creation unit: Create a RESTful API interface based on the API documentation and test API.

[0018] According to the unified service bus USB system based on authorization relationship provided by the present invention, after the second acquisition unit, it also includes:

[0019] The conversion subunit converts the metadata of the unified service bus USB into a preset format;

[0020] Management subunit: manages basic operations of USB devices according to the preset format;

[0021] Definition subunit: Based on the management results, define the requested method and URL path in the API interface, as well as the required parameters and responses;

[0022] Deployment sub-unit: Perform unit and integration testing on the definition results, ensure that the API interface has appropriate authentication and authorization mechanisms, and deploy it to the production environment.

[0023] According to the unified service bus USB system based on authorization relationship provided by the present invention, the definition module includes:

[0024] The first determination unit: determines the dependency relationship between various services through the system architecture diagram;

[0025] A second determining unit: determining a calling relationship between services according to the dependency relationship;

[0026] Definition unit: A transmission protocol is clearly defined based on the calling relationship, the characteristics of each service, and the applicable scenarios.

[0027] According to the unified service bus USB system based on authorization relationship provided by the present invention, the second acquisition module includes:

[0028] The third determining unit: obtains relevant information of the client unit and determines the user ID and password of the client unit based on the relevant information;

[0029] The third acquisition unit searches based on the user ID and password of the client unit to obtain the corresponding user record;

[0030] A fourth determining unit: determining, based on the user record, that the client unit sends a service discovery request to a service registration center or a discovery service;

[0031] Search unit: searches for available service instances in the cluster based on the request using a service discovery tool;

[0032] The fourth acquisition unit: obtains the node and port where the service instance is located;

[0033] The fifth acquiring unit acquires the location of the service instance based on the domain name of the server according to the node and the port.

[0034] According to the unified service bus USB system based on authorization relationship provided by the present invention, the transmission module includes:

[0035] A fifth determining unit: initiating a service call request according to the location of the service instance, and determining the type of the request and the target service name;

[0036] A sixth determining unit: determining a corresponding operation according to the type of the request and the target service name;

[0037] Communication unit: searching for user credentials from local storage or database according to the corresponding operation and communicating with the proxy server;

[0038] Encryption transmission unit: obtains the communication result, determines the requested authentication and authorization result, and encrypts and transmits the authentication and authorization result according to the transmission protocol.

[0039] The unified service bus USB system based on authorization relationship provided by the present invention, the audit and recording module includes:

[0040] Capture unit: captures detailed information of the service calling process through the middleware;

[0041] Transmission unit: encodes the detailed information into JSON format and transmits it to a centralized storage system;

[0042] Audit and recording unit: audits and logs the service call process according to preset audit rules and information from the centralized storage system, enabling the system to trace and analyze security issues when they occur.

[0043] According to the authorization relationship-based unified service bus USB system provided by the present invention, after defining a clear transmission protocol according to the calling relationship between the services, the system further includes:

[0044] The first generation module: randomly generates a timestamp for a data transmission file and obtains the current local clock for subsequent data transmission files;

[0045] The third acquisition module: obtains the difference between the current local clock and the timestamp;

[0046] The fourth acquisition module: performs equivalent replacement of the transmission protocol based on the difference until the difference is less than or equal to a preset threshold, and obtains the target transmission protocol;

[0047] The second generation module: generates a service description file in XML format corresponding to each service;

[0048] The fifth acquisition module: obtains the service-related location information and interface parameters of each service according to the service description file;

[0049] Calculation module: performs bandwidth calculation operation based on service-related location information and interface parameters of each service to obtain a first transmission bandwidth of a target transmission protocol;

[0050] A first confirmation module: confirms whether the first transmission bandwidth meets the preset transmission requirements. If so, no subsequent operation is required. If not, a second transmission bandwidth that meets the efficient transmission requirements is determined based on the service-related location information and interface parameters of each service;

[0051] Optimization module: optimizes the target transmission protocol according to the second transmission bandwidth and obtains the optimized target transmission protocol;

[0052] Test module: configures the integrity check program and uses the integrity check program to perform integrity test on the optimized target transmission protocol;

[0053] The second confirmation module: confirms whether the optimized target transmission protocol is qualified according to the test results. If so, no subsequent operation is required. If not, a transmission protocol unqualified reminder is issued.

