Authorization method, system and device based on micro-service architecture and medium

Abstract

The invention discloses an authorization method, system and device based on a micro-service architecture and a medium, and the method comprises the steps: receiving a first authorization request of a client, decomposing the first authorization request to obtain a business model parameter, obtaining a business classification, a business affiliation relation and business historical data according to the business model parameter, and storing the business classification, the business affiliation relation and the business historical data; determining whether a service classification authorization script, an authorization script to which the service belongs and a historical access authorization script exist at the gateway side, and if a verification authorization script set exists at the gateway side, substituting the service classification into the service classification authorization script to perform first-layer authorization verification; substituting the service affiliation relation into the service affiliation authorization script to perform second-layer authorization verification; and substituting the historical service data into the historical access authorization script to perform third-layer authorization verification, and if the first-layer authorization verification, the second-layer authorization verification and the third-layer authorization verification pass verification, returning calling data to the client. According to the invention, flexible authorization in a fine-grained service scene can be realized, and the method can be applied to the technical field of micro-service architecture.

Description

Technical Field

[0001] The present invention relates to the field of microservice architecture technology, and in particular to an authorization method, system, device and medium based on a microservice architecture. Background Art

[0002] In the design and development of general systems, different functions rarely establish associations due to differences in data structures and models. With the development of digitalization and artificial intelligence, the data relationships between systems and between different functions within the system have become more complicated. Effective labeling can improve the quality of data on the one hand, and on the other hand, it can build more data relationships to support business expansion and fine-grained data processing capabilities. With the increase in application functions, the construction of more fine-grained data relationships can be authorized based on functions and general relationships. Authorization based on functions and general relationships is not convenient for establishing scalable data business relationships, and the authorization granularity is not flexible and specific, which affects data sharing, exchange and business docking between systems. The system has strong constraints and insufficient expansion capabilities. Data security has problems such as inadequate management and supervision in fine-grained business scenarios. Summary of the invention

[0003] In order to solve one of the above problems, the purpose of the present invention is to provide an authorization method, system, device and medium based on a microservice architecture, which can realize flexible authorization in fine-grained business scenarios and improve the management and supervision effects.

[0004] On the one hand, the present invention provides an authorization method based on a microservice architecture, comprising the following steps:

[0005] Receiving a first authorization request from a client, decomposing the first authorization request to obtain a business model parameter, and obtaining a business classification, a business affiliation, and business history data according to the business model parameter;

[0006] Determine whether there is a verification and authorization script collection on the gateway side; the verification and authorization script collection includes a business classification authorization script, a business belonging authorization script and a historical access authorization script;

[0007] If the verification and authorization script collection exists on the gateway side, the service classification is substituted into the service classification authorization script for the first layer of authorization verification; the service affiliation is substituted into the service affiliation authorization script for the second layer of authorization verification; the service history data is substituted into the history access authorization script for the third layer of authorization verification;

[0008] If the first-layer authorization verification, the second-layer authorization verification and the third-layer authorization verification all pass the verification, the call data is returned to the client.

[0009] Optionally, determining whether there is a verification authorization script collection on the gateway side specifically includes:

[0010] Substituting the business classification, the business belonging relationship and the business history data into a preset expression for matching, if a key-value pair of a business classification authorization script is matched, determining that the business classification authorization script exists;

[0011] If a key-value pair of an authorization script to which the business belongs is matched, it is determined that the authorization script to which the business belongs exists;

[0012] If a key-value pair of a historical access authorization script is matched, it is determined that the historical access authorization script exists.

[0013] Optionally, if the verification and authorization script collection does not exist on the gateway side, the gateway side sends a second authorization request to the container group;

[0014] so that the container group generates the service classification authorization script, the service belonging authorization script and the historical access authorization script according to the second authorization request;

[0015] The service classification authorization script, the service belonging authorization script and the historical access authorization script are returned to the gateway side.

[0016] Optionally, the second authorization request includes the service classification, the service affiliation, and the service history data; the container group generates the service classification authorization script, the service affiliation authorization script, and the history access authorization script according to the second authorization request, specifically including:

[0017] Identify the service classification, obtain the authorization configuration and the first execution logic of the service classification, and generate the service classification authorization script according to the authorization configuration and the first execution logic of the service classification;

[0018] Identify the business belonging relationship, obtain the authorization configuration and the second execution logic of the business belonging relationship, and generate the business belonging authorization script according to the authorization configuration of the business belonging relationship and the second execution logic;

[0019] The business history data is matched to obtain new business history data, and the new business history data is converted into the historical access authorization script.

