Access method and device, transit server, service cluster and storage medium

Abstract

The embodiment of the invention provides an access method and device, a transit server, a service cluster and a storage medium, and relates to the technical field of computers. Obtaining an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request comprises an access address corresponding to the target third-party service; and forwarding the access request to the target third-party service according to the access address, so that the target third-party service authenticates the access request according to the IP address of the transit server under the condition that the target third-party service receives the access request. The access request can be sent to the target third-party service through the transit server, so that the source IP of the access request is the IP address of the transit server, and therefore, the IP addresses of all servers in a cluster do not need to be exposed to the third-party service, and potential safety hazards can be reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an access method, device, transfer server, service cluster and storage medium. Background Art

[0002] Currently, a cluster environment is a common network service deployment environment, that is, multiple servers are organized into a cluster to jointly provide high-performance services.

[0003] In the prior art, in a cluster environment, a service-oriented program can be dynamically deployed on any server. Therefore, when the service-oriented program initiates an access request to a third-party service, the source IP of the access request will change. In this case, in order to facilitate the third-party service to authenticate the access request, it is often necessary to provide the IP addresses of all servers in the cluster to the third-party service. However, this method will expose the IP addresses of all servers in the cluster, which poses certain security risks. Summary of the invention

[0004] In view of this, the purpose of this application is to provide an access method, device, transit server, service cluster and storage medium to solve the problem in the prior art that the source IP of the access request changes, resulting in the need to expose the IP addresses of all servers in the cluster, which poses certain security risks.

[0005] In order to achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, the present application provides an access method, which is applied to at least one transit server in a service cluster, wherein the service cluster further includes a plurality of request servers, wherein the transit server is respectively connected to each of the request servers and at least one third-party service in communication, wherein the third-party service stores an IP address of the transit server, and the method includes:

[0007] Obtaining an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to a target third-party service;

[0008] The access request is forwarded to the target third-party service according to the access address, so that when the target third-party service receives the access request, it authenticates the access request according to the IP address of the transit server.

[0009] In an optional implementation manner, an Nginx service is deployed in the transit server, and forwarding the access request to the target third-party service according to the access address includes:

[0010] The access request is forwarded to the target third-party service through the Nginx service according to the access address.

[0011] In an optional implementation, the Nginx service is deployed through the following steps:

[0012] Obtain a label adding instruction, and add an Nginx label to the transit server according to the label adding instruction;

[0013] Create an Nginx service, deploy the Nginx service on the transit server according to the Nginx label, and configure an Nginx reverse proxy rule for the transit server according to the access address of the third-party service.

[0014] In an optional embodiment, the method further comprises:

[0015] Obtain an Nginx log file, and determine the interface response status of the third-party service according to the Nginx log file.

[0016] In an optional implementation manner, the Nginx log file includes the interface response time and interface status of the third-party service;

[0017] Determining the interface response status of the third-party service according to the Nginx log file includes:

[0018] If the interface status indicates that the request is successful and the interface response time exceeds a preset time, determining that the interface response status is a response timeout;

[0019] If the interface status characterization request fails, the interface response status is determined to be unresponsive.

[0020] In an optional embodiment, the method further comprises:

[0021] If the interface response status is response timeout or failure to respond, the service provider information of the service provider to which the third-party service belongs is obtained, and an alarm message is sent to the service provider according to the service provider information.

[0022] In a second aspect, the present application provides an access device, which is applied to at least one transit server in a service cluster, wherein the service cluster further includes a plurality of request servers, wherein the transit server is respectively connected to each of the request servers and at least one third-party service in communication, wherein the third-party service stores an IP address of the transit server, and the device includes:

[0023] an acquisition module, configured to acquire an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to a target third-party service;

[0024] The forwarding module is used to forward the access request to the target third-party service according to the access address, so that the target third-party service can authenticate the access request according to the IP address of the transit server when receiving the access request.

[0025] In a third aspect, the present application provides a transit server, comprising a processor and a memory, wherein the memory stores a computer program that can be executed by the processor, and the processor can execute the computer program to implement the method described in any one of the aforementioned implementations.

[0026] In a fourth aspect, the present application provides a service cluster, comprising at least one transit server as described in the aforementioned embodiment and a plurality of request servers, and the transit server is respectively communicatively connected with each of the request servers and at least one third-party service.

