Service processing method and device based on interface authentication, equipment and storage medium

Abstract

The embodiment of the invention provides a service processing method and device based on interface authentication, equipment and a storage medium, belongs to the technical field of computers, and can relate to the fields of cloud technology, distributed technology, security authentication and the like. The method comprises: in response to a service request for a target application, constructing a first to-be-processed request corresponding to the service request and sending the first to-be-processed request to a gateway of a service server, the first to-be-processed request comprising a request address and a request parameter, the request address being an address of the gateway, and the request parameter being an address of the gateway; the request parameter comprises an interface name and an interface input parameter of a target interface requested to be called; receiving authentication notification information which is returned by the gateway and is used for notifying a target authentication mode of the target interface, and obtaining to-be-authenticated information corresponding to the target authentication mode based on the information; and sending a second to-be-processed request to the gateway to obtain a first request response returned by the gateway, wherein the second to-be-processed request comprises the to-be-authenticated information and the request parameter. Based on the method provided by the embodiment of the invention, the actual application requirement can be better met.

Description

Technical Field

[0001] This application belongs to the field of computer technology and may involve cloud technology, distributed technology, microservices, security authentication and other fields. Specifically, this application relates to a business processing method, system, device, electronic device and storage medium based on interface authentication. Background Art

[0002] With the rapid development of technology and the improvement of people's living standards, a variety of applications have emerged one after another and have become an indispensable part of people's daily lives. As a result, application security has also received increasing attention. In some applications (such as web applications), for systems with high security requirements, secondary authentication is required for calls to certain interfaces.

[0003] While traditional secondary authentication solutions can meet security requirements, they are complex to implement, highly intrusive to businesses, and suffer from poor maintainability. This is particularly true when a system offers a wide variety of businesses / services. For example, for front-end businesses, if a system has more than 100 interface calls, maintaining over 100 similar interface authentication implementation logics is necessary, making system maintenance difficult. Therefore, existing authentication implementation solutions in business systems still need improvement. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a service processing method, apparatus, device, and storage medium based on interface authentication that can better meet actual application needs. To achieve this purpose, the technical solutions provided by the embodiments of the present application are as follows:

[0005] On the one hand, an embodiment of the present application provides a service processing method based on interface authentication, the method comprising:

[0006] In response to a service request for a target application, construct a first pending request corresponding to the service request, wherein the first pending request includes a request address and request parameters, wherein the request address is the address of the gateway of the service server of the target application, and the request parameters include the interface name and interface input parameters of the target interface called by the service request, and the service request is a service request for any one of multiple services supported by the target application;

[0007] Sending the first pending request to the gateway, and receiving authentication notification information returned by the gateway, wherein the authentication notification information is sent by the gateway when it determines that the target interface is an interface requiring authentication based on the interface name in the request parameter, and the authentication notification information is used to notify the target interface of a target authentication method;

[0008] Based on the authentication notification information, obtaining the to-be-authenticated information corresponding to the target authentication method;

[0009] By sending a second pending request to the gateway, obtaining a first request response to the business request returned by the gateway, wherein the second pending request includes the request parameters and the information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated is verified.

[0010] On the other hand, an embodiment of the present application provides a service processing method based on interface authentication, which is applied to a gateway of a service server of a target application, and includes:

[0011] receiving a first pending request, wherein the first pending request is generated by a request sender in response to a service request for a target application, the first pending request includes a request address and request parameters, the request address is the address of the gateway, the request parameters include an interface name and interface input parameters of a target interface called by the service request, and the service request is a service request for any one of multiple services supported by the target application;

[0012] If it is determined according to the interface name of the target interface that the target interface is an interface requiring authentication, determining a target authentication mode for the target interface, and sending authentication notification information to the request sender based on the target authentication mode of the target interface, the authentication notification information being used to notify the target authentication mode of the target interface;

[0013] receiving a second pending request, where the second pending request includes the request parameters and information to be authenticated, where the information to be authenticated is information to be authenticated corresponding to the target authentication method obtained by the request sender based on the authentication notification information;

[0014] The information to be authenticated is verified. If the information to be authenticated passes the verification, a first request response to the service request is obtained from the service server based on the request parameters, and the first request response is sent to the request sender.

[0015] On the other hand, an embodiment of the present application provides a service processing device based on interface authentication, the device comprising:

[0016] a request generation module, configured to, in response to a service request for a target application, construct a first pending request corresponding to the service request, wherein the first pending request includes a request address and request parameters, wherein the request address is the address of the gateway of the service server of the target application, and the request parameters include the interface name and interface input parameters of the target interface called by the service request, wherein the service request is a service request for any one of multiple services supported by the target application;

[0017] a request processing module, configured to send the first request to be processed to the gateway, and receive authentication notification information returned by the gateway, wherein the authentication notification information is sent by the gateway when it determines that the target interface is an interface requiring authentication based on the interface name in the request parameter, and the authentication notification information is used to notify the target interface of a target authentication method;

[0018] The request processing module is also used to obtain the information to be authenticated corresponding to the target authentication method based on the authentication notification information, and obtain the first request response of the business request returned by the gateway by sending a second request to be processed to the gateway, wherein the second request to be processed includes the request parameters and the information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated has been verified.

[0019] Optionally, the authentication notification information is sent by the gateway based on the following method:

[0020] Reading the interface name of the target interface from the request parameters of the received first request to be processed;

[0021] querying, from a target database, the interface status of the target interface according to the interface name of the target interface, wherein the target database stores interface information of each interface corresponding to the multiple services, the interface information of an interface including an interface name and an interface status, the interface status including first information, the first information identifying whether the interface requires authentication, and for an interface requiring authentication, the interface status also including second information, the second information identifying an authentication method for the interface;

[0022] If it is determined based on the interface status of the target interface that the target interface is an interface requiring authentication, authentication notification information is sent based on the interface status of the target interface.

[0023] Optionally, for any interface, the interface status of the interface is updateable. The interface status of the interface is updated in the following ways:

[0024] In response to an interface configuration modification operation triggered by a first management client corresponding to the interface, displaying an authentication mode modification interface corresponding to the interface on the first management client, the authentication mode modification interface displaying a plurality of options, the plurality of options including at least one of an authentication off option or an authentication on option, and options corresponding to a plurality of candidate authentication modes;

[0025] In response to a selection operation on any one of the multiple options, the interface state of the interface is updated based on the option corresponding to the selection operation.

[0026] Optionally, in response to the interface configuration modification operation triggered by the first management client corresponding to the interface, displaying the authentication mode modification interface corresponding to the interface on the first management client includes:

[0027] In response to an interface configuration viewing operation triggered by the first management client, displaying interface configuration information of each interface corresponding to the first management client on the first management client, the interface configuration information including a configuration modification control of the interface;

[0028] In response to a control triggering operation on a configuration modification control corresponding to any interface, an authentication mode modification interface corresponding to the interface is displayed, wherein the interface configuration modification operation includes the control triggering operation.

[0029] Optionally, for any interface, updating the interface status of the interface based on the option corresponding to the selection operation includes:

[0030] Obtaining historical update information of the interface, where the historical update information includes a priority of a second management client, where the second management client is the management client that last triggered an update of the interface status of the interface before the current time;

[0031] Obtaining the priority of the first management client;

[0032] If the priority of the first management client is not lower than the priority of the second management client, updating the interface state of the interface based on the option corresponding to the selection operation;

[0033] The interface status update methods include:

[0034] If the priority of the first management client is lower than the priority of the second management client, a prompt message is displayed on the first management client, where the prompt message is used to prompt that the first management client does not have the authority to modify the authentication method of the interface.

[0035] Optionally, the target database includes at least two sub-databases, each of the sub-databases is associated with a business priority, each of the multiple businesses has its own business priority, and each sub-database is used to store interface information of each interface corresponding to each business with the business priority associated with the sub-database; wherein the first pending request also includes the business priority corresponding to the request, and querying the interface status of the target interface from the target database based on the interface name of the target interface includes:

[0036] determining, according to the service priority corresponding to the first pending request, a target sub-repository associated with the service priority from the multiple sub-repositories;

[0037] According to the interface name of the target interface, the interface status of the target interface is queried from the target sub-library.

[0038] Optionally, the target database includes multiple first databases, each first database is associated with an application identifier, and at least two first databases have at least one identical interface name; wherein the first pending request also includes the application identifier of the target application, and querying the interface status of the target interface from the target database based on the interface name of the target interface includes:

[0039] determining, according to the application identifier of the target application, a first database corresponding to the target application from a plurality of first databases;

[0040] According to the interface name of the target interface, the interface status of the target interface is queried from a first database corresponding to the target application.

[0041] Optionally, the request processing module performs the following operations when obtaining authentication notification information:

[0042] When it is determined based on the authentication notification information that the target interface is an interface requiring authentication, loading an interface authentication SDK (Software Development Kit), wherein the interface authentication SDK includes authentication components corresponding to respective authentication methods, the target authentication method being one of the multiple authentication methods, and the authentication component corresponding to an authentication method being used to obtain information to be authenticated corresponding to the authentication method;

[0043] Based on the authentication notification information, the authentication function component corresponding to the target authentication method in the interface authentication SDK is started, an authentication information acquisition interface corresponding to the target authentication method is displayed, and the information to be authenticated corresponding to the target authentication method is acquired through the authentication information acquisition interface.

[0044] Optionally, the request processing module is further configured to provide the request parameters to the interface authentication SDK; when the request processing module obtains the first request response of the service request returned by the gateway by sending the second request to be processed to the gateway, the request processing module is configured to:

[0045] Sending a second request to be processed to the gateway through the interface authentication SDK; receiving a first request response to the business request returned by the interface authentication SDK, where the first request response is received by the authentication SDK from the gateway.

[0046] Optionally, the authentication component in the interface authentication SDK is updateable, wherein the update method of the interface authentication SDK includes:

[0047] In response to an authentication component update operation, the interface authentication SDK is updated accordingly, wherein the update operation is an authentication component adding operation, an authentication component deleting operation, or an authentication component modifying operation.

[0048] Optionally, the device is a business request processing SDK deployed in the target application.