[0054] Compared with the prior art, the present invention has the following advantages:

[0055] By defining a clear transmission protocol through the calling relationship between services, determining the user ID and password of the client unit, sending a service discovery request to the service registration center or discovery service, finding available service instances based on the request, and obtaining the location of the service instance, initiating a service call request and obtaining the authentication and authorization result of the request, and encrypting the authentication and authorization result for transmission according to the transmission protocol, it can ensure the simplification of the authorization relationship of the device, the security of the authorization process, and improve the privacy of the authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0057] Figure 1 1 is a schematic structural diagram of a unified service bus USB system based on authorization relationships provided by an embodiment of the present invention;

[0058] Figure 2 It is a structural diagram of the first acquisition module provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0060] Example 1:

[0061] The embodiment of the present invention provides a unified service bus USB system based on authorization relationship, such as Figure 1 As shown, the system mainly includes the following modules:

[0062] The first acquisition module: obtains the meta information of the unified service bus USB, creates a RESTful API interface according to the meta information, and determines the calling relationship between services;

[0063] Definition module: defines a clear transmission protocol based on the calling relationship between the services;

[0064] The second acquisition module: determines the user ID and password of the customer unit and sends a service discovery request to the service registration center or discovery service. It then searches for available service instances based on the request and obtains the location of the service instances.

[0065] Transmission module: Initiates a service call request based on the location of the service instance and obtains the authentication and authorization result of the request, and encrypts and transmits the authentication and authorization result according to the transmission protocol;

[0066] Audit and logging module: audits and logs the calling process of the service, so that the system can trace and analyze the source when security issues occur.

[0067] In this embodiment, the meta information may include: service name, URL, description, and version.

[0068] In this embodiment, the calling relationship between services refers to how different services interact with each other in a distributed system to complete specific tasks. It can be a simple point-to-point relationship or a more complex hierarchical structure, such as the service combination in a microservice architecture.

[0069] In this embodiment, the service registration center is an important component in a distributed service framework, responsible for managing and maintaining functions such as service discovery, registration, and dynamic load balancing.

[0070] In this embodiment, the discovery service is an important mechanism for realizing mutual discovery and calling between service instances in distributed systems and microservice architectures. The goal of service discovery is to enable service instances to automatically find each other.

[0071] In this embodiment, a service call request refers to a request initiated by a client to a server to obtain specific resources or functions. During this request process, the client needs to provide some necessary information, such as request method, parameters, and return format.

[0072] In this embodiment, data encryption transmission is a method for protecting the security of data during network transmission. It converts data into ciphertext form, and only the recipient with the key can decrypt and restore the original data.

[0073] The beneficial effects of the above technical solution are: through the definition of a clear transmission protocol through the calling relationship between services, the user ID and password of the customer unit are determined to send a service discovery request to the service registration center or discovery service, and the available service instance is found according to the request, and the location of the service instance is obtained, a service call request is initiated and the authentication and authorization result of the request is obtained, and the authentication and authorization result is encrypted and transmitted according to the transmission protocol. Different data access rights can be assigned to different systems or requests according to business needs. Through the coordination and management of the service bus, the system and request can access specific data resources within the scope of the access rights, thereby ensuring the security and privacy of the data.

[0074] Example 2:

[0075] Based on Example 1, the first acquisition module of the embodiment of the present invention is as follows: Figure 2 As shown, including:

[0076] Calling unit: calls the API provided by the unified service bus or sends an HTTP request;

[0077] A first acquiring unit: acquiring a list and detailed information of USB devices according to the provided API or sending an HTTP request;

[0078] A second acquiring unit: acquiring the meta information of the unified service bus USB according to the list and detailed information of the device;

[0079] Construction unit: builds API documentation and tests API based on Swagger according to the meta information;

[0080] Creation unit: Create a RESTful API interface based on the API documentation and test API.

[0081] In this embodiment, API is an application programming interface, which is a specification and convention that enables interaction and data exchange between different software. API defines methods and interfaces for various functions. Through these interfaces, different applications can access and operate data or services in other applications.

[0082] In this embodiment, the list of USB devices is a way of displaying USB devices connected to the computer. These devices can be various types of external devices, such as a keyboard, a mouse, a mobile hard disk, a USB flash drive, etc.

[0083] In this embodiment, the detailed information of the USB device includes: device name, device type, version / firmware version, and serial number.