[0027] In a fifth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method described in any one of the aforementioned embodiments is implemented.

[0028] The access method, device, relay server, service cluster and storage medium provided in the embodiments of the present application include at least one relay server and multiple request servers in the service cluster. The relay server can be respectively connected to each request server and at least one third-party service in communication, and the third-party service stores the IP address of the relay server. On this basis, the relay server can obtain the access request generated by any server in the service cluster, and then forward the access request to the target third-party service according to the access address of the target third-party service in the access request. The target third-party service can authenticate the access request according to the IP address of the relay server when receiving the access request. Since the access request can be sent to the target third-party service through the relay server, the source IP of the access request is the IP address of the relay server. Based on this, there is no need to expose the IP addresses of all servers in the cluster to the third-party service, thereby reducing security risks.

[0029] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A block diagram of a service cluster provided in an embodiment of the present application is shown;

[0032] Figure 2 A block diagram of a transfer server provided in an embodiment of the present application is shown;

[0033] Figure 3 A schematic diagram of a process flow of an access method provided by an embodiment of the present application is shown;

[0034] Figure 4 A functional module diagram of an access device provided by an embodiment of the present application is shown;

[0035] Figure 5 Another functional module diagram of the access device provided in an embodiment of the present application is shown.

[0036] Icons: 1-service cluster; 10-transit server; 100-memory; 110-processor; 120-communication module; 20-request server; 200-acquisition module; 210-forwarding module; 220-deployment module; 230-determination module; 30-third-party service. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0038] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0039] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0040] Currently, a cluster environment is a common network service deployment environment, that is, multiple servers are organized into a cluster to jointly provide high-performance services.

[0041] In the prior art, in a cluster environment, a service-based program can be dynamically deployed on any server. Therefore, when the service-based program initiates an access request to a third-party service, the source IP of the access request will change. In this case, in order to facilitate the third-party service to authenticate the access request, it is often necessary to provide the IP addresses of all servers in the cluster to the third-party service. However, this will lead to the following problems.

[0042] 1. Since this method will expose the IP addresses of all servers in the cluster, there will be certain security risks.

[0043] 2. If the servers in the cluster are updated, for example, some servers are added or some servers are removed, the IP list of the third service needs to be updated according to the IP addresses of these servers, but this will lead to higher management difficulty and cost.

[0044] Based on this, embodiments of the present application provide an access method, device, transit server, service cluster and storage medium to solve the above problems.

[0045] Specifically, Figure 1 For a block diagram of the service cluster 1 provided in the embodiment of the present application, please refer to Figure 1 The service cluster includes at least one transit server 10 and a plurality of request servers 20 , and the transit server is respectively connected to each request server and at least one third-party service 30 for communication.

[0046] Optionally, the third-party service 30 may store the IP address of the transit server.

[0047] Optionally, the transit server may be any server in the service cluster, such as a management server or other servers, which may be specifically determined by the user according to actual needs.

[0048] Optionally, considering that a relay server may fail, resulting in the access request being unable to be forwarded successfully, multiple relay servers may be set up, for example, two relay servers, and each relay server is respectively connected to each request server and at least one third-party service for communication.

[0049] It is understandable that if one of the relay servers fails, the request server may forward the access request to the third-party service through other relay servers.

[0050] Further, in Figure 1 On the basis of Figure 2 For a block diagram of the transfer server 10 provided in the embodiment of the present application, see Figure 2 The transfer server includes a memory 100, a processor 110 and a communication module 120. The memory 100, the processor 110 and the communication module 120 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0051] The memory 100 is used to store computer programs or data that can be executed by the processor. The memory can be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electric erasable programmable read-only memory (EEPROM), etc.

[0052] The processor 110 is used to read / write data or computer programs stored in the memory, and execute the computer program to implement the access method provided in the embodiment of the present application.

[0053] The communication module 120 is used to establish a communication connection between the transit server and other communication terminals through the network, and to send and receive data through the network.

[0054] It should be understood that Figure 2 The structure shown is only a schematic diagram of the structure of the relay server. The relay server may also include Figure 2 More or fewer components as shown, or with Figure 2 Different configurations are shown. Figure 2 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0055] Next, the above Figure 1 The transfer server in the embodiment is the execution entity, and the access method provided in the embodiment of the present application is exemplarily introduced in combination with the flow chart.

