Authentication method of management platform and related product

Abstract

The invention provides an authentication method of a management platform and a related product. The method comprises the following steps: registering a target management platform on a Kong gateway, configuring a service forwarding and plug-in of the target management platform, and performing full registration on an interface which needs to be called through the platform. And the front end of the management platform registers the menu and the button on the Kong gateway according to the page structure and function requirements of the management platform, and establishes a corresponding relationship between the button and the interface. And through the triggering operation of the menu, the Kong gateway performs certificate verification when receiving a user request, and determines the business service requested to be executed by the user by comparing the permission set with the user request. According to the permission set of the user, dynamically filtering and displaying the menu page with the permission of the user. And when the menu page is triggered, the front end of the management platform inquires and returns the menu page set with the permission to the user, and the menu permission is automatically granted based on the menu page set with the permission. According to the method, rapid authentication can be realized.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an authentication method for a management platform and related products. Background Art

[0002] With the continuous development of science and technology, people are paying more and more attention to network security. Authentication is a very common technology in the process of data processing. Authentication is the process of confirming user identity and authority, and is often performed after identity verification (such as username and password, fingerprint recognition). Related technologies generally authenticate the management platform through the backend. During the authentication process, there is no substantial interaction between the front-end and back-end of the management platform. The front-end of the management platform needs to perform related operations based on the authentication results after the back-end authentication is completed. Not only is the response speed slow, but the user experience is also poor. Therefore, how to improve the speed of authentication has become a technical problem that technicians in this field urgently need to solve. Summary of the invention

[0003] Based on the above problems, the present application provides an authentication method and related products for a management platform to improve the speed of authentication.

[0004] The present application provides an authentication method for a management platform, the method comprising the following steps:

[0005] Register the target management platform on the Kong gateway;

[0006] Configure the service forwarding and plug-ins of the target management platform on the Kong gateway;

[0007] Fully register all interfaces that need to be called through the platform on the Kong gateway;

[0008] The front end of the management platform registers menus and buttons on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes a corresponding relationship between the buttons and the interface;

[0009] Automatically granting menu permissions by triggering the menu;

[0010] The automatic granting of menu permissions includes:

[0011] When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request;

[0012] Determine the business service requested by the user by comparing the permission set of the user with the user request;

[0013] According to the permission set of the user, dynamically filter and display the menu pages to which the user has permission;

[0014] When the menu page is triggered, the front end of the management platform queries and returns the set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

[0015] In a possible implementation, the plug-in includes an identity plug-in, and when the Kong gateway receives a user request, the credential verification of the user identity corresponding to the user request includes:

[0016] The identity plug-in carries a blacklist and a whitelist, and the blacklist and the whitelist are used to verify the legitimacy of the user identity;

[0017] Comparing the user identity information in the user request, the blacklist and the whitelist based on the identity plug-in to obtain a comparison result;

[0018] The credential verification is performed based on the comparison result.

[0019] In a possible implementation, the credential verification is performed using the following formula:

[0020] V=Validate(UserID,Request)

[0021] Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

[0022] In a possible implementation, the step of automatically granting menu permissions is performed on the Kong gateway, which is decoupled from the backend server of the management platform.

[0023] The present application also provides an authentication device for a management platform, the device comprising the following modules:

[0024] The first registration module is used to register the target management platform on the Kong gateway;

[0025] A configuration module, used to configure service forwarding and plug-ins of the target management platform on the Kong gateway;

[0026] The second registration module is used to fully register all interfaces that need to be called by the platform on the Kong gateway;

[0027] The third registration module is used to register the menu and button on the Kong gateway according to the front end of the management platform according to the page structure and functional requirements of the management platform, and establish a corresponding relationship between the button and the interface;

[0028] An authentication module, used for automatically granting menu permissions by triggering the menu;

[0029] The authentication module is specifically used for:

[0030] When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request;

