Authentication method and device, electronic equipment and storage medium

Abstract

The invention provides an authentication method and device, electronic equipment and a storage medium, and the method comprises the steps: responding to an authentication event triggered in real time or regularly, and when the event type of the authentication event belongs to a preset event type, carrying out the authentication of a user related to the authentication event, so as to obtain a corresponding authentication result; an authentication result obtained through authentication is stored in the first storage area and the second storage area; when the interface calling request triggered by the to-be-authenticated user and used for executing the to-be-authenticated operation is detected, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is inquired from the first storage area and / or the second storage area, and the to-be-authenticated user does not need to be authenticated by inquiring an authentication strategy, so that the authentication efficiency of the to-be-authenticated user is improved. The authentication time delay is reduced; and the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an authentication method, device, electronic equipment and storage medium. Background Art

[0002] With the development of information technology, cloud service desks are widely used in all walks of life. When users call the interface of the cloud service desk, they need to be authenticated, and only after authentication can they call the interface of the cloud service desk.

[0003] At present, the cloud service platform authenticates users in the following way: every time a user calls an interface, he needs to go back to the source with a tag to query the authentication policy in the database, and authenticate the user based on the authentication policy obtained. However, it takes a certain amount of time to query the authentication policy and authenticate according to the authentication policy. Users need to wait for a long time to get the authentication result, resulting in a long authentication delay and a poor user experience. Summary of the invention

[0004] In view of this, the embodiments of the present invention provide an authentication method, an apparatus, an electronic device and a storage medium to solve the problems of long authentication delay and poor user experience in the current user authentication method.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention discloses an authentication method, the method comprising:

[0007] In response to an authentication event triggered in real time or timed, when the event type of the authentication event belongs to a preset event type, authenticate the user involved in the authentication event to obtain a corresponding authentication result;

[0008] The authentication result obtained by the authentication is stored in the first storage area and the second storage area;

[0009] When an interface call request for executing an operation to be authenticated is detected, querying the first storage area and / or the second storage area for an authentication result corresponding to the operation to be authenticated of the user to be authenticated;

[0010] Among them, if the query speed of the first storage area is greater than that of the second storage area, when the interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the first storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the first storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is queried from the second storage area.

[0011] Preferably, the preset event type includes an initialization event, and when the event type of the authentication event belongs to the preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result includes:

[0012] When the event type of the authentication event is an initialization event, reading a full amount of authentication policy and user information of the user from the first storage area;

[0013] Based on the full authentication policy and the user information of the user, each type of operation of each user is authenticated to obtain a corresponding authentication result.

[0014] Preferably, the preset event type includes a change event, and when the event type of the authentication event belongs to the preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result includes:

[0015] When the event type of the authentication event is a change event, at least one change object is read from the first storage area; the change object includes a changed authentication policy and changed user information;

[0016] If the changed object is the changed authentication policy, based on the changed authentication policy and the user information of the users covered by the changed authentication policy, authenticate each type of operation of the covered users to obtain a corresponding authentication result;

[0017] If the changed object is the changed user information, based on the changed user information and the authentication policy corresponding to the target user, each type of operation of the target user is authenticated to obtain a corresponding authentication result; the target user is the user whose user information has been changed.

[0018] Preferably, it also includes:

[0019] When the event type of the authentication event is a deletion event, all authentication results involved in the authentication event are deleted from the first storage area and the second storage area.

[0020] Preferably, when the event type of the authentication event is a deletion event, deleting the authentication result involved in the authentication event from the first storage area and the second storage area includes:

[0021] When the authentication event is a deletion event, determining at least one deletion object; the deletion object includes any authentication policy or any user information;

[0022] Deleting the deletion object;

[0023] The deletion object and its corresponding authentication result are deleted from the first storage area and the second storage area.

[0024] Preferably, before responding to the authentication event triggered in real time or timed, the method further includes:

[0025] Set up a timing strategy;

[0026] When the timing strategy changes at a specified time point, an event notification of an authentication event is sent to an event center, so that the event center triggers the authentication event on a regular basis.

[0027] Preferably, the method further comprises:

[0028] If the query speed of the first storage area is greater than that of the second storage area, and the authentication result corresponding to the operation to be authenticated is queried from the second storage area, the queried authentication result corresponding to the operation to be authenticated is asynchronously written into the first storage area.

[0029] A second aspect of an embodiment of the present invention discloses an authentication device, the device comprising:

[0030] An authentication unit, used to respond to an authentication event triggered in real time or timed, and when the event type of the authentication event belongs to a preset event type, authenticate the user involved in the authentication event to obtain a corresponding authentication result;

[0031] A storage unit, used for storing the authentication result obtained by authentication in the first storage area and the second storage area;

[0032] a query unit, configured to query an authentication result corresponding to the operation to be authenticated by the user to be authenticated from the first storage area and / or the second storage area when an interface call request for executing the operation to be authenticated is detected.

[0033] Among them, if the query speed of the first storage area is greater than that of the second storage area, when the interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the first storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the first storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is queried from the second storage area.

[0034] The third aspect of an embodiment of the present invention discloses an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement the authentication method disclosed in the first aspect of the embodiment of the present invention.

