White list-based authentication management system

Abstract

The invention relates to an authentication management system based on a white list, and the system comprises an authentication request analysis module which is used for obtaining a first keyword and a second keyword from an authentication request; the white list configuration management module is used for grouping white lists; performing node classification on the application service initiating the authentication request based on the first keyword, creating a corresponding exclusive white list configuration management node for each application service, and distributing at least one piece of white list configuration information; during initialization or dynamic updating, the white list configuration management module obtains white list configuration information and loads the white list configuration information into a cache; and the authentication and forwarding module reads the white list configuration information in the cache, authenticates the authentication request based on the second keyword, and determines forwarding routing information of the authentication request. According to the invention, by optimizing the white list configuration management mode and process, the maintenance efficiency is improved, and potential risks caused by configuration errors or service restart are reduced, so that the stability and reliability of the whole system are enhanced.

Description

Technical Field

[0001] The invention relates to the field of communication technology, in particular to an authentication management system based on a white list. Background Art

[0002] As a core component of network communication, gateway technology plays the role of traffic distribution, security control and protocol conversion. In modern network architecture, gateways are usually responsible for processing requests from different clients and authenticating them according to preset security policies to ensure that only legitimate requests can access backend services. The authentication mechanism is a key part of network security, which prevents unauthorized access by verifying the identity of the user. Whitelisting is a common security measure that defines a group of trusted entities, such as IP addresses or domain names, that are allowed to bypass regular security checks.

[0003] With the expansion of business and the increase of application services, the number of whitelist addresses that the gateway needs to manage has increased dramatically, which has led to the complexity of configuration management. When faced with whitelist configurations for hundreds or thousands of services, traditional management methods are not only inefficient but also prone to errors, increasing maintenance costs and risks. In addition, the need for intranet access control has also posed new challenges, as intranet access usually requires faster and more direct processing to avoid affecting the efficiency of internal communications.

[0004] The whitelist technology and configuration management methods used by existing gateways have the following shortcomings:

[0005] First, whitelist management is too complex. Especially for systems with a large number of application services, how to efficiently manage the whitelist addresses of hundreds or thousands of services, reduce management costs and reduce the risk of errors has become a severe challenge.

[0006] Second, the intranet access authentication processing mechanism is imperfect. Intranet access is generally considered safe, but in some scenarios, it is still necessary to fine-tune the intranet access to prevent potential security threats.

[0007] Third, the configuration is not dynamic enough. Traditional configuration management methods often require restarting the service when the configuration changes. This not only increases the complexity of operations, but may also cause service interruptions, affecting user experience and business continuity.

[0008] Fourth, configuration efficiency and flexibility need to be improved. As business needs continue to change, whitelist configurations also need to be adjusted frequently. How to achieve rapid updates and flexible adjustments to configurations to better adapt to changes in business needs is a technical problem that needs to be solved urgently.

[0009] The information disclosed in this background technology section is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as acknowledging or suggesting in any form that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0010] In view of the defects existing in the prior art, the purpose of the present invention is to provide an authentication management system based on a whitelist, which not only improves the maintenance efficiency but also reduces the potential risks caused by configuration errors or service restarts by optimizing the whitelist configuration management method and process, thereby enhancing the stability and reliability of the entire system.

[0011] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0012] An authentication management system based on a whitelist, characterized by comprising:

[0013] An authentication request parsing module, used for receiving an authentication request and obtaining a first keyword and a second keyword from the authentication request according to a preset classification rule;

[0014] Whitelist configuration management module, used for whitelist configuration management, including whitelist grouping, storage and reading of whitelist configuration information;

[0015] Based on the first keyword, the whitelist configuration management module classifies the application service that initiates the authentication request, creates a corresponding exclusive whitelist configuration management node for each application service, and allocates at least one whitelist configuration information to the whitelist configuration management node;

[0016] During initialization or dynamic update, the whitelist configuration management module obtains the whitelist configuration information and loads the information into the cache;

[0017] The authentication and forwarding module reads the whitelist configuration information in the cache and authenticates the authentication request based on the second keyword, and determines the forwarding routing information of the authentication request.

[0018] On the basis of the above technical solution, the preset classification rule is any one of the following, or a mixed granularity grouping rule formed by a combination of at least two of the following preset classification rules according to priority:

[0019] The whitelist is grouped according to the first path of the request path;

[0020] Group the whitelist according to the type of application service;

[0021] Group the whitelist based on the range of client IP addresses;

[0022] Group the whitelist by user account;

[0023] Group the whitelist based on the access rights of user accounts;

[0024] Group the whitelist according to business scenarios;

[0025] Group the whitelist according to the specified HTTP header information;

[0026] Whitelist groups based on request parameters.

