A service request authentication method, device, equipment and readable storage medium

Abstract

The application discloses a service request authentication method and device, equipment and a readable storage medium, and relates to the technical field of communication, so as to reduce network delay. The method comprises the following steps: receiving a service request message sent by a third-party application, wherein the service request message comprises service data and service authentication related information; generating a service authentication message according to the service authentication related information, wherein the service authentication message does not comprise the service data; and sending the service authentication message to an API gateway for authentication. The embodiment of the application can reduce network delay.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a service request authentication method, apparatus, device, and readable storage medium. Background Technology

[0002] When a third-party application calls a service deployed on an edge cloud platform, it needs to authenticate the business request before it can call the service on the edge cloud platform, and logs are recorded during this process. However, the existing authentication method causes the business request to take a long time to transmit over the network, resulting in network latency. Summary of the Invention

[0003] This application provides a service request authentication method, apparatus, device, and readable storage medium to reduce network latency.

[0004] In a first aspect, embodiments of this application provide a service request authentication method, applied to a proxy gateway, including:

[0005] Receive a business request message sent by a third-party application, wherein the business request message includes business data and business authentication related information;

[0006] Based on the business authentication information, a business authentication message is generated, wherein the business authentication message does not include the business data;

[0007] The service authentication message is sent to the Application Programming Interface (API) gateway for authentication.

[0008] Optionally, receiving the business request message sent by the third-party application includes:

[0009] The first interface of the proxy gateway receives the service request message sent by the third-party application.

[0010] The step of generating a business authentication message based on the business authentication information includes:

[0011] The first interface of the proxy gateway converts the business authentication-related information into the first authentication parameters required for authentication by the API gateway.

[0012] The first authentication parameter is encapsulated into the business authentication message by the first interface of the proxy gateway in accordance with the API gateway data access specification.

[0013] Optionally, the method further includes:

[0014] The service request message is stored in the first message queue by the first interface of the proxy gateway.

[0015] Optionally, the method further includes:

[0016] The proxy gateway receives a service authorization message sent by the API gateway through its first interface and sends a service response message to the third-party application, wherein the service authorization message and the service response message indicate that authentication failed.

[0017] or

[0018] The second interface of the proxy gateway receives the service authorization message sent by the API gateway and stores the authentication result in the second message queue, wherein the service authorization message and the authentication result indicate that the authentication is successful; the first interface of the proxy gateway obtains the authentication result from the second message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service called by the service request message;

[0019] or

[0020] The proxy gateway receives the service authorization message sent by the API gateway through its second interface, retrieves the service request message from the first message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the service request message. The service authorization message indicates that the authentication has been passed.

[0021] Optionally, the method further includes:

[0022] The first interface of the proxy gateway receives the service response message sent by the edge cloud platform and stores the service response message in the third message queue;

[0023] The second interface of the proxy gateway retrieves the service response message from the third message queue and sends the service response message to the API gateway.

[0024] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0025] Optionally, the method further includes:

[0026] The second interface of the proxy gateway receives the service response message sent by the edge cloud platform and sends the service response message to the API gateway.

[0027] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0028] Secondly, embodiments of this application provide a business request authentication method applied to an API gateway, including:

[0029] Receive a service authentication message sent by the proxy gateway, wherein the service authentication message does not include the service data of the third-party application;

[0030] Authentication is performed based on the aforementioned business authentication message.

[0031] Optionally, the method further includes:

[0032] Send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or

[0033] Send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication has been successful.

[0034] Optionally, the method further includes:

[0035] Send a service response message to the first interface of the proxy gateway.

[0036] Thirdly, embodiments of this application provide a service request authentication device applied to a proxy gateway, comprising:

[0037] The first receiving module is used to receive a business request message sent by a third-party application, wherein the business request message includes business data and business authentication related information;

[0038] The first generation module is used to generate a business authentication message based on the business authentication information, wherein the business authentication message does not include the business data;

[0039] The first sending module is used to send the business authentication message to the API gateway for authentication.

[0040] Optionally, the first receiving module is configured to: receive a business request message sent by the third-party application through the first interface of the proxy gateway;

[0041] The first generation module is used for:

[0042] The first interface of the proxy gateway converts the business authentication-related information into the first authentication parameters required for API gateway authentication.

[0043] The first authentication parameter is encapsulated into the business authentication message according to the API gateway data access specification through the first interface of the proxy gateway.

[0044] Optionally, the device further includes:

[0045] The first storage module is used to store the business request message into the first message queue through the first interface of the proxy gateway.