[0049] On the other hand, an embodiment of the present application provides a service processing device based on interface authentication, which is deployed on a gateway of a service server of a target application, and includes:

[0050] a request receiving module, configured to receive a first pending request, wherein the first pending request is generated by a request sender in response to a service request for a target application, the first pending request includes a request address and request parameters, the request address is the address of the gateway, the request parameters include the interface name and interface input parameters of the target interface called by the service request, and the service request is a service request for any one of multiple services supported by the target application;

[0051] a request processing module, configured to determine, based on the interface name of the target interface, that the target interface is an interface requiring authentication, determine a target authentication mode for the target interface, and send authentication notification information to the request sender based on the target authentication mode of the target interface, wherein the authentication notification information is used to notify the target authentication mode of the target interface;

[0052] The request receiving module is further configured to receive a second request to be processed, the second request to be processed including the request parameters and information to be authenticated, the information to be authenticated being information to be authenticated corresponding to the target authentication method obtained by the request sender based on the authentication notification information;

[0053] The request processing module is further configured to verify the information to be authenticated, and if the information to be authenticated passes the verification, obtain a first request response to the service request from the service server based on the request parameters;

[0054] A request response sending module is used to send the first request response to the request sender.

[0055] On the other hand, an embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein a computer program is stored in the memory, and the processor executes the computer program to implement the method provided in any optional embodiment of the present application.

[0056] On the other hand, an embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method provided in any optional embodiment of the present application.

[0057] On the other hand, an embodiment of the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method provided in any optional embodiment of the present application.

[0058] The beneficial effects of the technical solution provided by the embodiments of the present application are as follows:

[0059] In the solution provided by the embodiment of the present application, the business requests for each business of the target application will be uniformly packaged and processed as the first pending request and then sent to the gateway of the business server. The request will be intercepted and processed by the gateway. Only for requests that do not require authentication of the interface or requests that have passed verification, the gateway will provide the request parameters to the business server for business processing. With the solution provided by the present application, the business requests of all businesses of the target application will be uniformly intercepted and processed, and the authentication implementation of the interface is also completed through the interaction between the node that processes the business request and the gateway, so as to achieve zero intrusion of the authentication implementation logic of the interface on the business. In addition, by adding a gateway, all requests triggered by the business end can first reach the gateway layer instead of directly reaching the business server. Only when the authentication of the interface to be called is not enabled or the authentication is passed will the gateway send the request to the business server for processing. This can effectively reduce the load on the business server and avoid the resource occupation of the business server by requests that fail the authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments of the present application.

[0061] Figure 1A schematic diagram of the structure of a business system applicable to the method provided in the embodiments of the present application;

[0062] Figure 2 A schematic diagram of the structure of another business system to which the method provided in the embodiments of the present application is applicable;

[0063] Figure 3 A flowchart of a business processing method provided in one embodiment of the present application;

[0064] Figure 4 A schematic diagram of interface configuration information provided in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of an interface for modifying an interface authentication method provided in an embodiment of the present application;

[0066] Figure 6 A flowchart of a business processing method provided in another embodiment of the present application;

[0067] Figure 7 A schematic diagram of the architecture of a business system to which the method provided in the embodiments of the present application is applicable;

[0068] Figure 8 A schematic diagram illustrating the implementation principles of publishing business components and modifying interface configurations in a private cloud scenario provided by an embodiment of the present application;

[0069] Figure 9 A flowchart of a business processing method provided in an embodiment of the present application;

[0070] Figure 10 A schematic diagram of an interface for obtaining information to be authenticated provided in an embodiment of the present application;

[0071] Figure 11 A schematic diagram of a user interface after verification of authentication information fails, provided in an embodiment of the present application;

[0072] Figure 12 A schematic diagram of another interface for obtaining information to be authenticated provided in an embodiment of the present application;

[0073] Figure 13 A schematic diagram of the structure of a service authentication system provided in an embodiment of the present application;

[0074] Figure 14 A schematic diagram of the structure of a service processing device provided in two embodiments of the present application;

[0075] Figure 15 This is a schematic diagram of the structure of another service processing device provided in an embodiment of the present application;

[0076] Figure 16 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The following describes the embodiments of the present application in conjunction with the accompanying drawings. It should be understood that the embodiments described below in conjunction with the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0078] Those skilled in the art will understand that, unless otherwise stated, the singular forms "a", "an", "said", and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application mean that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements, and / or components, but do not exclude implementation as other features, information, data, steps, operations, elements, components, and / or combinations thereof supported by the present technical field. It should be understood that when we say that an element is "connected" or "coupled" to another element, the element can be directly connected or coupled to the other element, or it can refer to the element and the other element establishing a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used here can include wireless connection or wireless coupling. The term "and / or" used here indicates at least one of the items defined by the term, for example, "A and / or B" can be implemented as "A", or as "B", or as "A and B". When describing multiple (two or more) items, if the relationship between the multiple items is not clearly defined, the multiple items may refer to one, multiple or all of the multiple items. For example, the description of "parameter A includes A1, A2, A3" can be implemented as parameter A including A1 or A2 or A3, and can also be implemented as parameter A including at least two of the three items A1, A2, and A3.

[0079] As application requirements increase, the security of business systems becomes increasingly important. For many applications, many operations require users to be logged in before initiating them. Logging in to an application generally requires authentication / verification. For example, the user's entered login account and password are verified. If the entered account and password match the registered account and password, the login is successful. Login verification is a very common authentication method. However, for some systems with higher security requirements, in addition to requiring users to remain logged in, further authentication is required. For example, interface-level secondary authentication requires some interfaces in the system to require secondary authentication. If a user's operation request requires calling such an interface, the user is required to enter the corresponding authentication information for security authentication. Only after successful authentication can the system process the user's request.

[0080] In existing technologies, the business implementation logic for each service supported by an application is typically independent. Business personnel are required to write and maintain the implementation logic for each service (including the authentication implementation logic for the interfaces involved in the service processing). The business code for each service and the code related to interface authentication implementation involved in the service processing are coupled together, making interface authentication implementation highly invasive. Taking mobile phone SMS authentication as an example, in existing systems, the front-end typically determines whether a secondary authentication is required based on the interface's return code after the interface call. If secondary authentication is required, a secondary authentication modal pops up, prompting the user to send a text message and enter a verification code. On the back-end, when a request arrives, it needs to retrieve the information from a configuration file to determine whether the current interface requires secondary authentication. If secondary authentication is required, the corresponding return code is returned to the front-end. If a system has more than 100 interface calls, it will need to maintain over 100 similar pop-up logic based on the interface return code, resulting in poor maintainability.

[0081] Furthermore, in existing solutions, whether or not secondary authentication is required for each interface is hard-coded in the backend and cannot be modified dynamically. Furthermore, in actual applications, different customers may have different configurations for interfaces requiring secondary authentication (e.g., which interfaces enable secondary authentication and which interfaces disable secondary authentication, etc.). In existing technologies, the configuration information for all interfaces is stored in the application's configuration file. Each time a customer needs to enable or disable secondary authentication for a particular interface, they must modify the file configuration and restart the service, which can easily cause business interruptions.

[0082] In order to solve at least one of the above-mentioned problems existing in the prior art, an embodiment of the present application provides a business processing method based on interface authentication. By adopting this method, while ensuring the security of interface calls and meeting the security requirements of the business system, the intrusion of interface authentication on the business can be reduced or even avoided, and the maintainability of the system can be improved, thereby better meeting actual application needs.

[0083] Optionally, the data processing involved in the method provided in the embodiment of the present application can be implemented based on cloud technology. For example, the solution provided in the embodiment of the present application can be applied to a business system in a private cloud scenario, and the target application described in the embodiment of the present application can be an application implemented based on a private cloud (including but not limited to a web application). For another example, the data storage involved in the embodiment of the present application can adopt a cloud storage method, such as the target database can be a cloud storage server. For another example, the data processing involved in the embodiment of the present application (such as verifying whether the information to be authenticated in the interface is correct) can be implemented using cloud computing.

[0084] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network that provides these resources is called the "cloud." To users, these resources appear infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for on a per-use basis.

[0085] Cloud storage is a new concept that has been extended and developed from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide external data storage and business access functions.

[0086] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained through the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information requires the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0087] The business processing method provided in the embodiment of the present application can be executed by a user terminal or a server. The method can be described from different angles, and the steps involving the interaction between different ends can be described separately from different sides. Optionally, the business processing method provided in the embodiment of the present application can be described with a certain functional module / component (such as the request SDK described later) in the application running in the user terminal as the execution subject. The method may involve the interaction between different functional modules / components in the user terminal, and may also involve the interaction between the user terminal and other devices, such as the interaction between the user terminal and the gateway of the server. The method can also be described with the gateway as the execution subject, and of course it can also be described with other functional modules / components or devices involved in the business processing flow as the execution subject. The following will explain the scheme of the embodiment of the present application from a number of different angles.

[0088] In the embodiments of the present application, the server (such as the business server of the target application) can also be a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, smart speaker, smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this. The server can receive the business processing request triggered by the user terminal, process the business processing request, and can also feed back the business processing results to the user terminal.

[0089] The user terminal in the embodiments of the present application may be a smartphone, tablet computer, laptop computer, desktop computer, intelligent voice interaction device (such as a smart speaker), wearable electronic device (such as a smart watch), vehicle-mounted terminal, smart home appliance (such as a smart TV), AR / VR device, etc., but is not limited thereto. The user terminal and the server may be connected directly or indirectly via wired or wireless communication, which is not limited in the embodiments of the present application.

[0090] The method provided in the embodiments of the present application is theoretically applicable to any application that provides business / services. The application can be any type of application running on a mobile terminal or a fixed terminal, including but not limited to an app (Application), a web application, a mini-program, etc. The application can provide a variety of services to its users.

[0091] To better understand and illustrate the solution provided by the embodiments of the present disclosure, the following first describes the deployment of the solution provided by the embodiments of the present disclosure in conjunction with a specific application scenario, as well as the optional implementation methods in that scenario. In the following scenario embodiment, the target application is described using a web application as an example. The web application provides a variety of services, i.e., a variety of services. For example, the web application can be a shopping application, and the services it provides can include but are not limited to product information viewing services (such as viewing detailed information about a certain item of clothing), order services (orders can be generated based on user operations), and payment services.

