Interface network management authentication method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an interface gateway authentication method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a data access request of a user for a micro-service system interface gateway; performing authentication processing on the data access request in an authorization authentication mode to obtain an authorization authentication result; under the condition that the authorization authentication result represents that the authentication is passed, decrypting the data access request through a secure transmission protocol to obtain decrypted information; extracting interface key information in the decryption information; and performing key authentication processing on the interface key information to obtain an authentication result of the data access request. According to the application, after the data access request is received, authorization authentication is firstly performed on the request, then the request is decrypted by using the secure transmission protocol, and finally key authentication is performed on the decrypted request, so that diversified authentication modes are realized, different user scenes and data requirements are met, and the security of the system is enhanced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an interface network management authentication method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] With the development of computer technology and software development, microservice technology has emerged. Microservices (or microservice architecture) is a cloud-native architecture approach that contains many loosely coupled and independently deployable small components or services in a single application. An architectural style that splits a single application into a set of small, independent service units, each with its own specific functions that can be independently deployed, expanded, and managed. With the popularity of microservice architecture, more and more companies choose to split applications into microservices and deploy them in different containers. In this case, a unified entry control point is needed to manage and protect access to all microservices, while ensuring that only authorized users or applications can access specific services.

[0003] Currently, API gateways are used as the entrance to microservice architectures, and all external requests are subject to access control and authentication through API gateways. In order to achieve secure access to APIs, each client needs to carry a unique API key in the request, which is usually used as a credential to identify and authenticate the client. The authentication method based on API keys has certain limitations and cannot meet complex authentication requirements, thus affecting the security of the system. Summary of the invention

[0004] Based on this, it is necessary to provide an interface gateway authentication method, device, computer equipment, computer-readable storage medium and computer program product that can improve system security in response to the above technical problems.

[0005] In a first aspect, the present application provides an interface gateway authentication method, comprising:

[0006] Obtain the user's data access request for the microservice system interface gateway;

[0007] Authenticating the data access request in an authorization and authentication manner to obtain an authorization and authentication result;

[0008] When the authorization authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information;

[0009] Extracting interface key information from the decryption information;

[0010] Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0011] In one embodiment, performing key authentication processing on the interface key information to obtain an authentication result of the data access request includes:

[0012] Extract random number information of the interface key information;

[0013] Digest processing is performed based on the random number information to obtain a digest value.

[0014] Performing signature processing based on the digest value and the pre-stored decryption key to obtain a signature verification value;

[0015] The signature verification value is compared with the signature value in the interface key information to obtain an authentication result of the data access request.

[0016] In one embodiment, the method further comprises:

[0017] Get key creation request;

[0018] Generate an encryption key and a decryption key based on the key creation request;

[0019] A page generation process is performed according to the encryption key and the decryption key to obtain a key information display page.

[0020] In one embodiment, the method further comprises:

[0021] Get the key rotation strategy;

[0022] Determining a key update time node based on the key rotation strategy;

[0023] Push key update confirmation information according to the key update time node;

[0024] upon receiving a key update request for the key update confirmation information, generating an updated key based on the key update request;

[0025] The stored key information is updated based on the update key.

[0026] In one embodiment, the method further comprises:

[0027] Cache the authentication result of the data access request to obtain an authentication cache result;

[0028] The data access request subsequently submitted by the user is authenticated based on the authentication cache result.

[0029] In one embodiment, the method further comprises:

[0030] Obtain the interface log of the microservice system interface gateway;

[0031] Extracting interface key verification record information from the interface log;

[0032] A report generation process is performed based on the interface key verification record information to generate a key work report of the interface key.