[0046] Optionally, the device may further include: a second processing module, used for;

[0047] The proxy gateway receives a business authorization message sent by the API gateway through its first interface and sends a business response message to the third-party application, wherein the business authorization message and the business response message indicate that authentication failed.

[0048] or

[0049] The proxy gateway receives a service authorization message sent by the API gateway through its second interface and stores the authentication result in a second message queue, wherein the service authorization message and the authentication result indicate that the authentication is successful; the proxy gateway retrieves the authentication result from the second message queue through its first interface, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service invoked by the service request message;

[0050] or

[0051] The proxy gateway receives the service authorization message sent by the API gateway through its second interface, retrieves the service request message from the first message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the service request message. The service authorization message indicates that the authentication has been passed.

[0052] Optionally, the device may further include: a third processing module, used for:

[0053] The proxy gateway receives the service response message sent by the edge cloud platform through its first interface and stores the service response message in the third message queue.

[0054] The service response message is obtained from the third message queue through the second interface of the proxy gateway, and then sent to the API gateway.

[0055] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0056] Optionally, the device may further include: a fourth processing module, used for:

[0057] The proxy gateway receives the business response message sent by the edge cloud platform through its second interface and sends the business response message to the API gateway.

[0058] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0059] Fourthly, embodiments of this application provide a business request authentication device applied to an API gateway, comprising:

[0060] The first receiving module is used to receive a service authentication message sent by the proxy gateway, wherein the service authentication message does not include the service data of the third-party application;

[0061] The first processing module is used to perform authentication based on the business authentication message.

[0062] Optionally, the device may further include: a first transmitting module, used for:

[0063] Send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or

[0064] Send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication has been successful.

[0065] Optionally, the device may further include: a second transmitting module, used for:

[0066] Send a service response message to the first interface of the proxy gateway.

[0067] Fifthly, embodiments of this application provide a service request authentication device applied to a proxy gateway, comprising: a processor and a transceiver;

[0068] The transceiver is used to receive business request messages sent by third-party applications, wherein the business request messages include business data and business authentication-related information.

[0069] The processor is configured to generate a service authentication message based on the service authentication information, wherein the service authentication message does not include the service data;

[0070] The transceiver is also used to send the business authentication message to the API gateway for authentication.

[0071] Optionally, the transceiver is also used for:

[0072] The proxy gateway receives business request messages sent by the third-party application through its first interface.

[0073] The processor is also used for:

[0074] The first interface of the proxy gateway converts the business authentication-related information into the first authentication parameters required for API gateway authentication.

[0075] The first authentication parameter is encapsulated into the business authentication message according to the API gateway data access specification through the first interface of the proxy gateway.

[0076] Optionally, the processor is further configured to store the service request message into a first message queue through the first interface of the proxy gateway.

[0077] Optionally, the processor is further configured to:

[0078] The proxy gateway receives a business authorization message sent by the API gateway through its first interface and sends a business response message to the third-party application, wherein the business authorization message and the business response message indicate that authentication failed.

[0079] or

[0080] The proxy gateway receives a service authorization message sent by the API gateway through its second interface and stores the authentication result in a second message queue, wherein the service authorization message and the authentication result indicate that the authentication is successful; the proxy gateway retrieves the authentication result from the second message queue through its first interface, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service invoked by the service request message;

[0081] or

[0082] The proxy gateway receives the service authorization message sent by the API gateway through its second interface, retrieves the service request message from the first message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the service request message. The service authorization message indicates that the authentication has been passed.

[0083] Optionally, the transceiver is also used for:

[0084] The proxy gateway receives the service response message sent by the edge cloud platform through its first interface and stores the service response message in the third message queue.

[0085] The service response message is obtained from the third message queue through the second interface of the proxy gateway, and then sent to the API gateway.

[0086] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0087] Optionally, the transceiver is also used for:

[0088] The proxy gateway receives the business response message sent by the edge cloud platform through its second interface and sends the business response message to the API gateway.

[0089] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0090] Sixthly, embodiments of this application provide a business request authentication device applied to an API gateway, comprising: a processor and a transceiver;

[0091] The transceiver is used to receive service authentication messages sent by the proxy gateway, wherein the service authentication messages do not include business data of third-party applications.

[0092] The processor is used to perform authentication based on the service authentication message.

[0093] Optionally, the transceiver is also used for:

[0094] Send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or

[0095] Send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication has been successful.

[0096] Optionally, the transceiver is also used for:

[0097] Send a service response message to the first interface of the proxy gateway.