[0092] Figure 1 A schematic diagram of the structure of a business system to which the business processing method provided in the embodiment of the present disclosure is applicable is shown in FIG. Figure 1 As shown, the business system may include a front-end device 10 and a back-end device 20 of the system, wherein the front-end device 10 is a user terminal running a web application, such as Figure 1The terminal 11 and the terminal 12 shown in the figure, the electronic equipment of the back end 20 may include a business server 22 and a gateway 21 of the business server 22. The business server 22 is a server that actually processes the user's business request, and the user terminal can communicate with the business server 22 through the gateway 21. Specifically, the user of the web application can initiate a business request (such as a payment request) through the user interface of the application (such as a web page) displayed on its user terminal. After receiving the business request, the user terminal can send a corresponding processing request to the gateway 21 based on the business request. If the request meets the conditions (such as verification passed), the gateway 21 will send the request to the business server 22, which will process it and feedback the processing result of the business server 22, that is, the response to the request, to the user terminal.

[0093] In the embodiments of the present application, the implementation form of the gateway is not limited. The gateway can be a physical device, such as a server, or a virtual gateway. For example, the gateway can be a virtual gateway implemented by a software program. For a physical gateway, the gateway and the service server can be independent electronic devices. For a virtual gateway, the gateway and the service server can be the same electronic device, which can be called the back-end server / application server of a web application. In this case, the gateway can be a software running on the back-end server, such as proxy server software with gateway functions.

[0094] like Figure 1 As shown, the business system may further include a management terminal 30, wherein the management terminal 30 may run management software for a web application. The terminal may be a terminal device used by the provider of the web application to manage the web application. A manager with corresponding management authority may modify some configurations of the web application through the client of the management software (management client). In an embodiment of the present application, a person with interface management authority may modify the authentication method of an interface that will be called during the use of the web application through the management client. The modification may include, but is not limited to, changing the authentication method of the interface from authentication method A to authentication method B, changing authentication method A to not requiring authentication, or changing not requiring authentication to requiring authentication and authentication method C.

[0095] In the solution provided by the embodiment of the present application, a service request processing SDK (request SDK for short) and an interface authentication SDK can be deployed in the user terminal. Among them, the request SDK is used to intercept all service requests initiated on the user terminal and perform unified processing before sending them to the gateway. In other words, the service requests of all front-end services are taken over by the request SDK. In this way, all service requests are sent from the request SDK, and the request address and request parameters are also uniformly encapsulated by the request SDK, realizing the separation of the encapsulation processing of service requests from other front-end service logic, and there is no need to re-write the corresponding service request processing logic for each service, which can effectively reduce the workload of service personnel and improve the maintainability of the service.

[0096] It's understandable that an SDK, or software development kit, typically includes various components and libraries that help developers more easily implement specific functions. An SDK can be thought of as a collection of files or a program package containing pre-built software functions that provide services for applications. By integrating or embedding the SDK into an application, the application can invoke the SDK to implement the corresponding functions during runtime. For example, an advertising SDK can enable advertising functionality within an application.

[0097] In an embodiment of the present application, the above-mentioned request SDK and interface authentication SDK can both be SDKs integrated / embedded in the front end of the target application, where the request SDK can be understood as a virtual gateway of the client of the target application, which can realize unified encapsulation and processing of all business requests initiated by the user terminal. The interface authentication SDK is an SDK that can realize the authentication process of the target application. By calling this SDK, the interface authentication process of the target application can be realized.

[0098] Figure 1 The database 23 in the target database is an optional implementation scheme in the target database described later. The database 23 can be a server, such as a cloud storage server. The database always stores the interface status of all interfaces to be called by all services provided by the target application. After the request SDK encapsulates and processes the intercepted service request, it will send the processed request to the gateway. When the gateway 21 receives the processing request sent by the request SDK, it can query the database 23 for the status of the interface to be called, determine whether the interface needs to be authenticated, and which authentication method the interface adopts, and then return authentication notification information to the request SDK based on the query result.

[0099] The interface authentication SDK is used to implement the interface authentication logic of the front-end. After receiving the authentication notification information returned by the gateway to notify the interface authentication method, the request SDK will load the interface authentication SDK. Through the authentication component corresponding to the interface authentication method in the interface authentication SDK, a pop-up window for obtaining the information to be authenticated will be displayed on the user interface to obtain the information to be authenticated from the user and provide it to the gateway for verification. If the verification is successful, the gateway will send the request parameters to the business server, obtain the processing result of the business request, and provide it to the request end of the business request through the request SDK. Since the authentication implementation of the interfaces corresponding to all businesses is handled by the request authentication SDK in the same way, it is not invasive to the front-end business. In the front-end business implementation, there is no need to maintain similar authentication implementation logic for each interface call, which further improves the maintainability of the business system.

[0100] Figure 2 The schematic diagram of the structure of another business system to which the business processing method provided by this application is applicable is shown. Optionally, the business system can be a distributed structure, and the target application can be a microservice application, which can provide a variety of business services to the users of the application, such as login service, authentication service, payment service, etc. Figure 2 As shown, the business system also includes user terminals (terminal 41, terminal 42), gateway 51 and business servers. In this distributed business scenario, there can be multiple business servers, such as Figure 2 The business servers 61, 62 and 63 in the microservice application are taken as an example. Each business server can provide one or more microservices. Optionally, in this business scenario, the gateway 51 can be a physical device, through which various processing requests triggered by the user terminal can be sent to the business server that provides the corresponding business service. The gateway 51 also acts as a proxy server at this time, and can be used as the main calling server of the microservice application, while the business server is the called server of the microservice application. The gateway routes the request that has passed the interface authentication or does not require authentication to the corresponding business server, which is processed by the business server, and the processing result is then provided to the request SDK via the gateway.

[0101] Similarly, database 71 and Figure 1 The database 23 in the example has the same function, which is a database for storing the interface status of each interface corresponding to all services. The gateway determines whether the interface called by the current request is an interface that requires authentication based on the information stored in the database. If it is an interface that requires authentication, the target authentication method of the interface can also be learned. If the interface requires authentication, the gateway 51 returns authentication notification information indicating the interface authentication method to the requesting SDK, and the requesting SDK obtains the information to be authenticated by loading the authentication SDK.

[0102] It is understood that the solution provided in this application can be applied to but not limited to the above system architecture. Figure 1 and Figure 2 The system architecture shown in is only two optional examples. In addition, the interface-level authentication provided in the embodiments of the present application may include but is not limited to secondary authentication, or it may be the first authentication or more authentications. For example, when a user logs in to an application, the login interface will be called. The solution provided in the embodiments of the present application is also applicable to similar scenarios such as the first login and re-login. For the application login scenario, the business request is the application login request. To call the login interface, you need to pass the authentication before you can log in. For the sake of convenience, the authentication described in the embodiments provided below will be explained using secondary authentication as an example.

[0103] The following describes several exemplary embodiments to illustrate the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application. It should be noted that the following embodiments can refer to, learn from, or combine with each other, provided that there is no conflict between them. For the same terms, similar features, and similar implementation steps in different embodiments, the description will not be repeated.

[0104] Figure 3 A flow chart of a business processing method based on interface authentication provided in an embodiment of the present application is shown. The method can be executed by a user terminal. Optionally, the method can be applied to a target application running in a user terminal and can be executed by a request processing node on the user terminal side. The specific implementation method of the request processing node is not limited in the embodiment of the present application. It can be a physical device or a functional module or component implemented by software. The request processing node is used to uniformly encapsulate and process all business requests initiated by the user in the user interface of the target application, and send the processed requests to the request recipient. In an embodiment of the present application, the request receiving side is the gateway of the business server. Optionally, the request processing node can be the business request processing SDK of the target application. In the following description, the business request processing SDK can be referred to as the request SDK. The execution subject will be explained using the request SDK as an example.

[0105] like Figure 3 As shown, the business processing method provided in the embodiment of the present application may include the following steps S310 to S340.

[0106] Step S310: In response to the business request for the target application, construct a first pending request corresponding to the business request. The first pending request includes a request address and request parameters. The request address is the address of the gateway of the business server of the target application. The request parameters include the interface name and interface input parameters of the target interface called by the business request.

[0107] Among them, the target application is an application running on the user terminal, and the above-mentioned business request is a business request for any of the multiple services supported by the target application. The target application can be any application running in the user terminal that provides multiple services to the user, which may include but is not limited to private cloud-based applications, distributed architecture-based applications, etc. The multiple services provided by the target application can also be interpreted as multiple services provided by the application or multiple functions provided by the application. The embodiment of this application does not limit the granularity of the division of services in the application, and it can be divided according to actual application requirements and applications. For example, a service can be the smallest granularity / unit service in the application, and a service can also include multiple sub-services.

[0108] For example, an online shopping application defines multiple services to meet various business needs, such as those related to products, customers, orders, and payments. When using this application, users can view product-related information through the user interface related to product services, view their own information through the user interface related to customer services, and place orders through the user interface related to order services.

[0109] In the embodiments of the present application, the aforementioned service request refers to a service operation triggered by a user through the user interface of the target application. Taking a web application as an example, a user can trigger a service request by clicking an operable control on a web page. For example, a user can click a data editing control (such as a control named "Edit Data / Edit Personal Information") on the user interface of an application to which they have logged in to edit their relevant information (such as registration information). In this example, the user's click on the control triggers a service request to modify the relevant information. The service side (service initiator) that initiates the service request is the client of the data editing service of the web application.

[0110] In an embodiment of the present application, for a service request of a target application, that is, an interface call request for a target service of a target application (which may be any of a variety of services supported by the target application), different application program interfaces correspond to different services, and corresponding service functions are implemented by calling the interface.

[0111] After receiving a business request for any business through the user interface of the target application, the SDK is requested to encapsulate the business request according to the requested business and generate a first pending request with a unified format, that is, a business processing request that needs to be sent to the network side (server side). Among them, the first pending request includes the request address and the interface name and interface input parameters of the target interface to be called by the request. The interface input parameters refer to the parameters required when the business function module (program) corresponding to the interface is executed. For example, the target application has an interface with a text message sending function. By calling this interface, the function of sending text messages can be realized. The input parameters of this interface usually include a mobile phone number and text message content. The SDK is requested to know the interface name and interface input parameters of the target interface that needs to be called according to the business information corresponding to the business request triggered by the business side (such as a business identifier or other information that can determine the interface that needs to be called by the business). The interface name of an interface is the unique identifier of the interface. The specific form of the interface name is not limited in this embodiment of the application. It can be a digital number, text information or other types of identification information.

