Method and apparatus for optimizing an authentication and authorization system

Abstract

The application provides an optimization method and device of an authentication authorization system, and relates to the technical field of computers.The method comprises the following steps: obtaining log information and historical monitoring data of a target authentication authorization system in a target historical period; the log information comprises system logs, operation logs and login logs; the historical monitoring data comprises historical login numbers, historical traffic data, historical response times, historical error rates, historical service indexes, historical user behavior information and historical hardware resource utilization rates; performance index prediction information of the target authentication authorization system in a to-be-predicted period is predicted according to the log information and the historical monitoring data; optimization decision information of the target authentication authorization system is obtained according to the performance index prediction information, and expansion operation or contraction operation is performed according to the optimization decision information.The application realizes the intelligence, timeliness, agility and accuracy of the expansion and contraction strategy, and further improves the availability of the authentication authorization system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an optimization method and device of an authentication and authorization system. BACKGROUND

[0002] The authentication and authorization system based on OIDC (OpenID Connect) is a system for identity authentication and authorization, which allows client applications to obtain access tokens through the authentication and authorization system and authenticate users. It is an important system supporting microservices in the application domain. The system unifies all users in the domain, so when the number of concurrent user logins reaches a peak, the computing resource pressure, network bandwidth pressure, and concurrent connection pressure of the system are very large. If the authentication service instance of the authentication and authorization system suddenly fails, the authentication and authorization system cannot complete the authentication and authorization work, so it is necessary to optimize the elastic expansion and contraction of the service to support the authentication and authorization requests of multiple users, which is one of the technical problems to be solved at present.

[0003] In related technologies, the performance indicators (such as CPU usage, memory usage, etc.) of the authentication and authorization system are monitored, a threshold is set, and an automatic expansion or contraction operation is triggered. When a certain performance indicator exceeds the threshold, the number of authentication service instances is increased to cope with high load; when the indicator is below the set threshold, the number of instances is reduced to save resources.

[0004] However, this optimization method only triggers expansion or contraction when the actual performance indicator reaches a certain threshold, resulting in optimization and adjustment only when the authentication and authorization system is actually under pressure or has excess resources. The response time of optimization and adjustment is delayed, which reduces the availability of the authentication and authorization system. SUMMARY

[0005] The present application provides an optimization method and device of an authentication and authorization system to solve the problem of delayed response time of the authentication and authorization system optimization in the prior art, which affects user experience or leads to resource waste, and to reduce the response time delay of optimization and adjustment and improve the availability of the authentication and authorization system.

[0006] The present application provides an optimization method of an authentication and authorization system, applied to a target authentication and authorization system, comprising:

[0007] Obtaining log information and historical monitoring data of the target authentication and authorization system in a target historical period; the log information includes system logs, operation logs and login logs, and the historical monitoring data includes historical login number, historical traffic data, historical response time, historical error rate, historical service indicators, historical user behavior information and historical hardware resource utilization rate;

[0008] According to the log information and the historical monitoring data, performance index prediction information of the target authentication and authorization system in a to-be-predicted period is predicted;

[0009] According to the performance index prediction information, optimization decision information of the target authentication and authorization system is obtained, and expansion operation or contraction operation is performed according to the optimization decision information.

[0010] According to the authentication and authorization system optimization method provided by the application, the performance index prediction information of the target authentication and authorization system in the to-be-predicted period is predicted according to the log information and the historical monitoring data, and the performance index prediction information includes:

[0011] The log information and the historical monitoring data are preprocessed to obtain target input information; the preprocessing includes at least one of data cleaning, normalization and format conversion;

[0012] The target input information is input into a prediction model to obtain the performance index prediction information;

[0013] The prediction model is obtained by training an initial neural network model based on sample log information and sample monitoring data of a sample authentication and authorization system in a first historical period and performance index labels of the sample authentication and authorization system in a second historical period; the initial neural network model includes an attention network, a recurrent neural network and a prediction layer.

[0014] According to the authentication and authorization system optimization method provided by the application, the prediction model is obtained by training based on the following steps:

[0015] The sample log information and the sample monitoring data are preprocessed to obtain sample input information;

[0016] The sample input information is input into the attention network, the multiplicative attention operation and the bilinear transformation operation are performed on the sub-input information at each time step in the sample input information by the attention network, the weight vector of the sub-input information at each time step is obtained, and the weighted sum of the sub-input information at each time step and the weight vector is obtained to obtain a first feature;

[0017] The sample input information is input into the recurrent neural network, and the recurrent neural network extracts time sequence features from the sample input information to obtain a second feature;

[0018] The first feature and the second feature are input into the prediction layer, and the prediction layer predicts the performance index prediction information of the sample authentication and authorization system in the second historical period according to the first feature and the second feature;

[0019] According to the performance index prediction information of the second historical period of the sample authentication authorization system and the performance index label, the attention network, the recurrent neural network and the prediction layer are iteratively optimized to obtain an optimized initial neural network model;

[0020] According to the optimized initial neural network model, the prediction model is constructed.

[0021] According to the optimization method of the authentication authorization system provided by the application, the method further comprises:

[0022] Obtain the performance index actual information of the target authentication authorization system in the to-be-predicted period;

[0023] According to the log information and historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information, the prediction model is verified.

[0024] In the case that the prediction model fails to pass the verification, the prediction model is re-optimized and trained based on the log information and historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information.

[0025] According to the optimization method of the authentication authorization system provided by the application, the method further comprises:

[0026] In the case that the client sends an authorization request, it is determined in the pre-constructed session information list whether the client has completed identity authentication; the authorization request is used to request permission authorization;

[0027] In the case that the client has not completed identity authentication, an authentication port is called to perform identity authentication on the client;

[0028] In the case that the client has completed identity authentication, a target operation is performed;

[0029] Among them, the target operation includes at least one of the following: authorization processing on the authorization request, sharing and updating the authorization permission information of the client to the authorization consent table in the database, and sharing and updating the authorization information table in the database according to the authorization processing progress information and the authorization processing result of the authorization request.

[0030] According to the optimization method of the authentication authorization system provided by the application, the authorization processing on the authorization request comprises:

[0031] According to the APISIX gateway and the Nacos platform, at least one target authentication authorization instance is matched and obtained in the plurality of authentication authorization instances of the target authentication authorization system.

[0032] dynamically routing the authorization request to each of the target authentication and authorization instances for authorization processing of the authorization request.