[0035] A fourth aspect of an embodiment of the present invention discloses a computer-readable storage medium, in which computer-executable instructions are stored. The computer-executable instructions are used to execute the authentication method disclosed in the first aspect of the embodiment of the present invention.

[0036] Based on the above-mentioned embodiment of the present invention, an authentication method, device, electronic device and storage medium are provided. The method is: responding to an authentication event triggered in real time or timed, when the event type of the authentication event belongs to a preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result; storing the authentication result obtained by authentication in the first storage area and the second storage area; when detecting an interface call request for executing the operation to be authenticated triggered by the user to be authenticated, querying the authentication result corresponding to the operation to be authenticated of the user to be authenticated from the first storage area and / or the second storage area. In this scheme, in response to the authentication event, the authentication result obtained by pre-authentication is stored in the first storage area and the second storage area. When the user to be authenticated calls the interface, the corresponding authentication result is directly obtained from the first storage area and the second storage area to complete the authentication of the user to be authenticated, without querying the authentication policy to authenticate the user to be authenticated, thereby reducing the authentication delay and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 An example diagram of the interface of the cloud service platform provided by an embodiment of the present invention;

[0039] Figure 2 An example diagram of an interface for creating an authentication policy provided in an embodiment of the present invention;

[0040] Figure 3 A flowchart of an authentication method provided by an embodiment of the present invention;

[0041] Figure 4 A flowchart of processing initialization events provided by an embodiment of the present invention;

[0042] Figure 5 A flowchart of processing change events provided by an embodiment of the present invention;

[0043] Figure 6 A flowchart of processing a deletion event provided by an embodiment of the present invention;

[0044] Figure 7 A flowchart of a timed trigger authentication event provided by an embodiment of the present invention;

[0045] Figure 8 A flowchart of querying authentication results provided by an embodiment of the present invention;

[0046] Fig. 9 An example diagram of the architecture of an event center provided in an embodiment of the present invention;

[0047] Fig.10 An example diagram of the architecture of an authentication method provided by an embodiment of the present invention;

[0048] Fig.11 A structural block diagram of an authentication device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0051] Combined with the background technology, it can be seen that the current way for cloud service platforms to authenticate users (also called roles) is: each time a user calls an interface, he needs to go back to the source with a tag to query the authentication policy in the database, and authenticate the user through the authentication policy obtained by the query.

[0052] After research, it was found that when the cloud service desk interface is called for the first time (including the first call after the user's permissions are changed), it is necessary to go back to the source with the tag to query the authentication policy in the database for authentication; when the interface is not called for the first time, the authentication policy stored in the cloud service desk's memory will be loaded for authentication; if the authentication policy changes, it is necessary to delete the authentication policy in the memory first, and then go back to the source to pull the authentication policy again;

[0053] There are two problems with the above research findings:

[0054] Problem 1: After the user's permissions are changed or upgraded, when the interface is called for the first time, there will be an operation of "returning to the source database to load the authentication policy", which will cause a long authentication delay (usually more than 100ms);

[0055] Question 2: When the interface is not called for the first time, there will still be an authentication operation, and the authentication operation will take a long time (usually more than 50ms).

[0056] To solve the above problems, the present invention proposes an authentication method, device, electronic device and storage medium, which respond to authentication events and store the authentication results obtained by pre-authentication in the first storage area and the second storage area. When the user to be authenticated calls the interface, the corresponding authentication results are directly obtained from the first storage area and the second storage area to complete the authentication of the user to be authenticated, without querying the authentication policy to authenticate the user to be authenticated, thereby reducing the authentication delay and improving the user experience.

[0057] In order to better understand the subsequent embodiments of the present invention, some terms involved in the present invention are explained here.

[0058] SCC: Cloud Service Desk.

[0059] Authentication: Authentication refers to the process of verifying the identity of a user.

[0060] Identity and Access Management (IAM): IAM is a set of frameworks and solutions to ensure that the correct users can access appropriate resources and access them in the correct manner. IAM includes user identity management, permissions, role assignment, access policy formulation, etc.

[0061] CRUD (Create, Read, Update, Delete): CRUD is the abbreviation of database operations, which stands for Create, Read, Update, and Delete.

[0062] Task Module: A task module usually refers to a component that is responsible for handling a specific task in a software or system.

[0063] Binlog (Binary Log): Binary log is a log file in the MySQL database, which is used to record all operations that modify the data in the database or potentially affect the data, such as table structure change (DDL) operations and data change (DML) operations; Binlog is mainly used for replication and data recovery; in the MySQL master-slave replication architecture, the Binlog on the master server will record all changes, and the slave server maintains data consistency with the master server by reading and executing these binlogs; in addition, because Binlog records the history of data changes, Binlog can also be used for incremental backup.

[0064] Event Handler: An event handler is a program, function, or method that is called when a specific event occurs. In programming, an event can be a user click, a system error, a timer expiration, etc. The event handler is responsible for defining the actions that should be performed when these events occur.

[0065] MySQL: An open source relational database management system that uses Structured Query Language (SQL) to create, operate, and manage databases.

[0066] Redis: An open source, high-performance key-value store that is commonly used as a database, cache, and message broker.

[0067] Redis Stream: A data structure in Redis. Redis Stream is mainly used to implement message queues (MQ).

[0068] It should be noted that the present invention is applied to a cloud service station. When providing services, the cloud service station can manage (create, change, delete) authentication policies in advance in the cloud service station, and implement user authority management through the authentication policies.

