Request processing method and device, equipment, storage medium and product

Abstract

The invention relates to the technical field of data processing, and discloses a request processing method and device, equipment, a storage medium and a product, and the method comprises the steps: extracting a computing power group number, a service identifier and a request parameter from an external access request, and searching a target computing power group corresponding to the computing power group number; selecting execution gateway computing power from the target computing power group; performing identity authentication on the request parameter through a filter link; when the authentication is passed, determining a target service method through the service identifier; and calling a service method corresponding to the service identifier according to the request parameter by executing the gateway computing power. Due to the fact that the data processing device is used for unifying the interaction between the gateways to manage the subsystems and accessing all the flow in a centralized mode, data safety is guaranteed, meanwhile, it is avoided that multiple different gateways need to be connected in a butt joint mode, maintenance cost is reduced, and management efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to request processing methods, devices, equipment, storage media and products. Background Art

[0002] With the continuous development of services (such as international roaming services), related business systems will be divided into multiple subsystems, and interact more and more with third-party systems. The traditional interface data transmission method has the risk of data leakage and unauthorized access. In addition, different subsystems may use different technical architectures, communication protocols and data formats. This diversity makes the information interaction between systems complicated, which not only increases the difficulty of data conversion and synchronization, but also may cause information loss or inconsistency.

[0003] The existing business system communication adopts the traditional decentralized management method, in which gateways are configured separately in different subsystems for management. During the system integration process, the gateway configuration needs to be continuously adjusted to ensure the efficient operation of the system. At the same time, the scalability and elasticity of the system are also poor, which increases the complexity and difficulty of management. It is not only inefficient, but also difficult to detect and solve potential problems in a timely manner, resulting in high maintenance costs. Summary of the invention

[0004] The main purpose of this application is to provide a request processing method, device, equipment, storage medium and product, aiming to solve the technical problem of configuring gateways separately in different subsystems for management, which is difficult and inefficient to manage.

[0005] To achieve the above objectives, the present application proposes a request processing method, which includes:

[0006] Extract the computing power group number, service identifier and request parameters from the external access request, and search for the target computing power group corresponding to the computing power group number;

[0007] Selecting an execution gateway computing power from the target computing power group, wherein the execution gateway computing power is provided with a filter chain, wherein the filter chain includes a plurality of filters with different priorities, and each filter in the filter chain is sorted from high to low based on the corresponding priority;

[0008] Performing identity authentication on the request parameters through the filter link, wherein the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and authority detection;

[0009] When the authentication is passed, the target service method is determined by the service identifier;

[0010] The target service method is called according to the request parameters through the execution gateway computing power.

[0011] Optionally, calling the target service method according to the request parameter by executing the gateway computing power includes:

[0012] Obtain the parent interface corresponding to the target service method;

[0013] Searching for corresponding decryption configuration and encryption configuration according to the service identifier and / or the upper interface;

[0014] Encrypt the request parameters according to the encryption configuration to generate request ciphertext parameters;

[0015] Calling the service method corresponding to the service identifier according to the request ciphertext parameters through the execution gateway computing power;

[0016] After calling the target service method according to the request parameters by executing the gateway computing power, the method further includes:

[0017] Decrypt the ciphertext data of the service method feedback corresponding to the service identifier according to the decryption configuration to generate feedback data;

[0018] Response data is constructed according to the feedback data, and the response data is sent to a request initiator corresponding to the external access request.

[0019] Optionally, before extracting the computing power group number, service identifier and request parameters from the external access request, the method further includes:

[0020] Scan the service code corresponding to the newly deployed service based on the preset service provision annotation to obtain the method information to be added;

[0021] Update the method information table in the gateway database with the method information to be added, wherein the method information table is used to store method information of the callable service method;

[0022] When the update is completed, the cache method list corresponding to the method information table is updated;

[0023] When the authentication is passed, determining the target service method by the service identifier includes:

[0024] When the authentication is passed, searching whether there is a data record corresponding to the service identifier in the cache method list;

[0025] If it exists, the target service method is determined according to the data record corresponding to the service identifier.

[0026] Optionally, before extracting the computing power group number, service identifier and request parameters from the external access request, the method further includes:

[0027] When a routing configuration update is detected, the updated routing configuration is obtained, where the routing configuration includes a division rule of computing power groups and a request routing rule of gateway computing power in each computing power group;

[0028] Updating the routing configuration table in the gateway database based on the updated routing configuration;

[0029] When the update is completed, the cache routing configuration table corresponding to the routing configuration table is updated.

[0030] Optionally, if at least one of the following is met, it is determined that a routing configuration update is monitored:

[0031] The administrator modifies the routing configuration table in the gateway database;

[0032] The routing configuration initialization function is triggered;

[0033] The configuration of the gateway computing power in the computing power group has been modified.

[0034] Optionally, extracting a computing power group number, a service identifier, and a request parameter from an external access request includes:

[0035] Obtaining the protocol type corresponding to the external access request;

[0036] If the protocol type is not a standard protocol type, performing protocol conversion on the external access request to generate a standard external access request;

[0037] The computing power group number, service identifier and request parameters are extracted from the standard external access request.