[0027] Based on the above technical solution, the whitelist configuration information is stored in the nacos configuration management and service management platform;

[0028] The nacos configuration management and service management platform provides a configuration management list to maintain the published whitelist configuration information;

[0029] The nacos configuration management and service management platform provides a subscription interface for subscribing to whitelist configuration information, and dynamically obtains the latest whitelist configuration information through the subscription interface.

[0030] On the basis of the above technical solutions, it also includes:

[0031] The forwarding controller transparently transmits or directly forwards the authentication request if the second keyword matches the whitelist configuration information; if the second keyword does not match the whitelist configuration information, the request is rejected or other authentication processes are performed.

[0032] On the basis of the above technical solutions, it also includes:

[0033] The intranet access control module specifically processes intranet access requests according to the range of the client IP address, obtains the whitelist configuration information applicable to the intranet application scenario according to the intranet adaptation identifier in the whitelist configuration information, authenticates the authentication request, and determines the forwarding routing information of the authentication request.

[0034] On the basis of the above technical solutions, it also includes:

[0035] The dynamic configuration refresh module is responsible for monitoring changes in the whitelist configuration information. When there are changes, it initiates a dynamic update request to the whitelist configuration management module and sends the latest whitelist configuration information to the whitelist configuration management module.

[0036] Based on the above technical solution, the dynamic configuration refresh module monitors the changes of the whitelist configuration information in real time by subscribing to change notifications.

[0037] On the basis of the above technical solutions, it also includes:

[0038] The configuration update synchronizer is used to maintain a configuration cache routing list. When the whitelist configuration management module loads the whitelist configuration information into the cache, it saves a configuration node route to the configuration cache routing list according to the cache success feedback, and obtains a unique identification ID from the configuration update synchronizer.

[0039] When a dynamic update request is initiated to the whitelist configuration management module, the configuration update synchronizer synchronizes the dynamic update request to each configuration node route until all configuration node routes feedback that the update is complete.

[0040] The whitelist-based authentication management system described in the present invention has the following beneficial effects:

[0041] 1. The whitelist is managed in a standardized manner by grouping. When maintaining the whitelist, you can quickly find the configuration you need to maintain among the massive configurations, which greatly reduces the cost of whitelist maintenance and reduces the risks brought by maintenance;

[0042] 2. Through the online refresh function, the whitelist can be maintained at any time without restarting the service, which improves configuration efficiency and avoids service interruptions caused by service restart.

[0043] The whitelist-based authentication management system described in the present invention significantly improves the maintenance efficiency of the whitelist configuration and the security of the system by implementing group specification management and online refresh functions, so that when faced with a large number of configurations, the required configuration can be quickly located and maintained, effectively reducing maintenance costs and risks caused by configuration errors; at the same time, the real-time update capability of the whitelist ensures the continuity and response speed of the service, avoids interruptions caused by service restarts, and thus improves the stability and reliability of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The present invention has the following accompanying drawings:

[0045] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0046] Figure 1 System architecture diagram of embodiment 1 of a whitelist-based authentication management system described in the present invention. DETAILED DESCRIPTION

[0047] The present invention is further described in detail below in conjunction with the accompanying drawings. The detailed description is a description made in conjunction with exemplary embodiments of the present invention, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0048] like Figure 1 As shown, the whitelist-based authentication management system described in the present invention includes:

[0049] An authentication request parsing module is used to receive an authentication request and obtain a first keyword and a second keyword from the authentication request according to a preset classification rule; the keywords are used for subsequent whitelist matching and authentication decision-making;

[0050] Whitelist configuration management module, used for whitelist configuration management, including whitelist grouping, storage and reading of whitelist configuration information;

[0051] Based on the first keyword, the whitelist configuration management module classifies the application service that initiates the authentication request, creates a corresponding exclusive whitelist configuration management node for each application service, and allocates at least one whitelist configuration information to the whitelist configuration management node;

[0052] During initialization or dynamic update, the whitelist configuration management module obtains the whitelist configuration information and loads the information into the cache;

[0053] The authentication and forwarding module reads the whitelist configuration information in the cache and authenticates the authentication request based on the second keyword, and determines the forwarding routing information of the authentication request.

[0054] Through precise whitelist management and authentication mechanisms, the system can effectively prevent unauthorized access and enhance system security; the system supports whitelist configuration based on multiple keywords, and can be flexibly grouped and configured according to different application services and business needs, making the system easy to expand and adapt to different usage scenarios.

[0055] The whitelist configuration management node is a logical unit in the system used to store and manage specific categories of whitelist configuration information. It classifies application services according to the first keyword (such as application service type, request path, etc.). Each application service is assigned an exclusive whitelist configuration management node, so that specific security policies and access control rules can be customized for different application services; application services can also be clustered into application service groups and then assigned exclusive whitelist configuration management nodes; whitelist configuration management nodes can form a hierarchical or modular organizational structure for easy management and maintenance.