[0069] like Figure 1 The following is a sample diagram of the cloud service desk interface. The administrator of the cloud service desk can Figure 1 The interface shown manages each authentication strategy (that is, Figure 1 To add an authentication policy, click Figure 1 Click the Create control in the Figure 2 The interface for creating an authentication policy is shown, and the administrator creates an authentication policy in the interface for creating an authentication policy.

[0070] After logging into the cloud service desk, when a user calls an interface to perform a certain type of operation, the user's operation needs to be authenticated according to the authentication strategy mentioned above;

[0071] If the authentication is successful (or the authentication is passed), the internal interface of the cloud service platform will be queried, and then the plug-in inside the gateway will be called;

[0072] If authentication fails, an error message such as "Insufficient permissions, please contact the super administrator" or "Missing xxx permissions, please contact the super administrator" will be reported.

[0073] The present invention is described in detail below through various embodiments.

[0074] Before describing the present invention in detail, for the first storage area and the second storage area mentioned later, the storage areas can be divided into cache and persistent storage according to the storage type. For example, assuming that the query speed of the first storage area is greater than that of the second storage area, the storage type of the first storage area can be cache (for example, Redis-based cache), and the storage type of the second storage area can be persistent storage (for example, MySQL-based persistent storage), or, the storage type of the first storage area and the storage type of the second storage area are both cache, and the difference is that the cache of the first storage area is implemented by memory or high-speed cache (for example, Redis-based or MongoDB-based cache), and the cache of the second storage area is implemented by a cache with a lower speed than the first storage area (for example, MySQL-based or ORACLE-based cache).

[0075] It should be noted that when the storage type of the first storage area adopts cache and the storage type of the second storage area adopts persistent storage, the speed of obtaining authentication results can be improved through cache while ensuring that the full amount of authentication results are stably stored, thereby improving the stability of authentication, thereby balancing speed requirements and stability requirements.

[0076] The cache may be a database cache, server cache, distributed cache, etc. implemented by software, or a disk cache, memory cache, etc. implemented by local hardware;

[0077] Persistent storage can be implemented by local storage methods such as local databases, or by cloud storage methods such as distributed databases or servers. The embodiments of the present invention do not impose any restrictions on the specific storage type of the storage area.

[0078] See also Figure 3 , shows a flow chart of an authentication method provided by an embodiment of the present invention, the method comprising the following steps:

[0079] Step S301: responding to an authentication event triggered in real time or timed, when the event type of the authentication event belongs to a preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result.

[0080] It should be noted that the event center monitors the authentication events triggered in real time by the administrator of the cloud service desk. When the authentication event triggered in real time is monitored, the event center sends the authentication event;

[0081] In addition, a timing policy is pre-set, which takes effect at a specified time for a specified operation, and triggers an authentication event in a timed manner through changes (deletion, update or creation) of the timing policy; specifically, a time wheel is used to record time points, and when the timing policy changes (deletion, update or creation) at a specified time point, an event notification of the authentication event is sent to the event center, so that the event center triggers the authentication event in a timed manner, that is, when the event center receives the event notification, the event center issues a corresponding authentication event (a timed triggered authentication event).

[0082] In the process of implementing step S301, a real-time or timed-triggered authentication event issued by an event center is received and responded to. When the event type of the authentication event belongs to a preset event type, the user involved in the authentication event is authenticated to obtain a corresponding authentication result. In the process of authenticating various operations of the user involved in the authentication event, each type of operation of a user involved in the authentication event obtains a corresponding authentication result.

[0083] It should be noted that event types are divided into initialization events, change events, and deletion events. Initialization events are recorded as Init_enforce_event events, change events are recorded as Update_enforce_event events, and deletion events are recorded as Delete_enforce_event events.

[0084] It is worth noting that the timing of triggering the initialization event in real time is: when the cloud service desk system is initialized, the module is initialized, an authentication policy is added, or a new user is added, the initialization event is triggered in real time.

[0085] The timing of triggering a change event in real time is: when the authentication policy is changed or the user is changed, the change event is triggered in real time.

[0086] The timing of triggering the deletion event in real time is: when deleting the authentication policy or deleting the user, the deletion event is triggered in real time.

[0087] When the authentication event responded to is an initialization event or a change event, the way of authenticating the user is different, which are explained below.

[0088] In some embodiments, the preset event type includes an initialization event. When the event type of the authentication event belongs to the preset event type (equivalent to when the authentication event is an initialization event), the method of authenticating the user involved in the authentication event (the user involved in the initialization event in this case) is as follows: when the event type of the authentication event is an initialization event, the full authentication policy and user information of the user are read (or loaded) from the first storage area; based on the full authentication policy and user information of the user, each type of operation of each user is authenticated to obtain a corresponding authentication result;

[0089] Among them, each type of operation of each user is authenticated to obtain the corresponding authentication result, that is, each type of operation of each user has an authentication result. When the authentication event responded is an initialization event, the users involved in the authentication event (initialization event at this time) are all users, so each type of operation of each user needs to be authenticated to obtain the corresponding authentication result.