[0038] In addition, to achieve the above purpose, the present application also provides a request processing device, the device comprising:

[0039] An extraction module is used to extract a computing power group number, a service identifier, and request parameters from an external access request, and to search for a target computing power group corresponding to the computing power group number;

[0040] A selection module, used for selecting an execution gateway computing power from the target computing power group, wherein the execution gateway computing power is provided with a filter chain, wherein the filter chain includes a plurality of filters of different priorities, and each filter in the filter chain is sorted from high to low based on the corresponding priority;

[0041] A detection module, used to perform identity authentication on the request parameters through the filter link, wherein the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and authority detection;

[0042] A determination module, used to determine the target service method through the service identifier when the authentication is passed;

[0043] A calling module is used to call the target service method according to the request parameters through the execution gateway computing power.

[0044] In addition, to achieve the above-mentioned purpose, the present application also provides a request processing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the request processing method as described above.

[0045] In addition, to achieve the above-mentioned purpose, the present application also provides a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the request processing method described above are implemented.

[0046] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the request processing method described above are implemented.

[0047] One or more technical solutions proposed in this application have at least the following technical effects:

[0048] The use of data processing equipment as a unified gateway to manage the interactions between subsystems and centrally access all traffic ensures data security while avoiding the need to connect to multiple different gateways separately, reducing maintenance costs and improving management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0051] Figure 1 A flowchart of the first embodiment of the method for processing a request of this application is provided;

[0052] Figure 2 A flowchart of the second embodiment of the method for processing a request of this application is provided;

[0053] Figure 3 A schematic diagram of a gateway interaction process according to an embodiment of the present application;

[0054] Figure 4A schematic diagram of system collaboration distribution according to an embodiment of the present application;

[0055] Figure 5 A schematic diagram of the functional design of a gateway core communication module according to an embodiment of the present application;

[0056] Figure 6 A schematic diagram of filter function according to an embodiment of the present application;

[0057] Figure 7 A flowchart of the third embodiment of the method for processing a request of this application is provided;

[0058] Figure 8 A schematic diagram of updating routing configuration according to an embodiment of the present application;

[0059] Fig. 9 This is a functional diagram of a gateway registration center module according to an embodiment of the present application;

[0060] Fig.10 This is a schematic diagram of the module structure of the request processing device according to an embodiment of the present application;

[0061] Fig.11 A schematic diagram of the device structure of the hardware operating environment involved in the request processing method in the embodiment of the present application.

[0062] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0064] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0065] Based on this, the present application embodiment provides a request processing method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the method for processing requests of this application.

[0066] In this embodiment, the request processing method includes steps S10 to S50:

[0067] Step S10: extract the computing power group number, service identifier and request parameters from the external access request, and search for the target computing power group corresponding to the computing power group number.

[0068] It should be noted that the execution subject of this embodiment can be the request processing device, and the request processing device can be a personal computer, server or other electronic device, such as a server. Of course, it can also be other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the request processing method of the present invention is explained by taking the request processing device as an example.

[0069] It should be noted that the request processing device can serve as a unified gateway, responsible for managing the communication between the subsystems, and the communication between the subsystems and the third-party platform or system.

[0070] In actual use, an external access request can be an access request sent by a third-party platform when it needs to access a business system. The service identifier can be the business method (also known as a business service) that the third-party platform needs to access, and the request parameters can be the parameters used by the third-party platform to ensure that the method can be called correctly when accessing the business system, such as method call parameters, identity authentication parameters (such as account number or identity authentication information token, etc.), and the computing power group number can be the group identifier of the computing power group to which the computing power that provides the called business method belongs.

[0071] Among them, a computing power group can contain multiple gateway computing powers. The gateway computing power corresponds to the services provided by the subsystem. The gateway computing power corresponding to services with the same functions or functions classified into the same category will be divided into a unified computing power group. Depending on the number of services provided by the subsystem, a subsystem can correspond to at least one gateway computing power.

[0072] Of course, each subsystem can try to use internal calls to directly access other subsystems. Of course, access between subsystems can also be through request access, that is, using the same method as a third-party platform calling a subsystem. At this time, the subsystem that initiates the access is regarded as a third-party platform.

[0073] In actual use, the external access request can be parsed to extract the computing power group number, service identifier and request parameters. Then, the computing power group number is compared with the group identifier of each computing power group to determine the target computing power group.

[0074] In a specific implementation, the link format of the external access request can be "gateway IP address: port / group number / service ID". At this time, the computing power group number and service ID can be extracted from the request link of the external access request. As for the request parameters, the request type of the external access request can be determined first, and then the request parameters can be extracted from the external access request according to the parameter reading method corresponding to the request type.

[0075] For example, taking an http (Hypertext Transfer Protocol) request as an example, you can first determine whether the external access request is a get request or a post request. If it is a get request, read the request parameters from the request link of the external access request. If it is a post request, read the request parameters from the request body of the external access request.

[0076] In a specific implementation, in order to ensure internal protocol consistency, step S10 in this embodiment may include:

[0077] Obtaining the protocol type corresponding to the external access request;

[0078] If the protocol type is not a standard protocol type, performing protocol conversion on the external access request to generate a standard external access request;

[0079] The computing power group number, service identifier and request parameters are extracted from the standard external access request.

[0080] It should be noted that the corresponding protocol type can be determined by the protocol type parameter of the external access request, and of course, the corresponding protocol type can also be determined by the format, parameters and other characteristics of the external access request. The standard protocol type can be pre-set by the administrator of the request processing device, for example, setting the http protocol as the standard protocol type.