[0098] In a seventh aspect, embodiments of this application also provide a communication device, including: a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the service request authentication method described above.

[0099] Eighthly, embodiments of this application also provide a readable storage medium storing a program, which, when executed by a processor, implements the steps in the business request authentication method described above.

[0100] In this embodiment of the application, since the business authentication message sent by the proxy gateway to the API gateway does not include the business data of the third-party application, network latency can be reduced during network transmission. Attached Figure Description

[0101] Figure 1 This is one of the flowcharts of the business request authentication method provided in the embodiments of this application;

[0102] Figure 2 This is the second flowchart of the business request authentication method provided in the embodiments of this application;

[0103] Figure 3 This is the third flowchart of the business request authentication method provided in the embodiments of this application;

[0104] Figure 4 This is the fourth flowchart of the business request authentication method provided in the embodiments of this application;

[0105] Figure 5 This is one of the structural diagrams of the service request authentication device provided in the embodiments of this application;

[0106] Figure 6 This is the second structural diagram of the service request authentication device provided in the embodiments of this application;

[0107] Figure 7 This is the third structural diagram of the service request authentication device provided in the embodiments of this application;

[0108] Figure 8 This is the fourth structural diagram of the service request authentication device provided in the embodiments of this application. Detailed Implementation

[0109] In the embodiments of this application, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0110] In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0111] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0112] See Figure 1 , Figure 1 This is a flowchart of a service request authentication method provided in an embodiment of this application, applied to a proxy gateway, such as... Figure 1 As shown, it includes the following steps:

[0113] Step 101: Receive a business request message sent by a third-party application, wherein the business request message includes business data and business authentication related information.

[0114] The business authentication information may include, for example, the parameter name, parameter type, and parameter location of the data to be authenticated, as well as the identifier of the third-party application. In this embodiment, to further reduce latency, different interfaces of the proxy gateway can process different messages or handle different threads. For example, in this step, the first interface of the proxy gateway can receive the business request message sent by the third-party application. This first interface can be any interface of the proxy gateway.

[0115] Step 102: Generate a business authentication message based on the business authentication information, wherein the business authentication message does not include the business data.

[0116] In this embodiment, the proxy gateway formulates a data access specification based on the authentication data required by the API gateway to be connected. This specification includes a service identifier, and the service identifier corresponds one-to-one with the parameters required for API gateway authentication. Furthermore, the proxy gateway specifies the format of the authentication data included in the request, including parameter name, parameter type, and parameter location, specifying whether it should be placed in the header or the body.

[0117] Before a service can be invoked, it needs to be registered with both the proxy gateway and the API gateway. Registration information includes the service identifier and a route address. The route address registered with the proxy gateway is the interface address of the service deployed on the edge cloud platform, while the route address registered with the API gateway is the proxy gateway address.

[0118] Specifically, in this step, the first interface of the proxy gateway converts the business authentication information into the first authentication parameters required for API gateway authentication, and the first interface of the proxy gateway encapsulates the first authentication parameters into the business authentication message according to the API gateway data access specification.

[0119] Step 103: Send the business authentication message to the API gateway for authentication.

[0120] In this embodiment, since the business authentication message sent by the proxy gateway to the API gateway does not include business data from third-party applications, network latency can be reduced during network transmission. Furthermore, because it does not include business data from third-party applications, the risk of data leakage is also reduced.

[0121] Optionally, based on the above embodiments, the first interface of the proxy gateway may also store the service request message in the first message queue so that other interfaces of the proxy gateway can obtain the service request message.

[0122] Optionally, based on the above embodiments, the proxy gateway may also receive a service authorization message from the API gateway, wherein the service authorization message may indicate whether authentication has passed or failed.

[0123] For example, if authentication fails, the first interface of the proxy gateway receives the business authorization message sent by the API gateway and sends a business response message to the third-party application, wherein the business authorization message and the business response message indicate that authentication failed.

[0124] For example, if authentication is successful, the second interface of the proxy gateway receives the service authorization message sent by the API gateway and stores the authentication result in the second message queue, wherein the service authorization message and the authentication result indicate that authentication is successful; the first interface of the proxy gateway obtains the authentication result from the second message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service called by the service request message.

[0125] For example, if authentication is successful, the second interface of the proxy gateway receives the business authorization message sent by the API gateway, retrieves the business request message from the first message queue, determines the routing address of the target service, and sends the business request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the business request message. The business authorization message indicates that authentication is successful.