[0020] Optionally, returning the service classification authorization script, the service belonging authorization script and the historical access authorization script to the gateway side specifically includes:

[0021] Sorting the business classification authorization script, the business belonging authorization script and the historical access authorization script and removing repeated expressions of script calls, and adding the removed results to a queue;

[0022] The queue is serialized, and the serialized queue is returned to the gateway side.

[0023] Optionally, the service classification authorization script, the service belonging authorization script and the historical access authorization script are cached on the gateway side in a buffer stack manner.

[0024] On the other hand, the present invention provides an authorization system based on a microservice architecture, including a gateway diversion module and a gateway authorization module, wherein:

[0025] The gateway distribution module is used to receive a first authorization request from a client, decompose the first authorization request to obtain a service model parameter, and obtain a service classification, a service affiliation, and service history data according to the service model parameter;

[0026] The gateway authorization module is used to determine whether there is a verification authorization script collection on the gateway side; the verification authorization script collection includes a business classification authorization script, a business affiliation authorization script and a historical access authorization script; if the verification authorization script collection exists on the gateway side, the business classification is substituted into the business classification authorization script for a first-level authorization verification; the business affiliation relationship is substituted into the business affiliation authorization script for a second-level authorization verification; the business history data is substituted into the historical access authorization script for a third-level authorization verification; if the first-level authorization verification, the second-level authorization verification and the third-level authorization verification all pass the verification, the call data is returned to the client.

[0027] Optionally, the system further comprises a parsing and generating module, wherein the parsing and generating module is configured to cause the gateway side to send a second authorization request to the container group if the verification and authorization script collection does not exist on the gateway side;

[0028] The container group generates the service classification authorization script, the service belonging authorization script and the historical access authorization script according to the second authorization request;

[0029] The service classification authorization script, the service belonging authorization script and the historical access authorization script are returned to the gateway side.

[0030] Optionally, the gateway authorization module includes a plug-in execution unit, and the plug-in execution unit is used to cache the returned service classification authorization script, the service belonging authorization script and the historical access authorization script in the gateway authorization module in a buffer stack manner.

[0031] On the other hand, the present invention provides an authorization device based on a microservice architecture, comprising:

[0032] at least one processor;

[0033] at least one memory for storing at least one program;

[0034] When the at least one program is executed by the at least one processor, the at least one processor implements the method described above.

[0035] In another aspect, the present invention provides a computer-readable storage medium storing a program executable by a processor. When the program executable by the processor is executed by the processor, it is used to perform the method as described above.

[0036] Implementation of the present invention includes the following beneficial effects: by receiving a first authorization request from a client, decomposing the first authorization request to obtain business model parameters, and obtaining business classification, business affiliation and business history data according to the business model parameters; determining whether there is a verification authorization script collection on the gateway side; the verification authorization script collection includes a business classification authorization script, a business affiliation authorization script and a historical access authorization script; if there is a verification authorization script collection on the gateway side, the business classification is substituted into the business classification authorization script for a first-level authorization verification; the business affiliation is substituted into the business affiliation authorization script for a second-level authorization verification; the business history data is substituted into the historical access authorization script for a third-level authorization verification; if the first-level authorization verification, the second-level authorization verification and the third-level authorization verification are all verified, the call data is returned to the client; by respectively substituting the business classification, the business affiliation and the business history data into different authorization scripts, executing different authorization logics, and performing three levels of authorization verification, the business Pod participating in the business is obtained, which can better handle data relationships, improve fine-grained data processing capabilities, realize flexible authorization in fine-grained business scenarios, and improve management and supervision effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a step flow chart of an authorization method based on microservice architecture provided by the present invention;

[0038] Figure 2 It is a data structure diagram of a service classification, service affiliation and service history data provided by the present invention;

[0039] Figure 3 The present invention provides a flow chart for substituting business model parameters into a preset expression to obtain relevant data;

[0040] Figure 4 It is a flow chart of steps for generating an authorization script provided by the present invention;

[0041] Figure 5 It is a flow chart of steps for generating an authorization script provided by the present invention;

[0042] Figure 6It is a flowchart of the steps of returning the authorization script to the gateway side provided by the present invention;