[0031] Determine the business service requested by the user by comparing the permission set of the user with the user request;

[0032] According to the permission set of the user, dynamically filter and display the menu pages to which the user has permission;

[0033] When the menu page is triggered, the front end of the management platform queries and returns the set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

[0034] In a possible implementation, the authentication module is specifically used to:

[0035] The identity plug-in carries a blacklist and a whitelist, and the blacklist and the whitelist are used to verify the legitimacy of the user identity;

[0036] Comparing the user identity information in the user request, the blacklist and the whitelist based on the identity plug-in to obtain a comparison result;

[0037] The credential verification is performed based on the comparison result.

[0038] In a possible implementation, the authentication module is specifically used to perform credential verification using the following formula:

[0039] V=Validate(UserID,Request)

[0040] Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

[0041] In a possible implementation, the device further includes a decoupling module, and the decoupling module is specifically used to: decouple from the backend server of the management platform when automatically granting menu permissions.

[0042] The present application also provides an electronic device, the electronic device comprising a processor and a memory:

[0043] The memory is used to store a computer program and transmit the computer program to the processor;

[0044] The processor is used to execute the steps of the authentication method of the management platform according to the instructions in the computer program.

[0045] The present application also provides a computer-readable storage medium, characterized in that the computer-readable storage medium is used to store a computer program, and when the computer program is executed by an electronic device, the steps of the authentication method of the above-mentioned management platform are implemented.

[0046] Compared with the prior art, this application has the following beneficial effects:

[0047] The method provided by the present application registers the target management platform on the Kong gateway, configures the service forwarding and plug-in of the target management platform on the Kong gateway, and fully registers all interfaces that need to be called through the platform on the Kong gateway. The front end of the management platform registers the menu and button on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes the corresponding relationship between the button and the interface, and automatically grants the menu permission through the triggering operation of the menu. When the Kong gateway receives the user request, it verifies the user identity corresponding to the user request, and determines the business service executed by the user request by comparing the user's permission set and the user request. According to the user's permission set, the menu page that the user has permission to is dynamically filtered and displayed. When the menu page is triggered, the front end of the management platform queries and returns the menu page set that the user has permission to, and automatically grants the menu permission based on the menu page set with permission. The method provided by the present application allows the front end of the management platform to participate in the authentication process. During the authentication, the front end menu of the management platform does not need to wait for the authentication of the back end to be completed, and the management platform can display information to the user more quickly based on the front end. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 A flow chart of an authentication method for a management platform provided in this application;

[0050] Figure 2 A schematic diagram of the structure of the authentication device of the management platform provided in this application. DETAILED DESCRIPTION

[0051] As described above, the authentication of the management platform by the related technology is generally performed through the backend. During the authentication process, there is no substantial interaction between the frontend and the backend of the management platform. The frontend of the management platform needs to perform related operations according to the authentication results after the backend authentication is completed. Not only is the response speed slow, but the user experience is also poor. Therefore, how to improve the authentication speed has become a technical problem that technicians in this field need to solve urgently.

[0052] After research, it was found that the management platform's data processing depends on the backend of the management platform, and it is difficult for the frontend of the management platform to participate in authentication in the architecture of the management platform. Therefore, the Kong gateway can be introduced to assist the frontend of the management platform in participating in authentication.

[0053] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] It is understandable that the method provided in the present application can be applied to a processing device, which is a processing device that can authenticate the management platform, such as a terminal device or a server that can authenticate the management platform. The method provided in the present application can be executed independently by a terminal device or a server, or it can be applied to a network scenario in which a terminal device and a server communicate, and is executed by the cooperation of a terminal device and a server. Among them, the terminal device can be a computer, a mobile phone and other devices. The server can be understood as an application server or a Web server. In actual deployment, the server can be a stand-alone server or a cluster server.

[0055] Figure 1 A flowchart of an authentication method for a management platform provided in this application, the method comprising the following steps:

[0056] S101: Register the target management platform on the Kong gateway.