[0126] Optionally, based on the above embodiments, the proxy gateway can also send business response messages to third-party applications.

[0127] For example, the first interface of the proxy gateway receives the business response message sent by the edge cloud platform and stores the business response message in a third message queue; the second interface of the proxy gateway retrieves the business response message from the third message queue and sends the business response message to the API gateway; the first interface of the proxy gateway receives the business response message sent by the API gateway and sends the business response message to the third-party application.

[0128] For example, the second interface of the proxy gateway receives the business response message sent by the edge cloud platform and sends the business response message to the API gateway; the first interface of the proxy gateway receives the business response message sent by the API gateway and sends the business response message to the third-party application.

[0129] See Figure 2 , Figure 2 This is a flowchart of a business request authentication method provided in an embodiment of this application, applied to an API gateway, such as... Figure 2 As shown, it includes the following steps:

[0130] Step 201: Receive the service authentication message sent by the proxy gateway, wherein the service authentication message does not include the service data of the third-party application.

[0131] Step 202: Perform authentication based on the business authentication message.

[0132] In this embodiment of the application, the method of authenticating API network elements is not limited.

[0133] In this embodiment, since the business authentication message sent by the proxy gateway to the API gateway does not include business data from third-party applications, network latency can be reduced during network transmission. Furthermore, because it does not include business data from third-party applications, the risk of data leakage is also reduced.

[0134] Optionally, the API gateway may also send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or, send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication passed.

[0135] Optionally, the API gateway may also send a business response message to the first interface of the proxy gateway.

[0136] The following describes in detail the specific implementation process of the embodiments of this application with reference to different examples.

[0137] To enable unified authentication and authorization of services on the edge cloud platform via the API gateway in the cloud center, a proxy gateway is added in this embodiment. Upon receiving a service request message, the proxy gateway extracts the service authentication message (excluding service data) and forwards it to the API gateway for authentication. Once authentication is successful, the proxy gateway forwards the service request message (including service data) to the edge cloud platform.

[0138] See Figure 3 , Figure 3 This is a flowchart of the business request authentication method provided in the embodiments of this application, which may include the following steps:

[0139] Step 301: The third-party application sends a business request message to the proxy gateway interface 1. The business request message contains business data and business authentication information. The business request message must conform to the access specifications of the proxy gateway data.

[0140] In this embodiment, the proxy gateway formulates a proxy gateway data access specification based on the authentication data required by the API gateway to be connected. The specification includes a service identifier that corresponds one-to-one with the parameters required for API gateway authentication. The specification request includes the format of the authentication data, including parameter name, parameter type and parameter position, specifying whether it is placed in the header or body.

[0141] Step 302: After receiving the business request message, the proxy gateway interface 1 extracts the authentication-related parameters from the business authentication-related information in thread 1 according to the proxy gateway data access specification. These parameters are then converted into the parameters required for API gateway authentication (i.e., the first authentication parameters) according to the corresponding relationship. The parameters required for API gateway authentication are then encapsulated into a business authentication message according to the API gateway data access specification. This message contains the service identifier and the unique serial number of the message, but does not contain business data.

[0142] Step 303: Proxy gateway interface 1 (thread 1) forwards the business authentication message to the API gateway. This message does not contain business data.

[0143] Step 304: After receiving the business authentication message, the API gateway verifies the authentication information contained therein in thread 2 and encapsulates the authentication result into a business authorization message, which contains a unique serial number and information on whether the authentication passed.

[0144] Step 305: If authentication is successful, the API gateway (thread 2) retrieves the routing address information corresponding to the service identifier from the API gateway registered service library, i.e., the address of proxy gateway interface 2, and sends the business authorization message to proxy gateway interface 2; if authentication fails, the API gateway logs the message and returns the business authorization message to proxy gateway interface 1 (thread 1) along the original path, and thread 2 ends.

[0145] Step 306: If proxy gateway interface 1 (thread 1) receives a business authorization message returned by the API gateway, and the message indicates that authentication failed, proceed to step 307; if proxy gateway interface 2 receives a business authorization message returned by the API gateway, and the message indicates that authentication passed, store the serial number and authentication result in the message into message queue 1 in thread 3, and proceed to steps 308-313.

[0146] Step 307: Proxy gateway interface 1 (thread 1) encapsulates the authorization result (authentication failed) into business response information and returns it to the third-party application via the original path. Thread 1 ends.