[0033] According to the authentication and authorization system optimization method provided by the application, the method further comprises:

[0034] generating a key pair; the key pair comprises a pair of generated public key and private key;

[0035] creating a target document according to the public key and attribute information of the public key;

[0036] digitally signing the target document based on the private key to obtain a signed document;

[0037] receiving a document acquisition instruction sent by a client;

[0038] verifying the identity of the client, in the case that the client passes the identity verification, transmitting the signed document to the client, so that the client performs digital signature verification on the signed document, and in the case that the digital signature of the signed document passes the verification, sending the public key in the signed document to a resource manager; the resource manager is configured to verify a token in an access request sent by the client according to the public key, and determine whether to reject the access request of the client according to the verification result; the access request is used to request resource access.

[0039] According to the authentication and authorization system optimization method provided by the application, the method further comprises:

[0040] in the case that an access request sent by a client is received, verifying the access request according to each verification condition configured in a verification plug-in of an APISIX gateway, in the case that the access request passes the verification, performing identity authentication on the client, and in the case that the client passes the identity authentication, sending the access request to a resource manager.

[0041] The application further provides an authentication and authorization system optimization device applied to a target authentication and authorization system, comprising:

[0042] an acquisition unit configured to acquire log information and historical monitoring data of the target authentication and authorization system in a target historical period; the log information comprises system logs, operation logs and login logs, and the historical monitoring data comprises historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate;

[0043] a prediction unit configured to predict, according to the log information and the historical monitoring data, performance index prediction information of the target authentication and authorization system in a to-be-predicted period;

[0044] an optimization unit configured to obtain optimization decision information of the target authentication and authorization system according to the performance index prediction information, and perform a capacity expansion operation or a capacity reduction operation according to the optimization decision information.

[0045] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the optimization method of the authentication and authorization system according to any of the above when executing the program.

[0046] The application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program is executable on a processor to implement the optimization method of the authentication and authorization system according to any of the above.

[0047] The application further provides a computer program product comprising a computer program, and the computer program is executable on a processor to implement the optimization method of the authentication and authorization system according to any of the above.

[0048] The optimization method and device of the authentication and authorization system provided by the application can predict the performance index prediction and / or performance index prediction trend of the authentication and authorization system in a future period by predicting the multi-dimensional log information of the authentication and authorization system, including system logs, operation logs and login logs, and multi-dimensional monitoring data, including historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate, thereby predicting the performance requirement change and the peak login node of the authentication and authorization system in advance, so that more accurate capacity expansion and reduction decisions can be made in time, horizontal capacity expansion and reduction optimization of the authentication and authorization system is achieved, the intelligence, timeliness, agility and accuracy of the capacity expansion and reduction strategy are improved, and the usability of the authentication and authorization system is improved, so that the OIDC authentication and authorization process of the client application can be successfully completed, and the user experience is improved. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0050] Figure 1 is the OIDC authorization code mode authentication and authorization timing diagram provided by the prior art;

[0051] Figure 2 is one of the flow diagrams of the optimization method of the authentication authorization system provided by the application;

[0052] Figure 3 is one of the flow diagrams of the optimization method of the authentication authorization system provided by the application;

[0053] Figure 4 is a structural diagram of the optimization device of the authentication authorization system provided by the application;

[0054] Figure 5 is a structural diagram of the electronic device provided by the application. DETAILED DESCRIPTION

[0055] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0056] OIDC is an identity authentication and authorization protocol based on OAuth 2.0 protocol, which allows client applications to obtain access tokens and authenticate users through an authentication authorization system. It is an important system supporting microservices in the application domain, and the high availability of the service is particularly critical for the normal use of other microservices. The availability of the service refers to the probability or time occupancy expectation value that the service can normally provide services. The high availability of the service level mainly includes load balancing, elastic scaling, asynchronous decoupling, fault tolerance, overload protection, etc. For OIDC authentication and authorization services deployed based on containerization technology, the availability of the service can usually be improved through horizontal expansion and fault switching. Containerization technology makes it easier to quickly create and manage instances, while using load balancers and automatic scaling mechanisms can ensure the balance of requests and the availability of services. The responsibilities of the OIDC-based unified authentication and authorization system mainly include two parts: one is to perform identity authentication and unified authorization for OIDC processes for client services, and the other is to provide token verification functions for resource services. The system unifies all users in the domain, so when the number of concurrent user logins reaches a peak, the computing resource pressure, network bandwidth pressure, and concurrent connection pressure of the system are very large. If the authentication service instance suddenly fails, the authentication service cannot complete the authentication and authorization work, so it is necessary to perform elastic scaling of the service to support multiple user authentication and authorization requests; and, for example, if the OIDC service instance is suddenly overloaded, the service instance cannot complete the authentication and authorization work, so it is necessary to perform elastic scaling of the service to support multiple user authentication and authorization requests. Figure 1As shown, the authentication and authorization process of OIDC requires multiple interactions between the client and the authentication and authorization system. When the client and the authentication and authorization system complete part of the interaction, the authentication service fails, and the client directly fails to authenticate. When the resource server receives the request of the client, it sends a token verification request to the authentication and authorization system. If the authentication and authorization system is unavailable at this time, the resource server will reject the request of the client, and such situations seriously affect the availability of each microservice.

[0057] The existing method for improving the availability of OIDC authentication service usually adopts the expansion of authentication service instances; specifically, the Kubernetes cluster is directly used for horizontal expansion of the authentication service, the indicators (such as CPU usage, memory usage, etc.) of each Pod of the authentication service are monitored, a threshold is set and an automatic expansion or shrinkage operation is triggered. When a certain indicator exceeds the threshold, the number of instances of the authentication service is increased to cope with high load; when the indicator is lower than the set threshold, the number of instances is reduced to save resources.

[0058] And monitoring the current running indicators is usually a reactive method, which triggers expansion or shrinkage only when the actual performance indicators reach a certain threshold, resulting in optimization and adjustment only when the authentication and authorization system is actually under pressure or has excess resources, lacking the ability to predict future load changes, resulting in a lag in response time for optimization and adjustment, and being unable to prepare resources in advance for the upcoming traffic peak, thereby making the availability of the authentication and authorization system poor, the service unstable, affecting user experience or causing resource waste.

[0059] Therefore, in view of the above problems, the embodiment provides an optimization method of an authentication and authorization system, which analyzes and predicts historical data such as the number of login users, traffic, response time, error rate, special events, user behavior and hardware resource utilization, and log information of the OIDC authentication service, so as to intelligently decide the expansion and shrinkage strategy, realize intelligent horizontal expansion of the authentication service instances, predict the peak node of login in advance, improve the availability of the authentication system, ensure that the client application can smoothly complete the OIDC authentication and authorization process, and thus improve user experience and resource utilization.