[0084] In this embodiment, the meta information may include: service name, URL, description, and version.

[0085] In this embodiment, the API documentation is a detailed, structured document that can explain the methods, parameters, responses, and examples of the API endpoints.

[0086] In this embodiment, testing the API is a way to ensure that the API endpoint correctly handles client requests.

[0087] In this embodiment, the RESTful API interface is an application programming interface based on Internet technology specifications.

[0088] The beneficial effects of the above technical solution are: by calling the API provided by the unified service bus or sending an HTTP request to obtain a list and detailed information of USB devices, the metadata of the unified service bus USB is obtained, API documentation and API testing are built, a RESTful API interface is created, and the behavior and response of the API are defined. The use of the RESTful API interface can make it easier to integrate applications with existing or future Web services. At the same time, it ensures that the system is integrated and works collaboratively with other information systems, realizes wider data circulation, sharing and utilization, and improves interoperability and reusability.

[0089] Example 3:

[0090] Based on Example 1, the embodiment of the present invention further includes, after the second obtaining unit:

[0091] The conversion subunit converts the metadata of the unified service bus USB into a preset format;

[0092] Management subunit: manages basic operations of USB devices according to the preset format;

[0093] Definition subunit: Based on the management results, define the requested method and URL path in the API interface, as well as the required parameters and responses;

[0094] Deployment sub-unit: Perform unit and integration testing on the definition results, ensure that the API interface has appropriate authentication and authorization mechanisms, and deploy it to the production environment.

[0095] In this embodiment, the preset format may be: JSON or XML.

[0096] In this embodiment, basic operations may be: search, add, delete, and list.

[0097] In this embodiment, the request method is the action used by the client to initiate a request to the server, which is used to specify the request method and the processing method to be taken, such as: obtaining resources, creating resources, updating resources, and partially updating resources.

[0098] In this embodiment, the URL path is a string sequence used to identify a specific resource address on a server, and is used to instruct a browser or application which resource to access. The URL includes information such as protocol, domain name, port, authentication, host name, and path.

[0099] In this embodiment, the API interface parameter types include: query parameters, body parameters, header parameters, and named parameters.

[0100] In this embodiment, the response is the result returned by the server after processing the client request, such as: successful request, invalid request, unauthorized access.

[0101] The beneficial effects of the above technical solution are: by managing the basic operations of USB devices through the preset format of the metadata of the unified service bus USB, the operation process can be simplified and the security of the system can be improved. Furthermore, it ensures that the API interface has an appropriate authentication and authorization mechanism and is deployed in a production environment, which can protect the security and integrity of the application, avoid potential data leakage, malicious attacks and other security issues, and maintain the normal operation of the application.

[0102] Example 4:

[0103] Based on Example 1, the embodiment of the present invention defines a module, including:

[0104] The first determination unit: determines the dependency relationship between various services through the system architecture diagram;

[0105] A second determining unit: determining a calling relationship between services according to the dependency relationship;

[0106] Definition unit: A transmission protocol is clearly defined based on the calling relationship, the characteristics of each service, and the applicable scenarios.

[0107] In this embodiment, the dependency relationship refers to the interface, data format, and message serialization method.

[0108] In this embodiment, the calling relationship between services can be a one-way dependency, a two-way dependency, or a circular dependency.

[0109] In this embodiment, the transmission protocol can be: HTTP / HTTPS, gRPC, WebSocket.

[0110] The beneficial effects of the above technical solution are: determining the calling relationship between services through the dependencies between each service, and defining a clear transmission protocol based on the characteristics and applicable scenarios of each service, which helps to ensure that all participants follow the same regulations during the communication process and ensure consistent data transmission between different systems and components.

[0111] Example 5:

[0112] Based on Example 1, the second acquisition module of this embodiment of the present invention includes:

[0113] The third determining unit: obtains relevant information of the client unit and determines the user ID and password of the client unit based on the relevant information;

[0114] The third acquisition unit searches based on the user ID and password of the client unit to obtain the corresponding user record;

[0115] A fourth determining unit: determining, based on the user record, that the client unit sends a service discovery request to a service registration center or a discovery service;

[0116] Search unit: searches for available service instances in the cluster based on the request using a service discovery tool;

[0117] The fourth acquisition unit: obtains the node and port where the service instance is located;

[0118] The fifth acquiring unit acquires the location of the service instance based on the domain name of the server according to the node and the port.