[0057] A gateway is a network interconnection device, also known as an internetwork connector or protocol converter. Gateways realize network interconnection above the transport layer and are the most complex network interconnection device. They are only used for interconnection between two networks with different high-level protocols. Gateways can be used for wide area network interconnection or local area network interconnection. A gateway is a translator. Unlike a bridge that simply transmits information, a gateway repackages the received information to meet the needs of the destination system. A gateway is a "gateway" that information must pass through when it is sent from one network to another.

[0058] Kong Gateway is an API gateway. Its main function is to provide protection, security, scalability, and controllability for APIs. Kong Gateway can handle tasks such as traffic routing, request verification and authorization, load balancing, caching, logging, and monitoring.

[0059] The processing device registers the target management platform on the Kong gateway.

[0060] S102: Configure service forwarding and plug-ins of the target management platform on the Kong gateway.

[0061] The processing device configures the service forwarding and plug-ins of the target management platform on the Kong gateway. A plug-in refers to a program written in accordance with a certain specification of the application program interface, which can only run on the system platform specified by the program, and cannot run independently from the specified platform.

[0062] S103: Register all interfaces that need to be called through the platform on the Kong gateway.

[0063] The processing device fully registers all interfaces that need to be called by the platform on the Kong gateway. The interfaces called by the platform may include interfaces that require authentication and interfaces that do not require authentication. When an interface that requires authentication is called, it is authenticated by the method provided in this application.

[0064] S104: The front end of the management platform registers menus and buttons on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes a corresponding relationship between buttons and interfaces.

[0065] The front end refers to the foreground part of a software, webpage or application. The front end is the page displayed to users. The front end may include buttons. Buttons can be buttons in the menu. Buttons are a channel for users to interact with the management platform. When the user triggers a button, the button will call the corresponding interface to implement the corresponding function.

[0066] S105: Automatically granting menu authority by triggering the menu.

[0067] The processing device can automatically grant menu permissions through a user's triggering operation on the menu. The triggering operation can be an operation such as clicking a button or selecting a button.

[0068] S105 includes:

[0069] S1051: When the Kong gateway receives a user request, it performs credential verification on the user identity corresponding to the user request.

[0070] Credentials are an authentication mechanism, equivalent to a key. With it, you can open a specific lock and enter the corresponding door. This is equivalent to adding a layer of protection mechanism to filter out unreasonable operations.

[0071] When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request. In one possible implementation, the credential verification can be performed using the following formula:

[0072] V=Validate(UserID,Request)

[0073] Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

[0074] In a possible implementation, the identity plug-in carries a blacklist and a whitelist, and the processing device can verify the legitimacy of the user identity based on the blacklist and the whitelist. The processing device compares the user identity information in the user request, the blacklist and the whitelist through the identity plug-in, obtains a comparison result, and uses the comparison result to perform credential verification.

[0075] S1052: Determine the business service requested by the user by comparing the user's permission set and the user's request.

[0076] The processing device determines the business service requested by the user by comparing the user's permission set and the user's request. The processing device mainly determines whether the user has the right to perform a certain business service by comparing the user's permission set (that is, the permissions the user has) and the user's request (that is, the operation the user wants to perform or the service to access). This process ensures the security of the system, and only users with corresponding permissions can access or operate specific business services.

[0077] S1053: According to the user's permission set, dynamically filter and display the menu pages that the user has permission to.

[0078] Based on the user's permission set, the system will dynamically filter and display the menu pages that the user has permission to access. In other words, users will only see the menu options they can access on the interface, which can improve the user experience and prevent users from trying to access functions they do not have permission to access.

[0079] S1054: When a menu page is triggered, the front end of the management platform queries and returns a set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

[0080] When a user triggers a menu page on a processing device, the front end of the management platform will query and return the set of menu pages that the user has permission to access. Based on these authorized menu page sets, the system will automatically grant the user the corresponding menu permissions. This process ensures that users can flexibly and securely access functions that match their permissions when they actually use the system.