[0090] It should be noted that the first storage area is a cache or a persistent storage. When the full amount of authentication policy and user information is read from the first storage area for authentication, if the storage type of the first storage area is a cache, the full amount of authentication policy and user information can be directly read from the first storage area (the storage type is a cache), and then the comparison authentication is performed;

[0091] If the storage type of the first storage area is persistent storage, the full amount of authentication policy and user information in the first storage area (storage type is persistent storage) can be read into the cache or memory first, and then the comparison and authentication are performed.

[0092] In some other embodiments, the preset event type includes a change event. When the event type of the authentication event belongs to the preset event type (equivalent to when the authentication event is a change event), the method of authenticating the user involved in the authentication event (the user involved in the change event in this case) is as follows: when the event type of the authentication event is a change event, at least one change object is read from the first storage area, and the change object includes a changed authentication policy and changed user information;

[0093] If the changed object is the changed authentication policy, based on the changed authentication policy and the user information of the users covered by the changed authentication policy, each type of operation of the covered user (the user covered by the changed authentication policy) is authenticated to obtain a corresponding authentication result;

[0094] If the changed object is the changed user information, based on the changed user information and the authentication policy corresponding to the target user, each type of operation of the target user is authenticated to obtain a corresponding authentication result, wherein the target user is the user whose user information has been changed.

[0095] It should be noted that when the authentication event is a change event, if the change object is the changed authentication policy, the users involved in the authentication event (this time the change event) are: the users covered by the changed authentication policy (the users associated with the changed authentication policy);

[0096] If the changed object is the changed user information, the user involved in the authentication event (in this case, a change event) is: the target user (ie, the user whose user information has been changed).

[0097] Specifically, at least one change object is read from the first storage area, and designated correspondence information is read, where the designated correspondence information includes a correspondence between a user and an authentication policy;

[0098] If the changed object is the changed authentication policy (equivalent to the authentication policy being changed), first determine the users covered by the changed authentication policy (equivalent to determining the users associated with the changed authentication policy) according to the specified corresponding relationship information; then use the changed authentication policy to authenticate each type of operation of the users covered by the changed authentication policy to obtain the corresponding authentication result;

[0099] If the changed object is the changed user information (equivalent to the user's user information being changed), first determine the authentication policy corresponding to the target user (i.e., the user whose user information has been changed) according to the specified corresponding relationship information (equivalent to determining the authentication policy associated with the target user); then use the authentication policy corresponding to the target user to authenticate each type of operation of the target user to obtain the corresponding authentication result.

[0100] It should be noted that, in the above two embodiments, when authenticating the user's operation, a multi-threaded approach can be used to authenticate the user's operation;

[0101] For example, assuming that a certain authentication strategy is to execute four authentication operations in sequence, when the user's operation is authenticated using the authentication strategy, the four authentication operations are executed in parallel in a multi-threaded manner to perform authentication.

[0102] In some other embodiments, when the event type of the authentication event is a deletion event, all authentication results involved in the authentication event are deleted from the first storage area and the second storage area.

[0103] Specifically, when the authentication event is a deletion event, at least one deletion object is determined; the deletion object includes any authentication policy or any user information; the deletion object is deleted; the deletion object and its corresponding authentication result are deleted from the first storage area and the second storage area.

[0104] It should be noted that when the first storage area and the second storage area store authentication policies and authentication results, each authentication policy and authentication result is provided with a corresponding cache key, which is composed of fields such as user ID, tenant ID, user name, source IP, etc.;

[0105] When deleting a deletion object and an authentication result corresponding to the deletion object from the first storage area and the second storage area, the deletion can be performed in the following manner: deleting the cache key of the deletion object and the cache key of the authentication result corresponding to the deletion object from the first storage area and the second storage area.

[0106] That is, the deleted object and the authentication result corresponding to the deleted object are deleted from the first storage area and the second storage area by deleting the cache key.

[0107] Step S302: storing the authentication result obtained by authentication in the first storage area and the second storage area.

[0108] In the specific implementation of step S302, after authenticating each type of user operation involved in the authentication event to obtain a corresponding authentication result in step S301, the obtained authentication result is asynchronously written into the first storage area and the second storage area.

[0109] It can be seen from the content of step S301 that in response to an authentication event, when the authentication event is an initialization event or a change event, the user involved in the authentication event is authenticated in advance, and the authentication result obtained by the authentication is stored in the first storage area and the second storage area; when the user subsequently calls the interface of the cloud service station, the authentication result can be directly obtained from the first storage area and the second storage area to quickly realize the authentication of the user, without the need to return to the source to load the authentication policy, which can effectively reduce the authentication delay.

[0110] Step S303: when an interface call request for executing the operation to be authenticated triggered by the user to be authenticated is detected, an authentication result corresponding to the operation to be authenticated of the user to be authenticated is queried from the first storage area and / or the second storage area.

[0111] In the process of specifically implementing step S303, when an interface call request for executing the operation to be authenticated triggered by the user to be authenticated is detected, the authentication result corresponding to the user to be authenticated and the operation to be authenticated is queried from the second storage area and / or the first storage area, and the authentication of the operation to be authenticated of the user to be authenticated is quickly completed through the authentication result obtained by the query.