[0112] The request address carried in the first pending request is the address of the request receiving end. In the embodiment of the present application, the request address is the gateway address of the business server, rather than the address of the business server. By adding a gateway, all business requests triggered by the business end can first reach the gateway layer instead of directly reaching the back-end business, i.e., the business server. Only when the interface to be called does not have authentication enabled or authentication is passed will the gateway send the request to the business server for processing.

[0113] Step S320: Send a first request to be processed to the gateway, and receive authentication notification information returned by the gateway, where the authentication notification information is used to notify the target authentication method of the target interface.

[0114] In the embodiment of the present application, the authentication method of an interface can be any one of but not limited to mobile phone text message verification, digital certificate, MFA (Multi-Factor Authentication) verification, etc.

[0115] The authentication notification information may notify the user that the target interface invoked by the first pending request requires secondary authentication and the target authentication method used by the interface. An interface requiring authentication means that authentication is required before it can be called, and the corresponding request will be sent to the service server for processing.

[0116] The embodiments of the present application do not limit the specific form of the content contained in the authentication notification information. Optionally, the authentication notification information may include information in a specific format. For example, the authentication notification information may include a return code and authentication type information corresponding to the return code. As an example, the authentication notification information may be expressed as: {code:1001,data:{type:"mfa"}}, where code is the return code, data is the authentication type information, code 1001 indicates that the interface has enabled secondary authentication, and type mfa indicates that the secondary authentication method is MFA.

[0117] After receiving the business processing request sent by the requesting SDK, the gateway can determine whether the target interface is an interface that requires authentication based on the interface name carried in the request. For interfaces that require authentication, the network can further determine the target authentication method of the target interface. If the gateway determines that the target interface is an interface that requires authentication, it can return authentication notification information to the requesting SDK to inform the requesting SDK that the target interface to be called by the request it sent is an interface that requires authentication and what the authentication method of the interface is. Based on this information, the requesting SDK can obtain the corresponding authentication information for the target interface.

[0118] As an alternative, the interface information for all interfaces involved in all services supported by the target application can be stored in the target database. For any interface, the interface information can include the interface name and interface status. The interface status includes first information, which indicates whether the interface requires authentication. For interfaces that require authentication, the interface status also includes second information, which indicates the authentication method for the interface. Of course, for interfaces that require authentication, the first and second information corresponding to the interface can be implemented as a single piece of information or as two separate pieces of information. For example, if interface A is an interface that does not have secondary authentication enabled, the interface status of the interface can be represented by "0." Interface B is an interface that requires authentication, and the authentication method for interface B is MFA. "MFA" can be used as the interface status of the interface. "MFA" indicates both that interface B requires authentication and that the authentication method for the interface is MFA. Alternatively, for interface B, the first information of its interface status can be represented by "1," and the second information can be "MFA." "1" indicates that interface B requires authentication, and "MFA" indicates that the authentication method for the interface is MFA.

[0119] Among them, the above-mentioned target database can be a storage device different from the gateway and business server, such as an independent cloud storage server or blockchain. The target database can also be a designated storage space in the gateway (when the gateway is implemented using a hardware device) or the business server. The target database can have its own storage address.

[0120] Optionally, corresponding to the above-mentioned storage method of the interface information, the above-mentioned authentication notification information may be sent by the gateway based on the following method:

[0121] Read the interface name of the target interface from the request parameters of the received first request to be processed;

[0122] According to the interface name of the target interface, query the interface status of the target interface from the target database;

[0123] If it is determined based on the interface status of the target interface that the target interface is an interface requiring authentication, authentication notification information is sent based on the interface status of the target interface.

[0124] In real-world applications, an application typically involves multiple, sometimes even hundreds, of interface calls. Depending on the application's needs, some interfaces may require secondary authentication, while others may not. When the gateway receives a business processing request for any service, it can query the target database for the interface status corresponding to the interface name carried in the request parameter. Based on the interface status, it can determine whether the interface requires authentication and the authentication method. For interfaces that require authentication, the gateway returns authentication notification information to the request sender (the requesting SDK).

[0125] As an optional solution, the target database includes at least two sub-databases, each sub-database is associated with a business priority, each of the multiple businesses has its own business priority, and each sub-database is used to store interface information of each interface corresponding to each business with the business priority associated with the sub-database; wherein the first pending request also includes the business priority corresponding to the request, and querying the interface status of the target interface from the target database based on the interface name of the target interface may include:

[0126] According to the business priority corresponding to the first pending request, determining a target sub-database associated with the business priority from the multiple sub-databases;

[0127] According to the interface name of the target interface, the interface status of the target interface is queried from the target sub-library.

[0128] Adopting this optional solution can reduce the amount of data for all queries and speed up the efficiency of determining the interface status of the target interface. The specific division method of the service priority of various services of the target application can be configured according to actual application requirements.

[0129] As another optional solution, the target database includes multiple first databases, each first database is associated with an application identifier, and at least two of the first databases have at least one identical interface name. The first pending request also includes the application identifier of the target application. Querying the interface status of the target interface from the target database based on the interface name of the target interface may include:

[0130] determining, according to the application identifier of the target application, a first database corresponding to the target application from a plurality of first databases;

[0131] According to the interface name of the target interface, the interface status of the target interface is queried from a first database corresponding to the target application.

[0132] In actual applications, a business server (such as a server cluster) can be a server that supports multiple applications at the same time, or a server that includes multiple applications. The interfaces called by the services of some different applications may also be the same. In this case, different applications can share these same interfaces, which can improve the reuse rate of the interface and reduce the amount of code on the business server side. However, for the same interface, different applications may have the same or different authentication requirements for the interface. For example, there are 50 interfaces to be called by the services in application A, and 30 interfaces to be called by the services in application B. There are 10 common interfaces corresponding to the two applications, and interface A is one of these 10. However, interface A does not require authentication when called in application A, but requires authentication when called in application B. To address this problem, in the above-mentioned optional solution of the present application, different first databases can be configured for different applications. A first database includes the interface status of each interface corresponding to an application. When the gateway receives a business processing request sent by the request SDK, it can query the interface status from the corresponding first database according to the application identifier carried in the request. With this solution, interfaces can be reused and the security requirements of different applications for interface calls can be met.

[0133] After the gateway determines the interface status of the target interface based on the target database, if the target interface requires authentication, it returns corresponding authentication notification information to the requesting SDK based on the authentication method of the target interface.

[0134] Step S330: Based on the authentication notification information, obtain the to-be-authenticated information corresponding to the target authentication method;

[0135] Step S340: By sending a second pending request to the gateway, obtain the first request response of the business request returned by the gateway, wherein the second pending request includes request parameters and information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated is verified.

[0136] After receiving the authentication notification information returned by the gateway, the requesting SDK can know the target authentication method of the target interface based on this information, thereby triggering the acquisition of the information to be authenticated corresponding to the target authentication method. The content and form of the information to be authenticated are generally different for different authentication methods. For example, for mobile phone SMS authentication, the information to be authenticated is usually a text message verification code sent to the terminal via SMS. For MFA authentication, the information to be authenticated is usually a dynamic verification code generated by the associated MFA device. For digital certificate authentication, the information to be authenticated can be a digital certificate stored in a security device (such as a USB key). Using a digital certificate requires establishing a connection between the security device and the user terminal, and the user terminal reads the digital certificate in the USB key.

[0137] After the request SDK determines the target authentication method, it can obtain the corresponding information to be verified by calling the functional component corresponding to the authentication method. For example, for MFA authentication, the verification code input interface can be displayed on the user terminal by calling the corresponding functional component, and the verification code entered by the user can be obtained through this interface.

[0138] In order to better decouple business logic, business request processing logic, and interface authentication logic, improve system maintainability, and reduce intrusion into business, in the optional solution of this application, the above-mentioned acquisition of the authentication information corresponding to the target authentication method based on the authentication notification information may include:

[0139] When it is determined based on the authentication notification information that the target interface is an interface that requires authentication, the interface authentication SDK is loaded, wherein the interface authentication SDK includes authentication components corresponding to multiple authentication methods, the target authentication method is one of the multiple authentication methods, and the authentication component corresponding to one authentication method is used to obtain the information to be authenticated corresponding to the authentication method;

[0140] Based on the authentication notification information, the authentication function component corresponding to the target authentication method in the startup interface authentication SDK is displayed, the authentication information acquisition interface corresponding to the target authentication method is displayed, and the information to be authenticated corresponding to the target authentication method is obtained through the authentication information acquisition interface.

[0141] In the embodiment of the present application, the request SDK and the interface authentication SDK are both function SDKs of the target application, and the interface authentication information to be authenticated is obtained by loading the interface authentication SDK. Specifically, after the request SDK determines that the target interface needs to be authenticated based on the authentication notification information returned by the gateway, the request SDK will load the interface authentication SDK, which includes authentication function components corresponding to all interface authentication methods involved in the target application, and each function component can implement the front-end logic of an interface authentication method. After loading the interface authentication SDK, the request SDK can control the interface authentication SDK to start the authentication function component corresponding to the target authentication method, and the request SDK can provide the indication information of the target authentication method to the interface authentication SDK (such as providing the value of type in the authentication notification information in the previous example to the authentication SDK), and the interface authentication SDK can start the corresponding authentication function component according to the indication information to trigger the display of the information acquisition interface to be authenticated corresponding to the authentication method on the user terminal, and obtain the information to be authenticated entered by the user, such as popping up a verification code input box on the user interface.

[0142] In actual implementation, since some authentication methods require the user side to receive the information to be authenticated (for example, in the SMS authentication method, the user needs to receive an SMS verification code), and then provide the information to be authenticated to the authentication SDK by input, for this type of authentication method, this application does not limit the specific implementation method for the user side to obtain the information to be authenticated. Optionally, the gateway can generate corresponding authentication information according to the target authentication method after determining that the target interface is an interface that requires authentication and send it to the pre-bound user-side terminal device, or the gateway can send instructions to a dedicated authentication server, and the authentication server generates authentication information and sends it to the user-side terminal device.