[0033] In a second aspect, the present application also provides an interface gateway authentication device, including:

[0034] The request acquisition module is used to obtain the user's data access request for the microservice system interface gateway;

[0035] An authorization and authentication module is used to authenticate the data access request in an authorization and authentication manner to obtain an authorization and authentication result;

[0036] A decryption processing module, used to decrypt the data access request through a secure transmission protocol to obtain decryption information when the authorization authentication result indicates that the authentication is passed;

[0037] An information extraction module, used to extract the interface key information in the decryption information;

[0038] The key authentication module is used to perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0039] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0040] Obtain the user's data access request for the microservice system interface gateway;

[0041] Authenticating the data access request in an authorization and authentication manner to obtain an authorization and authentication result;

[0042] When the authorization authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information;

[0043] Extracting interface key information from the decryption information;

[0044] Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0045] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0046] Obtain the user's data access request for the microservice system interface gateway;

[0047] Authenticating the data access request in an authorization and authentication manner to obtain an authorization and authentication result;

[0048] When the authorization authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information;

[0049] Extracting interface key information from the decryption information;

[0050] Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0051] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0052] Obtain the user's data access request for the microservice system interface gateway;

[0053] Authenticating the data access request in an authorization and authentication manner to obtain an authorization and authentication result;

[0054] When the authorization authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information;

[0055] Extracting interface key information from the decryption information;

[0056] Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0057] The above-mentioned interface gateway authentication method, device, computer equipment, computer-readable storage medium and computer program product obtain the user's data access request for the microservice system interface gateway; authenticate the data access request in an authorization authentication manner to obtain an authorization authentication result; when the authorization authentication result indicates that the authentication is passed, decrypt the data access request through a secure transmission protocol to obtain decrypted information; extract the interface key information in the decrypted information; perform key authentication on the interface key information to obtain the authentication result of the data access request. This application implements diversified authentication methods by first performing authorization authentication on the request after receiving the data access request, then decrypting the request with a secure transmission protocol, and finally performing key authentication on the decrypted request, thereby meeting different user scenarios and data requirements and enhancing the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] FIG1 is an application environment diagram of an interface gateway authentication method in one embodiment;

[0060] FIG2 is a schematic diagram of a flow chart of an interface gateway authentication method in one embodiment;

[0061] FIG3 is a schematic diagram of a process flow of a key authentication step in one embodiment;

[0062] FIG4 is a schematic diagram of the description of each parameter in a request header in one embodiment;

[0063] FIG5 is a schematic diagram of a key management page in one embodiment;

[0064] FIG6 is a block diagram of an interface gateway authentication device in one embodiment;

[0065] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0067] The interface gateway authentication method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process, and the server 104 is specifically a microservice system. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. When the user of the terminal 102 needs to access the server 104, a data access request can be initiated to the server 104 through the terminal 102, and the server 104 needs to obtain the data access request of the user terminal for the microservice system interface gateway; the data access request is authenticated in an authorized authentication manner to obtain an authorized authentication result; when the authorized authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information; the interface key information in the decrypted information is extracted; the interface key information is key authenticated to obtain the authentication result of the data access request. And the final result information is fed back to the terminal 102. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0068] In an exemplary embodiment, as shown in FIG2 , an interface gateway authentication method is provided, which is described by taking the method applied to the server 104 in FIG1 as an example, and includes the following steps 201 to 209. Among them:

[0069] Step 201: Obtain a data access request from a user terminal to a microservice system interface gateway.

[0070] Among them, the microservice system refers to an application system built with a microservice architecture. Microservice architecture is an architectural style that splits a single application into a group of small, independent service units. Each service unit has its own specific functions and can be independently deployed, expanded, and managed. The interface gateway is the API gateway, which mainly acts as an entry service in the microservice architecture. It is responsible for providing a unified API access interface to the outside world and performing access control, security authentication, traffic control and other functions. A data access request refers to a data processing request to access a service unit within a microservice. The request will be authenticated at the interface gateway and processed after the authentication is completed.

[0071] For example, with the popularity of microservice architecture, more and more enterprises choose to split applications into microservices and deploy them in different containers. In this case, a unified entry control point is needed to manage and protect the access of all microservices, and it is necessary to ensure that only authorized users or applications can access specific services. On this basis, the terminal 102 can initiate a corresponding data access request to the server 104, and the server 104 needs to complete the authentication and certification processing of the data access request at the interface gateway, thereby ensuring the security of the system, so that only authenticated requests can access the core data of the system.

[0072] Step 203: Authenticate the data access request in an authorization authentication manner to obtain an authorization authentication result.