[0056] Whitelist configuration information is the specific data stored in the whitelist configuration management node, which is used for actual authentication and access control decisions. The two are interdependent and together constitute the core part of the authentication management system.

[0057] On the basis of the above technical solution, the preset classification rule is any one of the following, or a mixed granularity grouping rule formed by a combination of at least two of the following preset classification rules according to priority:

[0058] The whitelist is grouped according to the first path of the request path;

[0059] Group the whitelist according to the type of application service;

[0060] Group the whitelist based on the range of client IP addresses;

[0061] Group the whitelist by user account;

[0062] Group the whitelist based on the access rights of user accounts;

[0063] Group the whitelist according to business scenarios;

[0064] Group the whitelist according to the specified HTTP header information;

[0065] Whitelist groups based on request parameters.

[0066] Hybrid granularity grouping rules are a flexible strategy that allows grouping of whitelists based on a combination of multiple conditions, which allows for more granular control of access rights and ensures security and efficiency. The following is an example:

[0067] Example 1: Group requests based on the first path of the request path (such as / api, / user) and the type of application service (such as Web service, API service). For example, group all Web service requests that access the / api path into one group, and group all API service requests that access the / user path into another group.

[0068] Example 2: Combine client IP address ranges, user accounts, and user account access permissions to ensure that only specific user accounts from specific IP ranges can access certain authorized resources.

[0069] Example 3: Grouping based on business scenarios and specified HTTP header information (such as X-Custom-Header) to meet different business needs. For example, for API calls that require specific authentication information, you can group them based on the authentication information in the HTTP header and the business scenario.

[0070] Example 4: Grouping based on request parameters and business scenarios to ensure that only requests that meet specific business logic are allowed. For example, if the request parameters contain a preset identification ID, grouping is performed under the preset business scenario (such as settlement, query list, etc.).

[0071] These mixed-granularity grouping rules allow for more precise control of access rights while maintaining system flexibility and scalability.

[0072] Based on the above technical solution, the whitelist configuration information is stored in the nacos configuration management and service management platform;

[0073] The nacos configuration management and service management platform provides a configuration management list to maintain the published whitelist configuration information;

[0074] The nacos configuration management and service management platform provides a subscription interface for subscribing to whitelist configuration information, and dynamically obtains the latest whitelist configuration information through the subscription interface.

[0075] On the basis of the above technical solutions, it also includes:

[0076] The forwarding controller transparently transmits or directly forwards the authentication request if the second keyword matches the whitelist configuration information; if the second keyword does not match the whitelist configuration information, the request is rejected or other authentication processes are performed.

[0077] The forwarding controller is the execution unit in the authentication management system. It is responsible for deciding how to handle the authentication request based on the result of matching the second keyword with the whitelist configuration information. The processing of the authentication request includes: transparent transmission (directly passed to the target service), forwarding (sent to a specific service according to routing information) or rejection (not allowing access). By rejecting unmatched requests, the forwarding controller enhances the security of the system and ensures that only authenticated requests can access system resources.

[0078] By quickly processing matching requests, the forwarding controller can reduce system response time and improve overall efficiency; by rejecting unauthorized requests, the forwarding controller helps prevent unauthorized access and potential security threats.

[0079] On the basis of the above technical solutions, it also includes:

[0080] The intranet access control module specifically processes intranet access requests according to the range of the client IP address, obtains the whitelist configuration information applicable to the intranet application scenario according to the intranet adaptation identifier in the whitelist configuration information, authenticates the authentication request, and determines the forwarding routing information of the authentication request.

[0081] The intranet access control module is a module in the authentication management system that specifically handles intranet access requests, ensuring that these requests comply with the intranet's security policies and access control requirements. In this way, the system can more effectively protect intranet resources and prevent unauthorized access and potential security threats. Specifically, it includes:

[0082] In terms of intranet adaptation, by checking the intranet adaptation identifier in the whitelist configuration information, this module can obtain specific whitelist configuration information suitable for intranet application scenarios, and obtain the whitelist configuration suitable for the intranet environment based on the intranet adaptation identifier in the whitelist configuration information.

[0083] In terms of authentication decisions, the authentication request is authenticated using the intranet-specific whitelist configuration information obtained to ensure that only requests that comply with the intranet security policy are allowed.

[0084] In terms of routing decisions, determine the forwarding routing information for the authentication request to ensure that the request is correctly routed to the target intranet service.