[0060] Figure 2 A flowchart of an optimization method of an authentication and authorization system provided by the present application is shown; the execution subject of the method can be the authentication and authorization system to be optimized, also called the target authentication and authorization system.

[0061] As shown in the method, the method comprises the following steps: Figure 2

[0062] ​At step 210, log information and historical monitoring data of the target authentication and authorization system in a target historical period are acquired; the log information includes system logs, operation logs and login logs, and the historical monitoring data includes historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate.

[0063] Optionally, when the target authentication and authorization system needs to be upgraded in terms of availability, the target authentication and authorization system log information, including but not limited to system logs, operation logs and login logs, can be collected by Loki (a lightweight log collection and analysis application), and the historical monitoring data of the target historical period, including but not limited to historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate, can be collected by Prometheus (an open source system monitoring and alarm toolkit). The historical period can be one or more historical time points or historical time periods.

[0064] It should be noted that after the log information and the historical monitoring data are acquired, they can be pushed to a data warehouse for data processing of the log information and the historical monitoring data, and then performance index prediction information prediction is performed, thereby improving the data quality required for subsequent performance index prediction information prediction, and further improving the optimization performance of the authentication and authorization system.

[0065] At step 220, performance index prediction information of the target authentication and authorization system in a to-be-predicted period is predicted according to the log information and the historical monitoring data.

[0066] Optionally, after the log information and the historical monitoring data are acquired, the log information and the historical monitoring data can be combined to obtain the performance index prediction information of the target authentication and authorization system in the to-be-predicted period.

[0067] The to-be-predicted period herein is one or more future time periods; the performance index prediction information herein includes but is not limited to trend prediction information and / or numerical prediction information of the performance index in the to-be-predicted period; the performance index includes but is not limited to CPU usage, response time, memory usage and concurrent connection number.

[0068] At step 230, optimization decision information of the target authentication and authorization system is acquired according to the performance index prediction information, and expansion operation or contraction operation is performed according to the optimization decision information.

[0069] Optionally, after obtaining the performance index prediction information, an optimization decision can be made based on the performance index prediction information to obtain optimization decision information of the target authentication and authorization system. Thus, based on the optimization decision information, a capacity expansion operation or a capacity reduction operation is performed, thereby realizing intelligent optimization of the target authentication and authorization system and further improving the availability of the target authentication and authorization system. The specific decision steps include:

[0070] First, the model prediction results are exposed as custom metrics through a custom metric collector, and the CustomMetrics API provides query and monitoring functions. Then, when creating an HPA (HorizontalPod Autoscaler), set the target deployment or replica set and define the threshold and conditions based on the model prediction results. Next, the custom metric collector obtains the model prediction result data from the Custom Metrics API and compares it with the threshold in the HPA rule. According to the comparison result, it is determined whether to perform an expansion or contraction operation to obtain optimization decision information. Finally, by calling the Kubernetes API or using command line tools, the corresponding expansion or contraction operation is performed according to the optimization decision information; specifically, by increasing or decreasing the number of Pod replicas of the target deployment or replica set, intelligent expansion or contraction is realized.

[0071] The optimization method of the authentication and authorization system provided in this embodiment predicts the performance index prediction and / or performance index prediction trend of the authentication and authorization system in the future period by using multi-dimensional log information of the authentication and authorization system, including system logs, operation logs and login logs, and multi-dimensional monitoring data, including historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate. Thus, the performance requirement changes and peak login nodes of the authentication and authorization system are predicted in advance, so that more accurate expansion or contraction decisions can be made in time, the horizontal expansion or contraction optimization of the authentication and authorization system is realized, the intelligence, timeliness, agility and accuracy of the expansion or contraction strategy are improved, and the availability of the authentication and authorization system is improved. The service is not available or resources are wasted due to untimely expansion or contraction, thereby ensuring that the client application can successfully complete the OIDC authentication and authorization process and improving the user experience.

[0072] In some embodiments, the performance index prediction information of the target authentication and authorization system in the to-be-predicted period is predicted based on the log information and the historical monitoring data in step 220, including:

[0073] The log information and the historical monitoring data are preprocessed to obtain target input information; the preprocessing includes at least one of data cleaning, normalization and format conversion.

[0074] inputting the target input information into the prediction model to obtain the performance index prediction information;

[0075] The prediction model is obtained by training an initial neural network model based on sample log information and sample monitoring data of a sample authentication and authorization system in a first historical period and performance index labels of the sample authentication and authorization system in a second historical period. The initial neural network model includes an attention network, a recurrent neural network, and a prediction layer.

[0076] Optionally, the performance index prediction information in step 220 can be predicted based on a pre-trained prediction model, and specifically includes:

[0077] The log information and historical monitoring data collected in step 210 are preprocessed by at least one of data cleaning, normalization, and format conversion to obtain target input information input into the prediction model, thereby improving the quality of the input information input into the prediction model. The data cleaning is to remove noise, outliers, or irrelevant information in the log information and historical monitoring data. For example, data points that are obviously incorrect or abnormal can be deleted or corrected to ensure the accuracy and reliability of the data. The normalization is to normalize the data so that they are in the same order of magnitude, which is convenient for the neural network model to process, because different monitoring indicators can have different dimensions and ranges. The format conversion is to convert the original data into a specific format, such as time series data, image data, etc., according to the needs of the prediction model.

[0078] After obtaining the target input information, the target input information can be input into the prediction model, and the prediction model can predict the performance index prediction information of the target authentication and authorization system in the to-be-predicted period according to the target input information.

[0079] The prediction model is obtained by training an initial neural network model combined with an attention network, a recurrent neural network, and a prediction layer, using sample log information and sample monitoring data of a sample authentication and authorization system in a first historical period as input and performance index labels of the system in a second historical period as output. The attention network can assign different attention weights to different parts of the data when processing sequence data, thereby more effectively capturing key information. The recurrent neural network can capture the time dependence in the data when processing sequence data. Therefore, the prediction model trained by the initial neural network model combined with the attention network and the recurrent neural network can capture both the time dependence information in the sequence and the important features in the sequence, thereby improving the accuracy of performance index prediction and further improving the optimization performance of the authentication and authorization system.

[0080] The recurrent neural network can be an LSTM (Long Short-Term Memory) or a gated recurrent network, and the embodiment is not specifically limited thereto.

[0081] The method provided by the embodiment can analyze and predict historical data by using an artificial intelligence model, perceive demand changes in advance, improve intelligence and agility, and realize more accurate scaling strategies for OIDC authentication management systems, thereby avoiding service unavailability or resource waste caused by untimely scaling.