[0081] It is understandable that in order to ensure the consistency of the protocols within the computing power processing device and each subsystem, if the protocol type of the external access request is not a standard protocol type, the external access request can be converted to a protocol, and a request of a standard protocol type can be constructed based on the data contained in the external access request, thereby generating a standard external access request. After the standard external access request is constructed, the standard external access request can be further parsed to extract the computing power group number, service identifier, and request parameters.

[0082] Step S20: Selecting execution gateway computing power from the target computing power group.

[0083] It should be noted that a filter chain may be set in the execution gateway computing power for identity authentication. The filter chain includes multiple filters with different priorities. The filters in the filter chain are sorted from high to low based on the corresponding priority.

[0084] Step S30: Authenticate the request parameters through the filter link.

[0085] It should be noted that identity authentication can include at least one of session detection, SQL (Structured Query Language) injection detection, parameter legitimacy detection, and permission detection. The role of identity authentication is to control the passage and processing of legitimate requests, which is achieved through at least one gateway filter. The filter will verify the session information (token) in the request to ensure its validity and legitimacy. If the requested token is invalid or timed out, the request will be rejected and cannot be processed further. In addition, client verification and black and white list checks will be performed to further ensure that only legitimate and authorized requests can pass.

[0086] At the same time, the filter chain can also perform SQL injection detection. For example, the filter chain can also include a custom global filter, which can dynamically refresh the SQL injection filtering path and filter the http request to determine whether it contains SQL injection keywords, thereby achieving the effect of preventing SQL injection attacks.

[0087] Among them, the global filter used for SQL injection detection can be set through the preset tool class, such as adding the SqLinjectionRuleUtils tool class, writing a reasonable SQL interception verification method, so as to realize the custom anti-SQL injection gateway configurable global filter.

[0088] Step S40: When the authentication is successful, the target service method is determined through the service identifier.

[0089] In actual use, if the authentication is passed, it means that the service in the subsystem can be called at this time, and the request processing device acts as a gateway, in which a service method list can be stored. The service method list can store method information of the service methods that can be called in each subsystem, such as the method belonging system, method calling parameters, method calling method, etc. At this time, the specific execution process of determining the target service method through the service identifier can be to find the corresponding target service method in the service method list according to the service identifier.

[0090] Step S50: calling the target service method according to the request parameters through the execution gateway computing power.

[0091] In actual use, since the request processing device acts as a gateway, the service method corresponding to the service identifier is not actually provided by the request processing device. At this time, a remote call is required. Specifically, the service method corresponding to the service identifier can be remotely called through RPC (Remote Procedure Call) by using dubbo+zookeeper, cglib dynamic proxy, etc.

[0092] In a specific implementation, for security reasons, when some service methods are called, the calling parameters required are encrypted parameters. In order to ensure that such service methods can also be called normally, step S50 in this embodiment may include:

[0093] Obtain the parent interface corresponding to the target service method;

[0094] Searching for corresponding decryption configuration and encryption configuration according to the service identifier and / or the upper interface;

[0095] Encrypt the request parameters according to the encryption configuration to generate request ciphertext parameters;

[0096] The service method corresponding to the service identifier is called according to the request ciphertext parameters through the execution gateway computing power.

[0097] It should be noted that the superior interface corresponding to the target service method can be the interface implemented by the target service method. For example, if the class to which the target service method belongs is the specific implementation class of interface A, then interface A is the superior interface corresponding to the target service method.

[0098] In actual use, the request processing device may pre-store encryption configuration / decryption configuration. The encryption configuration may include information such as the encryption algorithm and the encryption key. Similarly, the decryption configuration may include information such as the decryption algorithm and the decryption key.

[0099] Among them, the encryption configuration can be set for the service method, and the corresponding encryption configuration can be found according to the service identifier; the encryption configuration can also be set for a certain interface, and the corresponding encryption configuration can be found according to the superior interface; the encryption configuration can also be set for a specific method in a certain interface, and the corresponding encryption configuration can be found according to the service identifier and the superior interface.

[0100] It can be understood that after finding the corresponding encryption configuration, the request parameters can be encrypted according to the encryption configuration, and then the service method corresponding to the service identifier can be remotely called according to the request ciphertext parameters by executing the gateway computing power to ensure that the service method that requires the parameters to be encryption parameters can also be called normally.

[0101] In a specific implementation, the data fed back by such service methods requiring parameter encryption may also be ciphertext data. In order to feed back the plaintext normally, after the step of calling the target service method according to the request parameters by executing the gateway computing power in this embodiment, the following may also be included:

[0102] Decrypt the ciphertext data of the service method feedback corresponding to the service identifier according to the decryption configuration to generate feedback data;

[0103] Response data is constructed according to the feedback data, and the response data is sent to a request initiator corresponding to the external access request.

[0104] It should be noted that the query method of the decryption configuration is similar to the query method of the encryption configuration, which will not be repeated here. After obtaining the decryption configuration, the ciphertext data of the service method feedback corresponding to the service identifier can be encrypted according to the decryption configuration to generate plaintext feedback data. After that, the response data is constructed according to the feedback data, and the response data is sent to the request initiator corresponding to the external access request to ensure that the request initiator can normally receive the feedback data corresponding to the request.