[0147] Step 308: Proxy gateway interface 1 (thread 1) retrieves the authorization result (authentication passed) from message queue 1 based on the serial number, retrieves the routing address (service address on the edge cloud platform) corresponding to the service from the proxy gateway registration service library based on the service identifier, and forwards the original business request message sent by the third-party application to the service deployed on the edge cloud platform.

[0148] Step 309: The service deployed on the edge cloud platform processes the received business request messages, encapsulates the processing results into business response messages, and returns them to the proxy gateway interface 1 (thread 1) via the original path.

[0149] Step 310: Proxy gateway interface 1 (thread 1) stores the message serial number and the received business response message into message queue 2; Proxy gateway interface 2 (thread 3) retrieves the business response message from message queue 2 according to the message serial number and returns the business response message to API gateway (thread 2) via the original path, and thread 3 ends.

[0150] Step 311: After receiving the business response message, the API gateway (thread 2) logs it.

[0151] Step 312: The API gateway (thread 2) returns the received business response message to the proxy gateway interface 1 (thread 1) via the original path, and thread 2 ends.

[0152] Step 313: Proxy gateway interface 1 (thread 1) returns the received business response message to the third-party application via the original path, and thread 1 ends.

[0153] See Figure 4 , Figure 4 This is a flowchart of the business request authentication method provided in the embodiments of this application, which may include the following steps:

[0154] Step 401: The third-party application sends a business request message to the proxy gateway interface 1. The business request message contains business data and business authentication information. The business request message must conform to the access specifications of the proxy gateway data.

[0155] In this embodiment, the proxy gateway formulates a proxy gateway data access specification based on the authentication data required by the API gateway to be connected. The specification includes a service identifier that corresponds one-to-one with the parameters required for API gateway authentication. The specification request includes the format of the authentication data, including parameter name, parameter type and parameter position, specifying whether it is placed in the header or body.

[0156] Step 402: After receiving the business request message, the proxy gateway interface 1 extracts the authentication-related parameters from the business authentication-related information in thread 1 according to the proxy gateway data access specification. These parameters are then converted into the parameters required for API gateway authentication (i.e., the first authentication parameters) according to the corresponding relationship. The parameters required for API gateway authentication are then encapsulated into a business authentication message according to the API gateway data access specification. This message contains the service identifier and the unique serial number of the message, but does not contain business data.

[0157] Step 403: Proxy gateway interface 1 (thread 1) stores the message serial number and business request message into message queue 1, and forwards the business authentication message to the API gateway. This message does not contain business data.

[0158] Step 404: After receiving the business authentication message, the API gateway verifies the authentication information contained therein in thread 2 and encapsulates the authentication result into a business authorization message, which contains a message serial number and information on whether the authentication passed.

[0159] Step 405: If authentication is successful, the API gateway (thread 2) retrieves the routing address information corresponding to the service from the API gateway registered service library based on the service identifier, i.e., the address of proxy gateway interface 2, and sends the business authorization message to proxy gateway interface 2; if authentication fails, the API gateway records the log and returns the business authorization message to proxy gateway interface 1 (thread 1) along the original path, and thread 2 ends.

[0160] Step 406: Determine whether the authentication is successful.

[0161] If proxy gateway interface 1 (thread 1) receives a business authorization message returned by the API gateway, and the message indicates that authentication failed, proceed to step 407; if proxy gateway interface 2 receives a business authorization message returned by the API gateway, proceed to thread 3, and the message indicates that authentication passed, proceed to steps 408-413.

[0162] Step 407: Proxy gateway interface 1 (thread 1) encapsulates the authorization result (authentication failed) into business response information and returns it to the third-party application via the original path. Thread 1 ends.

[0163] Step 408: Proxy gateway interface 2 (thread 3) retrieves the business request message from message queue 1 according to the serial number, retrieves the routing address (service address on the edge cloud platform) corresponding to the service from the proxy gateway registered service library according to the service identifier, and forwards the business request message to the service deployed on the edge cloud platform.

[0164] Step 409: The service deployed on the edge cloud platform processes the received business request messages, encapsulates the processing results into business response messages, and returns them to the proxy gateway interface 2 (thread 3) via the original path.

[0165] Step 410: Proxy gateway interface 2 (thread 3) returns the business response message to the API gateway (thread 2) via the original path, and thread 3 ends.

[0166] Step 411: After receiving the business response message, the API gateway (thread 2) logs it.

[0167] Step 412: The API gateway (thread 2) returns the received business response message to the proxy gateway interface 1 (thread 1) via the original path.

[0168] Step 413: Proxy gateway interface 1 (thread 1) returns the received business response message to the third-party application via the original path, and thread 1 ends.