[0082] In some embodiments, the prediction model is trained based on the following steps:

[0083] The sample log information and the sample monitoring data are preprocessed to obtain sample input information;

[0084] The sample input information is input into the attention network, the multiplicative attention operation and the bilinear transformation operation are performed on the sub-input information at each time step in the sample input information by the attention network, a weight vector of the sub-input information at each time step is obtained, and the sub-input information at each time step and the weight vector are weighted and summed to obtain a first feature;

[0085] The sample input information is input into the recurrent neural network, and the recurrent neural network extracts time sequence features from the sample input information to obtain a second feature;

[0086] The first feature and the second feature are input into the prediction layer, and the prediction layer predicts the performance index prediction information of the sample authentication and authorization system in the second historical period according to the first feature and the second feature;

[0087] According to the performance index prediction information of the sample authentication and authorization system in the second historical period and the performance index label, the attention network, the recurrent neural network, and the prediction layer are iteratively optimized to obtain an optimized initial neural network model;

[0088] The prediction model is constructed according to the optimized initial neural network model.

[0089] Figure 3 A flowchart of the optimization method of the authentication and authorization system provided by the present application is shown in Figure 2. Figure 3 As shown in Figure 2, the training steps of the prediction model specifically include:

[0090] Data collection and preparation step: first, sample log information of the sample authentication and authorization system is collected through Loki, including but not limited to system logs, operation logs and login logs, and historical monitoring data of the first historical period is collected through Prometheus (an open source system monitoring and alarm toolkit), including but not limited to historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization; and the performance indicators of the sample authentication and authorization system in the second historical period are labeled based on the sample log information and sample monitoring data, thereby obtaining the performance indicator label; then, at least one of data cleaning, normalization and format conversion is preprocessed on the sample log information and sample monitoring data to convert them into a format suitable for input into the initial neural network model, thereby obtaining sample input information. The so-called second historical period is a future period of the first historical period.

[0091] Initial neural network model step: an initial neural network model with LSTM network and attention network is constructed. The input will be a sequence of time step data, and LSTM network and attention network are used to capture the time dependence and important features in the sequence. It should be noted that multiple LSTM layers and stacked LSTM can be used to increase the complexity and representation ability of the initial neural network model.

[0092] Data set division step: the data set is divided into training set and validation set, such as using 70% of the data as training set and the rest as validation set for verifying the model performance.

[0093] Model training and optimization step: the initial neural network model is trained using the training set, and the model parameters are updated through back propagation and stochastic gradient descent algorithm. The trained initial neural network model is evaluated and optimized according to the results of the validation set, and the trained initial neural network model that passes the validation is used as the optimized initial neural network model, thereby constructing a prediction model that can accurately predict performance indicators based on the optimized initial neural network model; the model training is realized by the following steps:

[0094] The sample input information is input into the attention network, and the attention mechanism with weighted weight is used by the attention network to extract features, so as to improve the attention and weight distribution of the model to different time steps; it can be realized by the following steps:

[0095] An attention function is defined in the model, which takes the sample input information and the hidden state of the time step of the second historical period as input, and outputs an attention weight vector. Then, the attention weight vector is multiplied by the corresponding time step of the sample input information. The weighted results of each time step of the sample input information are obtained, and the weighted results of all time steps are added to obtain the attention output, that is, the first feature, so as to increase the attention of the model to the feature representation of different time steps.

[0096] The weight vector can be calculated based on the following steps: for each time step of the sample input information, the attention function is used to calculate the attention weight, which can be realized by comparing the hidden state of the time step of the second historical period with all time steps of the sample input information, and by jointly multiplying the attention and bilinear transformation.

[0097] Similarly, the sample input information is input into the recurrent neural network to extract the time sequence dependence of the sample input information by the recurrent neural network, thereby obtaining the second feature.

[0098] Subsequently, the first feature output by the attention network and the second feature output by the LSTM network are combined through the prediction layer to form the final model output, that is, the performance index prediction information of the sample authentication and authorization system in the second historical period. The prediction layer can include a splicing layer and a fully connected layer, the splicing layer is used to splice the first feature output by the attention network and the second feature output by the LSTM network, and the fully connected layer is used to predict the performance index prediction information of the sample authentication and authorization system in the second historical period according to the splicing result.

[0099] Subsequently, the performance index prediction information of the sample authentication and authorization system in the second historical period and the performance index label are used to calculate the loss function, and the parameters of the attention network, the recurrent neural network and the prediction layer model are updated based on the loss function through back propagation and stochastic gradient descent algorithm.

[0100] The method provided in the embodiment trains the prediction model by combining the attention network and the recurrent neural network, so that the performance index prediction information of the target authentication and authorization system in the to-be-predicted period based on the trained model can capture the time dependence information in the sequence and the important features in the sequence, thereby improving the accuracy of the performance index prediction and the optimization performance of the authentication and authorization system.

[0101] In some embodiments, the method further comprises:

[0102] Obtaining the actual performance index information of the optimized target authentication and authorization system in the to-be-predicted period;

[0103] According to the log information and the historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information, the prediction model is verified.

[0104] In the case where the prediction model fails to pass the verification, the prediction model is re-optimized and trained based on the log information and the historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information.

[0105] Optionally, after the target authentication authorization system is optimized based on the prediction model, the actual operation of the target authentication authorization system needs to be continuously monitored, that is, the performance index actual information of the target authentication authorization system in a to-be-predicted period is obtained, and the prediction accuracy of the prediction model is verified according to the log information and the historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information. In the case where the prediction model fails to pass the verification, the log information and the historical monitoring data of the target authentication authorization system in the target historical period and the performance index actual information are taken as new sample data to re-train the prediction model, so that the prediction model can adapt to new data and business changes in time, and the optimization performance of the authentication authorization system is improved.

[0106] In some embodiments, the method further includes:

[0107] In the case where the authorization request sent by the client is received, it is determined whether the client has completed identity authentication in the pre-constructed session information list; the authorization request is used to request permission authorization;

[0108] In the case where the client has not completed identity authentication, an authentication port is called to perform identity authentication on the client;

[0109] In the case where the client has completed identity authentication, a target operation is performed;

[0110] The target operation includes at least one of the following: authorization processing on the authorization request, sharing and updating of authorization permission information of the client to an authorization consent table in a database, and sharing and updating of an authorization information table in the database according to authorization processing progress information and an authorization processing result of the authorization request.