[0112] In a specific implementation, when the front end of the cloud service station detects an interface call request for executing an operation to be authenticated triggered by the user to be authenticated, the authentication result corresponding to the user to be authenticated and the operation to be authenticated is asynchronously queried from the second storage area and the first storage area;

[0113] If the authentication result corresponding to the user to be authenticated and the operation to be authenticated is queried from the first storage area (such as a cache based on redis), the authentication result queried from the first storage area is returned to the front end of the cloud service station;

[0114] If the authentication result corresponding to the user to be authenticated and the operation to be authenticated is not found in the first storage area, the authentication result corresponding to the user to be authenticated and the operation to be authenticated is found in the second storage area (such as MySQL-based persistent storage).

[0115] In the case where the authentication result corresponding to the user to be authenticated and the operation to be authenticated is not found in the first storage area, if the authentication result corresponding to the user to be authenticated and the operation to be authenticated is found in the second storage area, the authentication result found in the second storage area is returned to the front end of the cloud service station, and the authentication result found in the second storage area is asynchronously written back to the first storage area;

[0116] If the authentication result corresponding to the user to be authenticated and the operation to be authenticated is not found in the second storage area, the authentication policy corresponding to the user to be authenticated is read back to the source, and the operation to be authenticated is authenticated by using the authentication policy read back to the source to obtain the authentication result, and then the authentication result is asynchronously written back to the first storage area and the second storage area.

[0117] The above is one implementation of querying the authentication result from the first storage area and / or the second storage area;

[0118] In actual applications, the query speeds of the first storage area and the second storage area may be different. Therefore, when an interface call request for executing the operation to be authenticated is detected, another implementation method of querying the authentication result may be:

[0119] (1) If the query speed of the first storage area is greater than that of the second storage area, when an interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the first storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the first storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is then queried from the second storage area.

[0120] Among them, if the query speed of the first storage area is greater than that of the second storage area, and the authentication result corresponding to the operation to be authenticated is queried from the second storage area (equivalent to the authentication result corresponding to the operation to be authenticated is not queried in the first storage area), the queried authentication result corresponding to the operation to be authenticated is asynchronously written into the first storage area.

[0121] (2) If the query speed of the second storage area is greater than that of the first storage area, when an interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the second storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the second storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is then queried from the first storage area.

[0122] Among them, if the query speed of the second storage area is greater than that of the first storage area, and the authentication result corresponding to the operation to be authenticated is queried from the first storage area (equivalent to the authentication result corresponding to the operation to be authenticated is not queried in the second storage area), the authentication result corresponding to the operation to be authenticated is asynchronously written into the second storage area.

[0123] (3) If the query speed of the second storage area is consistent with the query speed of the first storage area, when an interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user can be first queried from the first storage area or the second storage area; if no authentication result is found, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user can be queried from the other storage area.

[0124] The above is an example of an implementation method for querying the authentication result from the first storage area and / or the second storage area. When an interface call request for executing the operation to be authenticated triggered by the user to be authenticated is detected, the authentication result can be queried from the first storage area and / or the second storage area in the manner given above.

[0125] In the embodiment of the present invention, in response to the authentication event, the authentication result obtained by pre-authentication is stored in the first storage area and the second storage area. When the user to be authenticated calls the interface, the corresponding authentication result is directly obtained from the first storage area and the second storage area to complete the authentication of the user to be authenticated, and there is no need to query the authentication policy to authenticate the user to be authenticated, thereby reducing the authentication delay and improving the user experience.

[0126] It should be noted that the above embodiments of the present invention Figure 3 The content can be executed by the processing module of the cloud service station; in order to avoid resource preemption, the processing module can also be subdivided into a permission processing module and an authentication module. The content of steps S301 to S302 is executed by the permission processing module, and the content of step S303 is executed by the authentication module.

[0127] To better understand the above embodiments of the present invention Figure 3 The following content is Figures 4 to 8 To illustrate with an example, Figures 4 to 8 In the example, the first storage area is a cache based on Redis, and the second storage area is a persistent storage based on MySQL.

[0128] See also Figure 4 , showing a flowchart of processing an initialization event provided by an embodiment of the present invention, Figure 4 The following steps are involved:

[0129] Step S401: the event center sends an Init_enforce_event event to the permission processing module.

[0130] It should be noted that the Init_enforce_event event is the initialization event mentioned above.

[0131] In the specific implementation of step S401, when the cloud service station is initialized, a module is initialized, an authentication policy is added, or a user is added, the event center sends an Init_enforce_event event to the permission processing module.

[0132] Step S402: The permission processing module loads the entire authentication policy from MySQL into memory.

[0133] Step S403: The permission processing module loads all user information from MySQL into the memory.

[0134] Step S404: The authority processing module executes the authentication logic.

[0135] In the specific implementation of step S404, the authentication logic executed by the permission processing module is: based on the full authentication policy and user information, each type of operation of each user is authenticated to obtain a corresponding authentication result.

[0136] Step S405: The authority processing module stores the authentication result in redis.

[0137] Step S406: The authority processing module asynchronously refreshes the authentication result to MySQL.

[0138] The above embodiments of the present invention Figure 4 This is an example of handling initialization events.

[0139] See also Figure 5 , which shows a flow chart of processing change events provided by an embodiment of the present invention, Figure 5 The following steps are involved:

[0140] Step S501: the event center sends an Update_enforce_event event to the permission processing module.

[0141] It should be noted that the Update_enforce_event event is the change event mentioned above;

[0142] In the specific implementation of step S501, when the authentication policy is changed or the user information is changed, the event center sends an Update_enforce_event event to the authority processing module.