[0056] Specifically, Figure 3 A flowchart of the access method provided in the embodiment of the present application is shown in Figure 3 , the method comprising:

[0057] Step S20, obtaining an access request.

[0058] The access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to the target third-party service.

[0059] Optionally, since the service-oriented program can be dynamically deployed on any server, the service-oriented program can be deployed on the request server or on the transit server, that is, the access request may be an access request sent by the request server or generated by the transit server.

[0060] Optionally, in order to prevent excessive resource pressure on the transit server, it can also be set that the service-oriented program can only be dynamically deployed on the request server, and the access request is an access request sent by the request server.

[0061] Step S21 : forwarding the access request to the target third-party service according to the access address, so that the target third-party service authenticates the access request according to the IP address of the transit server when receiving the access request.

[0062] In this embodiment, the target third-party service needs to authenticate the access request to determine whether the access request is safe, and thus determine whether to respond to the access request.

[0063] It can be understood that since the target third-party service stores the IP address of the relay server, the target third-party service can authenticate the source IP of the access request based on the IP address of the relay server, and determine whether the source IP of the access request is the IP address of the relay server stored in advance. If so, it is determined that the authentication is successful and responds to the access request.

[0064] Optionally, the transit server may also receive response information sent by the target third-party service, and forward the response information to a corresponding server.

[0065] In the access method provided in the embodiment of the present application, the transit server can obtain the access request generated by any server in the service cluster, and then forward the access request to the target third-party service according to the access address of the target third-party service in the access request. Then, the target third-party service can authenticate the access request according to the IP address of the transit server when receiving the access request. Since the access request can be sent to the target third-party service through the transit server, the source IP of the access request is the IP address of the transit server. Based on this, there is no need to expose the IP addresses of all servers in the cluster to the third-party service, thereby reducing security risks.

[0066] Furthermore, since the access method provided in the embodiment of the present application can forward access requests through a relay server, there is no need to update the IP list of the third-party service even if the servers in the cluster are increased or decreased, thereby reducing management difficulty and cost.

[0067] In addition, considering that in this case, only the transit server in the service cluster exchanges information with the outside world, the service cluster can be guaranteed to be a relatively closed environment. Compared with the prior art in which each server may send access requests to the outside world (to third-party services), this method can further ensure information security and communication security within the cluster.

[0068] In a possible implementation, an Nginx service may be deployed in the transit server, and the transit server may forward the access request to the target third-party service according to the access address through the Nginx service.

[0069] It should be noted that Nginx is an open source, high-performance HTTP and reverse proxy server, which also provides the functions of mail proxy server and general TCP / UDP proxy server.

[0070] In this embodiment, in order to facilitate subsequent applications, the user can select a transit server from multiple servers when building a service cluster, and deploy an Nginx service for the transit server.

[0071] Optionally, a tag may be added to the transit server first to select the transit server so as to deploy the Nginx service on the transit server.

[0072] Specifically, you can deploy the Nginx service on the transit server by following the steps below:

[0073] Get the tag adding instruction, and add Nginx tags to the transit server according to the tag adding instruction. Then create the Nginx service, deploy the Nginx service on the transit server according to the Nginx tag, and configure the Nginx reverse proxy rules for the transit server according to the access address of the third-party service.

[0074] Optionally, the user can add Nginx labels to the transit server and deploy Nginx services through the management node in the service cluster, or directly add Nginx labels to the transit server and deploy Nginx services.

[0075] Optionally, Nginx reverse proxy rules are a server configuration that allows Nginx to receive client requests and then forward those requests to one or more backend servers. Reverse proxy can improve the availability, security, and performance of your website and can hide the details of the backend servers.

[0076] In this embodiment, the Nginx reverse proxy rule may include the access address of the third-party service.

[0077] In one example, the management node in the service cluster can be used as a transit server to deploy the Nginx service.

[0078] In this example, if the service cluster includes 10 servers and there are two management nodes, the IP address of management node A is 192.168.1.100, and the IP address of management node B is 192.168.1.101, you can add the Nginx label "role=proxy" to these two management nodes through the label addition instruction "docker node update --label-add role=proxy".