[0111] Since OIDC authentication has state, it is necessary to ensure that the client communicates with the same Pod (container group) instance throughout the authentication process. By using sticky session technology, the client's request is bound to the same Pod instance throughout the OIDC authentication process, ensuring consistency and stability of the state. However, there are many intermediate states in OIDC authentication: in the case of using sticky session technology, if the authentication service instance is switched due to failure or scaling, the client may lose the previous authentication state, such as each service instance can only identify the login session information authenticated by the current service instance, and the authorization code issued by the current instance, so in the entire authentication process, the user may be required to re-authenticate or re-obtain the authorization code, which destroys the user experience and continuity of the session. And when using sticky session technology, there are many restrictions, such as when cross-availability zone load balancing is enabled, sticky session is not supported.

[0112] Therefore, to solve the above problems, the embodiment provides a method for stateless OIDC authentication service and centralized management of sessions by sharing login session information and persisting OIDC authentication information, which ensures that the session state can be persisted and migrated properly when switching instances, ensuring consistency of intermediate authentication states, so that the client can switch to any authentication service instance throughout the authentication process, greatly improving the high availability of the authentication service. The specific steps are as follows:

[0113] Optionally, since the OIDC authentication process requires the user to first complete identity authentication using a username and password, then generate session information and store it in the session, and return the corresponding JSESSIONID (a identifier used to track user sessions in Java applications) to the client to associate the corresponding session information, the client needs to carry the JSESSIONID in the cookie in the subsequent process. To this end, the embodiment provides an implementation step for sharing session information between instances, which specifically includes:

[0114] A session table is built in the database. When a client initiates an authorization request to an authorization endpoint, such as an oauth2 / authorize endpoint, the session attribute information of the client is obtained according to the authorization request, the session information corresponding to the client in the session table is found according to the primary key ID of the session attribute information, and it is judged whether the client has completed identity authentication according to the session information corresponding to the client. If the identity authentication is not completed, the current authorization request is stored in the session table, and then the client is redirected to a unified login page. After the identity authentication of the client is completed, the authorization request is taken out from the session table, and the authorization processing of the authorization request is performed. Thus, by building the session information table, the identity authentication information and the authorization code request before the identity authentication are stored, and the data sharing between service instances is realized through the persistence of key information.

[0115] The structure of the session information table is as follows:

[0116]

[0117] The session ID is used to uniquely identify a session, which is generated by the OIDC authentication and authorization system. When generating an id_token (identity token), it is also written into the declaration for token verification.

[0118] The maximum survival time of the session indicates the longest time that the session can be maintained without being accessed. If the time limit is exceeded, the session will be automatically invalidated.

[0119] The session expiration time indicates the estimated expiration time of the session. When the current time exceeds the expiration time, the session is considered to have expired.

[0120] The authentication subject identifier indicates the name or identifier of the authentication subject associated with the session. The subject can be a user, a role, a service, or other entities. This field is used to identify the subject identity to which the session belongs.

[0121] The structure of the session attribute table is as follows:

[0122]

[0123] The session attribute is used to store the session state and other related information of the user. Common session attributes include user identity verification information, user preferences, and other information, wherein the attribute data is stored in byte type.

[0124] It should be noted that the storage form of the session information table or the session attribute table includes storage in a (distributed) relational database, a columnar storage database, a Hive (data warehouse tool), or a persistent in-memory database, as well as a combination of the above database types.

[0125] Optionally, in the case of determining that the client completes the identity authentication, the authorization permission information of the client can also be updated to the authorization consent table in the database; the authorization information table in the database can also be updated according to the authorization processing progress information and the authorization processing result of the authorization request, so as to persistently store the state information in the OIDC authentication process into the database, and the state of each process node can be shared by multiple service instances. The specific implementation steps are as follows:

[0126] First, an authorization information table and an authorization consent table are created in the database to store related authorization information and user consent information. Exemplarily, the data structure of the authorization information table is as follows:

[0127]

[0128]

[0129] Exemplarily, the data structure of the authorization consent table is as follows:

[0130]

[0131] In the authorization information table, detailed authorization information is recorded, including the values of authorization code, access token, etc., the issuance time and the expiration time. In the authorization consent information table, the information of user's consent to authorization is recorded.

[0132] Next, when receiving the authorization request initiated by the client and completing the identity authentication, the authentication and authorization system checks the authorization information table corresponding to the client at the end, writes the related information in the authorization request into the authorization information table; the information required to be written includes the registered client ID, the authentication subject name, the authorization type, the authorization scope, the attribute information and the state parameter; and generates the authorization code according to the information in the authorization request, and writes the authorization code into the authorization information table. At the same time, the permission information that the user has confirmed to agree is written into the authorization consent table.

[0133] In the authorization code mode, after the authentication and authorization system verifies the validity of the authorization code, the access token, OIDC-ID token and refresh token are generated according to the data in the authorization information table, and the corresponding values, issuance time and expiration time and other information are written into the corresponding fields in the authorization information table.

[0134] In different stages of the authentication process, the authentication and authorization system updates the state information in the authorization information table according to the processing progress information and the verification result of the authorization request, for example, updates the issuance time and expiration time of the access token after the token is refreshed, so as to realize the storage of the state information of each node in the authorization request in the authentication and authorization system, so that the previous authorization information is not lost even if the authentication service instance is switched, thereby further improving the availability of the authentication and authorization system.

[0135] The method provided by the embodiment simplifies the complexity of horizontal expansion by sharing login session information and persisting authentication process information, and ensures the consistency of state information migration between service instances, supports switching to different service instances in the client authentication and authorization process without sticky session, avoids the state loss of the OIDC authentication process of the client caused by instance switching in the expansion and contraction process of the authentication service, improves the user experience, and further improves the availability of the authentication and authorization system.

[0136] In some embodiments, the authorization processing of the authorization request comprises:

[0137] According to the APISIX gateway and the Nacos platform, at least one target authentication and authorization instance is matched and obtained from the plurality of authentication and authorization instances of the target authentication and authorization system;

[0138] The authorization request is dynamically routed to each of the target authentication and authorization instances for authorization processing.

[0139] Optionally, for client retry and load balancing, the client itself implements the load balancing and retry strategy in the authentication process. In the OIDC authentication process, if the requested authentication service instance fails, for example, fails to obtain a token, the client itself re-pulls the service instance list for retry, and when switching to another instance for retry, the client re-obtains an authorization code and then requests a token, resulting in a large development and maintenance cost of client retry and load balancing: each client needs to handle the retry and load balancing logic by itself, resulting in various implementation methods and strategies in the system, which violates the unified architecture of microservices, affects the consistency and maintainability of the system, is difficult to unify and manage in the later stage, and increases the development and maintenance cost.