[0105] The request initiator may be a system or platform that sends an external access request to a request processing device.

[0106] Of course, the service method can correspond only to decryption configuration or encryption configuration. For example, the service method only requires the input of encryption parameters, but directly feedbacks plaintext parameters. In this case, only encryption configuration can be set for this service method; the service method receives plaintext parameters, but feedbacks ciphertext data. In this case, only decryption configuration can be set for this service method.

[0107] This embodiment provides a request processing method. Since a data processing device is used as a unified gateway to manage the interactions between subsystems and centrally access all traffic, it not only ensures data security, but also avoids the need to connect to multiple different gateways separately, thereby reducing maintenance costs and improving management efficiency.

[0108] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 2 Before step S10, the request processing method further includes steps S01 to S03:

[0109] Step S01: Scan the service code corresponding to the newly deployed service based on the preset service provision annotation to obtain the method information to be added.

[0110] It should be noted that the preset service provision annotation can be set in advance by the administrator of the request processing device. For example, the preset service provision annotation is set to "@APIProducerMethod()". If a method is configured with the preset service provision annotation, it indicates that the method will be used as a service method. At this time, the method can be used as a method to be added; and if a class is configured with the preset service provision annotation, it means that the methods in the class will be used as service methods. At this time, all methods in the class can be used as methods to be added.

[0111] In actual use, if a new service is deployed, the request processing device can scan the service code corresponding to the service, read the method or class configured with the preset service provision annotation, and thus determine the method information of the method to be added, that is, the method information to be added.

[0112] Step S02: updating the method information table in the gateway database with the method information to be added.

[0113] It should be noted that the gateway database may be a database for storing method information tables, such as a MySQL database, and the method information table may be used to store method information of all callable service methods.

[0114] In actual use, the method information to be added can be added to the method information table stored in the gateway database.

[0115] Step S03: When the update is completed, the cache method list corresponding to the method information table is updated.

[0116] In actual use, due to the persistence of the database, querying and reading data is relatively slow, and if the reading frequency is too high, the pressure on the database is relatively high, and the performance requirements of the database are also high. In order to avoid frequent reading of the database, the method information table in the gateway database can be cached and a cached method list can be generated. At this time, in order to ensure that the cache can be updated synchronously, when it is determined that the method information table in the gateway database has been updated, the cached method list corresponding to the method information table can be updated.

[0117] Among them, when constructing the cache method list, redis cache can be used. Of course, other caches with the same or similar functions can also be used. This embodiment does not limit this. Updating the cache method list corresponding to the method information table can be adding the method information to be added to the cache method list, or reading the data in the method information table in the gateway database, rebuilding the cache method list according to the read data, and overwriting the previous cache method list according to the newly constructed cache method list.

[0118] Accordingly, step S40 in this embodiment may include:

[0119] Step S401: when the authentication is passed, searching whether there is a data record corresponding to the service identifier in the cache method list.

[0120] Step S402: If it exists, determine the target service method according to the data record corresponding to the service identifier.

[0121] It can be understood that the query performance of the cache is relatively high. After using the cache method list, when it is determined that the authentication is passed, you can first check whether there is a data record corresponding to the service identifier in the cache method list. If it exists, the target service method is determined based on the data record corresponding to the service identifier, and an attempt is made to call the target service method to avoid empty calls.

[0122] In a specific implementation, the cache is only for improving query performance. Even if the cache method list is not set, it is still possible to first check whether there is a data record corresponding to the service identifier in the method information table. This embodiment does not limit this.

[0123] For ease of understanding, now combined Figure 3 , Figure 4 , Figure 5 and Figure 6 This is for illustration only but not for limitation. Figure 3 is a schematic diagram of the gateway interaction process of this embodiment, Figure 4 This is a schematic diagram of the system collaboration distribution of this embodiment. Figure 5 This is a schematic diagram of the functional design of the gateway core communication module of this embodiment. Figure 6 FIG. 4 is a functional diagram of the filter of this embodiment.

[0124] like Figure 3 As shown, the request processing device includes a dynamic gateway (omsatt-dynamic-gateway) and a dynamic gateway management module (omsatt-dynamic-manage). The third-party platform initiates a request to the dynamic gateway (omsatt-dynamic-gateway). After receiving the request, the dynamic gateway first processes the data and forwards the request to the business system (such as the international roaming billing and settlement system). The request after data processing is forwarded to the dynamic gateway management module (omsatt-dynamic-manage) for further processing. After the dynamic gateway management module completes the processing, it returns the result to the dynamic gateway, and the dynamic gateway forwards the result back to the third-party platform.

[0125] Among them, omsatt-dynamic-manage: dynamic gateway management module, responsible for processing business logic related to dynamic gateway, including creating, deleting, updating and querying dynamic gateway information omsatt-dynamic-gateway: dynamic gateway, as an API (Application Programming Interface, Application Programming Interface) gateway, its main functions are routing forwarding, traffic control, identity authentication, logging, etc.