[0043] Figure 7 It is a structural diagram of an authorization system based on a microservice architecture provided by the present invention;

[0044] Figure 8 It is a structural diagram of another authorization system based on microservice architecture provided by the present invention;

[0045] Fig. 9 This is a system structure diagram of Istio providing microservices provided by the present invention;

[0046] Fig.10 It is a structural diagram of an authorization device based on a microservice architecture provided by the present invention. DETAILED DESCRIPTION

[0047] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0048] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present application. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0049] When the following description relates to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. In the description of the present application, it is necessary to understand that the terms "first / S100", "second / S200", "third / S300", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0050] In order to better understand the technical solution of the present invention, this embodiment takes the Istio service platform as an example for explanation.

[0051] Among them, Istio is an open source service mesh platform, which belongs to the cloud native technology system and aims to provide a unified, intelligent and flexible method for microservice architecture to connect, monitor, protect and control the communication between services. Istio can simplify the deployment, expansion and management of microservices, while providing advanced network functions for developers and operation and maintenance teams.

[0052] Business model: a model built according to activities and stakeholder participation content. It is a data storage logic model and is a model built in a globally unified and standardized manner. Its main contents include activity code, creator, creation time, content, secondary participation and other related information.

[0053] like Figure 1-2 As shown, Figure 1 It is a step flow chart of the authorization method based on microservice architecture. Figure 2 The present invention provides a data structure diagram of business classification, business affiliation and business history data, and provides an authorization method based on microservice architecture, including the following steps:

[0054] S100: Receive a first authorization request from a client, decompose the first authorization request to obtain business model parameters, and obtain business classification, business affiliation, and business history data according to the business model parameters.

[0055] Among them, Figure 2 As shown, business classification includes but is not limited to classification number, authorization mode, authorization ownership, authorization role and matching expression; business ownership relationship includes but is not limited to business number, participation channel, participation function point, participation role and dual expression; business history data includes but is not limited to business number, participant, participation method, participation frequency and number expression.

[0056] The business model parameters include, but are not limited to, the business identification number (ie, the business ID).

[0057] Specifically, the uplink data stream sent by the client (browser and other front-end pages) includes business data and the first authorization request, which includes business model parameters. When the uplink data is received on the gateway side of Istio, the gateway diversion module on the gateway side uses WASM technology to build a WASM plug-in, and uses the WASM plug-in to split the uplink data stream to obtain business data and the first authorization request. The business data is sent to the predetermined business Pod along the original path for processing. The first authorization request is parsed to obtain business model parameters, and matching is performed based on the business model parameters to obtain business classification, business affiliation, and business history data. The gateway diversion module completes the dual-channel diversion processing of business data and the first authorization request, and realizes hierarchical processing. It effectively separates the processing of general capabilities and business data, simplifies business processing, and improves the scalability and security of the system.

[0058] According to the matching of business model parameters, the business model parameters can be substituted into the preset expression, and the business classification, business affiliation and business history data can be obtained. Figure 3 As shown, Figure 3 It is a flowchart for substituting business model parameters into preset expressions to obtain relevant data. Substituting business model parameters, such as business ID, into preset expressions, the execution logic of the preset expressions can be to obtain business classification and results according to the business ID, and to obtain participation paths and historical data according to the business classification. Participation paths include but are not limited to model participation and instance participation.

[0059] Based on the model participation, participants and classification numbers are obtained; based on the participants, authorization models are obtained. Authorization models include but are not limited to classification participation and role participation; based on the instance participation, business types and participation methods are obtained. Participation methods include but are not limited to process participation and invitation participation.

[0060] Determine based on historical data if there is historical participation, determine whether historical participation is disabled, if disabled, calculate the number of disablements, determine whether participation is successful, if successful, determine the number of participations, etc.

[0061] It is worth noting that Figure 3 It is just a feasible execution logic.

[0062] S200: Determine whether there is a collection of verification and authorization scripts on the gateway side.

[0063] Among them, the verification authorization script collection includes business classification authorization script, business affiliation authorization script and historical access authorization script.

[0064] Specifically, a preset expression for matching scripts is cached on the gateway side, and the business classification, business affiliation and business history data are substituted into the preset expression for execution. During the execution process, if a corresponding script exists, the corresponding execution result, such as the corresponding key-value pair, is returned.