[0169] As can be seen from the above description, the business authentication message sent by the proxy gateway to the API gateway does not contain business data, which reduces latency during network transmission and avoids business data leakage.

[0170] See Figure 5 , Figure 5 This is a structural diagram of the service request authentication device provided in this application embodiment, applied to a proxy gateway. For example... Figure 5 As shown, the service request authentication device includes:

[0171] The first receiving module 501 is used to receive a business request message sent by a third-party application, wherein the business request message includes business data and business authentication related information; the first generating module 502 is used to generate a business authentication message based on the business authentication related information, wherein the business authentication message does not include the business data; the first sending module 503 is used to send the business authentication message to the API gateway for authentication.

[0172] Optionally, the first receiving module is configured to: receive a business request message sent by the third-party application through the first interface of the proxy gateway;

[0173] The first generation module is used for:

[0174] The first interface of the proxy gateway converts the business authentication-related information into the first authentication parameters required for API gateway authentication.

[0175] The first authentication parameter is encapsulated into the business authentication message according to the API gateway data access specification through the first interface of the proxy gateway.

[0176] Optionally, the device further includes:

[0177] The first storage module is used to store the business request message into the first message queue through the first interface of the proxy gateway.

[0178] Optionally, the device may further include: a second processing module, used for;

[0179] The proxy gateway receives a business authorization message sent by the API gateway through its first interface and sends a business response message to the third-party application, wherein the business authorization message and the business response message indicate that authentication failed.

[0180] or

[0181] The proxy gateway receives a service authorization message sent by the API gateway through its second interface and stores the authentication result in a second message queue, wherein the service authorization message and the authentication result indicate that the authentication is successful; the proxy gateway retrieves the authentication result from the second message queue through its first interface, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service invoked by the service request message;

[0182] or

[0183] The proxy gateway receives the service authorization message sent by the API gateway through its second interface, retrieves the service request message from the first message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the service request message. The service authorization message indicates that the authentication has been passed.

[0184] Optionally, the device may further include: a third processing module, used for:

[0185] The proxy gateway receives the service response message sent by the edge cloud platform through its first interface and stores the service response message in the third message queue.

[0186] The service response message is obtained from the third message queue through the second interface of the proxy gateway, and then sent to the API gateway.

[0187] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0188] Optionally, the device may further include: a fourth processing module, used for:

[0189] The proxy gateway receives the business response message sent by the edge cloud platform through its second interface and sends the business response message to the API gateway.

[0190] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0191] The apparatus provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0192] See Figure 6 , Figure 6 This is a structural diagram of the service request authentication device provided in this application embodiment, applied to an API gateway. Figure 6 As shown, the service request authentication device includes:

[0193] The first receiving module 601 is used to receive a service authentication message sent by the proxy gateway, wherein the service authentication message does not include the service data of the third-party application; the first processing module 602 is used to perform authentication based on the service authentication message.

[0194] Optionally, the device may further include: a first transmitting module, used for:

[0195] Send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or

[0196] Send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication has been successful.

[0197] Optionally, the device may further include: a second transmitting module, used for:

[0198] Send a service response message to the first interface of the proxy gateway.

[0199] The apparatus provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0200] See Figure 7 , Figure 7 This is a structural diagram of the service request authentication device provided in this application embodiment, applied to a proxy gateway. For example... Figure 7 As shown, the service request authentication device includes: a processor 701 and a transceiver 702;

[0201] The transceiver 702 is used to receive business request messages sent by third-party applications, wherein the business request messages include business data and business authentication related information.

[0202] The processor 701 is configured to generate a service authentication message based on the service authentication information, wherein the service authentication message does not include the service data;

[0203] The transceiver 702 is also used to send the service authentication message to the API gateway for authentication.

[0204] Optionally, the transceiver 702 is further configured to:

[0205] The proxy gateway receives business request messages sent by the third-party application through its first interface.

[0206] The processor 701 is also used for:

[0207] The first interface of the proxy gateway converts the business authentication-related information into the first authentication parameters required for API gateway authentication.

[0208] The first authentication parameter is encapsulated into the business authentication message according to the API gateway data access specification through the first interface of the proxy gateway.

[0209] Optionally, the processor 701 is further configured to store the service request message into a first message queue through the first interface of the proxy gateway.

[0210] Optionally, the processor 701 is further configured to:

[0211] The proxy gateway receives a business authorization message sent by the API gateway through its first interface and sends a business response message to the third-party application, wherein the business authorization message and the business response message indicate that authentication failed.