[0081] In one possible implementation, the step of automatically granting menu permissions is performed on the Kong gateway, which is decoupled from the backend server of the management platform.

[0082] The method provided by the present application registers the target management platform on the Kong gateway, configures the service forwarding and plug-in of the target management platform on the Kong gateway, and fully registers all interfaces that need to be called through the platform on the Kong gateway. The front end of the management platform registers the menu and button on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes the corresponding relationship between the button and the interface, and automatically grants the menu permission through the triggering operation of the menu. When the Kong gateway receives the user request, it verifies the user identity corresponding to the user request, and determines the business service executed by the user request by comparing the user's permission set and the user request. According to the user's permission set, the menu page that the user has permission to is dynamically filtered and displayed. When the menu page is triggered, the front end of the management platform queries and returns the menu page set that the user has permission to, and automatically grants the menu permission based on the menu page set with permission. The method provided by the present application allows the front end of the management platform to participate in the authentication process. During the authentication, the front end menu of the management platform does not need to wait for the authentication of the back end to be completed, and the management platform can display information to the user more quickly based on the front end.

[0083] The present application also provides a Figure 2 The structural diagram of the authentication device of the management platform shown in FIG. 200 includes the following modules:

[0084] The first registration module 201 is used to register the target management platform on the Kong gateway;

[0085] Configuration module 202, used to configure service forwarding and plug-ins of the target management platform on the Kong gateway;

[0086] The second registration module 203 is used to fully register all interfaces that need to be called by the platform on the Kong gateway;

[0087] The third registration module 204 is used to register the menu and button on the Kong gateway according to the front end of the management platform according to the page structure and functional requirements of the management platform, and establish a corresponding relationship between the button and the interface;

[0088] An authentication module 205, used to automatically grant menu permissions by triggering the menu;

[0089] The authentication module 205 is specifically used for:

[0090] When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request;

[0091] Determine the business service requested by the user by comparing the permission set of the user with the user request;

[0092] According to the permission set of the user, dynamically filter and display the menu pages to which the user has permission;

[0093] When the menu page is triggered, the front end of the management platform queries and returns the set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

[0094] In a possible implementation, the authentication module is specifically used to:

[0095] The identity plug-in carries a blacklist and a whitelist, and the blacklist and the whitelist are used to verify the legitimacy of the user identity;

[0096] Comparing the user identity information in the user request, the blacklist and the whitelist based on the identity plug-in to obtain a comparison result;

[0097] The credential verification is performed based on the comparison result.

[0098] In a possible implementation, the authentication module is specifically used to perform credential verification using the following formula:

[0099] V=Validate(UserID,Request)

[0100] Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

[0101] In a possible implementation, the device further includes a decoupling module, and the decoupling module is specifically used to: decouple from the backend server of the management platform when automatically granting menu permissions.

[0102] The above-mentioned device registers the target management platform on the Kong gateway, configures the service forwarding and plug-in of the target management platform on the Kong gateway, and fully registers all interfaces that need to be called through the platform on the Kong gateway. The front end of the management platform registers the menu and button on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes the corresponding relationship between the button and the interface, and automatically grants the menu permission through the triggering operation of the menu. When the Kong gateway receives the user request, it verifies the user identity corresponding to the user request, and determines the business service executed by the user request by comparing the user's permission set and the user request. According to the user's permission set, the menu page that the user has permission to is dynamically filtered and displayed. When the menu page is triggered, the front end of the management platform queries and returns the menu page set that the user has permission to, and automatically grants the menu permission based on the menu page set with permission. The method provided by the present application allows the front end of the management platform to participate in the authentication process. During the authentication, the front end menu of the management platform does not need to wait for the authentication of the back end to be completed, and the management platform can display information to the user more quickly based on the front end.