[0065] If the expression is executed and the key-value pair of the business classification authorization script is returned, and it is confirmed that the business classification authorization script exists, the business classification authorization script is called to perform the first-level authorization verification.

[0066] If the key-value pair of the business authorization script is returned and it is confirmed that the business authorization script exists, the business authorization script is called to perform the second-level authorization verification.

[0067] If the key-value pair of the historical access authorization script is returned and it is confirmed that the historical access authorization script exists, the historical access authorization script is called to perform the third-layer authorization verification.

[0068] S300a. If there is a collection of verification and authorization scripts on the gateway side, substitute the business classification into the business classification authorization script for the first layer of authorization verification; substitute the business affiliation into the business affiliation authorization script for the second layer of authorization verification; substitute the business history data into the history access authorization script for the third layer of authorization verification.

[0069] Specifically, if the gateway side has a service classification authorization script cached, the service classification authorization script is called, the service classification is substituted into the service classification authorization script, and the service classification authorization script is executed to obtain the service Pod required to complete the service.

[0070] If the gateway side has a business authorization script cached, call the business authorization script, substitute the business ownership relationship into the business authorization script, execute the business authorization script, and obtain the business Pod required to complete the business.

[0071] If there is a historical access authorization script cached on the gateway side, call the historical access authorization script, substitute the business historical data into the historical access authorization script, execute the historical access authorization script, and obtain the business Pod required to complete the business.

[0072] If the gateway side does not exist, that is, any of the above-mentioned business classification authorization scripts, business belonging authorization scripts, and historical access authorization scripts are not cached, the gateway side can send a second authorization request to the corresponding Pod, generate an authorization script that does not exist on the gateway side, and return the generated authorization script to the gateway side.

[0073] Among them, the first layer of authorization verification is defined based on the authorization role, focusing on the division of responsibilities of different users or system components; the second layer of authorization verification is defined according to the flow mode, managing the process and state changes of activities; the third layer of authorization verification is defined based on historical access data, using past interaction records to optimize and adjust the current logical processing.

[0074] For the authorization scripts in the buffer, the gateway calls the wasm plug-in to load the business classification authorization script, business belonging authorization script and historical access authorization script returned above. If the execution result is successful, the output obtained by executing the authorization script is brought into the original path of the aforementioned business data. After passing the authorization verification, the same authorization processing does not need to be authorized again. The output merge expression obtained by calling the plug-in to execute the authorization script completes the data integration and returns it to the client.

[0075] S400: If the first-layer authorization verification, the second-layer authorization verification, and the third-layer authorization verification all pass verification, the call data is returned to the client.

[0076] Specifically, if the first layer authorization verification, the second layer authorization verification and the third layer authorization verification are all verified, several business Pods that complete the business can be obtained. The gateway side transfers data packets to the business Pod, where the data packets may include but are not limited to business classification, business affiliation, business historical data and callback address. The business Pod executes the callback through the data packet, and returns the callback data obtained by the execution to the browser side to complete the corresponding business function. Among them, the business Pod can perform the functions of calculating and storing business data. It runs independently in a microservice manner. The business Pod provides external calls and callback interfaces. After passing the verification, it can provide calls to related functions through external calls and callback interfaces. For example, the business data is input into the business Pod, and the relevant calculation process is executed in the business Pod. The calculation results are returned through external calls and callback interfaces. In this way, multiple businesses can share the same business Pod to realize Pod sharing.

[0077] In some embodiments, the above method may also include S500, automatic update of the authorization script. When the authorization logic of the container group changes, the corresponding business classification authorization script, business belonging authorization script and historical access authorization script are generated according to the changed authorization logic, and returned to the gateway side and cached on the gateway side. When the gateway side receives uplink data, it can perform authorization according to the above steps S100-S400.

[0078] After the business data is sent along the original path to the predetermined business Pod for processing, the obtained data and the data obtained through authorization verification are returned to the gateway side. The wasm plug-in on the gateway side merges the data obtained from the two paths by calling the merge expression, and then returns the merged data to the client (caller).

[0079] In some embodiments, in the authorization Pod on the container group side, three levels of authorization expressions are constructed in a hierarchical manner, namely, business classification, business affiliation, and business history data. Each authorization expression handles the authorization logic related to business classification, business affiliation, and business history data respectively. The authorization expression can be called by the corresponding authorization script to complete the authorization. The authorization logic is not an authentication process, but a process of obtaining a business Pod. Figure 4 As shown, Figure 4 The flowchart is a step flow chart of generating an authorization script, wherein step S300 also includes step S300b, specifically including:

[0080] S310b: If the verification authorization script collection does not exist on the gateway side, the gateway side sends a second authorization request to the container group.