[0143] Step S502: The authority processing module loads the changed authentication policy or the changed user information from MySQL.

[0144] It should be noted that the changed authentication policy or the changed user information is the change object mentioned above.

[0145] Step S503: The authority processing module executes the authentication logic.

[0146] In the specific implementation of step S503, the authentication logic executed by the permission processing module is: if the changed object is the changed authentication policy, each type of operation of the user covered by the changed authentication policy is authenticated to obtain the corresponding authentication result;

[0147] If the changed object is the changed user information, each type of operation of the target user (the user whose user information has been changed) is authenticated to obtain a corresponding authentication result.

[0148] Step S504: The authority processing module stores the authentication result in redis.

[0149] Step S505: The authority processing module asynchronously refreshes the authentication result to MySQL.

[0150] The above embodiments of the present invention Figure 5 This is an example of handling change events.

[0151] See also Figure 6 , showing a flowchart of processing a deletion event provided by an embodiment of the present invention, Figure 6 The following steps are involved:

[0152] Step S601: the event center sends a Delete_enforce_event event to the permission processing module.

[0153] It should be noted that the Delete_enforce_event event is the delete event mentioned above;

[0154] In the specific implementation of step S601, when deleting the authentication policy or deleting the user, the event center sends a Delete_enforce_event event to the authority processing module.

[0155] Step S602: The permission processing module deletes the deletion object from the memory.

[0156] It should be noted that the deletion object (the object that needs to be deleted by the deletion event) is any authentication policy or any user information.

[0157] Step S603: The permission processing module deletes the cache key corresponding to the deleted object from redis.

[0158] Step S604: the permission processing module deletes the cache key corresponding to the deleted object from MySQL in an asynchronous refresh manner.

[0159] The above embodiments of the present invention Figure 6 This is an example of handling a delete event.

[0160] It should be noted that Figures 4 to 6 The execution principle of the present invention can be found in the above-mentioned embodiment of the present invention. Figure 3 The contents of each step will not be repeated here.

[0161] See also Figure 7 , shows a flow chart of timing-triggered authentication events provided by an embodiment of the present invention, Figure 7 The following steps are involved:

[0162] Step S701: When the system is initialized, the policy module loads the timing policy and registers the timing policy into the timer of the time wheel.

[0163] Step S702: The policy module sends the event change information to the time wheel.

[0164] It should be noted that the event is changed to deletion, update or creation; when the event is changed to deletion, step S703 is executed; when the event is changed to update, step S704 is executed; when the event is changed to creation, step S705 is executed.

[0165] Step S703: the time wheel removes the timing policy from the time wheel and sends a notification of the Delete_enforce_event event to the event center.

[0166] Step S704: the time wheel updates the timing policy in the time wheel and sends a notification of the Update_enforce_event event to the event center.

[0167] Step S705: the time wheel registers a new timing strategy and sends a notification of the Init_enforce_event event to the event center.

[0168] It should be noted that steps S701 to S705 can be implemented through the task module of the cloud service station.

[0169] After the event center receives the notification of the Init_enforce_event event, the notification of the Update_enforce_event event, and the notification of the Delete_enforce_event event, the interaction mode between the event center and the permission processing module can be referred to in the above embodiment of the present invention. Figures 4 to 6 The content will not be repeated here.

[0170] The above embodiments of the present invention Figure 7 This is an example of timing the triggering of authentication events.

[0171] See also Figure 8 , which shows a flowchart of querying authentication results provided by an embodiment of the present invention, Figure 8 The following steps are involved:

[0172] Step S801: The front end of the cloud service station sends a query request to the authentication module.

[0173] It should be noted that when an interface call request for executing an operation to be authenticated is detected, the front end of the cloud service station sends a query request to the authentication module, and the query request carries a cache key for querying the authentication result.

[0174] Step S802: The authentication module queries the authentication result from redis.

[0175] Step S803: The authentication module queries the authentication result from MySQL.

[0176] In the process of implementing step S802 and step S803, if there is an authentication result corresponding to the cache key carried in the query request in redis, redis returns the authentication result, and the authentication module returns the authentication result obtained from the redis query to the front end;

[0177] If there is no authentication result corresponding to the cache key carried in the query request in redis, redis returns an empty result.

[0178] When redis returns an empty result, if there is an authentication result corresponding to the cache key carried in the query request in MySQL, MySQL returns the authentication result. At this time, the authentication module returns the authentication result obtained from the MySQL query to the front end, and asynchronously writes the authentication result obtained from the MySQL query back to redis;

[0179] If there is no authentication result corresponding to the cache key carried in the query request in MySQL, MySQL returns an empty result.

[0180] Step S804: The authentication module executes the actual authentication logic and returns the authentication result to the front end.

[0181] In the specific implementation of step S804, if there is no authentication result corresponding to the cache key carried in the query request in redis and MySQL, the authentication module goes back to the source to read the authentication policy corresponding to the user to be authenticated, and then uses the authentication policy read back to the source to authenticate the authentication operation of the user to be authenticated to obtain the authentication result.

[0182] Step S805: The authentication module asynchronously writes the authentication result to redis.

[0183] Step S806: The authentication module asynchronously writes the authentication result into MySQL.

[0184] The above embodiments of the present invention Figure 8 This is an example of querying the authentication result.