[0143] After obtaining the information to be authenticated, a second pending request containing the information to be authenticated and the request parameters can be sent to the gateway. After receiving the second pending request, the gateway verifies the information to be authenticated. If the verification is successful, the gateway will provide the request parameters to the business server, which will perform business processing and feedback the processing results to the business side through the gateway. Optionally, the second pending request can be sent to the gateway by the request SDK or by the interface authentication SDK. For the former, the authentication interface SDK can provide the information to be authenticated to the request SDK after obtaining it. For the latter, the request SDK can provide the request parameters to the interface authentication SDK.

[0144] For the solution in which the interface authentication SDK sends the second pending request to the gateway, in step S340, obtaining the first request response of the service request returned by the gateway by sending the second pending request to the gateway may include:

[0145] Send a second pending request to the gateway through the interface authentication SDK;

[0146] Receive the first request response of the business request returned by the interface authentication SDK. The first request response is received by the authentication SDK from the gateway. The response is sent by the gateway when the information to be authenticated in the second pending request is verified successfully.

[0147] Similarly, the implementation logic of the gateway verifying the received information to be authenticated can be that the gateway itself performs the verification, or the gateway provides the information to the authentication server for authentication after receiving the information to be authenticated. For example, after generating the authentication information, the authentication server can provide the authentication information to the user's terminal device and the gateway at the same time. The gateway determines whether the verification is successful by comparing the authentication information received from the authentication server with the information to be authenticated in the second pending request. If they are consistent, the verification is successful. The gateway obtains the first request response from the business server based on the request parameters. If they are inconsistent, the verification fails. The gateway can directly return a prompt message to indicate that the verification failed, such as a prompt that the verification code was entered incorrectly.

[0148] In the embodiment of the present application, the authentication component in the interface authentication SDK is updateable, wherein the update method of the interface authentication SDK includes:

[0149] In response to the authentication component update operation, the interface authentication SDK is updated accordingly, wherein the update operation is an authentication component adding operation, an authentication component deleting operation, or an authentication component modifying operation.

[0150] Since the interface authentication SDK is decoupled from the implementation logic of the specific business provided by the application, if the interface authentication method involved in the target application needs to be updated, it can be easily implemented. Among them, this application does not make a unique limitation on the specific implementation method of triggering the authentication component update operation. Optionally, it can be triggered by a management client with interface management authority. After receiving the authentication component update operation of the administrator, the management client can send the updated interface authentication SDK to the user terminal via the business server and gateway (or via a dedicated interface management server), and the user terminal will replace the current authentication SDK. Alternatively, the management client can provide the updated content in the authentication interface SDK to the user terminal, and the user terminal will update the current authentication SDK according to the received content. For example, if the update operation is an authentication component addition operation, only the newly added authentication function component can be sent to the user terminal. In other words, the update of the interface SDK can be a full update or an incremental update.

[0151] It should be noted that, as an optional implementation method, the interface authentication SDK and the request SDK can also be implemented using a single SDK. In this case, this single SDK has the functions of both the interface authentication SDK and the request SDK. However, using two SDKs can better decouple different functions, which is beneficial for system maintenance and reduces maintenance difficulty. In addition, when using two SDKs, the interface authentication SDK only needs to be loaded when the target interface corresponding to the business request is the interface that requires authentication. If the target interface is not opened twice, the interface authentication SDK will not be loaded. This can reduce the resources of the user terminal occupied by the target application and improve the business processing efficiency of the terminal.

[0152] In this embodiment of the application, if the interface called by the request does not have secondary authentication enabled, that is, the interface does not require authentication, the gateway can provide the service request parameters to the service server. The service server processes the request based on the request parameters, obtains the corresponding processing result, and sends the processing result as a request response through the gateway to the request sender. Accordingly, for the request sender, the service processing method also includes:

[0153] A second request response sent by the gateway is received, wherein the second request response is a response to the service request obtained from the service server based on the request parameters when the gateway determines, based on the interface status of the target interface, that the target interface is an interface that does not require authentication.

[0154] Taking into account that in actual applications, the actual needs of different customers (application providers) are likely to be different, for example, for toB (to Business, enterprise-oriented) scenarios, there are dozens or even hundreds of customers, and different customers need to customize different functions. However, in the current related technologies, the implementation of the interface authentication logic is not decoupled from the business implementation. For the backend, whether each interface needs to enable secondary authentication is also hard-coded and cannot be modified dynamically. If the user wants to enable or disable secondary authentication of certain interfaces, the service needs to be suspended, the file configuration of the target application needs to be modified, and then the service needs to be restarted, which can easily cause business interruption. In response to the above problems, the optional embodiment of the present application also provides a solution that supports the modification of the interface status of the interface (whether the interface enables authentication, the configuration method of the interface). By adopting this solution, the visual configuration of the authentication method of the interface can be realized, and the solution supports dynamic modification during application runtime. Optionally, for any interface, the interface status of the interface is updateable, and the update of the interface status of the interface is achieved in the following way:

[0155] In response to an interface configuration modification operation triggered by a first management client corresponding to the interface, displaying an authentication mode modification interface corresponding to the interface on the first management client, the authentication mode modification interface displaying a plurality of options, the plurality of options including at least one of an authentication off option or an authentication on option, and options corresponding to a plurality of candidate authentication modes;

[0156] In response to a selection operation on any one of the multiple options, the interface state of the interface is updated based on the option corresponding to the selection operation.

[0157] The first management client is a management client for the target application. An authorized administrator can use the management client to update the interface status of any interface corresponding to various services supported by the target application. For interfaces that currently do not require authentication, updating the interface status includes enabling interface authentication and selecting an authentication method. For interfaces that currently require authentication, updating the interface status includes disabling interface authentication or modifying the authentication method. The administrator can trigger a modification of the interface status based on their needs by selecting a corresponding option from a variety of options displayed on the management client. Based on the administrator's selection, the management client can access the updated interface status and, based on the updated status, update the interface status stored in the target database. For example, the target database can be a dedicated storage device. The management client can send an interface status update request to the storage device. The request can include the interface name and the updated interface status. Upon receiving the request, the storage server can update the interface status of the interface based on the information carried in the request. For example, if the interface name is A and the updated authentication method is b, the updated interface status indicates that the interface requires authentication and that the authentication method is b. Alternatively, the management client may send the request to a business server, a gateway, or a dedicated management server, which then updates the interface status in the target database.

[0158] The specific implementation method of triggering the interface configuration modification operation on the first management client is not limited in this embodiment of the present application. As an optional solution, for any interface, in response to the interface configuration modification operation triggered by the first management client corresponding to the interface, the first management client displays the authentication method modification interface corresponding to the interface, including:

[0159] In response to an interface configuration viewing operation triggered by the first management client, the interface configuration information of each interface corresponding to the first management client is displayed on the management client, where the interface configuration information includes a configuration modification control of the interface;

[0160] In response to a control triggering operation on a configuration modification control corresponding to any interface, an authentication mode modification interface corresponding to the interface is displayed, wherein the interface configuration modification operation includes a control triggering operation.

[0161] In this optional solution, the user interface of the target application's management client can display a control for triggering interface configuration. By clicking this control, the administrator can enter the interface configuration information display interface, which can display the configuration information of each interface involved in the various services of the target application. The interface configuration information includes an operable configuration modification control. By triggering this modification control, the administrator can enter the authentication method modification interface for the corresponding interface, which displays the aforementioned multiple options. The specific display format of the multiple options in the user interface can be configured according to actual needs, such as displaying the multiple options in a list format.

[0162] The interfaces corresponding to the first management client may refer to interfaces for which the first management client has permission to modify interface status, and may be some or all of the interfaces involved in the target application. For example, an administrator may need to modify the interface status by logging into the management program of the target application. There may be multiple administrators, each with their own permission to modify the interface. Different permissions may modify different interfaces. Different administrators may have the same or different permission to modify, and administrators with different permission may modify at least some of the interfaces differently.

[0163] Optionally, in order to enable administrators to understand more interface-related information when modifying the interface status, administrators can determine how to make modifications based on this information. The interface-related information may include but is not limited to the interface name, interface description, backend address, update time, etc.

[0164] As an example, Figure 4 A schematic diagram of interface configuration information displayed by a management client is shown, wherein the interface description can be information used to describe the interface function, the backend address can be the address of the business server or other pre-configured backend address associated with the interface, and the update time can be the time information when the interface status was last updated. In this example, the operation information corresponds to the configuration modification control of the interface. The "configuration" in the figure is the control. Clicking the control of an interface will display the authentication method modification interface of the interface. For example, it can be displayed in the form of a pop-up window. Clicking the control will pop up the configuration pop-up window of the corresponding interface, and multiple secondary authentication types (authentication methods) will be displayed in the pop-up window.

[0165] Figure 5An example of an authentication method modification interface is shown. The user interface of this example displays secondary types including mobile phone authentication (such as mobile phone SMS authentication), digital certificate authentication, and MFA thermal authentication. It also displays a "Do not enable" secondary authentication option. The administrator clicks the confirmation button of an option (the circular control in the figure) to enable the corresponding authentication method for the current interface or disable the secondary authentication of the interface.

[0166] To prevent arbitrary modification of the interface status and improve the security of the interface modification process, the interface status of any interface is updated based on the options corresponding to the above selection operation, including:

[0167] Obtaining historical update information of the interface, where the historical update information includes a priority of a second management client, where the second management client is the management client that last triggered an update of the interface status of the interface before the current time;

[0168] Obtaining the priority of the first management client;

[0169] If the priority of the first management client is not lower than the priority of the second management client, the interface status of the interface is updated according to the option corresponding to the selection operation.

[0170] The interface status update methods include:

[0171] If the priority of the first management client is lower than the priority of the second management client, a prompt message is displayed on the first management client, and the prompt message is used to prompt that the first management client does not have the authentication method modification authority of the interface.

[0172] The second management client refers to the management client that modified the interface status of the interface most recently before the current time. For example, manager a modified the authentication method of interface A at 9 o'clock this morning, and manager b modified the authentication method of interface A again at 3 o'clock in the afternoon. However, the priority of manager b's management client is lower than the priority of manager a's management client, so manager b cannot modify interface A again. Among them, the priority of the management client can be associated with the modification authority of the manager who logs into the management application. The higher the modification authority, the higher the priority. The embodiment of this application does not limit the storage method of the priorities of different management clients. For example, it can be a storage management server. After the manager logs into the first management client, the management server can determine the priority of the first management client based on the manager's identification (such as the login account) and compare it with the priority of the second management client that modified the interface status last time. If the priority of the first management client is lower than the priority of the second management client, the corresponding prompt information is displayed through the first management client. If the priority of the first management client is not lower than the priority of the second management client, the interface status can be updated again according to the manager's operation.