[0079] In this example, you can create a 6-Nginx service and deploy it on a server with the label "role=proxy" by running the deployment instruction "docker service create --name nginx-proxy --constraint'node.labels.role=proxy' --publish published=80,target=80nginx:latest;".

[0080] Next, you can configure Nginx reverse proxy rules for the server where the 6-Nginx service is deployed. In this example, if the access address domain name of a third-party service is https: / / www.a.com, you can add the following content to the / etc / nginx / conf.d / default.conf file directory of the transit server to configure Nginx reverse proxy rules for the transit server:

[0081] "location / a-com{

[0082] proxy_pass http: / / www.a.com;

[0083] proxy_set_header Host $host;

[0084] proxy_set_header X-Real-IP$remote_addr; #other necessary proxy_set_header instructions}".

[0085] Understandably, after deploying the Nginx service for the transit server, the IP address of the transit server needs to be sent to a third-party service for backup.

[0086] In this example, the IP address 192.168.1.100 of the management node A and the IP address 192.168.1.101 of the management node B may be sent to the third-party service so that the third-party service may later authenticate the access request based on the IP address.

[0087] In this example, the request server may send an access request "nginx-proxy / a-com" to management node A or management node B to achieve access to the third-party service.

[0088] Optionally, considering that the interface of the third-party service may have an incorrect response status, in order to solve this problem in a timely manner, the transit server also needs to determine the response status of the interface of the third-party service.

[0089] In one possible implementation, the transit server may obtain an Nginx log file, and determine the interface response status of the third-party service according to the Nginx log file.

[0090] Optionally, the transit server may obtain the Nginx log file in real time for judgment, or may obtain the Nginx log file within a certain period of time for judgment at regular intervals.

[0091] It can be understood that the interface response status can reflect whether the interface of the third-party service can work normally or may fail.

[0092] In this embodiment, the Nginx log file may record the interface response time and interface status of the third-party service, and the transit server may determine the interface response status of the third-party service according to the interface response time and interface status.

[0093] Specifically, if the interface status characterization request is successful and the interface response time exceeds a preset duration, the relay server may determine that the interface response status is a response timeout; if the interface status characterization request fails, the relay server may determine that the interface response status is an unresponsive state.

[0094] In addition, if the interface status representation request is successful and the interface response time does not exceed a preset time, the transit server may determine that the interface response status is normal.

[0095] In a possible implementation, an interface status of 200 indicates a successful request, and an interface status of 404 indicates a failed request, and the preset time length may be 2 seconds.

[0096] Optionally, the Nginx log file may also record other information of the third-party service, such as the interface address of the third-party service, supplier information of the supplier to which the third-party service belongs, and the like.

[0097] It is understandable that if the interface response status is response timeout or failure to respond, it can be determined that the interface of the third-party service may be faulty. In this case, the transit server can also notify the supplier of the third-party service to handle the fault in a timely manner.

[0098] Specifically, if the interface response status is response timeout or failure to respond, the transit server may obtain the service provider information of the service provider to which the third-party service belongs, and send an alarm message to the service provider according to the service provider information.

[0099] In this embodiment, the transit server can obtain the service provider information of the service provider to which the third-party service belongs through the Nginx log file.

[0100] Optionally, the service provider information may be communication information of the service provider, such as an email address, a feedback webpage, and the like.

[0101] In one example, if the service provider information is an email address, the alarm information may be an alarm email, which may include relevant information such as the interface address of the faulty interface, the interface response status, etc., so that the service provider corresponding to the third-party service can troubleshoot the fault according to the alarm email.

[0102] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing an access device is given below. Optionally, the access device can adopt the above Figure 2 For further information, please refer to Figure 4 , Figure 4 A functional module diagram of an access device provided in an embodiment of the present application. It should be noted that the basic principle and technical effects of the access device provided in this embodiment are the same as those of the above embodiments. For the sake of brief description, for parts not mentioned in this embodiment, reference can be made to the corresponding contents in the above embodiments. The access device includes: an acquisition module 200 and a forwarding module 210.

[0103] The acquisition module 200 is used to acquire an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to the target third-party service.

[0104] It can be understood that the acquisition module 200 can also be used to execute the above step S20.