[0103] An embodiment of the present application also provides an authentication device for a management platform, wherein the device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device performs the steps of the authentication method for the management platform described in any embodiment of the present application.

[0104] In practical applications, the computer-readable storage medium may be any combination of one or more computer-readable media, which may be a computer-readable signal medium or a computer-readable storage medium.

[0105] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device, or device.

[0106] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0107] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0108] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0109] It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is merely schematic, in which the unit described as a separate component may or may not be physically separated, and the component prompted as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0110] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A management platform authentication method, characterized in that: include: Register the target management platform on the Kong gateway; Configure the service forwarding and plug-ins of the target management platform on the Kong gateway; Fully register all interfaces that need to be called through the platform on the Kong gateway; The front end of the management platform registers menus and buttons on the Kong gateway according to the page structure and functional requirements of the management platform, and establishes a corresponding relationship between the buttons and the interface; Automatically granting menu permissions by triggering the menu; The automatic granting of menu permissions includes: When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request; Determine the business service requested by the user by comparing the permission set of the user with the user request; According to the permission set of the user, dynamically filter and display the menu pages to which the user has permission; When the menu page is triggered, the front end of the management platform queries and returns the set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

2. The method according to claim 1, characterized in that The plug-in includes an identity plug-in, and when the Kong gateway receives a user request, the credential verification of the user identity corresponding to the user request includes: The identity plug-in carries a blacklist and a whitelist, and the blacklist and the whitelist are used to verify the legitimacy of the user identity; Comparing the user identity information in the user request, the blacklist and the whitelist based on the identity plug-in to obtain a comparison result; The credential verification is performed based on the comparison result.

3. The method according to claim 1, characterized in that The credential verification is performed by the following formula: V=Validate(UserID,Request) Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

4. The method according to claim 1, characterized in that: The step of automatically granting menu permissions is performed on the Kong gateway and is decoupled from the backend server of the management platform.

5. An authentication device for a management platform, characterized in that: include: The first registration module is used to register the target management platform on the Kong gateway; A configuration module, used to configure service forwarding and plug-ins of the target management platform on the Kong gateway; The second registration module is used to fully register all interfaces that need to be called by the platform on the Kong gateway; The third registration module is used to register the menu and button on the Kong gateway according to the front end of the management platform according to the page structure and functional requirements of the management platform, and establish a corresponding relationship between the button and the interface; An authentication module, used for automatically granting menu permissions by triggering the menu; The authentication module is specifically used for: When the Kong gateway receives a user request, it verifies the user identity corresponding to the user request; Determine the business service requested by the user by comparing the permission set of the user with the user request; According to the permission set of the user, dynamically filter and display the menu pages to which the user has permission; When the menu page is triggered, the front end of the management platform queries and returns the set of menu pages to which the user has permission, and automatically grants menu permission based on the set of menu pages to which the user has permission.

6. The device according to claim 1, characterized in that The authentication module is specifically used for: The identity plug-in carries a blacklist and a whitelist, and the blacklist and the whitelist are used to verify the legitimacy of the user identity; Comparing the user identity information in the user request, the blacklist and the whitelist based on the identity plug-in to obtain a comparison result; The credential verification is performed based on the comparison result.

7. The device according to claim 1, characterized in that The authentication module is specifically used to verify the credentials using the following formula: V=Validate(UserID,Request) Wherein, V represents the verification result, Validate represents the verification function, UserID represents the identity of the user in the user request, and Request represents the request information in the user request.

8. The device according to claim 1, characterized in that The device further comprises a decoupling module, and the decoupling module is specifically used for: decoupling from the backend server of the management platform when automatically granting menu permissions.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is used to execute the computer program to implement the authentication method of the management platform as described in any one of claims 1-4.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the authentication method of the management platform as described in any one of claims 1 to 4 is implemented.

Images