[0173] The business processing solution based on interface authentication provided by the embodiment of the present application can be applied to, but not limited to, private cloud scenarios. Based on the solution provided by the embodiment of the present application, a configurable interface secondary authentication solution based on gateway interception can be implemented in private cloud scenarios. With this solution, private cloud customers can configure multiple different secondary authentication methods for the same interface. For example, according to actual needs, authentication method A can be used for a period of time, authentication method B can be used for another period of time, or authentication for a certain interface can be turned off. The solution provided by the embodiment of the present application can well meet the various customized needs of different customers in private cloud scenarios (for example, different customers need to configure different interface secondary authentication methods. For example, customer 1 needs to configure 10 interfaces to enable secondary authentication. Among these 10 interfaces, the secondary authentication method of the write interface also needs to be configured differently. Customer 2 needs to configure 20 interfaces to enable secondary authentication, and can configure the authentication method he wants to use as needed).

[0174] The previous article is based on Figure 3 The various optional embodiments primarily describe the solution from the perspective of the front-end business side, specifically using a request processing node (e.g., a request SDK) as the execution entity of the business processing method. As previously explained, the business processing method can be described from the perspective of any node involved in the method's implementation process (e.g., a gateway, business server, authentication SDK) as the execution entity. Figure 6A flow chart of a service processing method using a gateway as an execution subject provided by an embodiment of the present application is shown. Figure 6 As shown, the method may include steps S610 to S640.

[0175] Step S610: Receive a first pending request, where the first pending request is generated by a request sender in response to a service request for a target application. The first pending request includes a request address and request parameters. The request address is the address of a gateway. The request parameters include the interface name and interface input parameters of a target interface called by the service request. The service request is a service request for any of multiple services supported by the target application.

[0176] Step S620: If the target interface is determined to be an interface requiring authentication based on the interface name of the target interface, a target authentication mode of the target interface is determined, and authentication notification information is sent to the request sender based on the target authentication mode of the target interface. The authentication notification information is used to notify the target authentication mode of the target interface.

[0177] Step S630: receiving a second request to be processed, the second request to be processed including request parameters and information to be authenticated, the information to be authenticated being information corresponding to the target authentication method obtained by the request sender based on the authentication notification information;

[0178] Step S640: verify the authentication information. If the authentication information is verified successfully, obtain a first request response of the service request from the service server based on the request parameters, and send the first request response to the request sender.

[0179] The sender of the above request is Figure 3 The execution subject of the method shown in , such as requesting SDK. For the optional implementation of the above steps S610 to S640, reference can be made to the relevant description in the above embodiments, which will not be repeated here.

[0180] The solution provided by the present application will be further described in detail below in conjunction with an optional specific embodiment. In the following embodiment, the service request is an application user who wants to view the object information (such as the object name) of a certain object. Figure 7A schematic diagram of the architecture of a business system with an interface-level secondary authentication function based on the solution provided by the present application is shown. In the schematic diagram, the target application can provide three services (back-end service 1, back-end service 2, and back-end service 3). The three services correspond to the three front-end businesses (business 1, business 2, and business 3). Users of the target application can initiate business requests for various businesses through the user interface of the target application running on their user terminal. One business request corresponds to a call to an interface. Through the interface call, the back-end server is triggered to provide the corresponding service, that is, to process the user's request and feed back the processing interface to the user. Figure 7 The business, request SDK, and secondary authentication components in the front-end architecture are all included in the target application program on the user terminal. The business can be understood as the front-end business logic implementation. The gateway and back-end services are the back-end architecture, and the back-end services can be understood as the target application program running on the business server.

[0181] In a private cloud scenario, the secondary authentication component can be provided by the private cloud provider to the customer (application provider). The customer can configure the configuration of each interface that needs to be called in the application provided by the private cloud provider according to their own needs. Different interfaces can be configured with different authentication methods. Figure 8 As shown, the private cloud provider can provide a secondary authentication SDK containing multiple authentication components to each customer using the private cloud, such as Customer 1, Customer 2 and Customer 3. Since the secondary authentication SDK contains authentication components corresponding to multiple authentication methods, different customers can modify the configuration of various interfaces in the applications they provide according to actual needs, and can set whether to enable authentication, which authentication method to enable, etc. Based on this method, if a customer needs to add a new authentication method, the private cloud vendor only needs to update the secondary authentication SDK it provides, add the new authentication method component to it, and provide the updated secondary authentication SDK to each customer. It can be seen that one secondary authentication SDK can meet the different needs of various customers.

[0182] Figure 9 Shown based on Figure 8 A flowchart of a business processing method of the system architecture shown in FIG. Figure 9 As shown, the method may include the following steps:

[0183] 1. The business side initiates a network request (business request / interface call request). The network request address and request parameters are uniformly constructed by the request SDK. Optionally, the address can be a URL (Uniform Resource Locator).

[0184] 2. Request the SDK to construct the request URL and request parameters. The request parameters can include the interface name and interface input parameters of the request. For the business request to obtain the user name, the interface name is assumed to be getUserName, and the request parameters can be expressed as {action:"getUserName", data:{page:1}}, where the field information {page:1} in the data field is the request input parameter, and the field information "getUserName" in the action field is the interface name.

[0185] 3. The browser initiates a network request (the first pending request / business processing request, such as an HTTP request). The request first reaches the gateway layer instead of directly reaching the backend business (business server, Figure 9 Backend servers in .

[0186] 4. The gateway layer reads the interface name getUserName based on the request parameters.

[0187] 5. The gateway queries the database for the status of the interface based on getUserName (the database stores information about each interface, including whether the interface has enabled two-factor authentication and the method used to enable it. The authentication methods include but are not limited to SMS verification and MFA verification).

[0188] 6. If the gateway finds that the secondary verification is not enabled on the interface, it will send a request to the corresponding backend service with the request parameters (provide the request parameters to the backend server), and the backend service will return the request response to the gateway layer.

[0189] 7. The gateway then returns the request response to the requesting SDK.

[0190] 8. The SDK is requested to return the request response to the business side, and the business request is completed.

[0191] 9. If the gateway finds that the interface has enabled two-factor authentication, it will return specific information (authentication notification information) to the requesting SDK, such as {code:1001,data:{type:"mfa"}}. Code 1001 indicates that the interface has enabled two-factor authentication, and type mfa indicates that the two-factor authentication method is MFA verification.

[0192] 10. Request the SDK to load the secondary authentication sSDK.

[0193] 11. The secondary authentication SDK pops up a pop-up window for SMS verification or MFA verification based on the type. Figure 10A schematic diagram of a pop-up window (interface for obtaining information to be authenticated) for a mobile phone SMS authentication method is shown. The user clicks Get Verification Code to obtain the SMS verification code (information to be authenticated), enters the received SMS verification code, confirms it, and then provides it to the secondary authentication SDK. Figure 12 A schematic diagram of a pop-up window for MFA authentication is shown, and the user is also required to enter the MFA verification code.

[0194] 12. The user enters the SMS verification code or MFA verification code.

[0195] 13. The secondary authentication SDK sends a request (second processing request) to the gateway layer with the verification code and service request parameters.

[0196] 14. The gateway layer extracts the verification code from the request parameters and verifies the verification code. If the verification fails, the gateway returns the relevant information of the verification failure to the secondary authentication SDK. The secondary authentication SDK prompts that the verification code is entered incorrectly. Figure 11 A schematic diagram of the user interface of a digital certificate authentication method when verification fails is shown. If the user wants to try again, he can click the "Retry" control, insert the USB Key and click Confirm. The secondary authentication SDK will send a request carrying the verification code and request parameters to the gateway again.

[0197] 15. If the verification code is successfully verified, a request is made to the backend with the business request parameters.

[0198] 16. The backend service returns the request response to the gateway layer. The gateway returns the request response to the secondary authentication SDK. The secondary authentication SDK returns the request response to the request SDK. The request SDK finally returns the response to the business, completing the processing of an interface call request.

[0199] The solution of the embodiment of the present application can effectively solve the problem that the traditional implementation is relatively complex and too invasive to the business. The solution uniformly processes and intercepts requests through the gateway and SDK, achieving zero intrusion into the business. At the same time, the secondary authentication of the interface can be visually configured and dynamically modified at runtime, which can well meet the requirements of interface calls requiring authentication in various scenarios.

[0200] Figure 13 A business processing system based on interface authentication provided by an embodiment of the present application is shown. Figure 13 As shown, the business processing system 100 includes an application front-end 110 and an application back-end 120 of the target application, wherein the front-end 110 includes a business initiator 111 and a request sender 112, and the back-end 120 includes a gateway 121 and a business server 122 of the target application, and the target application supports multiple businesses.

[0201] The service initiator 111 is configured to receive a service request for a target application, where the service request may be a service request for any service supported by the target application;

[0202] The request sender 112 is configured to construct and generate a first pending request corresponding to the business request in response to the business request, and send the first pending request to the gateway 121, wherein the first pending request includes a request address and request parameters, the request address is the address of the gateway, and the request parameters include the interface name and interface input parameters of the target interface called by the business request;

[0203] The gateway 121 is configured to receive the first pending request and, upon determining based on the interface name in the first pending request that the target interface is an interface requiring authentication, send authentication notification information to the request sender, where the authentication notification information is used to notify the target interface of a target authentication method;

[0204] The request sender 112 is further configured to, upon receiving the authentication notification information sent by the gateway, obtain the to-be-authenticated information corresponding to the target authentication method based on the authentication notification information, and send a second to-be-processed request to the gateway, the second to-be-processed request including the request parameters and the to-be-authenticated information;

[0205] The gateway 121 is further configured to verify the information to be authenticated in the second request to be processed upon receiving the second request to be processed, and provide the request parameters to the business server 122 when the information to be authenticated passes the verification;

[0206] The business server 122 is configured to perform corresponding business processing based on the request parameters, obtain a processing result, and send a first request response (processing result) of the business request to the request sender;

[0207] The request sender 112 is further configured to provide the received first request response to the service initiator.