[0185] It is worth noting that, in order to ensure the reliability of the event center, the present invention ensures the reliability of the event center through multiple components;

[0186] like Fig. 9 As shown, Fig. 9 The following is an example diagram of the architecture of the event center provided by an embodiment of the present invention. The event center includes at least the following components: eventman-api, Eventman, redis, and MQ cluster. The specific meanings of the aforementioned components, business parties, and subscribers are described in detail below:

[0187] Business party: calls eventman-api to subscribe, unsubscribe, query subscription and other operations; the time wheel mentioned above is the business party.

[0188] eventman-api: receives subscription, unsubscribe, query subscription and other interfaces, and pushes updated subscription relationships to Eventman.

[0189] Eventman: After Eventman is started, it actively pulls the subscription relationship from the eventman-api; after Eventman receives the event, it first writes the event (including retrying to write) to the redis queue of the local node, and redis uses the stream structure; Eventman subscribes to data from the redis stream and sends the subscribed data (including retrying to send) to the MQ cluster.

[0190] Redis: Provides pub and sub modes of streams and persistence capabilities.

[0191] MQ cluster: subscribes to data from eventman and sends the data to the subscriber; if the sending fails, the MQ cluster will retry to ensure that the message can be sent successfully.

[0192] Subscriber: Receives data from the MQ cluster. The permission processing module mentioned above is the subscriber.

[0193] Through the above-mentioned embodiments of the present invention Figure 4-Figure 9 As can be seen from the content, in practical applications, the architecture of an authentication method proposed by the present invention is as follows Fig.10 As shown;

[0194] Fig.10 In the process, the event center monitors authentication events based on module initialization, system initialization, permission CRUD, and task modules. After the event center sends the authentication events to the permission processing module, the permission processing module performs authentication in MySQL, redis, and memory based on the authentication events.

[0195] When the front end detects an interface call request, it initiates a query request for authentication to the authentication module; the authentication module queries the corresponding authentication results from MySQL and redis to achieve fast authentication.

[0196] In summary, the present invention can achieve the following beneficial effects in practical applications:

[0197] The authentication results are stored in different storage areas through multi-level storage. When a problem occurs in a storage area, the authentication results can be queried from other normal storage areas.

[0198] Pre-authentication is performed based on the drive of authentication events, and the authentication results are stored in the storage area in advance, shortening the authentication time to less than 2ms, ensuring that the latency of each authentication is very low;

[0199] The reliability of the event center is ensured through redis queue + persistence.

[0200] Corresponding to an authentication method provided by the above embodiment of the present invention, see Fig.11, the embodiment of the present invention also provides a structural block diagram of an authentication device, the device includes: an authentication unit 100, a storage unit 200 and a query unit 300;

[0201] The authentication unit 100 is used to respond to an authentication event that is triggered in real time or at a scheduled time. When the event type of the authentication event belongs to a preset event type, the user involved in the authentication event is authenticated to obtain a corresponding authentication result.

[0202] The storage unit 200 is used to store the authentication result obtained through authentication in the first storage area and the second storage area.

[0203] The query unit 300 is used to query the authentication result corresponding to the operation to be authenticated of the user to be authenticated from the first storage area and / or the second storage area when detecting an interface call request for executing the operation to be authenticated triggered by the user to be authenticated.

[0204] Among them, if the query speed of the first storage area is greater than that of the second storage area, when an interface call request is received, the authentication result corresponding to the authentication operation of the user to be authenticated is first queried from the first storage area; if the authentication result corresponding to the authentication operation of the user to be authenticated is not queried from the first storage area, the authentication result corresponding to the authentication operation of the user to be authenticated is queried from the second storage area.

[0205] In the embodiment of the present invention, in response to the authentication event, the authentication result obtained by pre-authentication is stored in the first storage area and the second storage area. When the user to be authenticated calls the interface, the corresponding authentication result is directly obtained from the first storage area and the second storage area to complete the authentication of the user to be authenticated, and there is no need to query the authentication policy to authenticate the user to be authenticated, thereby reducing the authentication delay and improving the user experience.

[0206] Preferably, combined Fig.11 As shown in the content, the preset event type includes an initialization event, and the authentication unit 100 is specifically used for: when the event type of the authentication event is an initialization event, reading the full authentication policy and the user information of the user from the first storage area; based on the full authentication policy and the user information of the user, authenticating each type of operation of each user to obtain a corresponding authentication result.

[0207] Preferably, combined Fig.11As shown in the content, the preset event type includes a change event, and the authentication unit 100 is specifically used for: when the event type of the authentication event is a change event, reading at least one change object from the first storage area; the change object includes the changed authentication policy and the changed user information; if the change object is the changed authentication policy, based on the changed authentication policy and the user information of the users covered by the changed authentication policy, each type of operation of the covered users is authenticated to obtain a corresponding authentication result; if the change object is the changed user information, based on the changed user information and the authentication policy corresponding to the target user, each type of operation of the target user is authenticated to obtain a corresponding authentication result; the target user is a user whose user information has been changed.

[0208] Preferably, combined Fig.11 The content shown, the authentication device also includes:

[0209] The deleting unit is used to delete all authentication results involved in the authentication event from the first storage area and the second storage area when the event type of the authentication event is a deletion event.