[0105] The forwarding module 210 is used to forward the access request to the target third-party service according to the access address, so that the target third-party service can authenticate the access request according to the IP address of the transit server when receiving the access request.

[0106] It can be understood that the forwarding module 210 can also be used to execute the above step S21.

[0107] Optionally, the forwarding module 210 is further configured to forward the access request to a target third-party service according to the access address through the Nginx service.

[0108] Optionally, in Figure 4 On the basis of Figure 5 For another functional module diagram of the access device provided in the embodiment of the present application, please refer to Figure 5 The access device also includes a deployment module 220 and a determination module 230.

[0109] The deployment module 220 is used to obtain a label adding instruction and add an Nginx label to the transit server according to the label adding instruction; create an Nginx service, deploy the Nginx service on the transit server according to the Nginx label, and configure the Nginx reverse proxy rules for the transit server according to the access address of the third-party service.

[0110] The determination module 230 is used to obtain the Nginx log file and determine the interface response status of the third-party service according to the Nginx log file.

[0111] Optionally, the determination module 230 is further configured to determine that the interface response status is a response timeout if the interface status characterization request is successful and the interface response time exceeds a preset duration; and to determine that the interface response status is an unresponsive status if the interface status characterization request fails.

[0112] Optionally, the determination module 230 is further configured to obtain service provider information of a service provider to which the third-party service belongs if the interface response status is response timeout or failure to respond, and send an alarm message to the service provider according to the service provider information.

[0113] Optionally, the above modules can be stored in the form of software or firmware. Figure 2 The memory shown in FIG. 1 is stored in the operating system (OS) of the transfer server and can be used by Figure 2 Meanwhile, the data and program codes required for executing the above modules can be stored in the memory.

[0114] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the access method provided by the embodiment of the present application can be implemented.

[0115] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0117] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An access method, characterized in that: At least one transit server in a service cluster is applied, the service cluster further comprising a plurality of request servers, the transit server is respectively connected to each of the request servers and at least one third-party service in communication, the third-party service storing an IP address of the transit server, the method comprising: Obtaining an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to a target third-party service; The access request is forwarded to the target third-party service according to the access address, so that when the target third-party service receives the access request, it authenticates the access request according to the IP address of the transit server.

2. The method according to claim 1, characterized in that The transit server is deployed with an Nginx service, and forwarding the access request to the target third-party service according to the access address includes: The access request is forwarded to the target third-party service through the Nginx service according to the access address.

3. The method according to claim 2, characterized in that The Nginx service is deployed through the following steps: Obtain a label adding instruction, and add an Nginx label to the transit server according to the label adding instruction; Create an Nginx service, deploy the Nginx service on the transit server according to the Nginx label, and configure an Nginx reverse proxy rule for the transit server according to the access address of the third-party service.

4. The method according to claim 1, characterized in that The method further comprises: Obtain an Nginx log file, and determine the interface response status of the third-party service according to the Nginx log file.

5. The method according to claim 4, characterized in that The Nginx log file includes the interface response time and interface status of the third-party service; Determining the interface response status of the third-party service according to the Nginx log file includes: If the interface status indicates that the request is successful and the interface response time exceeds a preset time, determining that the interface response status is a response timeout; If the interface status characterization request fails, the interface response status is determined to be unresponsive.

6. The method according to claim 4, characterized in that The method further comprises: If the interface response status is response timeout or failure to respond, the service provider information of the service provider to which the third-party service belongs is obtained, and an alarm message is sent to the service provider according to the service provider information.

7. An access device, characterized in that: At least one transit server in a service cluster is applied, the service cluster further comprising a plurality of request servers, the transit server is respectively connected to each of the request servers and at least one third-party service in communication, the third-party service stores an IP address of the transit server, the device comprising: an acquisition module, configured to acquire an access request; the access request is generated by any server in the service cluster and sent to the transit server, and the access request includes an access address corresponding to a target third-party service; The forwarding module is used to forward the access request to the target third-party service according to the access address, so that the target third-party service can authenticate the access request according to the IP address of the transit server when receiving the access request.

8. A transit server, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor can execute the computer program to implement the method according to any one of claims 1 to 6.

9. A service cluster, characterized in that: It comprises at least one transit server as claimed in claim 8 and a plurality of request servers, and the transit server is respectively connected to each of the request servers and at least one third-party service for communication.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images