[0212] or

[0213] The proxy gateway receives a service authorization message sent by the API gateway through its second interface and stores the authentication result in a second message queue, wherein the service authorization message and the authentication result indicate that the authentication is successful; the proxy gateway retrieves the authentication result from the second message queue through its first interface, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is the service invoked by the service request message;

[0214] or

[0215] The proxy gateway receives the service authorization message sent by the API gateway through its second interface, retrieves the service request message from the first message queue, determines the routing address of the target service, and sends the service request message to the edge cloud platform according to the routing address. The target service is deployed on the edge cloud platform and is the service called by the service request message. The service authorization message indicates that the authentication has been passed.

[0216] Optionally, the transceiver 702 is further configured to:

[0217] The proxy gateway receives the service response message sent by the edge cloud platform through its first interface and stores the service response message in the third message queue.

[0218] The service response message is obtained from the third message queue through the second interface of the proxy gateway, and then sent to the API gateway.

[0219] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0220] Optionally, the transceiver 702 is further configured to:

[0221] The proxy gateway receives the business response message sent by the edge cloud platform through its second interface and sends the business response message to the API gateway.

[0222] The proxy gateway receives the business response message sent by the API gateway through its first interface and sends the business response message to the third-party application.

[0223] The apparatus provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0224] See Figure 8 , Figure 8This is a structural diagram of the service request authentication device provided in this application embodiment, applied to an API gateway. Figure 8 As shown, the service request authentication device includes: a processor 801 and a transceiver 802;

[0225] The transceiver 802 is used to receive a service authentication message sent by the proxy gateway, wherein the service authentication message does not include the service data of the third-party application.

[0226] The processor 801 is used to perform authentication based on the service authentication message.

[0227] Optionally, the transceiver 802 is further configured to:

[0228] Send a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication failed; or

[0229] Send a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication has been successful.

[0230] Optionally, the transceiver 802 is further configured to:

[0231] Send a service response message to the first interface of the proxy gateway.

[0232] The apparatus provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0233] It should be noted that the division of units in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0234] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0235] This application provides a communication device, including: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps in the service request authentication method described above.

[0236] This application also provides a readable storage medium storing a program. When executed by a processor, this program implements the various processes of the above-described service request authentication method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0237] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0238] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0239] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for authenticating a service request, characterized by, The application is applied to a proxy gateway, and comprises the following steps: receiving a service request message sent by a third-party application, wherein the service request message comprises service data and service authentication related information; generating a service authentication message according to the service authentication related information, wherein the service authentication message does not comprise the service data; sending the service authentication message to an application program interface (API) gateway for authentication; wherein the receiving of the service request message sent by the third-party application comprises the following steps: receiving, by a first interface of the proxy gateway, the service request message sent by the third-party application; the generating of the service authentication message according to the service authentication related information comprises the following steps: converting, by the first interface of the proxy gateway, the service authentication related information into first authentication parameters required by the API gateway authentication; encapsulating, by the first interface of the proxy gateway, the first authentication parameters into the service authentication message according to an API gateway data access specification.

2. The method of claim 1, wherein, The method further comprises the following steps: storing, by the first interface of the proxy gateway, the service request message into a first message queue.

3. The method according to claim 1 or 2, characterized in that, The method further comprises the following steps: receiving, by the first interface of the proxy gateway, a service authorization message sent by the API gateway, and sending a service response message to the third-party application, wherein the service authorization message and the service response message indicate that the authentication is failed; or receiving, by a second interface of the proxy gateway, the service authorization message sent by the API gateway, and storing an authentication result into a second message queue, wherein the service authorization message and the authentication result indicate that the authentication is passed; acquiring, by the first interface of the proxy gateway, the authentication result from the second message queue, determining a routing address of a target service, and sending the service request message to an edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is a service called by the service request message; or receiving, by the second interface of the proxy gateway, the service authorization message sent by the API gateway, acquiring the service request message from a first message queue, determining a routing address of a target service, and sending the service request message to an edge cloud platform according to the routing address, wherein the target service is deployed on the edge cloud platform and is a service called by the service request message, and the service authorization message indicates that the authentication is passed.

4. The method of claim 3, wherein, The method further comprises the following steps: receiving, by the first interface of the proxy gateway, a service response message sent by the edge cloud platform, and storing the service response message into a third message queue; acquiring, by the second interface of the proxy gateway, the service response message from the third message queue, and sending the service response message to the API gateway; receiving, by the first interface of the proxy gateway, a service response message sent by the API gateway, and sending the service response message to the third-party application.