[0119] In this embodiment, the relevant information of the client unit refers to all information related to the business relationship, transaction transactions, cooperation projects, etc. of the client unit.

[0120] In this embodiment, the user's records are stored in a database, and the corresponding records can be queried and viewed as needed.

[0121] In this embodiment, the service registration center is an important component in a distributed service framework, responsible for managing and maintaining functions such as service discovery, registration, and dynamic load balancing.

[0122] In this embodiment, the discovery service is an important mechanism for realizing mutual discovery and calling between service instances in a distributed system and microservice architecture. The goal of service discovery is to enable service instances to automatically find each other.

[0123] In this embodiment, the service discovery tool is a software tool used to find and identify service instances in a distributed system, such as Netflix Eureka and Nginx Service.

[0124] In this embodiment, a cluster is a mechanism for organizing and managing multiple identical or similar resources in a distributed system.

[0125] In this embodiment, the service instance is a specific instance running in a distributed system, including application code and all resources related to the application.

[0126] In this embodiment, the node where the service instance is located refers to a specific physical host or virtual machine in a distributed system that is responsible for storing and managing the service instance, which can be a physical server, virtual machine, or container.

[0127] In this embodiment, the port of the service instance is a unique numerical identifier assigned to each service instance in the distributed system, and the port number ranges from 0 to 6553.

[0128] In this embodiment, the domain name of the server is a method for uniquely identifying a computer on the Internet, and is a string of readable text characters, such as example.com.

[0129] The beneficial effects of the above technical solution are: obtaining the corresponding user records through the user ID and password of the client unit, determining the client unit to send a service discovery request to the service registration center or discovery service based on the records, and finding available service instances, which can realize concurrent management and load balancing of the system, improve the reliability and availability of the system, and also help users better manage and control the operating environment of their applications. Furthermore, the location of the service instance is obtained according to the node and port of the service instance, and the user's request can be distributed to the service instance closest to them according to the load balancing strategy to achieve high availability.

[0130] Example 6:

[0131] Based on Example 1, the transmission module of this embodiment of the present invention includes:

[0132] A fifth determining unit: initiating a service call request according to the location of the service instance, and determining the type of the request and the target service name;

[0133] A sixth determining unit: determining a corresponding operation according to the type of the request and the target service name;

[0134] Communication unit: searching for user credentials from local storage or database according to the corresponding operation and communicating with the proxy server;

[0135] Encryption transmission unit: obtains the communication result, determines the requested authentication and authorization result, and encrypts and transmits the authentication and authorization result according to the transmission protocol.

[0136] In this embodiment, the location of the service instance refers to the location where instances of different services are deployed on different physical hosts or virtual machines in a distributed system.

[0137] In this embodiment, a service call request refers to a request initiated by a client to a server to obtain specific resources or functions. During this request process, the client needs to provide some necessary information, such as request method, parameters, and return format.

[0138] In this embodiment, the request type refers to the different types of requests divided according to purpose and function in a distributed system, such as GET request, POST request, PUT request, and PATCH request.

[0139] In this embodiment, the target service name refers to the name of the specific service that the user wants to access, for example: http: / / example.com / api / v1 / user / info, which determines to which specific resource or function the request should be sent.

[0140] In this embodiment, user credentials refer to information used to verify user identity and authorize access to the system, which can be a password, fingerprint, token, certificate or any other form of identification mark. User credentials are the entrance to access the security system, and only users with valid credentials are allowed to enter the system.

[0141] In this embodiment, the proxy server is an intermediate layer located between the client and the server, and acts as a communication relay between the server and the client.

[0142] In this embodiment, the communication result refers to the result obtained after the information exchange between the sender and the receiver is completed during the data transmission process. During the communication process, the sender will encode the information into binary data according to the agreed protocol format and content, and transmit it to the receiver through the network. After receiving the data, the receiver decodes and parses it according to the corresponding protocol, and finally obtains the expected communication result. The communication result can be successful, indicating that the data transmission is correct; it can also be failed, indicating that an error occurs in the data transmission.

[0143] In this embodiment, the authentication and authorization result refers to the result of confirming that the user has the authority to access specific resources or perform specific operations after identity authentication and permission check. Authentication refers to determining whether the user has a valid username and password, while authorization is to control the user's permissions to prevent unauthorized operations. The result can be success or failure, and the refined management and efficient circulation of data elements can be guaranteed based on the authorization result.