[0081] Specifically, if any authorization script in the verification authorization script collection does not exist on the gateway side, the gateway side sends a second authorization request to the container group to request the authorization Pod to return the non-existent authorization script.

[0082] The second authorization request may include, but is not limited to, business model parameters, business classification, business affiliation, and business history data.

[0083] S320b, so that the container group generates a service classification authorization script, a service belonging authorization script and a historical access authorization script according to the second authorization request.

[0084] After receiving the second authorization request, the authorization Pod of the container group parses the second authorization request to obtain business model parameters, business classification, business affiliation, business history data, and the like.

[0085] like Figure 5 As shown, Figure 5 The invention is a flowchart of steps for generating an authorization script. In step S320b, the container group generates a service classification authorization script, a service belonging authorization script and a historical access authorization script according to the second authorization request, specifically including:

[0086] S321b. Identify the business classification, obtain the authorization configuration and the first execution logic of the business classification, and generate the business classification authorization script according to the authorization configuration and the first execution logic of the business classification.

[0087] The first execution logic is used to associate the classification number, authorization mode, authorization ownership, authorization role and matching expression in the business classification to obtain the business Pod that needs to be called to complete the corresponding business.

[0088] The business classification authorization script may be a file, wherein the file includes a script program and an expression program related to the business classification authorization, and the script program and the expression program may call each other.

[0089] Specifically, the authorization Pod identifies the business classification, obtains the authorization configuration and the first execution logic corresponding to the business classification, wherein the authorization configuration and the first execution logic corresponding to the business classification can be dynamically changed. When they change, the aforementioned step S500 can be actively executed to generate an expression program and a script program according to the authorization configuration and the first execution logic.

[0090] S322b, identifying the business belonging relationship, obtaining the authorization configuration and the second execution logic of the business belonging relationship, and generating the business belonging authorization script according to the authorization configuration and the second execution logic of the business belonging relationship.

[0091] The second execution logic is used to execute and convert the business number, participation path, participation function point, participation role and double expression in the business affiliation relationship to obtain a part of the business Pod that needs to be called to complete the corresponding business.

[0092] The business authorization script may be a file, which includes script programs and expression programs related to the business authorization.

[0093] Specifically, the authorization Pod identifies the business ownership relationship, obtains the authorization configuration and the second execution logic of the business ownership relationship, and generates script programs and expression programs related to the business ownership authorization according to the authorization configuration and the second execution logic of the business ownership relationship.

[0094] S323b, matching the business history data to obtain new business history data, and converting the new business history data into a historical access authorization script.

[0095] The business authorization script may be a file, which includes a script program and an expression program related to the business authorization.

[0096] Specifically, the authorization Pod identifies and matches the business historical data, converts the business historical data that has been circulated and participated in a special way in the business into new business historical data, and matches the script programs and expression programs related to the historical access authorization in the authorization Pod according to the new business historical data.

[0097] In some embodiments, for businesses that cannot adapt to the authorization script to which the business belongs, the business history data is used as the basis to locate the specific participants and participation methods, and the business number, participation frequency and direct participants are used as the relationship data as the execution logic to generate a historical access authorization script.

[0098] In some embodiments, if the authorization logic of any layer of authorization verification changes, the corresponding steps S321b, S322b or S323b are executed according to the changed authorization logic, and the obtained script program and expression program are returned to the gateway side. For example, if the first execution logic changes, step S321b is executed to obtain the expression program and script program related to the business classification authorization, and the expression program and script program related to the business classification authorization are returned to the gateway side to replace the expression program and script program related to the business classification authorization originally existing on the gateway side, that is, the update process of the aforementioned step S500.

[0099] In some embodiments, if the authorization logic changes, the authorization Pod sends an update instruction to the gateway side to notify the gateway side to update the authorization script. The update instruction may include but is not limited to the changed authorization logic.

[0100] If the gateway side responds to the update instruction, the corresponding steps in step S321b, S322b or S323b are executed according to the changed authorization logic. If the gateway side does not respond to the update instruction, the update strategy is not executed.