[0210] In a specific implementation, the deletion unit is specifically used to: when the authentication event is a deletion event, determine at least one deletion object; the deletion object includes any authentication policy or any user information; delete the deletion object; delete the deletion object and its corresponding authentication result from the first storage area and the second storage area.

[0211] Preferably, combined Fig.11 The content shown, the authentication device also includes:

[0212] A setting unit, used to set a timing strategy;

[0213] The sending unit is used to send an event notification of the authentication event to the event center when the timing strategy changes at a specified time point, so that the event center triggers the authentication event on a regular basis.

[0214] Preferably, combined Fig.11 The content shown, the authentication device also includes:

[0215] The writing unit is used to asynchronously write the queried authentication result corresponding to the operation to be authenticated into the first storage area if the query speed of the first storage area is greater than that of the second storage area and the authentication result corresponding to the operation to be authenticated is queried from the second storage area.

[0216] Preferably, an embodiment of the present invention further provides an electronic device, comprising: a processor and a memory, the processor and the memory being connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; the memory is used to store a program, and the program is used to implement the authentication method provided in the above method embodiment.

[0217] Preferably, an embodiment of the present invention further provides a computer-readable storage medium, in which computer-executable instructions are stored, and the computer-executable instructions are used to execute the authentication method provided by the above method embodiment.

[0218] In summary, the embodiments of the present invention provide an authentication method, device, electronic device and storage medium, which respond to an authentication event and store the authentication result obtained by pre-authentication in the first storage area and the second storage area. When the user to be authenticated calls the interface, the corresponding authentication result is directly obtained from the first storage area and the second storage area to complete the authentication of the user to be authenticated, and there is no need to query the authentication policy to authenticate the user to be authenticated, thereby reducing the authentication delay and improving the user experience.

[0219] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0220] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0221] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An authentication method, characterized in that: The method comprises: In response to an authentication event triggered in real time or timed, when the event type of the authentication event belongs to a preset event type, authenticate the user involved in the authentication event to obtain a corresponding authentication result; The authentication result obtained by the authentication is stored in the first storage area and the second storage area; When an interface call request for executing an operation to be authenticated is detected, querying the first storage area and / or the second storage area for an authentication result corresponding to the operation to be authenticated of the user to be authenticated; Among them, if the query speed of the first storage area is greater than that of the second storage area, when the interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the first storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the first storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is queried from the second storage area.

2. The method according to claim 1, characterized in that: The preset event type includes an initialization event, and when the event type of the authentication event belongs to the preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result includes: When the event type of the authentication event is an initialization event, reading a full amount of authentication policy and user information of the user from the first storage area; Based on the full authentication policy and the user information of the user, each type of operation of each user is authenticated to obtain a corresponding authentication result.

3. The method according to claim 1, characterized in that The preset event type includes a change event, and when the event type of the authentication event belongs to the preset event type, authenticating the user involved in the authentication event to obtain a corresponding authentication result includes: When the event type of the authentication event is a change event, at least one change object is read from the first storage area; the change object includes a changed authentication policy and changed user information; If the changed object is the changed authentication policy, based on the changed authentication policy and the user information of the users covered by the changed authentication policy, authenticate each type of operation of the covered users to obtain a corresponding authentication result; If the changed object is the changed user information, based on the changed user information and the authentication policy corresponding to the target user, each type of operation of the target user is authenticated to obtain a corresponding authentication result; the target user is the user whose user information has been changed.

4. The method according to claim 1, characterized in that Also includes: When the event type of the authentication event is a deletion event, all authentication results involved in the authentication event are deleted from the first storage area and the second storage area.

5. The method according to claim 4, characterized in that When the event type of the authentication event is a deletion event, deleting the authentication result involved in the authentication event from the first storage area and the second storage area includes: When the authentication event is a deletion event, determining at least one deletion object; the deletion object includes any authentication policy or any user information; Deleting the deletion object; The deletion object and its corresponding authentication result are deleted from the first storage area and the second storage area.

6. The method according to any one of claims 1 to 5, characterized in that: Before responding to real-time or timed authentication events, it also includes: Set up a timing strategy; When the timing strategy changes at a specified time point, an event notification of an authentication event is sent to an event center, so that the event center triggers the authentication event on a regular basis.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: If the query speed of the first storage area is greater than that of the second storage area, and the authentication result corresponding to the operation to be authenticated is queried from the second storage area, the queried authentication result corresponding to the operation to be authenticated is asynchronously written into the first storage area.

8. An authentication device, characterized in that: The device comprises: An authentication unit, used to respond to an authentication event triggered in real time or timed, and when the event type of the authentication event belongs to a preset event type, authenticate the user involved in the authentication event to obtain a corresponding authentication result; A storage unit, used for storing the authentication result obtained by authentication in the first storage area and the second storage area; a query unit, configured to query an authentication result corresponding to the operation to be authenticated by the user to be authenticated from the first storage area and / or the second storage area when an interface call request for executing the operation to be authenticated is detected. Among them, if the query speed of the first storage area is greater than that of the second storage area, when the interface call request is received, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is first queried from the first storage area; if the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is not queried from the first storage area, the authentication result corresponding to the to-be-authenticated operation of the to-be-authenticated user is queried from the second storage area.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement the authentication method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the authentication method described in any one of claims 1-7.

Images