[0144] In this embodiment, the transmission protocol is a protocol in a computer network, which is used to realize orderly, reliable and secure transmission of data between different devices on the network, such as HTTP, FTP and DNS.

[0145] The beneficial effects of the above technical solution are: determining the corresponding operation through the request type and target service name, searching the user's credentials from the local storage or database according to the operation, communicating with the proxy server, authenticating and authorizing the user based on the communication results, and encrypting the authentication and authorization results for transmission, which can protect data security and improve system reliability.

[0146] Example 7:

[0147] Based on Example 1, the audit and recording module of this embodiment of the present invention includes:

[0148] Capture unit: captures detailed information of the service calling process through the middleware;

[0149] Transmission unit: encodes the detailed information into JSON format and transmits it to a centralized storage system;

[0150] Audit and recording unit: audits and logs the service call process according to preset audit rules and information from the centralized storage system, enabling the system to trace and analyze security issues when they occur.

[0151] In this embodiment, the middleware is a software component located between the application program and the operating system, and is used to implement communication and coordination between different application programs in a distributed system, thereby simplifying system integration and management.

[0152] In this embodiment, the service calling process is the process of interaction between the client and the server.

[0153] In this embodiment, the detailed information includes, for example, user identity, request parameters, and response status.

[0154] In this embodiment, the centralized storage system may be: Elasticsearch, Hadoop, or a cloud storage service.

[0155] In this embodiment, the preset audit rules may define which IP addresses, ports, methods, or parameter combinations are considered abnormal.

[0156] The beneficial effect of the above technical solution is: by transmitting detailed information of the service calling process to a centralized storage system, the calling process of the service is audited and logged according to preset audit rules and information of the centralized storage system, which can increase the transparency of the calling process, reduce errors, and promptly discover the problem when a security problem occurs.

[0157] Example 8:

[0158] Based on Example 1, after defining a clear transmission protocol according to the calling relationship between the services, this embodiment of the present invention further includes:

[0159] The first generation module: randomly generates a timestamp for a data transmission file and obtains the current local clock for subsequent data transmission files;

[0160] The third acquisition module: obtains the difference between the current local clock and the timestamp;

[0161] The fourth acquisition module: performs equivalent replacement of the transmission protocol based on the difference until the difference is less than or equal to a preset threshold, and obtains the target transmission protocol;

[0162] The second generation module: generates a service description file in XML format corresponding to each service;

[0163] The fifth acquisition module: obtains the service-related location information and interface parameters of each service according to the service description file;

[0164] Calculation module: performs bandwidth calculation operation based on service-related location information and interface parameters of each service to obtain a first transmission bandwidth of a target transmission protocol;

[0165] A first confirmation module: confirms whether the first transmission bandwidth meets the preset transmission requirements. If so, no subsequent operation is required. If not, a second transmission bandwidth that meets the efficient transmission requirements is determined based on the service-related location information and interface parameters of each service;

[0166] Optimization module: optimizes the target transmission protocol according to the second transmission bandwidth and obtains the optimized target transmission protocol;

[0167] Test module: configures the integrity check program and uses the integrity check program to perform integrity test on the optimized target transmission protocol;

[0168] The second confirmation module: confirms whether the optimized target transmission protocol is qualified according to the test results. If so, no subsequent operation is required. If not, a transmission protocol unqualified reminder is issued.

[0169] In this embodiment, the timestamp of the data transmission file refers to a value that records the time when the data in the file is generated or modified.

[0170] In this embodiment, the current local clock refers to a unified clock used by all devices in a region, which is implemented through a network protocol, a hardware synchronizer, or other synchronization means to ensure coordination and consistency among all devices.

[0171] In this embodiment, the difference between the current local clock and the timestamp refers to: the local clock refers to the unified clock used by all devices in a region, which is implemented through network protocols, hardware synchronizers or other synchronization means, and the timestamp is a unique time representation method that provides an understanding of the exact time when an event occurred. Since the local clock may deviate due to hardware delays, network delays and other factors, there may be differences between them. The difference between the current local clock and the timestamp may be positive, negative or zero, depending on whether the timestamp is faster or slower than the current clock. If the timestamp is accurate, then the difference is zero. If the timestamp is wrong, then the difference will be positive or negative, depending on the direction of the error. For example, if the timestamp shows that it is January 1, 2023, and the actual current time is December 31, 2022, then the timestamp is faster than the current clock.