[0101] S330b, returning the service classification authorization script, service belonging authorization script and historical access authorization script to the gateway side.

[0102] Specifically, when the gateway side sends the second authorization request to the container group for the first time, the business classification authorization script, the business authorization script and the historical access authorization script can be directly executed in the authorization Pod, and the address of the executed business Pod, the business classification authorization script, the business authorization script and the historical access authorization script are returned to the gateway side.

[0103] The business classification authorization script, business affiliation authorization script and historical access authorization script can also be returned to the gateway side, and the gateway side executes the business classification authorization script, business affiliation authorization script and historical access authorization script to perform first-layer authorization, second-layer authorization and third-layer authorization.

[0104] After the authorization Pod returns the business classification authorization script, business affiliation authorization script and historical access authorization script to the gateway side, the plug-in execution unit on the gateway side can cache the returned business classification authorization script, business affiliation authorization script and historical access authorization script in the form of a buffer stack on the gateway side. When receiving uplink data next time, the business classification authorization script, business affiliation authorization script and historical access authorization script can be directly called on the gateway side for three-layer authorization without sending a second authorization request to the authorization Pod again.

[0105] Through the above S310b-S330b, the relevant authorization scripts are cached on the gateway side. After completing one authorization verification, a second authorization verification can be quickly performed in the form of an authorization script, thereby improving the response speed and processing efficiency. Through dynamic calls on the gateway side, the reusability and scalability of the system are achieved.

[0106] In some embodiments, Figure 6 As shown, Figure 6 It is a flowchart of the steps of returning the authorization script to the gateway side. Step S330b returns the activity classification authorization script, the activity belonging authorization script and the historical access authorization script to the gateway side, specifically including:

[0107] S331b, sort the activity classification authorization scripts, activity belonging authorization scripts and historical access authorization scripts, remove repeated expressions of script calls, and add the removed results to the queue.

[0108] Specifically, expression programs related to business classification authorization, expression programs related to business affiliation authorization, and expression programs related to historical access authorization are integrated, expression programs are sorted according to the most recent access authorization, duplicate expression programs are eliminated, and the remaining expression programs and script programs after eliminating duplicate expression programs are added to the queue.

[0109] S332b, serialize the queue, and return the serialized queue to the gateway side.

[0110] Specifically, the expression program and script program in the queue are serialized, and the serialized queue is returned to the gateway side.

[0111] After receiving the serialized queue, namely the serialized business classification authorization script, business belonging authorization script and historical access authorization script, the gateway side caches them in the form of a buffer stack on the gateway side.

[0112] In some embodiments, the aforementioned method may further include S340b: caching the returned service classification authorization script, the service belonging authorization script and the historical access authorization script on the gateway side in a buffer stack manner.

[0113] like Figure 7 As shown, Figure 7 The present invention is a schematic diagram of a microservices-based authorization system. The present invention also provides a microservices-based authorization system, including a gateway diversion module and a gateway authorization module, wherein:

[0114] The gateway distribution module is used to receive the first authorization request from the client, decompose the first authorization request to obtain business model parameters, and obtain business classification, business belonging relationship and business history data according to the business model parameters;

[0115] The gateway authorization module is used to determine whether there is a verification authorization script collection on the gateway side; the verification authorization script collection includes business classification authorization script, business affiliation authorization script and historical access authorization script; if there is a verification authorization script collection on the gateway side, the business classification is substituted into the business classification authorization script for the first layer of authorization verification; the business affiliation relationship is substituted into the business affiliation authorization script for the second layer of authorization verification; the business history data is substituted into the historical access authorization script for the third layer of authorization verification; if the first layer of authorization verification, the second layer of authorization verification and the third layer of authorization verification are all verified, the call data is returned to the client.

[0116] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0117] In some embodiments, the gateway diversion module is specifically used to substitute the business classification, business affiliation and business history data into a preset expression for matching. If a key-value pair of a business classification authorization script is matched, it is determined that a business classification authorization script exists; if a key-value pair of a business affiliation authorization script is matched, it is determined that a business affiliation authorization script exists; if a key-value pair of a historical access authorization script is matched, it is determined that a historical access authorization script exists.