[0126] The dynamic gateway includes the gateway core communication module and the gateway service discovery and reporting module, and the dynamic gateway management module includes the gateway registration center module and the gateway background management module. At this time, the functional modules in the request processing device can be divided into four modules, namely the gateway core communication module, the gateway registration center module, the gateway service discovery and reporting module, and the dynamic gateway management module. The collaboration process of each module is as follows: Figure 3 As shown. Figure 4 As shown in the figure, when a subsystem adds a new functional interface (i.e., a new service method), its collaboration process includes:

[0127] ① Add new service methods through application code and annotate them with the annotation @APIProducerMethod(). The service discovery reporting module defines the interface functions that need to be scanned when the service is started based on the SDK (Software Development Kit) and registers them in the registration center module;

[0128] ②The registration center persists service information to the database;

[0129] ③Every time a gateway communication service is deployed, the corresponding computing power is registered with the gateway registration center module, and the information is persisted to the database based on myBatis;

[0130] ④ The computing power module obtains the newly registered functional interface information in real time through redis, registers the service to the local cache with the help of Dubbo+nacos, and provides external request calls, where Dubbo is the software middleware for remote calls;

[0131] ⑤The third-party platform sends an access request (request format: according to gateway IP address: port / group number / service name);

[0132] ⑥NGINX will specify the service computing power according to the group number of the access request (for example, according to group number A in the figure, it is assigned to group A computing power). A computing power in group A in the computing power module will receive the request. After request parameter parsing and authentication judgment, if the authentication is successful, the computing power module will search the cache for the service method. The computing power uses dubbo+cglib dynamic proxy and generalizes the call to the requested RPC service;

[0133] ⑦-⑧ And encapsulate and return the response results to the third-party platform;

[0134] ⑨The current computing power and registration service interface and other information can be viewed through the gateway background management module.

[0135] Among them, the access request outside the system can be parsed to obtain the access IP and computing power group number according to the request header information, and then allocated to the corresponding gateway computing power of the gateway core communication module through Nginx to call the service. The gateway core communication module includes multiple gateway computing powers. Considering the access-intensive scenario, the gateway computing power adopts a cluster mode and groups each computing power. Grouping is conducive to improving the system response efficiency. For example, a system can have multiple domain accesses, which can be grouped according to regions, such as provinces. It can be divided into multiple groups. The computing power nodes of different groups are deployed in various regions. Users in region A can access through the gateway group in region A. Among them, the grouping of computing power groups can be customized by developers.

[0136] When the subsystem is started, the gateway registration center module will obtain the interfaces and methods marked in the code corresponding to the subsystem. After the gateway registration center module completes the processing, it will publish the newly added interfaces and methods to the corresponding gateway computing power for registration through the Redis message subscription and publishing functions. After the external request is assigned to the gateway computing power, it can use the open source distributed service framework dubbo to generalize the call and return the encapsulated response result.

[0137] The core communication module of the gateway mainly accepts external access requests, performs request message parsing, identity authentication, encryption, and response processing results. It can use the NIO (Non-blocking Input / Output) framework Netty to process the http requests sent by the client, convert the requests to protocols, use dubbo+zookeeper and cglib dynamic proxies and generalize calls to RPC services, and return the processed response information.

[0138] like Figure 5 As shown, the functions of the gateway core communication module include: message protocol conversion, session message processing, executor, and communication pipeline.

[0139] Message protocol parsing mainly receives non-http requests. By adding an adapter for protocol conversion, all non-http protocols are converted to http protocols, unifying the internal protocol type to facilitate processing within the system. Corresponding processing logic is added for the different formats of Get and Post request information.

[0140] Session message processing is mainly done by adding multiple ChannelHandlers in series through the core component ChannelPipeline in the Netty framework. Each ChannelHandler handles specific business logic, such as parameter parsing, identity authentication, filtering, message decryption, current limiting, etc.

[0141] Message decryption includes the following steps: configure the application information in the Nacos service center, including the application name, interface address, encryption algorithm, etc.; deploy the gateway service on the gateway server, which can obtain the application information from the Nacos registration center; when the application sends a request, the gateway service will encrypt the request according to the configuration information in the Nacos registration center;

[0142] When the application receives the response, the gateway service will decrypt the response according to the configuration information in the Nacos registry, monitor the configuration changes of the Nacos registry, and dynamically update the encryption strategy. The encryption gateway needs to be able to respond to configuration changes in real time. For this purpose, the configuration monitoring mechanism of Nacos can be used. The encryption and decryption algorithms include RSA, AES, BASE64, etc.

[0143] The role of identity authentication is to control the passing and processing of legitimate requests. It is implemented through the gateway filter. The filter will verify the token in the request to ensure its validity and legitimacy. If the token of the request is invalid or timed out, the request will be rejected and cannot be processed further. In addition, client verification and blacklist and whitelist checks will be performed to further ensure that only legitimate and authorized requests can pass.

[0144] In actual use, you can add the SqLinjectionRuleUtils tool class, write a reasonable SQL interception verification method, implement a custom anti-SQL injection gateway with a configurable global filter, dynamically refresh the SQL injection filtering path, and filter the http request to determine whether it contains SQL injection keywords, thereby preventing SQL injection attacks.

[0145] Through the Gateway filter link, multiple processing processes are encapsulated in the filter implementation. The specific process encapsulation is as follows Figure 6 The following is the execution priority order between the processors:

[0146] AbstractGatewayFilterFactory: This is an abstract class used to create GatewayFilter. It defines some basic properties and methods, and subclasses can extend it according to their own needs. Its execution priority is the highest.