[0172] In this embodiment, equivalent replacement of the transmission protocol refers to replacing the existing protocol with a new protocol, so that the original application can continue to run under the new protocol without affecting the functionality of the original application. According to the equivalent replacement transmission protocol, the system can be integrated and work collaboratively with other systems to achieve wider data circulation, sharing and utilization.

[0173] In this embodiment, the service description file is a text file used to define and describe the service structure and behavior, and describes information such as the service name, endpoints, input and output parameters, protocol, timeout settings, security, etc.

[0174] In this embodiment, the service-related location information includes:

[0175] Service instance location: The location of a service instance refers to the specific address or location where the service is deployed, including IP address, domain name, subdomain, etc.

[0176] Service provider location: The location of the service provider refers to the region or location of the service provider, including data center, city, province, etc.

[0177] Geographic location information: Geographic location information refers to information related to the location on the earth's surface, including longitude, latitude, elevation, weather, etc.

[0178] In this embodiment, the interface parameters of the service are a set of variables defined on the service interface, which are used to specify which data the service needs to use or process during operation.

[0179] In this embodiment, bandwidth calculation refers to evaluating the network transmission rate, which generally includes measurements and statistical information of the physical layer and link layer, such as:

[0180] Bandwidth measurement: Collect network traffic data through network devices (such as network cards, switches, etc.), record the size, sending and receiving time of each data packet, and then calculate the data transmission rate per second.

[0181] Throughput test: By testing multiple data streams, the maximum throughput of each data stream is determined, that is, the maximum amount of data that can be transmitted in a specific time.

[0182] In this embodiment, the first transmission bandwidth refers to the maximum data transmission rate between the transmitting device and the receiving device.

[0183] In this embodiment, the integrity check program is an algorithm or technology used to verify whether information or data has been tampered with or damaged. Its purpose is to detect any unauthorized modifications and report an error when such modifications are found. This check is usually implemented by comparing the original data with the expected value. If the original data has been tampered with, the integrity check program will detect this change and report a corresponding error.

[0184] In this embodiment, the current local clock is obtained by randomly generating a timestamp for the transmitted file and subtracting it from the timestamp. A third-party library or API can be used to obtain the system timestamp, and then a function is written that accepts a file path as a parameter and returns an object containing two times. The first time is the time when the file is created or modified, and the second time is the current system time. Next, we can use the difference between the two times to calculate the difference between the local clock and the current system clock, and use the difference to replace the transmission protocol until the difference is smaller than the preset threshold to obtain the target transmission protocol. After that, an XML format service description file corresponding to each service is generated, and service-related location information is obtained based on it. The bandwidth required for each service is calculated. By confirming whether the first transmission bandwidth can meet the preset requirements, the target transmission protocol is optimized to obtain the optimized new protocol, and an integrity verification program is configured. The integrity of the optimized transmission protocol is tested using the program, and whether the optimized transmission protocol is qualified is determined based on the test results.

[0185] The beneficial effects of the above technical solution are: the first transmission bandwidth of the target transmission protocol is obtained, and by carefully analyzing the bandwidth required for each service, wise design decisions can be made for the network architecture. At the same time, by determining the first transmission bandwidth of the target transmission protocol, additional bandwidth waste can be avoided during network transmission, and the network can be made more efficient, thereby reducing problems such as delay and packet loss. Then, further, according to the bandwidth requirements of the service, a suitable transmission protocol can be selected to meet these requirements. At the same time, potential problems can be identified, so that timely measures can be taken to solve the problems, which can avoid performance degradation and other problems caused by network congestion.