[0073] Among them, authorization authentication is a kind of authentication method, which can be implemented through the authorization framework. Users can authorize third-party applications to access their own resources stored on the resource server. This application uses the authorization authentication method to perform the first level of identity authentication on data access requests to ensure data security. Among them, authorization authentication can be implemented through OAuth 2.0. OAuth 2.0 is an authorization framework that can be used to implement user identity authentication and authorization, and provides a standard mechanism for API gateways to implement authentication.

[0074] Exemplarily, currently, the authentication processing of the interface gateway is generally implemented based on the interface key, but the authentication method based on the interface key has certain limitations and cannot meet complex authentication requirements. For different user scenarios and data access requirements, more flexible authentication methods may be required, and a single authentication method may not be able to meet all requirements. In terms of ensuring data security, multi-factor authentication is a safer method, but the traditional interface key authentication method is difficult to implement multi-factor authentication, which limits the security of the system. Therefore, this application introduces a multi-path and multi-mode authentication method. After obtaining a data access request, the data access request is authenticated and processed by authorization authentication to obtain an authorization authentication result. The authorization authentication can be specifically implemented through authorization code mode, implicit authorization mode, password mode or client mode. After passing the authorization authentication, the subsequent authentication process is carried out.

[0075] Step 205: When the authorization authentication result indicates that the authentication is successful, the data access request is decrypted through a secure transmission protocol to obtain decrypted information.

[0076] Among them, the secure transmission protocol is specifically used to provide confidentiality, data integrity and authenticity between two communicating applications. The secure transmission protocol can be implemented through the TLS protocol (Transport Layer Security Protocol) / SSL protocol (Secure Sockets Layer Protocol). For example, for TLS, TLS is mainly divided into two layers. The bottom layer is the TLS record protocol, which is mainly responsible for encrypting messages using symmetric cryptography. The upper layer is the TLS handshake protocol, which is mainly divided into four parts: handshake protocol, cipher specification change protocol and application data protocol.

[0077] Exemplarily, for a data access request, the request can be encrypted on the terminal through a secure transmission protocol before being transmitted to the server 104, and the server 104 can decrypt it if the authorization authentication is passed. The decryption process can be specifically performed based on a pre-selected secure transmission protocol. For example, in the case of encryption through the TLS protocol, the terminal 102 and the server 104 first need to negotiate various parameters for creating a secure connection through a handshake, such as using a random number, and both parties generate a symmetric key for encryption and decryption. The key is then used to encrypt and decrypt the message contained in the data access request, and the server 104 can obtain the decrypted access request data as decryption information.

[0078] Step 207: extract the interface key information in the decryption information.

[0079] Step 209: Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0080] Among them, for the interface key information, the http request header of the interface key information contains a part of the key information used for authentication, such as the authorized encryption key, encryption algorithm, encrypted signature value and random number, etc. These interface key information can be extracted for key authentication processing to determine the legitimacy of the access request. Ensure the access security for the microservice system.

[0081] Exemplarily, in order to achieve secure access to the microservice interface, each terminal needs to carry an interface key in the submitted request, and the key is usually used as a credential to identify and authenticate the terminal identity. When the request arrives at the gateway, the interface key carried in the request will be verified to confirm the legitimacy and authority of the terminal. Only the authenticated request can further access the internal microservice. Therefore, after completing the authorization authentication and decryption of the data access request, the interface key information contained therein can be further extracted, and the verification processing of this part of the interface key information can be completed. This application introduces authorization authentication and authentication based on a secure transmission protocol, so as to effectively authenticate various types of request information, and ensure that the multiple authentication methods meet the requirements of authentication security. In another embodiment, 1-2 methods can be selected from key authentication, authorization authentication and secure transmission protocol authentication as authentication and authorization methods, so as to confirm the flexibility of the authentication and authorization process. In addition, multi-factor authentication can be implemented in combination with other identity authentication methods (such as SMS verification codes, hardware tokens, etc.), further improving the security of the system and the reliability of user authentication.