[0208] Based on the same principle as the business processing method provided in this application, the embodiment of this application also provides a business processing device based on interface authentication, which can be deployed in a user terminal. Optionally, the device can be implemented as a request processing node of a target application running in the user terminal, such as a request SDK, such as Figure 14 As shown, the business processing device 200 may include a request generating module 210 and a request processing module 220 .

[0209] The request generation module 210 is configured to generate, in response to a service request for a target application, a first pending request corresponding to the service request, wherein the first pending request includes a request address and request parameters, wherein the request address is the gateway address of the service server of the target application, and the request parameters include the interface name and interface input parameters of the target interface called by the service request, and the service request is a service request for any of a plurality of services supported by the target application;

[0210] The request processing module 220 is configured to send a first request to be processed to the gateway and receive authentication notification information returned by the gateway. The authentication notification information is sent by the gateway when the gateway determines that the target interface is an interface that requires authentication based on the interface name in the request parameter. The authentication notification information is used to notify the target interface of the target authentication method;

[0211] The request processing module 220 is also used to obtain the information to be authenticated corresponding to the target authentication method based on the authentication notification information, and obtain the first request response of the business request returned by the gateway by sending a second request to be processed to the gateway, wherein the second request to be processed includes request parameters and information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated has been verified.

[0212] Optionally, the authentication notification information is sent by the gateway based on the following method:

[0213] Reading the interface name of the target interface from the request parameters of the received first request to be processed;

[0214] querying, from a target database, the interface status of the target interface according to the interface name of the target interface, wherein the target database stores interface information of each interface corresponding to the multiple services, the interface information of an interface including an interface name and an interface status, the interface status including first information, the first information identifying whether the interface requires authentication, and for an interface requiring authentication, the interface status also including second information, the second information identifying an authentication method for the interface;

[0215] If it is determined based on the interface status of the target interface that the target interface is an interface requiring authentication, authentication notification information is sent based on the interface status of the target interface.

[0216] Optionally, for any interface, the interface status of the interface is updateable. The interface status of the interface is updated in the following ways:

[0217] In response to an interface configuration modification operation triggered by a first management client corresponding to the interface, displaying an authentication mode modification interface corresponding to the interface on the first management client, the authentication mode modification interface displaying a plurality of options, the plurality of options including at least one of an authentication off option or an authentication on option, and options corresponding to a plurality of candidate authentication modes;

[0218] In response to a selection operation on any one of the multiple options, the interface state of the interface is updated based on the option corresponding to the selection operation.

[0219] Optionally, in response to the interface configuration modification operation triggered by the first management client corresponding to the interface, displaying the authentication mode modification interface corresponding to the interface on the first management client includes:

[0220] In response to an interface configuration viewing operation triggered by the first management client, displaying interface configuration information of each interface corresponding to the first management client on the first management client, the interface configuration information including a configuration modification control of the interface;

[0221] In response to a control triggering operation on a configuration modification control corresponding to any interface, an authentication mode modification interface corresponding to the interface is displayed, wherein the interface configuration modification operation includes the control triggering operation.

[0222] Optionally, for any interface, updating the interface status of the interface based on the option corresponding to the selection operation includes:

[0223] Obtaining historical update information of the interface, where the historical update information includes a priority of a second management client, where the second management client is the management client that last triggered an update of the interface status of the interface before the current time;

[0224] Obtaining the priority of the first management client;

[0225] If the priority of the first management client is not lower than the priority of the second management client, updating the interface state of the interface based on the option corresponding to the selection operation;

[0226] The interface status update methods include:

[0227] If the priority of the first management client is lower than the priority of the second management client, a prompt message is displayed on the first management client, where the prompt message is used to prompt that the first management client does not have the authority to modify the authentication method of the interface.

[0228] Optionally, the target database includes at least two sub-databases, each of the sub-databases is associated with a business priority, each of the multiple businesses has its own business priority, and each sub-database is used to store interface information of each interface corresponding to each business with the business priority associated with the sub-database; wherein the first pending request also includes the business priority corresponding to the request, and querying the interface status of the target interface from the target database based on the interface name of the target interface includes:

[0229] determining, according to the service priority corresponding to the first pending request, a target sub-repository associated with the service priority from the multiple sub-repositories;

[0230] According to the interface name of the target interface, the interface status of the target interface is queried from the target sub-library.

[0231] Optionally, the target database includes multiple first databases, each first database is associated with an application identifier, and at least two first databases have at least one identical interface name; wherein the first pending request also includes the application identifier of the target application, and querying the interface status of the target interface from the target database based on the interface name of the target interface includes:

[0232] determining, according to the application identifier of the target application, a first database corresponding to the target application from a plurality of first databases;

[0233] According to the interface name of the target interface, the interface status of the target interface is queried from a first database corresponding to the target application.

[0234] Optionally, the request processing module performs the following operations when obtaining authentication notification information:

[0235] When it is determined based on the authentication notification information that the target interface is an interface requiring authentication, loading an interface authentication software development kit (SDK), wherein the interface authentication SDK includes authentication components corresponding to respective authentication methods, the target authentication method being one of the multiple authentication methods, and the authentication component corresponding to an authentication method being used to obtain information to be authenticated corresponding to the authentication method;

[0236] Based on the authentication notification information, the authentication function component corresponding to the target authentication method in the interface authentication SDK is started, an authentication information acquisition interface corresponding to the target authentication method is displayed, and the information to be authenticated corresponding to the target authentication method is acquired through the authentication information acquisition interface.

[0237] Optionally, the request processing module is further configured to provide the request parameters to the interface authentication SDK; when the request processing module obtains the first request response of the service request returned by the gateway by sending the second request to be processed to the gateway, the request processing module is configured to:

[0238] Sending a second request to be processed to the gateway through the interface authentication SDK; receiving a first request response to the business request returned by the interface authentication SDK, where the first request response is received by the authentication SDK from the gateway.

[0239] Optionally, the authentication component in the interface authentication SDK is updateable, wherein the update method of the interface authentication SDK includes:

[0240] In response to an authentication component update operation, the interface authentication SDK is updated accordingly, wherein the update operation is an authentication component adding operation, an authentication component deleting operation, or an authentication component modifying operation.

[0241] Optionally, the device is a business request processing SDK deployed in the target application.

[0242] Optional, such as Figure 14 As shown, the service processing apparatus 200 may further include a request response feedback module 230, which is configured to provide the received first request response to the service side that initiates the service request.

[0243] Figure 15 FIG. 1 shows a schematic diagram of a business processing device based on interface authentication provided by another embodiment of the present application. Figure 15 As shown, the service processing device 300 may include a request receiving module 310 , a request processing module 320 and a request response sending module 330 .

[0244] The request receiving module 310 is configured to receive a first pending request, wherein the first pending request is generated by a request sender in response to a service request for a target application, and the first pending request includes a request address and request parameters, wherein the request address is the address of a gateway, and the request parameters include the interface name and interface input parameters of the target interface invoked by the service request, and the service request is a service request for any of a plurality of services supported by the target application;

[0245] The request processing module 320 is configured to determine, based on the interface name of the target interface, that the target interface is an interface requiring authentication, determine a target authentication mode for the target interface, and send authentication notification information to the request sender based on the target authentication mode of the target interface, where the authentication notification information is used to notify the request sender of the target authentication mode of the target interface;

[0246] The request receiving module 310 is further configured to receive a second request to be processed, the second request to be processed including request parameters and information to be authenticated, the information to be authenticated being information corresponding to a target authentication method obtained by the request sender based on the authentication notification information;

[0247] The request processing module 320 is further configured to verify the authentication information, and if the authentication information is verified successfully, obtain a first request response to the service request from the service server based on the request parameters;

[0248] The request response sending module 330 is configured to send the first request response to the request sender.

[0249] The device of the embodiment of the present application can execute the method provided by the embodiment of the present application, and its implementation principle is similar. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, and will not be repeated here.

[0250] An embodiment of the present application further provides an electronic device, comprising at least one processor configured to execute the steps of the method provided in any optional embodiment of the present application. Optionally, the electronic device may further comprise a transceiver and / or a memory coupled to the processor, wherein the memory stores a computer program, and when the processor executes the computer program, the solution provided in any optional embodiment of the present application may be implemented. Optionally, the electronic device may be a user terminal or a server.

[0251] Figure 16 FIG. 1 shows a schematic structural diagram of an electronic device to which an embodiment of the present invention is applicable. Figure 16 As shown, the electronic device may be a server or a user terminal, and the electronic device may be used to implement the method provided in any embodiment of the present invention.

[0252] like Figure 16 As shown in FIG, the electronic device 2000 may mainly include at least one processor 2001 ( Figure 16 1 ), memory 2002, communication module 2003 and input / output interface 2004 and other components, optionally, the components can be connected and communicated through bus 2005. It should be noted that, Figure 16 The structure of the electronic device 2000 shown in the figure is merely illustrative and does not constitute a limitation on the electronic devices to which the method provided in the embodiments of the present application is applicable.

[0253] Memory 2002 can be used to store operating systems and application programs, etc. Application programs can include computer programs that implement the methods described in the embodiments of the present invention when called by processor 2001, and can also include programs for implementing other functions or services. Memory 2002 can be ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices that can store information and computer programs, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0254] The processor 2001 is connected to the memory 2002 via the bus 2005 and implements corresponding functions by calling the application program stored in the memory 2002. The processor 2001 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof, which can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the present disclosure. The processor 2001 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0255] The electronic device 2000 can be connected to a network via a communication module 2003 (which may include, but is not limited to, components such as a network interface) to communicate with other devices (such as a user terminal or a server) via the network to implement data interaction, such as sending data to or receiving data from other devices. The communication module 2003 may include a wired network interface and / or a wireless network interface, etc., that is, the communication module may include at least one of a wired communication module and a wireless communication module.

[0256] The electronic device 2000 can be connected to the required input / output devices, such as a keyboard, a display device, etc., through the input / output interface 2004. The electronic device 2000 itself can have a display device, and can also be connected to other external display devices through the interface 2004. Optionally, a storage device, such as a hard disk, can also be connected through the interface 2004, so that data in the electronic device 2000 can be stored in the storage device, or data in the storage device can be read, and data in the storage device can also be stored in the memory 2002. It can be understood that the input / output interface 2004 can be a wired interface or a wireless interface. Depending on the actual application scenario, the device connected to the input / output interface 2004 can be a component of the electronic device 2000, or it can be an external device connected to the electronic device 2000 when needed.