[0147] GatewayFilter: This is an interface that defines the behavior of the filter. The specific filtering logic is implemented by the subclass that implements this interface. Its execution priority is lower than that of AbstractGatewayFilterFactory.

[0148] SentinelGatewayFilter: This is a class that implements the GatewayFilter interface, which is used to implement Sentinel's flow control and fuse degradation functions. Its execution priority is lower than that of AbstractGatewayFilterFactory.

[0149] GlobalFilter: This is an interface that defines the behavior of the global filter. The global filter is the logic for preprocessing the request before it reaches the gateway and between the application server. It has the lowest execution priority.

[0150] This embodiment provides a request processing method, which can dynamically scan the service code of the newly deployed service and update the method information table and the cache method list according to the scanning results, thereby ensuring that the newly deployed service can also be discovered at any time and dynamically loaded into the gateway.

[0151] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 7 Before step S10, the request processing method further includes steps S01' to S03':

[0152] Step S01': when a routing configuration update is detected, the updated routing configuration is obtained.

[0153] It should be noted that the routing configuration may include configuration information such as the division rules of computing power groups and the request routing rules of the gateway computing power in each computing power group.

[0154] In a specific implementation, if at least one of the following conditions is met, it can be determined that a routing configuration update is detected:

[0155] The administrator modifies the routing configuration table in the gateway database;

[0156] The routing configuration initialization function is triggered;

[0157] The configuration of the gateway computing power in the computing power group has been modified.

[0158] Step S02': updating the routing configuration table in the gateway database based on the updated routing configuration.

[0159] Step S03': when the updating is completed, the cache routing configuration table corresponding to the routing configuration table is updated.

[0160] For ease of understanding, now combined Figure 8 , 9 , 10 and 11 are used to illustrate but not to limit this solution. Figure 8This is a schematic diagram of routing configuration update in this embodiment. Fig. 9 This is a functional diagram of the gateway registration center module of this embodiment.

[0161] like Figure 8 As shown, nacos is used to implement the routing gateway (that is, the request processing function of the request processing device is implemented based on nacos). At this time, a route in the nacos configuration can correspond to a Gateway node (gateway computing power). At this time, if the operation and maintenance personnel manually modify the nacos configuration, such as manually modifying the route node information, the changes in the configuration file can be monitored through the NacosDataListener in nacos. At this time, the updated Gateway node configuration can be obtained, the routing configuration table in the gateway database is updated, and then the entity is converted. Then, the RouteDefinitionRepository function in nacos is called to update the cached routing configuration table corresponding to the routing configuration table to achieve hot loading of routing configuration;

[0162] Or the operation and maintenance personnel restart the gateway node and initialize the routing configuration of the request processing device. At this time, the routing data saved in the routing configuration table in the gateway database can be used as the updated routing configuration. Since the routing configuration is not modified at this time, the routing configuration table in the gateway database can be updated instead of updating it. Instead, the cached routing configuration table corresponding to the routing configuration table can be updated directly. Therefore, the routing data saved in the routing configuration table can be obtained, the entity can be converted, the cached data (map, i.e. the cached routing configuration table) can be generated, and the currently saved data can be temporarily recorded. After that, the RouteDefinitionRepository function in nacos is called to push the currently temporarily saved data and hot refresh the routing configuration.

[0163] Or the operation and maintenance personnel modify the route configuration table in the gateway database through the route management page. At this time, the persistent data in the route configuration table in the gateway database can be modified according to the request sent by the route management page, and then the modified route configuration table can be read, converted into entities, and the RouteDefinitionRepository function in nacos can be accessed to hot refresh the route configuration.

[0164] By using the Nacos registration center as the server, the gateway configuration is automatically updated after the specified configuration changes. Possible exceptions are captured and processed, and the corresponding log information is recorded.

[0165] To improve performance, multiple cache mechanisms are used, including IP list cache, registered server cache, and route cache. In addition, an event publishing mechanism is used to notify other components when routing rules change, and publish gateway routing configuration change events to specified subscribers.

[0166] The main function of the executor is to encapsulate the dubbo object as a connection resource, similar to the connection method with the database. When it is needed, it directly obtains the connection call execution. Finally, according to the business needs, the returned data is encrypted and the response is further processed, such as encrypting or desensitizing sensitive information. This can protect the privacy and security of users and prevent the leakage of sensitive information. The executor also limits the flow to prevent the system from exceeding the carrying capacity due to too many requests. According to the actual situation and needs of the system, the incoming request flow is limited and adjusted to maintain the stability and availability of the system. This can avoid system overload and performance degradation caused by too many requests.

[0167] The communication pipeline completes the final result return, saves the information of the entire request process, and records the number of requests. This can provide detailed log and statistical information, which is convenient for analyzing and monitoring the operating status and performance of the system.

[0168] The registration center module (its functional modules are as follows Fig. 9 As shown), it is mainly responsible for the persistence of information such as computing power and interface method services. The mybatis framework is used to simplify the underlying Mysql database link and operation code, and improve the overall system development efficiency and maintenance cost. The above-mentioned gateway core communication module needs to be regarded as a computing power. Each time a gateway communication service is deployed, the corresponding computing power is registered with the gateway registration center, and mysql+mybatis is used to implement data warehousing and query operations. The registration center also receives RPC interface registrations, based on SDK automatic scanning registration or background manual entry. When the RPC service is registered, the registration center will allocate the service mapping to a corresponding group of gateway computing power for use.