[0140] Therefore, in view of the above problems, the present embodiment combines APISIX gateway with Nacos to realize dynamic routing of client requests. Specifically, the APISIX gateway is associated with the service registry Nacos. The gateway communicates with the service registry Nacos (Dynamic Naming and Configuration Service, dynamic service discovery, configuration management and service management) at regular intervals to realize health detection of service instances and automatically update the available instance list of the authentication service instance, greatly reducing the possibility of client call failure. Even if the call fails, the gateway will automatically update the instance list and retry, and the entire load balancing and retry process is not perceived by the client, greatly reducing the cost of client access to the OIDC authentication system and the cost of later development and maintenance.

[0141] Exemplarily, the steps of combining APISIX gateway with Nacos to realize dynamic routing of client requests include:

[0142] The authentication service of the authentication and authorization system is successfully registered in Nacos, which can be registered by specifying the service name as "oauth2-service".

[0143] A new route is created using the Admin API (Administrative Application Programming Interface) provided by APISIX. In the route configuration, set the "uris" field to the URI path pattern that needs to be routed, for example " / nacos / *", which means that all requests starting with " / nacos / " will be matched by this route.

[0144] In the "upstream" field of the route, configure "service_name" as "oauth2-service", which means that the route will forward to the backend service named "oauth2-service". Set "discovery_type" as "nacos", which means using the service discovery function of Nacos.

[0145] Set "type" as "roundrobin" in "upstream", which means using round robin for load balancing. In this way, APISIX will get the instance list of all "oauth2-service" services from Nacos and forward requests to different instances in turn according to the round robin algorithm.

[0146] Configure the retry policy under this route, including the number of retries and the retry timeout. It is generally recommended to set the number of retries to 3 and the retry timeout to 2 seconds. In this way, when an instance fails, APISIX will automatically try to retry other available instances. Exemplarily, the retry code is as follows:

[0147] {"uris":[" / nacos / *"],

[0148] "upstream":{

[0149] "service_name":"oauth2-service",

[0150] "type":"roundrobin",

[0151] "discovery_type":"nacos",

[0152] "retries":3,

[0153] "retry_timeout":2000

[0154] }

[0155] };

[0156] After the above steps, assuming that the gateway domain name is APISIX.gateway, then the client only needs to request APISIX.gateway / nacos / oauth2 / authorize when initiating an authentication request, and APISIX will perform load balancing calls through the latest instance list obtained from nacos, and when the current instance fails, it will automatically retry and switch to another instance to request.

[0157] The method provided by the embodiment, through the combination of APISIX and the service registry Nacos, realizes the functions of automatic health check, updating of the available instance list, failure retry, load balancing and the like when the client calls the authentication service on the gateway side, optimizes the load balancing and failure recovery strategy, avoids the need for each client application in the application system to independently implement these functions, reduces the development and maintenance cost of the project, greatly improves the efficiency of application integration to the OIDC authentication system, and greatly reduces the probability of authentication failure or repeated authentication process due to OIDC authentication service instance failure, thereby further greatly improving the availability of the authentication service.

[0158] In some embodiments, the method further comprises:

[0159] generating a key pair; the key pair includes a pair of generated public key and private key;

[0160] creating a target document according to the public key and attribute information of the public key;

[0161] digitally signing the target document based on the private key to obtain a signed document;

[0162] receive the document acquisition instruction sent by the client;

[0163] authenticate the client, in the case where the client is authenticated, transmit the signed document to the client, so that the client performs digital signature verification on the signed document, and in the case where the digital signature of the signed document is verified, send the public key in the signed document to a resource manager; the resource manager is configured to verify a token in an access request sent by the client according to the public key, and determine whether to reject the access request of the client according to a verification result; the access request is configured to request resource access.

[0164] It should be noted that the authentication and authorization system will use an asymmetric encryption algorithm when issuing a token, wherein the authentication and authorization system digitally signs the token with a private key, and the resource server needs to use a public key to verify the token carried in the client request. Therefore, when horizontally expanding the authentication and authorization system, it is also necessary to ensure that the service instances share the same pair of keys, so as to ensure that the same private key is used for digital signature regardless of which instance the client requests, and the same public key is obtained by the resource server. To this end, the embodiment provides the following steps to realize key sharing:

[0165] Generate a key pair, specifically, use the RSA class library of Java to generate a key pair generator object, and specify the key length as 2048 bits. Initialize the key pair generator object through a secure pseudo-random number generation algorithm, and then generate a key pair (public key and private key).

[0166] Encrypt the generated private key using AES (Advanced Encryption Standard, AES). Import the public key and the encrypted private key into the KMS (Key Management System, KMS). KMS can provide secure key storage and management functions to ensure the confidentiality and integrity of the keys.

[0167] Create a JWKS (JSON Web Key Set, JSON object encryption document) on the local side of the authentication and authorization system. Add the generated public key to the "keys" field of the JWKS document. The JWKS document can include relevant metadata of the public key, such as key ID (kid), use, algorithm (alg), etc.

[0168] Digitally sign the JWKS document using the private key to ensure the integrity and source verification of the JWKS. Digital signature can be implemented using RSA algorithm and corresponding private key.

[0169] In the application of the authentication and authorization system, a secure API (Application Programming Interface) endpoint is provided for the client to obtain the JWKS document. The client needs to perform identity authentication when accessing the endpoint to ensure that only the client that passes the valid authentication can obtain the JWKS document. The API endpoint is protected using the OAuth 2.0 mechanism, and the authentication and authorization system needs to verify the token carried in the request to ensure that the public key can be safely transmitted to the resource server. After sending the public key in the signed document to the resource manager, the resource manager can verify the token in the access request sent by the client according to the public key, and determine whether to reject the access request of the client according to the verification result.

[0170] The method provided by the embodiment realizes stateless of the OIDC authentication service through token key sharing, ensures that the session state can be persisted and properly migrated when switching instances, ensures consistency of the intermediate state in authentication, and enables the client to switch any authentication service instance in the entire authentication process, thereby greatly improving the high availability of the authentication service.

[0171] In some embodiments, the method further comprises:

[0172] In the case of receiving an access request sent by a client, the access request is verified according to the verification conditions configured in the verification plug-in of the APISIX gateway, the client is identity authenticated in the case that the access request passes the verification, and the access request is sent to the resource manager in the case that the client passes the identity authentication.