[0082] The above-mentioned interface gateway authentication method obtains the user's data access request for the microservice system interface gateway; authenticates the data access request in an authorization authentication manner to obtain an authorization authentication result; when the authorization authentication result indicates that the authentication is passed, decrypts the data access request through a secure transmission protocol to obtain decrypted information; extracts the interface key information in the decrypted information; performs key authentication on the interface key information to obtain an authentication result of the data access request. After receiving the data access request, the present application first performs authorization authentication on the request, then decrypts the request using a secure transmission protocol, and finally performs key authentication on the decrypted request, thereby achieving diversified authentication methods, meeting different user scenarios and data requirements, and enhancing the security of the system.

[0083] In an exemplary embodiment, as shown in FIG3 , step 207 includes:

[0084] Step 302: extract random number information of the interface key information.

[0085] Step 304: Perform digest processing based on the random number information to obtain a digest value.

[0086] Step 306: Perform signature processing based on the digest value and the pre-stored decryption key to obtain a signature verification value.

[0087] Step 308: Compare the signature verification value with the signature value in the interface key information to obtain the authentication result of the data access request.

[0088] Among them, the HTTP request header for data access request contains various types of information, which can be used for authentication processing. In one embodiment, the description of each parameter in the HTTP request header can refer to Figure 4, including request response ID, authorized SecretID, encryption algorithm, signature value, random number and response code. The digest value is information obtained based on the random number information processing and is used for encryption verification.

[0089] Exemplarily, after obtaining the decrypted interface key information, it is also necessary to verify this part of the interface key information. The verification process needs to be verified with the help of a signature check value, and the generation formula of the signature check value signValue satisfies signValue=Base64String(signature algorithm(secretKey, digetValue), "utf-8"), where digetValue is the digest value, and its generation formula satisfies digestValue=(x-mg-nonce)+secretId+secretKey. Therefore, for the calculation process of the signature check value, it is necessary to first splice the random number information (x-mg-nonce) and the encryption key and decryption key of the signature authentication into a digest value. Then, through the preset signature algorithm, the signature processing is performed for the digest value and the pre-stored decryption key to obtain the signature check value. For the verification process, it is only necessary to compare the signature check value obtained with the signature value in the interface key information. If the two are consistent, it means that the authentication is passed. If the two are inconsistent, the corresponding authentication failure information can be returned. In this embodiment, the signature processing is completed based on various types of information in the interface key information, thereby effectively ensuring the accuracy of the signature authentication processing.

[0090] In an exemplary embodiment, the method further includes: obtaining a key creation request; generating an encryption key and a decryption key based on the key creation request; performing page generation processing according to the encryption key and the decryption key to obtain a key information display page.

[0091] Exemplarily, the present application also provides a key creation function for creating encryption keys and decryption keys for interface authentication in a microservice system. When the administrator of the microservice system wishes to generate a new key or update a key, a request for a new key can be initiated to the server, and after receiving the key creation request, an encryption key and a decryption key can be generated by a key generation algorithm. And a page generation process is performed based on the generated key information to obtain a key information display page. The administrator can confirm the generated key information through the display page. In one embodiment, the display page of the key information management can be specifically shown in Figure 5. After the confirmation is completed, the newly generated key can be activated, and the keys of the associated parties can be updated through messages. In this embodiment, the key creation process is completed through a key creation request, thereby improving the security of the key, and then improving the overall security of the microservice system.

[0092] In an exemplary embodiment, the method also includes: obtaining a key rotation strategy; determining a key update time node based on the key rotation strategy; pushing key update confirmation information according to the key update time node; upon receiving a key update request for the key update confirmation information, generating an updated key based on the key update request; and updating the stored key information based on the updated key.

[0093] For example, the key rotation strategy can be used to update the key, thereby improving the security of the key. Key rotation, in simple terms, is to regularly replace the key to increase the difficulty of data protection. For the keys generated by the key management service, it is very necessary to enable the rotation function. Over time, even highly secure keys may be cracked. Long-term use of the same key exposes data to risk. This risk can be significantly reduced by regularly replacing the key. Long-term use of the same key also increases the possibility that the attacker can obtain information about the key through speculation or analysis. For example, by monitoring the transmission of data or intercepting communications, the attacker may gradually guess the key. This risk can be reduced by regularly replacing the key. Key rotation can also prevent long-term security losses caused by accidental leakage of key files or databases. Key rotation can be implemented based on the key rotation strategy pre-set by the administrator. The key rotation strategy will set the key rotation frequency. The key rotation frequency can be set according to the needs and risk tolerance of the microservice system, and its frequency can be based on quarter, half a year or one year. When the update time node is reached, the administrator can be requested to update the key through the key update confirmation information. Then, an updated key is generated and the stored key information is updated, and the key update status is synchronized to the associated party. In addition, the key can be encrypted and saved by means of key encryption to improve the key security. In this embodiment, the key life cycle management is based on periodic rotation, key storage encryption and other measures to manage the key, which can reduce the difficulty and risk of key management.