[0186] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0187] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0188] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A unified service bus USB system based on authorization relationship, characterized in that: include: The first acquisition module: obtains the metadata of the unified service bus USB, creates a RESTful API interface based on the metadata, and determines the calling relationship between services; Definition module: defines a clear transmission protocol based on the calling relationship between the services; The second acquisition module: determines the user ID and password of the customer unit and sends a service discovery request to the service registration center or discovery service. It then searches for available service instances based on the request and obtains the location of the service instances. Transmission module: Initiates a service call request based on the location of the service instance and obtains the authentication and authorization result of the request, and encrypts and transmits the authentication and authorization result according to the transmission protocol; Audit and logging module: audits and logs the service call process, enabling the system to trace and analyze security issues when they occur; The first acquisition module includes: The conversion subunit converts the metadata of the unified service bus USB into a preset format; Management subunit: manages basic operations of USB devices according to the preset format; Definition subunit: Based on the management results, define the requested method and URL path in the API interface, as well as the required parameters and responses; Deployment sub-unit: Perform unit testing and integration testing on the definition results, ensure that the API interface has authentication and authorization mechanisms, and deploy it to the production environment; Auditing and logging modules, including: Capture unit: captures detailed information of the service calling process through the middleware; Transmission unit: encodes the detailed information into JSON format and transmits it to a centralized storage system; Audit and recording unit: audits and logs the service call process according to preset audit rules and information from the centralized storage system, enabling the system to trace and analyze security issues when they occur; The system further includes: The first generation module: randomly generates a timestamp for a data transmission file and obtains the current local clock for subsequent data transmission files; The third acquisition module: obtains the difference between the current local clock and the timestamp; The fourth acquisition module: performs equivalent replacement of the transmission protocol based on the difference until the difference is less than or equal to a preset threshold, and obtains the target transmission protocol; The second generation module: generates a service description file in XML format corresponding to each service; The fifth acquisition module: obtains the service-related location information and interface parameters of each service according to the service description file; Calculation module: performs bandwidth calculation operation based on service-related location information and interface parameters of each service to obtain a first transmission bandwidth of a target transmission protocol; A first confirmation module: confirms whether the first transmission bandwidth meets the preset transmission requirements. If so, no subsequent operation is required. If not, a second transmission bandwidth that meets the efficient transmission requirements is determined based on the service-related location information and interface parameters of each service; Optimization module: optimizes the target transmission protocol according to the second transmission bandwidth and obtains the optimized target transmission protocol; Test module: configures the integrity check program and uses the integrity check program to perform integrity testing on the optimized target transmission protocol; The second confirmation module: confirms whether the optimized target transmission protocol is qualified according to the test results. If so, no subsequent operation is required. If not, a transmission protocol unqualified reminder is issued.

2. The unified service bus USB system based on authorization relationship according to claim 1, characterized in that: The first acquisition module further includes: The calling unit calls the API provided by the unified service bus or sends an HTTP request; the first acquiring unit acquires the list and detailed information of the USB devices according to the provided API or by sending an HTTP request; A second acquiring unit: acquiring the meta information of the unified service bus USB according to the list and detailed information of the device; Construction unit: builds API documentation and tests API based on Swagger according to the meta information; Creation unit: Create a RESTful API interface based on the API documentation and test API.

3. The unified service bus USB system based on authorization relationship according to claim 1, characterized in that: Define the module, including: The first determination unit: determines the dependency relationship between various services through the system architecture diagram; A second determining unit: determining a calling relationship between services according to the dependency relationship; Definition unit: A transmission protocol is clearly defined based on the calling relationship, the characteristics of each service, and the applicable scenarios.

4. The unified service bus USB system based on authorization relationship according to claim 1, characterized in that: The second acquisition module includes: The third determining unit: obtains relevant information of the client unit and determines the user ID and password of the client unit based on the relevant information; The third acquisition unit searches based on the user ID and password of the client unit to obtain the corresponding user record; A fourth determining unit: determining, based on the user record, that the client unit sends a service discovery request to a service registration center or a discovery service; Search unit: searches for available service instances in the cluster based on the request using a service discovery tool; The fourth acquisition unit: obtains the node and port where the service instance is located; The fifth acquiring unit acquires the location of the service instance based on the domain name of the server according to the node and the port.

5. The unified service bus USB system based on authorization relationship according to claim 1, characterized in that: Transmission module, including: A fifth determining unit: initiating a service call request according to the location of the service instance, and determining the type of the request and the target service name; A sixth determining unit: determining a corresponding operation according to the type of the request and the target service name; Communication unit: searching for user credentials from local storage or database according to the corresponding operation and communicating with the proxy server; Encryption transmission unit: obtains the communication result, determines the requested authentication and authorization result, and encrypts and transmits the authentication and authorization result according to the transmission protocol.

Images