[0173] The related technology uses a high-performance gateway as an authentication center, and the OIDC authentication process is processed by the gateway. The high-performance gateway has strong processing capability and high availability, can effectively process and distribute authentication requests, provide fast authentication response, and reduce the pressure of the authentication service. However, the gateway as an authentication center has the following limitations: the authentication process processed by the gateway can reduce the pressure of the authentication service, but at the same time, it also limits the support and flexibility of some customized functions. The gateway is usually a general component and cannot meet all specific requirements and customized scenarios. Some customized requirements (such as specific authentication algorithms, custom identity verification plug-ins, etc.) may not be easily implemented at the gateway layer, thereby requiring additional development and customization. And simply checking whether the token is carried in the request through the gateway lacks accurate verification: for example, it cannot verify the token type, callback address, logout address, etc. and does not perform more in-depth analysis and verification on the content of the token, and cannot ensure that the request token has the required permission to access specific resources. It lacks fine-grained customization and flexibility for different applications.

[0174] To solve the above problems, the method provided in the embodiment uses a gateway to configure an OIDC plug-in, different configurations are made for different applications on the gateway side, when a client requests different resource servers, the gateway will perform customized verification on the request based on the configuration, which improves the flexibility of gateway filtering, a large number of invalid requests are intercepted on the gateway side, and the pressure on the resource server and the authentication and authorization system is reduced. At the same time, the gateway only performs OIDC-related verification on the request, and does not serve as an authentication center. The authentication center is still deployed in the authentication and authorization system, which decouples the two, so that the authentication center can meet more complex scenarios. At the same time, flexible OIDC gateway plug-in configurations are provided to enhance system usability and simplify client and resource server integration and maintenance. The pre-verification filtering can be implemented through the following steps:

[0175] Configure a verification plug-in. The verification plug-in contains various verification conditions, including but not limited to token configuration verification conditions, client configuration verification conditions, and key field configuration information verification conditions. For example, the content of the plug-in configuration can be implemented based on the following code:

[0176]

[0177] Deploy the verification plug-in to the APISIX gateway.

[0178] After the plug-in is configured, when an access request sent by a client is received, the access request can be verified by the APISIX gateway according to the various verification conditions configured in the verification plug-in. If the access request fails the verification, it is intercepted. If the access request passes the verification, it is sent to the resource manager, thereby greatly reducing the pressure on the resource server.

[0179] The method provided in the embodiment can adaptively filter invalid requests, reduce the pressure on the resource server and the authentication and authorization system, and improve usability. The gateway and the authentication center are coupled, so that the gateway only serves as a filtering and request verification component and does not assume the functions of the authentication center, so as to ensure that the authentication center can focus more on processing more complex authentication logic, which helps to improve the scalability and maintainability of the system as a whole, thereby improving the usability of the authentication and authorization system.

[0180] The optimization device of the authentication authorization system provided by the application is described below, and the optimization device of the authentication authorization system described below can be correspondingly referred to the optimization method of the authentication authorization system described above.

[0181] Figure 4 The optimization device of the authentication authorization system provided by the application is described below, and the optimization device of the authentication authorization system described below can be correspondingly referred to the optimization method of the authentication authorization system described above.

[0182] The acquisition unit 410 is configured to acquire log information and historical monitoring data of the target authentication authorization system in a target historical period, wherein the log information comprises system logs, operation logs and login logs, and the historical monitoring data comprises historical login numbers, historical traffic data, historical response times, historical error rates, historical service indicators, historical user behavior information and historical hardware resource utilization rates.

[0183] The prediction unit 420 is configured to predict performance indicator prediction information of the target authentication authorization system in a to-be-predicted period according to the log information and the historical monitoring data.

[0184] The optimization unit 430 is configured to acquire optimization decision information of the target authentication authorization system according to the performance indicator prediction information, and perform expansion operation or contraction operation according to the optimization decision information.

[0185] The device provided by the application predicts the performance indicator prediction and / or performance indicator prediction trend of the authentication authorization system in the future period through the multi-dimensional log information of the authentication authorization system, including system logs, operation logs and login logs, and multi-dimensional monitoring data, including historical login numbers, historical traffic data, historical response times, historical error rates, historical service indicators, historical user behavior information and historical hardware resource utilization rates, thereby predicting the performance requirement change and the peak node of login of the authentication authorization system in advance, so that more accurate expansion and contraction decisions can be made in time, the horizontal expansion and contraction optimization of the authentication authorization system is realized, the intelligence, timeliness, agility and accuracy of the expansion and contraction strategy are improved, and the availability of the authentication authorization system is improved, so that the OIDC authentication authorization process of the client application can be successfully completed, and the user experience is improved.

[0186] The device provided by the application is used to execute the above-mentioned method embodiments, and the specific process and detailed content are referred to the above-mentioned embodiments, which will not be described here.

[0187] Figure 5 An example of an entity structure diagram of an electronic device is shown in FIG. 1. Figure 5As shown, the electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 complete mutual communication through the communications bus 540. The processor 510 can invoke a logical instruction in the memory 530 to execute an optimization method of an authentication and authorization system, the method including: obtaining log information and historical monitoring data of a target authentication and authorization system in a target historical period; the log information including system logs, operation logs, and login logs, and the historical monitoring data including historical login numbers, historical traffic data, historical response times, historical error rates, historical service indicators, historical user behavior information, and historical hardware resource utilization rates; according to the log information and the historical monitoring data, performance indicator prediction information of the target authentication and authorization system in a to-be-predicted period is predicted; according to the performance indicator prediction information, optimization decision information of the target authentication and authorization system is obtained, and expansion operation or contraction operation is performed according to the optimization decision information.

[0188] In addition, the logical instruction in the memory 530 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or in part or parts of the technical solutions that contribute to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0189] In another aspect, the present application also provides a computer program product comprising a computer program, which can be stored on a non-transitory computer readable storage medium, and the computer program is executable by a processor to enable a computer to perform the optimization method of the authentication and authorization system provided by the above-mentioned methods, the method comprising: obtaining log information and historical monitoring data of the target authentication and authorization system in a target historical period; the log information comprises system logs, operation logs and login logs, and the historical monitoring data comprises historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate; according to the log information and the historical monitoring data, performance index prediction information of the target authentication and authorization system in a to-be-predicted period is predicted; according to the performance index prediction information, optimization decision information of the target authentication and authorization system is obtained, and expansion operation or contraction operation is performed according to the optimization decision information.

[0190] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having a computer program stored thereon, and the computer program is executable by a processor to implement the optimization method of the authentication and authorization system provided by the above-mentioned methods, the method comprising: obtaining log information and historical monitoring data of the target authentication and authorization system in a target historical period; the log information comprises system logs, operation logs and login logs, and the historical monitoring data comprises historical login number, historical traffic data, historical response time, historical error rate, historical service index, historical user behavior information and historical hardware resource utilization rate; according to the log information and the historical monitoring data, performance index prediction information of the target authentication and authorization system in a to-be-predicted period is predicted; according to the performance index prediction information, optimization decision information of the target authentication and authorization system is obtained, and expansion operation or contraction operation is performed according to the optimization decision information.