[0169] The main function of this module is data processing. When external data requests are sent and processed, the registration center is responsible for executing the data processing logic. When adding or modifying interface services, the core computing power of the gateway uses the Redis message subscription and sending functions to achieve dynamic service refresh capabilities without restarting.

[0170] The gateway service discovery and reporting module mainly annotates the system application interfaces and methods. With the help of springboot's bean postprocessor, it collects and sends class and method information to the gateway registration center after bean initialization. After the gateway center is registered, the database has the corresponding application information. The gateway computing power configures the application information to the current gateway for access by requests outside the system. When the system adds a new functional interface, the RPC interface needs to be registered with the registration center and provided to the computing power. This part of the process needs to implement a service discovery and reporting function. Based on the SDK definition of the interface function that needs to be scanned when the service starts, the specified interface is parsed and the service is registered. This module uses the annotation annotation in jdk to customize the required class annotations and method annotations. When the service system starts, all annotated classes and methods will be collected and reported to the registration center.

[0171] The gateway backend management module is the management backend corresponding to the gateway project. It uses web interface management to implement services such as registration and maintenance of user interface information, gateway switch configuration, traffic monitoring, and log viewing.

[0172] The system served by the encryption gateway is a multi-microservice architecture. In order to further improve data query performance, the database table structure design needs to follow a certain hierarchical relationship. For example, the database can have a total of 6 tables: gateway service table (gateway_server), gateway service details table (gateway_distrubution), gateway allocation table (gateway_ser_detail), system table (app_system), interface table (app_interface), and method table (app_interface_method). Among them, the gateway service table, gateway service details table, and gateway allocation table mainly record the basic information and operating status of the gateway computing power.

[0173] The system table, interface table, and method table have a hierarchical relationship, and a 1 to n relationship. A system has multiple interfaces, multiple classes can implement the interface, and a class contains multiple methods, so the system table and interface table have a 1 to n relationship, and the interface table and method table also have a 1 to n relationship.

[0174] Select the appropriate index type according to the query requirements. For columns that are frequently used for queries, such as primary keys, foreign keys, and foreign key columns, create indexes to improve query performance. Combine indexes to improve the efficiency of multi-column joint queries. Too many indexes not only increase the use of storage space, but also reduce write performance, so only create necessary indexes to avoid redundant and infrequently used indexes. The gateway computing power is deployed in a cluster, and multiple specified computing powers constitute different groups. Each gateway computing power can be mapped to multiple systems, so the group ID, gateway ID, and system representation are used as the unique index of the gateway service details table.

[0175] According to the hierarchical relationship between the system, interface and method, a system can contain multiple interfaces, and one interface can be implemented by multiple classes, each class containing multiple methods. The system identifier, interface identifier and method identifier can be used as a set of unique indexes for the method table. By reasonably designing database tables and indexes, the speed of routing address matching can be accelerated, thereby improving the overall performance of the international roaming billing and settlement system.

[0176] This embodiment provides a request processing method. Since the routing configuration table in the gateway database and the cached routing configuration table corresponding to the routing configuration table can be dynamically updated when the routing configuration is monitored, it ensures that the routing configuration in the gateway can be hot updated, thereby improving convenience.

[0177] This application also provides a request processing device, please refer to Fig.10 , the request processing device comprises:

[0178] The extraction module 10 is used to extract the computing power group number, service identifier and request parameters from the external access request, and search for the target computing power group corresponding to the computing power group number;

[0179] A selection module 20 is used to select an execution gateway computing power from the target computing power group, wherein the execution gateway computing power is provided with a filter chain, wherein the filter chain includes a plurality of filters of different priorities, and each filter in the filter chain is sorted from high to low based on the corresponding priority;

[0180] A detection module 30, configured to perform identity authentication on the request parameters through the filter link, wherein the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and authority detection;

[0181] A determination module 40, configured to determine a target service method by using the service identifier when the authentication is passed;

[0182] The calling module 50 is used to call the target service method according to the request parameters through the execution gateway computing power.

[0183] The request processing device provided by the present application adopts the request processing method in the above embodiment, which can solve the technical problem that different subsystems are configured separately for management of gateways, which is difficult and inefficient to manage. Compared with the prior art, the beneficial effects of the request processing device provided by the present application are the same as the beneficial effects of the request processing method provided by the above embodiment, and the other technical features in the request processing device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0184] The present application provides a request processing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the request processing method in the above-mentioned embodiment one.

[0185] Reference below Fig.11 , which shows a schematic diagram of the structure of a request processing device suitable for implementing the embodiment of the present application. The request processing device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.11 The request processing device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0186] like Fig.11As shown, the request processing device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the request processing device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the request processing device to communicate with other devices wirelessly or by wire to exchange data. Although the request processing device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0187] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0188] The request processing device provided by the present application adopts the request processing method in the above embodiment, which can solve the technical problem that different subsystems are configured separately for management of gateways, which is difficult and inefficient to manage. Compared with the prior art, the beneficial effects of the request processing device provided by the present application are the same as the beneficial effects of the request processing method provided by the above embodiment, and the other technical features in the request processing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0189] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0190] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0191] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the request processing method in the above-mentioned embodiment.