[0118] It can be seen that the contents of the above method embodiments are all applicable to the gateway diversion module embodiments. The functions specifically implemented by this system embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0119] like Figure 8 As shown, Figure 8 It is a structural diagram of another authorization system based on microservice architecture. The system also includes a parsing and generating module, which is used for sending a second authorization request to the container group on the gateway side if there is no verification authorization script collection on the gateway side; the container group generates a business classification authorization script, a business belonging authorization script and a historical access authorization script according to the second authorization request; and returns the business classification authorization script, the business belonging authorization script and the historical access authorization script to the gateway side.

[0120] In some embodiments, the parsing and generation module is specifically used to identify business classifications, obtain authorization configurations and first execution logic for business classifications, and generate business classification authorization scripts based on the authorization configurations and first execution logic for business classifications; identify business affiliations, obtain authorization configurations and second execution logic for business affiliations, and generate business affiliation authorization scripts based on the authorization configurations and second execution logic for business affiliations; match business history data to obtain new business history data, and convert the new business history data into historical access authorization scripts.

[0121] The parsing and generating module is also specifically used to sort the business classification authorization scripts, business belonging authorization scripts and historical access authorization scripts and remove repeated expressions of script calls, and add the removed results to the queue; serialize the queue, and return the serialized queue to the gateway side.

[0122] It can be seen that the contents in the above method embodiments are all applicable to the parsing generation module in the embodiments, the functions specifically implemented by the present system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0123] In some embodiments, Figure 8 As shown, the gateway authorization module includes a plug-in execution unit (which may be a WASM plug-in) for caching the returned business classification authorization script, business belonging authorization script and historical access authorization script in the gateway authorization module in the form of a buffer stack.

[0124] In some embodiments, the parsing generation module may also be used to perform declaration lifecycle management, etc.

[0125] The implementation of the present invention includes the following beneficial effects: the present invention obtains the business Pod participating in the business by respectively substituting business classification, business affiliation and business history data into different authorization scripts, executing different authorization logics, and performing three levels of authorization verification. It can better handle data relationships, improve fine-grained data processing capabilities, realize flexible authorization in fine-grained business scenarios, improve management and supervision effects, increase the accuracy and standardization of data authorization granularity, and improve the security of system data and business.

[0126] The present invention realizes layered processing by dual-channel shunting processing of business data and the first authorization request, effectively separates the processing of general capabilities and business data, simplifies business processing, and improves the scalability and security of the system.

[0127] The present invention caches the relevant authorization scripts on the gateway side through the above-mentioned S310b-S330b. After completing one authorization verification, the gateway layer implements component calling and fast authorization processing through wasm, and can quickly perform secondary authorization verification in the form of authorization scripts, thereby improving response speed and processing efficiency. Through dynamic calling on the gateway side, the reusability and scalability of the system are achieved.

[0128] like Fig. 9 As shown, Fig. 9 It is a system structure diagram of Istio providing microservices, including a client, an Istio gateway, and a Pod group. The Istio gateway is configured with a WASM plug-in. The Pod group includes an authorization Pod and a business Pod. The authorization Pod has a parsing generation module, and its functions are the same as those of the aforementioned method embodiments and system embodiments, which will not be repeated here.

[0129] It is understandable that the authorization method based on microservice architecture provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0130] The present invention can be applied to various types of authorization management and definition scenarios in general MIS or collaborative office scenarios based on ISTIO; it can also be applied to scenarios where the system has high requirements for data permissions and the setting requires that relevant permissions need to achieve fine-grained permission control.

[0131] like Fig.10 As shown, Fig.10 The present invention is a schematic diagram of a structure of an authorization device based on a microservice architecture. The present invention also provides an authorization device based on a microservice architecture, including:

[0132] at least one processor;

[0133] at least one memory for storing at least one program;

[0134] When the at least one program is executed by the at least one processor, the at least one processor implements the authorization method steps described in the above method embodiment.

[0135] Among them, the memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a remote memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0136] It can be seen that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0137] In addition, the embodiment of the present application also discloses a computer program product or a computer program, and the computer program product or the computer program is stored in a computer-readable storage medium. The processor of the computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above method. Similarly, the contents in the above method embodiment are all applicable to the storage medium embodiment, and the functions specifically implemented by the storage medium embodiment are the same as those in the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0138] The present invention also provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above method when executed by the processor.

[0139] It is understood that all or some steps and systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0140] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0141] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention, and these equivalent modifications or substitutions are all included in the scope defined by the claims of this application. In the present invention, those skilled in the art explicitly and implicitly understand that the embodiments described herein may be combined with other embodiments.