[0191] The device embodiments described above are only schematic, wherein the units shown as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement without creative labor.

[0192] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0193] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An optimization method for an authentication authorization system, characterized in that, The application is applied to a target authentication authorization system, and comprises the following steps: obtaining log information and historical monitoring data of the target authentication authorization system in a target historical period; the log information comprises system logs, operation logs and login logs, and the historical monitoring data comprises historical login numbers, historical traffic data, historical response times, historical error rates, historical service indicators, historical user behavior information and historical hardware resource utilization rates; according to the log information and the historical monitoring data, performance indicator prediction information of the target authentication authorization system in a to-be-predicted period is predicted; according to the performance indicator prediction information, optimization decision information of the target authentication authorization system is obtained, and expansion operation or contraction operation is performed according to the optimization decision information; the performance indicator prediction information of the target authentication authorization system in the to-be-predicted period is predicted according to the log information and the historical monitoring data, and comprises the following steps: target input information is obtained by preprocessing the log information and the historical monitoring data; the preprocessing comprises at least one of data cleaning, normalization and format conversion; the target input information is input into a prediction model to obtain the performance indicator prediction information; the prediction model is obtained by training an initial neural network model based on sample log information and sample monitoring data of a sample authentication authorization system in a first historical period and performance indicator labels of the sample authentication authorization system in a second historical period; the initial neural network model comprises an attention network, a recurrent neural network and a prediction layer.

2. The optimization method of an authentication-authorization system according to claim 1, characterized in that, the prediction model is obtained by training based on the following steps: sample input information is obtained by preprocessing the sample log information and the sample monitoring data; the sample input information is input into the attention network, the attention network performs multiplicative attention operation and bilinear transformation operation on sub-input information at each time step in the sample input information to obtain a weight vector of the sub-input information at each time step, and weighted summation is performed on the sub-input information at each time step and the weight vector to obtain a first feature; the sample input information is input into the recurrent neural network, and the recurrent neural network extracts time sequence features from the sample input information to obtain a second feature; the first feature and the second feature are input into the prediction layer, and the prediction layer predicts performance indicator prediction information of the sample authentication authorization system in the second historical period according to the first feature and the second feature; the attention network, the recurrent neural network and the prediction layer are iteratively optimized according to the performance indicator prediction information of the sample authentication authorization system in the second historical period and the performance indicator labels, and an optimized initial neural network model is obtained; the prediction model is constructed according to the optimized initial neural network model.

3. The optimization method of an authentication-authorization system according to claim 1, characterized in that, the method further comprises the following steps: obtaining performance indicator actual information of an optimized target authentication authorization system in the to-be-predicted period; According to the log information and the historical monitoring data of the target historical period of the target authentication authorization system, and the performance index actual information, the prediction model is verified; In the case that the prediction model fails to pass the verification, the prediction model is re-optimized and trained based on the log information and the historical monitoring data of the target historical period of the target authentication authorization system, and the performance index actual information.

4. The optimization method of an authentication-authorization system according to any one of claims 1-3, characterized in that, The method further comprises: In the case that the client sends an authorization request, determine whether the client has completed identity authentication in the pre-constructed session information list; the authorization request is used to request permission authorization; In the case that the client has not completed identity authentication, call the authentication port to perform identity authentication on the client; In the case that the client completes identity authentication, perform a target operation; The target operation includes at least one of authorization processing of the authorization request, sharing and updating of authorization permission information of the client to an authorization consent table in a database, and sharing and updating of an authorization information table in the database according to authorization processing progress information and authorization processing results of the authorization request.

5. The method of claim 4, wherein the method further comprises: The authorization processing of the authorization request comprises: According to the APISIX gateway and the Nacos platform, at least one target authentication authorization instance is matched and obtained in a plurality of authentication authorization instances of the target authentication authorization system; The authorization request is dynamically routed to each target authentication authorization instance to perform authorization processing on the authorization request.

6. The method of optimizing an authentication-authorization system according to any of claims 1-3, characterized in that, The method further comprises: Generating a key pair; the key pair includes a pair of generated public key and private key; According to the public key and attribute information of the public key, a target document is created; Based on the private key, the target document is digitally signed to obtain a signed document; Receiving a document acquisition instruction sent by a client; Identity authentication is performed on the client, and in the case that the client passes the identity authentication, the signed document is transmitted to the client for digital signature verification of the signed document, and in the case that the digital signature of the signed document passes the verification, the public key in the signed document is sent to a resource manager; the resource manager is used to verify a token in an access request sent by the client according to the public key, and according to the verification result, it is determined whether to reject the access request of the client; the access request is used to request resource access.

7. The method of optimizing an authentication-authorization system according to any of claims 1-3, characterized in that, The method further comprises: In the case that the client sends an access request, according to each verification condition configured in the verification plug-in of the APISIX gateway, the access request is verified, in the case that the access request passes the verification, identity authentication is performed on the client, and in the case that the client passes the identity authentication, the access request is sent to a resource manager.

8. An optimization apparatus of an authentication authorization system, characterized by comprising: Applied to a target authentication authorization system, comprising: The acquisition unit is configured to acquire log information and historical monitoring data of the target authentication and authorization system in a target historical period; the log information comprises system logs, operation logs and login logs; the historical monitoring data comprises historical login numbers, historical traffic data, historical response times, historical error rates, historical service indexes, historical user behavior information and historical hardware resource utilization rates; The prediction unit is configured to predict performance index prediction information of the target authentication and authorization system in a to-be-predicted period according to the log information and the historical monitoring data; The optimization unit is configured to acquire optimization decision information of the target authentication and authorization system according to the performance index prediction information, and perform expansion operation or contraction operation according to the optimization decision information; The prediction unit is specifically configured to pre-process the log information and the historical monitoring data to obtain target input information; the pre-processing comprises at least one of data cleaning, normalization and format conversion; and the target input information is input into a prediction model to obtain the performance index prediction information. The prediction model is obtained by training an initial neural network model based on sample log information and sample monitoring data of a sample authentication and authorization system in a first historical period and performance index labels of the sample authentication and authorization system in a second historical period; and the initial neural network model comprises an attention network, a recurrent neural network and a prediction layer.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the optimization method of the authentication and authorization system according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the optimization method of the authentication and authorization system according to any one of claims 1 to 7.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the optimization method of the authentication and authorization system according to any one of claims 1 to 7.

Images