[0085] On the basis of the above technical solutions, it also includes:

[0086] The dynamic configuration refresh module is responsible for monitoring changes in the whitelist configuration information. When there are changes, it initiates a dynamic update request to the whitelist configuration management module and sends the latest whitelist configuration information to the whitelist configuration management module.

[0087] Based on the above technical solution, the dynamic configuration refresh module monitors the changes of the whitelist configuration information in real time by subscribing to change notifications.

[0088] For example: subscribe to the change notification of the nacos configuration service, and when the configuration change is monitored, obtain the latest whitelist configuration information from the nacos configuration management and service management platform.

[0089] On the basis of the above technical solutions, it also includes:

[0090] The configuration update synchronizer is used to maintain a configuration cache routing list. When the whitelist configuration management module loads the whitelist configuration information into the cache, it saves a configuration node route to the configuration cache routing list according to the cache success feedback, and obtains a unique identification ID from the configuration update synchronizer.

[0091] When a dynamic update request is initiated to the whitelist configuration management module, the configuration update synchronizer synchronizes the dynamic update request to each configuration node route until all configuration node routes feedback that the update is complete.

[0092] This embodiment can ensure that after the configuration is updated, all relevant caches and states inside the gateway are updated synchronously to maintain system consistency.

[0093] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0094] The above description is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiment. Any equivalent modifications or changes made by those skilled in the art based on the contents disclosed by the present invention should be included in the protection scope recorded in the claims.

Claims

1. A whitelist-based authentication management system, characterized in that: include: An authentication request parsing module, used for receiving an authentication request and obtaining a first keyword and a second keyword from the authentication request according to a preset classification rule; Whitelist configuration management module, used for whitelist configuration management, including whitelist grouping, storage and reading of whitelist configuration information; Based on the first keyword, the whitelist configuration management module classifies the application service that initiates the authentication request, creates a corresponding exclusive whitelist configuration management node for each application service, and allocates at least one whitelist configuration information to the whitelist configuration management node; During initialization or dynamic update, the whitelist configuration management module obtains the whitelist configuration information and loads the information into the cache; The authentication and forwarding module reads the whitelist configuration information in the cache and authenticates the authentication request based on the second keyword, and determines the forwarding routing information of the authentication request.

2. The whitelist-based authentication management system according to claim 1, characterized in that: The preset classification rule is any one of the following, or a mixed granularity grouping rule formed by a combination of at least two of the following preset classification rules according to priority: The whitelist is grouped according to the first path of the request path; Group the whitelist according to the type of application service; Group the whitelist based on the range of client IP addresses; Group the whitelist by user account; Group the whitelist based on the access rights of user accounts; Group the whitelist according to business scenarios; Group the whitelist according to the specified HTTP header information; Whitelist groups based on request parameters.

3. The whitelist-based authentication management system according to claim 1, characterized in that: Whitelist configuration information is stored in the nacos configuration management and service management platform; The nacos configuration management and service management platform provides a configuration management list to maintain the published whitelist configuration information; The nacos configuration management and service management platform provides a subscription interface for subscribing to whitelist configuration information, and dynamically obtains the latest whitelist configuration information through the subscription interface.

4. The whitelist-based authentication management system according to claim 1, characterized in that: Also includes: The forwarding controller transparently transmits or directly forwards the authentication request if the second keyword matches the whitelist configuration information; If the second keyword does not match the whitelist configuration information, the request is rejected or other authentication processes are performed.

5. The whitelist-based authentication management system according to claim 1, characterized in that: Also includes: The intranet access control module specifically processes intranet access requests according to the range of the client IP address, obtains the whitelist configuration information applicable to the intranet application scenario according to the intranet adaptation identifier in the whitelist configuration information, authenticates the authentication request, and determines the forwarding routing information of the authentication request.

6. The whitelist-based authentication management system according to claim 1, characterized in that: Also includes: The dynamic configuration refresh module is responsible for monitoring changes in the whitelist configuration information. When there are changes, it initiates a dynamic update request to the whitelist configuration management module and sends the latest whitelist configuration information to the whitelist configuration management module.

7. The whitelist-based authentication management system according to claim 6, characterized in that: The dynamic configuration refresh module monitors changes in whitelist configuration information in real time by subscribing to change notifications.

8. The whitelist-based authentication management system according to claim 1, characterized in that: Also includes: The configuration update synchronizer is used to maintain a configuration cache routing list. When the whitelist configuration management module loads the whitelist configuration information into the cache, it saves a configuration node route to the configuration cache routing list according to the cache success feedback, and obtains a unique identification ID from the configuration update synchronizer. When a dynamic update request is initiated to the whitelist configuration management module, the configuration update synchronizer synchronizes the dynamic update request to each configuration node route until all configuration node routes feedback that the update is complete.

Images