Claims

1. An authorization method based on microservice architecture, characterized in that: The following steps are involved: Receiving a first authorization request from a client, decomposing the first authorization request to obtain a business model parameter, and obtaining a business classification, a business affiliation, and business history data according to the business model parameter; Determine whether there is a collection of verification and authorization scripts on the gateway side; The verification authorization script collection includes business classification authorization script, business belonging authorization script and historical access authorization script; If the verification and authorization script collection exists on the gateway side, the service classification is substituted into the service classification authorization script to perform the first layer authorization verification; Substitute the business belonging relationship into the business belonging authorization script for second-level authorization verification; substitute the business history data into the historical access authorization script for third-level authorization verification; If the first-layer authorization verification, the second-layer authorization verification and the third-layer authorization verification all pass the verification, the call data is returned to the client.

2. The method according to claim 1, characterized in that Determining whether there is a verification authorization script collection on the gateway side specifically includes: Substituting the business classification, the business belonging relationship and the business history data into a preset expression for matching; If a key-value pair of a business classification authorization script is matched, it is determined that the business classification authorization script exists; If a key-value pair of an authorization script to which the business belongs is matched, it is determined that the authorization script to which the business belongs exists; If a key-value pair of a historical access authorization script is matched, it is determined that the historical access authorization script exists.

3. The method according to claim 1, characterized in that If the verification and authorization script collection does not exist on the gateway side, the gateway side sends a second authorization request to the container group; so that the container group generates the service classification authorization script, the service belonging authorization script and the historical access authorization script according to the second authorization request; The service classification authorization script, the service belonging authorization script and the historical access authorization script are returned to the gateway side.

4. The method according to claim 3, characterized in that The second authorization request includes the service classification, the service affiliation and the service history data; the container group generates the service classification authorization script, the service affiliation authorization script and the historical access authorization script according to the second authorization request, specifically including: Identify the service classification, obtain the authorization configuration and the first execution logic of the service classification, and generate the service classification authorization script according to the authorization configuration and the first execution logic of the service classification; Identify the business belonging relationship, obtain the authorization configuration and the second execution logic of the business belonging relationship, and generate the business belonging authorization script according to the authorization configuration of the business belonging relationship and the second execution logic; The business history data is matched to obtain new business history data, and the new business history data is converted into the historical access authorization script.

5. The method according to claim 3, characterized in that: The returning the service classification authorization script, the service belonging authorization script and the historical access authorization script to the gateway side specifically includes: Sorting the business classification authorization script, the business belonging authorization script and the historical access authorization script and removing repeated expressions of script calls, and adding the removed results to a queue; The queue is serialized, and the serialized queue is returned to the gateway side.

6. The method according to any one of claims 3 to 5, characterized in that: The method further comprises: caching the service classification authorization script, the service belonging authorization script and the historical access authorization script on the gateway side in a buffer stack manner.

7. An authorization system based on microservice architecture, characterized in that: It includes a gateway diversion module and a gateway authorization module, among which, The gateway distribution module is used to receive a first authorization request from a client, decompose the first authorization request to obtain a service model parameter, and obtain a service classification, a service affiliation, and service history data according to the service model parameter; The gateway authorization module is used to determine whether there is a verification authorization script collection on the gateway side; the verification authorization script collection includes a business classification authorization script, a business affiliation authorization script and a historical access authorization script; if the verification authorization script collection exists on the gateway side, the business classification is substituted into the business classification authorization script for a first-level authorization verification; the business affiliation relationship is substituted into the business affiliation authorization script for a second-level authorization verification; the business history data is substituted into the historical access authorization script for a third-level authorization verification; if the first-level authorization verification, the second-level authorization verification and the third-level authorization verification all pass the verification, the call data is returned to the client.

8. The system according to claim 6, characterized in that The system further includes a parsing and generating module, wherein the parsing and generating module is configured to cause the gateway side to send a second authorization request to the container group if the verification and authorization script collection does not exist on the gateway side; The container group generates the service classification authorization script, the service belonging authorization script and the historical access authorization script according to the second authorization request; The service classification authorization script, the service belonging authorization script and the historical access authorization script are returned to the gateway side.

9. An authorization device based on a microservice architecture, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 6.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to perform the method according to any one of claims 1 to 6 when executed by the processor.

Images