[0094] In an exemplary embodiment, the method further includes: caching the authentication result of the data access request to obtain an authentication cache result; and authenticating the data access request subsequently submitted by the user terminal based on the authentication cache result.

[0095] Exemplarily, after completing the authentication process, the result of the authentication process can also be cached to obtain the authentication cache result, and the corresponding expiration time of the authentication cache result can be set. When a data access request submitted by the user terminal is received within the expiration time, the subsequent authentication process can be directly based on the authentication cache result, thereby improving the processing efficiency of the authentication process. In addition, authentication can also be performed through the optimization means of advance authentication, that is, when the user terminal accesses and no data access request is received, the user terminal is authenticated in advance, and the authentication result is cached, and authentication can be performed directly later. In this embodiment, the impact of the authentication process on the system performance is reduced by optimizing the cache, which can effectively improve the response speed and throughput of the system.

[0096] In one embodiment, the method also includes: obtaining an interface log of a microservice system interface gateway; extracting interface key verification record information in the interface log; performing report generation processing based on the interface key verification record information to generate a key work report for the interface key.

[0097] Exemplarily, in order to manage the interface gateway authentication process more finely, the log information of the microservice system interface gateway during operation can be obtained first. Then the interface key verification record information in these interface logs is extracted, and a report is generated by statistical analysis and processing of the interface key verification record information to obtain the key work report of the interface key. Based on the key work report, the administrator can track and monitor the use of API keys from various angles, quickly respond to possible risks and threats, and ensure the security of the system. In this embodiment, by extracting the key verification record information in the interface log to summarize various types of information and problems encountered in the key authentication process, the process of interface key authentication can be analyzed as a whole, providing a data basis for the optimization of the key authentication process.

[0098] In a specific embodiment, the interface gateway authentication method of the present application includes: obtaining a key creation request; generating an encryption key and a decryption key based on the key creation request; performing page generation processing according to the encryption key and the decryption key to obtain a key information display page. Obtaining a key rotation strategy; determining a key update time node based on the key rotation strategy; pushing a key update confirmation information according to the key update time node; generating an update key based on the key update request when a key update request for the key update confirmation information is received; and updating the stored key information based on the update key. Obtaining a data access request from a user terminal to a microservice system interface gateway; performing authentication processing on the data access request in an authorization authentication manner to obtain an authorization authentication result; when the authorization authentication result indicates that the authentication is passed, decrypting the data access request through a secure transmission protocol to obtain decrypted information; extracting the interface key information in the decrypted information; extracting the random number information of the interface key information; performing summary processing based on the random number information to obtain a summary value; performing signature processing based on the summary value and a pre-stored decryption key to obtain a signature verification value; comparing the signature verification value with the signature value in the interface key information to obtain the authentication result of the data access request. Cache the authentication result of the data access request to obtain the authentication cache result; authenticate the data access request subsequently submitted by the user terminal based on the authentication cache result. Obtain the interface log of the microservice system interface gateway; extract the interface key verification record information in the interface log; perform report generation based on the interface key verification record information to generate a key work report for the interface key.

[0099] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0100] Based on the same inventive concept, the embodiment of the present application also provides an interface gateway authentication device for implementing the interface gateway authentication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more interface gateway authentication device embodiments provided below can refer to the limitations on the interface gateway authentication method above, and will not be repeated here.

[0101] In an exemplary embodiment, as shown in FIG6 , an interface gateway authentication device is provided, including:

[0102] The request acquisition module 601 is used to obtain the data access request of the user for the microservice system interface gateway.