[0192] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0193] The computer-readable storage medium may be included in the request processing device; or may exist independently without being assembled into the request processing device.

[0194] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the request processing device, the request processing device: extracts the computing power group number, service identifier and request parameters from the external access request, and searches for the target computing power group corresponding to the computing power group number; selects the execution gateway computing power from the target computing power group, and the execution gateway computing power is provided with a filter link, and the filter link includes multiple filters with different priorities, and each filter in the filter link is sorted from high to low based on the corresponding priority; authenticates the request parameters through the filter link, and the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and permission detection; when the authentication is passed, the target service method is determined through the service identifier. The target service method is called according to the request parameters through the execution gateway computing power.

[0195] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0196] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0197] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0198] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned request processing method, and can solve the technical problem of configuring gateways separately in different subsystems for management, which is difficult and inefficient to manage. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the request processing method provided by the above-mentioned embodiment, and will not be repeated here.

[0199] The present application also provides a computer program product, including a computer program, which implements the steps of the request processing method as described above when executed by a processor.

[0200] The computer program product provided by the present application can solve the technical problem that the management of gateways configured separately in different subsystems is difficult and inefficient. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the request processing method provided in the above embodiment, which will not be repeated here.

[0201] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A request processing method, characterized in that: The method comprises: Extract the computing power group number, service identifier and request parameters from the external access request, and search for the target computing power group corresponding to the computing power group number; Selecting an execution gateway computing power from the target computing power group, wherein the execution gateway computing power is provided with a filter chain, wherein the filter chain includes a plurality of filters with different priorities, and each filter in the filter chain is sorted from high to low based on the corresponding priority; Performing identity authentication on the request parameters through the filter link, wherein the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and authority detection; When the authentication is passed, the target service method is determined by the service identifier; The target service method is called according to the request parameters through the execution gateway computing power.

2. The request processing method according to claim 1, characterized in that: The calling the target service method according to the request parameter by executing the gateway computing power includes: Obtain the parent interface corresponding to the target service method; Searching for corresponding decryption configuration and encryption configuration according to the service identifier and / or the upper interface; Encrypt the request parameters according to the encryption configuration to generate request ciphertext parameters; Calling the service method corresponding to the service identifier according to the request ciphertext parameters through the execution gateway computing power; After calling the target service method according to the request parameters by executing the gateway computing power, the method further includes: Decrypt the ciphertext data of the service method feedback corresponding to the service identifier according to the decryption configuration to generate feedback data; Response data is constructed according to the feedback data, and the response data is sent to a request initiator corresponding to the external access request.

3. The request processing method according to claim 1, characterized in that: Before extracting the computing power group number, service identifier and request parameters from the external access request, the method further includes: Scan the service code corresponding to the newly deployed service based on the preset service provision annotation to obtain the method information to be added; Update the method information table in the gateway database with the method information to be added, wherein the method information table is used to store method information of the callable service method; When the update is completed, the cache method list corresponding to the method information table is updated; When the authentication is passed, determining the target service method by the service identifier includes: When the authentication is passed, searching whether there is a data record corresponding to the service identifier in the cache method list; If it exists, the target service method is determined according to the data record corresponding to the service identifier.

4. The request processing method according to claim 1, wherein: Before extracting the computing power group number, service identifier and request parameters from the external access request, the method further includes: When a routing configuration update is detected, the updated routing configuration is obtained, where the routing configuration includes a division rule of computing power groups and a request routing rule of gateway computing power in each computing power group; Updating the routing configuration table in the gateway database based on the updated routing configuration; When the update is completed, the cache routing configuration table corresponding to the routing configuration table is updated.

5. The request processing method according to claim 4, characterized in that: If at least one of the following is met, it is determined that a routing configuration update is detected: The administrator modifies the routing configuration table in the gateway database; The routing configuration initialization function is triggered; The configuration of the gateway computing power in the computing power group has been modified.

6. The request processing method according to any one of claims 1 to 5, characterized in that: The step of extracting the computing power group number, service identifier, and request parameters from the external access request includes: Obtaining the protocol type corresponding to the external access request; If the protocol type is not a standard protocol type, performing protocol conversion on the external access request to generate a standard external access request; The computing power group number, service identifier and request parameters are extracted from the standard external access request.

7. A request processing device, characterized in that: The device comprises: An extraction module is used to extract a computing power group number, a service identifier, and request parameters from an external access request, and to search for a target computing power group corresponding to the computing power group number; A selection module, used for selecting an execution gateway computing power from the target computing power group, wherein the execution gateway computing power is provided with a filter chain, wherein the filter chain includes a plurality of filters of different priorities, and each filter in the filter chain is sorted from high to low based on the corresponding priority; A detection module, used to perform identity authentication on the request parameters through the filter link, wherein the identity authentication includes at least one of session detection, SQL injection detection, parameter legitimacy detection, and authority detection; A determination module, used to determine the target service method through the service identifier when the authentication is passed; A calling module is used to call the target service method according to the request parameters through the execution gateway computing power.

8. A request processing device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the request processing method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the request processing method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the request processing method according to any one of claims 1 to 6 are implemented.

Images