5. The method of claim 3, wherein, The method further comprises the following steps: receiving, by the second interface of the proxy gateway, a service response message sent by the edge cloud platform, and sending the service response message to the API gateway; receiving, by a first interface of the proxy gateway, the service response message sent by the API gateway, and sending the service response message to the third-party application.

6. A service request authentication method characterized by, Applied to an API gateway, comprising: receiving a service authentication message sent by a proxy gateway, wherein the service authentication message does not include service data of a third-party application; authenticating according to the service authentication message; wherein the service authentication message is generated in the following manner: converting, by a first interface of the proxy gateway, service authentication related information in a service request message into first authentication parameters required by the API gateway for authentication; and encapsulating, by the first interface of the proxy gateway, the first authentication parameters into the service authentication message according to API gateway data access specifications; wherein the service request message is a service request message sent by the third-party application and received by the first interface of the proxy gateway, and the service request message includes service data and the service authentication related information.

7. The method of claim 6, wherein, The method further comprises: sending a service authorization message to the first interface of the proxy gateway, wherein the service authorization message indicates that authentication is not passed; or sending a service authorization message to the second interface of the proxy gateway, wherein the service authorization message indicates that authentication is passed.

8. The method of claim 6, wherein, The method further comprises: sending a service response message to the first interface of the proxy gateway.

9. A service request authentication apparatus characterized by comprising: Applied to a proxy gateway, comprising: a first receiving module configured to receive a service request message sent by a third-party application, wherein the service request message includes service data and service authentication related information; a first generating module configured to generate a service authentication message according to the service authentication related information, wherein the service authentication message does not include the service data; a first sending module configured to send the service authentication message to an API gateway for authentication; wherein the first receiving module is further configured to receive the service request message sent by the third-party application through a first interface of the proxy gateway; the first generating module is further configured to: convert the service authentication related information into first authentication parameters required by the API gateway for authentication through the first interface of the proxy gateway; and encapsulate the first authentication parameters into the service authentication message according to API gateway data access specifications through the first interface of the proxy gateway.

10. A service request authentication apparatus characterized by comprising: Applied to an API gateway, comprising: a first receiving module configured to receive a service authentication message sent by a proxy gateway, wherein the service authentication message does not include service data of a third-party application; a first processing module configured to authenticate according to the service authentication message; wherein the service authentication message is generated in the following manner: converting, by a first interface of the proxy gateway, service authentication related information in a service request message into first authentication parameters required by the API gateway for authentication; and encapsulating, by the first interface of the proxy gateway, the first authentication parameters into the service authentication message according to API gateway data access specifications; wherein the service request message is a service request message sent by the third-party application and received by the first interface of the proxy gateway, and the service request message includes service data and the service authentication related information.

11. A service request authentication apparatus characterized by comprising: The application is applied to a proxy gateway, comprising a processor and a transceiver. The transceiver receives a service request message sent by a third-party application, wherein the service request message comprises service data and service authentication related information. The processor generates a service authentication message according to the service authentication related information, wherein the service authentication message does not comprise the service data. The transceiver sends the service authentication message to an API gateway for authentication. The transceiver further receives the service request message sent by the third-party application through a first interface of the proxy gateway. The processor further converts the service authentication related information into first authentication parameters required by the API gateway authentication through the first interface of the proxy gateway. The first authentication parameters are encapsulated into the service authentication message according to API gateway data access specifications through the first interface of the proxy gateway. The application is applied to an API gateway, comprising a processor and a transceiver. The transceiver receives a service authentication message sent by a proxy gateway, wherein the service authentication message does not comprise service data of a third-party application.

12. A service request authentication apparatus characterized by comprising: The processor performs authentication according to the service authentication message. The service authentication message is generated in the following manner: The service authentication related information in a service request message is converted into first authentication parameters required by the API gateway authentication by a first interface of the proxy gateway. The first authentication parameters are encapsulated into the service authentication message according to API gateway data access specifications by the first interface of the proxy gateway. The service request message is a service request message sent by a third-party application and received by the first interface of the proxy gateway, wherein the service request message comprises service data and the service authentication related information. The memory, the processor and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps in the service request authentication according to any one of claims 1 to 8.

13. A communication device comprising: The program is executed by the processor to implement the steps in the service request authentication according to any one of claims 1 to 8.

14. A readable storage medium for storing a program, characterized in that, ​

Images