[0103] The authorization authentication module 603 is used to authenticate the data access request in an authorization authentication manner to obtain an authorization authentication result.

[0104] The decryption processing module 605 is used to decrypt the data access request through a secure transmission protocol to obtain decryption information when the authorization authentication result indicates that the authentication is successful.

[0105] The information extraction module 607 is used to extract the interface key information in the decryption information.

[0106] The key authentication module 609 is used to perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

[0107] In one embodiment, the key authentication module 609 is specifically used to: extract random number information of the interface key information; perform summary processing based on the random number information to obtain a summary value; perform signature processing based on the summary value and a pre-stored decryption key to obtain a signature verification value; compare the signature verification value with the signature value in the interface key information to obtain an authentication result of the data access request.

[0108] In one embodiment, a key creation module is also included, which is used to: obtain a key creation request; generate an encryption key and a decryption key based on the key creation request; perform page generation processing according to the encryption key and the decryption key to obtain a key information display page.

[0109] In one embodiment, it also includes a key rotation module, which is used to: obtain a key rotation strategy; determine a key update time node based on the key rotation strategy; push key update confirmation information according to the key update time node; upon receiving a key update request for the key update confirmation information, generate an updated key based on the key update request; and update the stored key information based on the updated key.

[0110] In one embodiment, it also includes a result cache module, which is used to: cache the authentication result of the data access request to obtain the authentication cache result; and authenticate the data access request subsequently submitted by the user terminal based on the authentication cache result.

[0111] In one embodiment, a log analysis module is also included, which is used to: obtain the interface log of the microservice system interface gateway; extract the interface key verification record information in the interface log; perform report generation processing based on the interface key verification record information to generate a key work report of the interface key.

[0112] Each module in the above-mentioned interface gateway authentication device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0113] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data related to interface gateway authentication. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an interface gateway authentication method is implemented.

[0114] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0115] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0116] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0117] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0118] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0119] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0120] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0121] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An interface gateway authentication method, characterized in that: The method comprises: Obtain data access requests from user terminals to the microservice system interface gateway; Authenticating the data access request in an authorization and authentication manner to obtain an authorization and authentication result; When the authorization authentication result indicates that the authentication is passed, the data access request is decrypted through a secure transmission protocol to obtain decrypted information; Extracting interface key information from the decryption information; Perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

2. The method according to claim 1, characterized in that The performing key authentication processing on the interface key information to obtain the authentication result of the data access request includes: Extract random number information of the interface key information; Performing summary processing based on the random number information to obtain a summary value; Performing signature processing based on the digest value and the pre-stored decryption key to obtain a signature verification value; The signature verification value is compared with the signature value in the interface key information to obtain an authentication result of the data access request.

3. The method according to claim 1, characterized in that The method further comprises: Get key creation request; Generate an encryption key and a decryption key based on the key creation request; A page generation process is performed according to the encryption key and the decryption key to obtain a key information display page.

4. The method according to claim 1, characterized in that: The method further comprises: Get the key rotation strategy; Determining a key update time node based on the key rotation strategy; Push key update confirmation information according to the key update time node; upon receiving a key update request for the key update confirmation information, generating an updated key based on the key update request; The stored key information is updated based on the update key.

5. The method according to claim 1, characterized in that The method further comprises: Cache the authentication result of the data access request to obtain an authentication cache result; The authentication processing is performed on the data access request subsequently submitted by the user terminal based on the authentication cache result.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtain the interface log of the microservice system interface gateway; Extracting interface key verification record information from the interface log; A report generation process is performed based on the interface key verification record information to generate a key work report of the interface key.

7. An interface gateway authentication device, characterized in that: The device comprises: The request acquisition module is used to obtain the user's data access request for the microservice system interface gateway; An authorization and authentication module is used to authenticate the data access request in an authorization and authentication manner to obtain an authorization and authentication result; A decryption processing module, used to decrypt the data access request through a secure transmission protocol to obtain decryption information when the authorization authentication result indicates that the authentication is passed; An information extraction module, used to extract the interface key information in the decryption information; The key authentication module is used to perform key authentication processing on the interface key information to obtain an authentication result of the data access request.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images