[0257] Bus 2005, used to connect the various components, may include a path for transmitting information between the components. Bus 2005 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. Depending on their function, bus 2005 may be categorized as an address bus, a data bus, a control bus, or the like.

[0258] Optionally, for the solution provided in the embodiment of the present invention, the memory 2002 can be used to store a computer program for executing the solution of the present invention, and be run by the processor 2001. When the processor 2001 runs the computer program, the actions of the method or device provided in the embodiment of the present invention are implemented.

[0259] Based on the same principle as the method provided in the embodiment of the present application, the embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the corresponding content of the aforementioned method embodiment can be implemented.

[0260] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the corresponding content of the aforementioned method embodiment can be implemented.

[0261] It should be noted that the terms "first," "second," "third," "fourth," "1," "2," etc. (if any) in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that shown or described in the drawings.

[0262] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the order of implementation of these steps is not limited to the order indicated by the arrows. Unless otherwise clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart can include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage in these sub-steps or stages can also be executed at different times respectively. Under different scenarios at the execution time, the execution order of these sub-steps or stages can be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0263] The above description is only an optional implementation method for some implementation scenarios of this application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the solution of this application, the use of other similar implementation methods based on the technical ideas of this application also falls within the protection scope of the embodiments of this application.

Claims

1. A service processing method based on interface authentication, characterized in that: The method comprises: In response to a service request for a target application, construct a first pending request corresponding to the service request, wherein the first pending request includes a request address and request parameters, wherein the request address is an address of a gateway of a service server of the target application, and the request parameters include an interface name and interface input parameters of a target interface called by the service request, and the service request is a service request for any one of a plurality of services supported by the target application; Sending the first request to be processed to the gateway, and receiving authentication notification information returned by the gateway, wherein the authentication notification information is sent by the gateway when it is determined that the target interface is an interface that needs to be authenticated based on the interface name in the request parameter, and the authentication notification information is used to notify the target interface of a target authentication method; Based on the authentication notification information, obtaining the to-be-authenticated information corresponding to the target authentication method; By sending a second request to be processed to the gateway, a first request response to the business request returned by the gateway is obtained, wherein the second request to be processed includes the request parameters and the information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated has been verified.

2. The method according to claim 1, characterized in that The authentication notification information is sent by the gateway based on the following method: Reading and obtaining the interface name of the target interface from the request parameters of the first request to be processed received; According to the interface name of the target interface, query the interface status of the target interface from a target database, wherein the target database stores interface information of each interface corresponding to the multiple services, the interface information of one interface includes an interface name and an interface status, the interface status includes first information, the first information identifies whether the interface needs authentication, and for an interface that needs authentication, the interface status also includes second information, the second information identifies an authentication method of the interface; If it is determined based on the interface status of the target interface that the target interface is an interface that requires authentication, authentication notification information is sent based on the interface status of the target interface.

3. The method according to claim 2, characterized in that For any interface, the interface status of the interface is updateable. The update of the interface status of the interface is achieved in the following ways: In response to an interface configuration modification operation triggered by a first management client corresponding to the interface, an authentication method modification interface corresponding to the interface is displayed on the first management client, wherein the authentication method modification interface displays a plurality of options, wherein the plurality of options include at least one of an authentication shutdown option or an authentication startup option, and options corresponding to a plurality of candidate authentication methods respectively; In response to a selection operation on any one of the multiple options, an interface state of the interface is updated based on the option corresponding to the selection operation.

4. The method according to claim 3, characterized in that For any interface, in response to the interface configuration modification operation triggered by the first management client corresponding to the interface, displaying the authentication mode modification interface corresponding to the interface on the first management client includes: In response to an interface configuration viewing operation triggered by the first management client, displaying interface configuration information of each interface corresponding to the first management client on the first management client, the interface configuration information including a configuration modification control of the interface; In response to a control triggering operation on a configuration modification control corresponding to any of the interfaces, an authentication mode modification interface corresponding to the interface is displayed, wherein the interface configuration modification operation includes the control triggering operation.

5. The method according to claim 3, characterized in that: For any interface, updating the interface state of the interface based on the option corresponding to the selection operation includes: Acquire historical update information of the interface, where the historical update information includes a priority of a second management client, where the second management client is a management client that last triggered and updated the interface status of the interface before the current time; Obtaining the priority of the first management client; If the priority of the first management client is not lower than the priority of the second management client, updating the interface state of the interface based on the option corresponding to the selection operation; The interface status update methods also include: If the priority of the first management client is lower than the priority of the second management client, a prompt message is displayed on the first management client, where the prompt message is used to prompt that the first management client does not have the authentication method modification authority of the interface.

6. The method according to claim 2, characterized in that The target database includes at least two sub-databases, each of the sub-databases is associated with a service priority, each of the multiple services has its own service priority, and each sub-database is used to store interface information of each interface corresponding to each service having the service priority associated with the sub-database; The first request to be processed also includes a service priority corresponding to the request, and querying the interface status of the target interface from the target database according to the interface name of the target interface includes: According to the service priority corresponding to the first request to be processed, determining a target sub-database associated with the service priority from the multiple sub-databases; According to the interface name of the target interface, the interface status of the target interface is queried from the target sub-library.

7. The method according to claim 2, characterized in that The target database includes a plurality of first databases, each of which is associated with an application identifier, and at least two of the first databases have at least one identical interface name; The first request to be processed also includes an application identifier of the target application, and querying the interface status of the target interface from the target database according to the interface name of the target interface includes: Determining, according to the application identifier of the target application, a first database corresponding to the target application from a plurality of first databases; According to the interface name of the target interface, the interface status of the target interface is queried from a first database corresponding to the target application.

8. The method according to claim 1, characterized in that The acquiring, based on the authentication notification information, information to be authenticated corresponding to the target authentication method includes: When it is determined based on the authentication notification information that the target interface is an interface that needs to be authenticated, an interface authentication software development kit SDK is loaded, wherein the interface authentication SDK includes authentication components corresponding to each of a plurality of authentication methods, the target authentication method is one of the plurality of authentication methods, and the authentication component corresponding to an authentication method is used to obtain information to be authenticated corresponding to the authentication method; Based on the authentication notification information, by starting the authentication function component corresponding to the target authentication method in the interface authentication SDK, an authentication information acquisition interface corresponding to the target authentication method is displayed, and the to-be-authenticated information corresponding to the target authentication method is acquired through the authentication information acquisition interface.

9. The method according to claim 8, characterized in that The method further comprises: Providing the request parameters to the interface authentication SDK; The step of sending a second request to be processed to the gateway to obtain a first request response to the service request returned by the gateway includes: Sending a second request to be processed to the gateway through the interface authentication SDK; Receive a first request response to the service request returned by the interface authentication SDK, where the first request response is received by the authentication SDK from the gateway.

10. The method according to any one of claims 1, 2 and 6 to 9, characterized in that: The method is executed by the service request processing SDK of the target application, and the method further includes: The first request response is provided to the target service side that initiates the service request.

11. A service processing method based on interface authentication, characterized in that: The method is applied to a gateway of a service server of a target application, and the method comprises: Receive a first pending request, wherein the first pending request is generated by a request sender in response to a service request for a target application, the first pending request includes a request address and request parameters, the request address is the address of the gateway, the request parameters include an interface name and interface input parameters of a target interface called by the service request, and the service request is a service request for any one of a plurality of services supported by the target application; If it is determined according to the interface name of the target interface that the target interface is an interface that needs to be authenticated, determine the target authentication mode of the target interface, and send authentication notification information to the request sender based on the target authentication mode of the target interface, where the authentication notification information is used to notify the target authentication mode of the target interface; receiving a second request to be processed, the second request to be processed comprising the request parameter and information to be authenticated, the information to be authenticated being information to be authenticated corresponding to the target authentication method obtained by the request sender based on the authentication notification information; The information to be authenticated is verified. If the information to be authenticated passes the verification, a first request response to the service request is obtained from the service server based on the request parameters, and the first request response is sent to the request sender.

12. A service processing device based on interface authentication, characterized in that: The device comprises: A request generation module, configured to generate, in response to a service request for a target application, a first request to be processed corresponding to the service request, wherein the first request to be processed includes a request address and request parameters, wherein the request address is an address of a gateway of a service server of the target application, and the request parameters include an interface name and interface input parameters of a target interface called by the service request, and the service request is a service request for any one of a plurality of services supported by the target application; A request processing module, used for sending the first request to be processed to the gateway, and receiving authentication notification information returned by the gateway, wherein the authentication notification information is sent by the gateway when it is determined that the target interface is an interface that needs to be authenticated based on the interface name in the request parameter, and the authentication notification information is used to notify the target interface of a target authentication method; The request processing module is also used to obtain the information to be authenticated corresponding to the target authentication method based on the authentication notification information, and obtain the first request response of the business request returned by the gateway by sending a second request to be processed to the gateway, wherein the second request to be processed includes the request parameters and the information to be authenticated, and the first request response is obtained from the business server based on the request parameters when the gateway determines that the information to be authenticated has been verified.

13. A service processing device based on interface authentication, characterized in that: The device is deployed at the gateway of the service server of the target application, and the device includes: A request receiving module, configured to receive a first pending request, wherein the first pending request is generated by a request sender in response to a service request for a target application, the first pending request includes a request address and request parameters, the request address is the address of the gateway, the request parameters include an interface name and interface input parameters of a target interface called by the service request, and the service request is a service request for any one of a plurality of services supported by the target application; A request processing module, configured to determine, based on the interface name of the target interface, that the target interface is an interface that requires authentication, determine a target authentication method for the target interface, and send authentication notification information to the request sender based on the target authentication method of the target interface, wherein the authentication notification information is used to notify the target authentication method of the target interface; The request receiving module is further used to receive a second request to be processed, wherein the second request to be processed includes the request parameter and information to be authenticated, and the information to be authenticated is information to be authenticated corresponding to the target authentication method obtained by the request sender based on the authentication notification information; The request processing module is further configured to verify the information to be authenticated, and if the information to be authenticated passes the verification, obtain a first request response of the service request from the service server based on the request parameters; A request response sending module is used to send the first request response to the request sender.

14. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 11 when running the computer program.

15. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images