Micro-service authentication method and device, computer equipment and storage medium

Abstract

The invention relates to a micro-service authentication method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: configuring security authentication modules for all micro-services in a link; based on the starting key, acquiring an identity certificate and an authentication rule corresponding to the micro-service from the security center module by using the security authentication module, and periodically rotating the identity certificate and the authentication rule; under the condition that a business request sent by the upstream micro-service to the downstream micro-service is received, controlling a security authentication module of the upstream micro-service to send a bidirectional authentication request to a security authentication module of the downstream micro-service; under the condition that the bidirectional authentication request passes verification, controlling a security authentication module of the downstream micro-service to authenticate the service request based on the identity certificate and the authentication rule; and under the condition that the authentication is passed, controlling the downstream micro-service to carry out business processing. By adopting the method, the flexibility of the authentication capability can be improved in the communication process between micro-services.

Description

Technical Field

[0001] The present application relates to the field of microservice technology, and in particular to a microservice authentication method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of cloud computing and microservice architecture, enterprises are increasingly inclined to deploy their businesses on cloud platforms. Microservice architecture has become the first choice for building cloud platform services with its advantages such as scalability, agility, independent expansion, business logic isolation, independent lifecycle management, and easy distributed development. However, this decentralized microservice architecture also brings security challenges. By default, all interactions between microservices are insecure because they use plain text HTTP for communication, which is far from meeting security requirements. Therefore, internal calls must also be secure, which is the importance of zero-trust security. Zero-trust security requires explicit authentication everywhere and uses the principle of least privilege to limit access to resources. This security strategy can effectively protect the microservice architecture and prevent attackers from exploiting vulnerabilities in it.

[0003] The current technology is based on Kubernetes combined with the service mesh Istio. The sidecar proxy uniquely identifies the service and implements two-way identity authentication with certificates. After authentication, the sidecar encrypts the communication between microservices. After receiving the request, the sidecar performs access authentication based on the identity and request attributes. However, this security authentication method has some limitations. Istio's security model is strongly dependent on the Kubernetes cluster and is restricted by the Kubernetes cluster. Istio certificate rotation must pass through Kubernetes's ApiServer, which will cause the ApiServer to become a system bottleneck. In addition, Istio's certificate and authentication rules are strongly dependent on the cluster namespace, resulting in insufficient flexibility in authentication and authorization capabilities during communication between microservices, making it difficult to support cross-cluster and fine-grained security models.

[0004] Therefore, there is an urgent need for a microservice authentication method, apparatus, computer device, computer-readable storage medium, and computer program product that can improve the flexibility of authentication capabilities during communication between microservices. Summary of the invention

[0005] Based on this, it is necessary to provide a microservice authentication method, device, computer equipment, computer-readable storage medium and computer program product that can improve the flexibility of authentication and authorization capabilities during communication between microservices in order to address the above technical problems.

[0006] In a first aspect, the present application provides a microservice authentication method, including:

[0007] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0008] Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and the authentication rules are rotated regularly;

[0009] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0010] When the bidirectional authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, based on the identity certificate and the authentication rule, the security authentication module of the downstream microservice is controlled to authenticate the service request;

[0011] If authentication is successful, control the downstream microservices to perform business processing.

[0012] In one of the embodiments, when the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is agentmain mode, the authentication rules include the address and configuration items of the configuration center.

[0013] In one embodiment, the method further comprises:

[0014] When the security authentication module is configured in attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice;

[0015] When the security authentication module is configured in agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0016] In one embodiment, after obtaining the identity certificate and authentication rules of the corresponding microservice from the security center module using the security authentication module based on the startup key, the method further includes:

[0017] When the configuration mode of the security authentication module is agentmain mode, the security authentication module is controlled to establish a connection with the configuration center and obtain the authentication information in the configuration item.

[0018] In one embodiment, the method further comprises:

[0019] When the configuration mode of the security authentication module is agentmain mode, the security authentication module is controlled to send a custom security authentication request to the business authentication module and perform active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

[0020] In a second aspect, the present application also provides a microservice authentication device, including: a microservice controller, a security center module, a security authentication module and a business module:

[0021] Microservice controller, used to perform rolling upgrades on all microservices in the link, using bytecode enhancement technology to configure security authentication modules for all microservices;

[0022] A security authentication module, used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and regularly rotate the identity certificate and the authentication rules;

[0023] The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the custom security authentication rules of the business;

[0024] The microservice controller is further used to control the security authentication module of the downstream microservice to authenticate the business request based on the identity certificate and the authentication rule when the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified successfully;

[0025] The business module is used to control the downstream microservices to perform business processing when the authentication is passed.

[0026] In one of the embodiments, the device further comprises a service authentication module, and the service authentication module is granted authentication authority by the security center module;

[0027] When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send a custom security authentication request to the business authentication module and perform active identity authentication.

[0028] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0029] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0030] Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and the authentication rules are rotated regularly;

[0031] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0032] When the bidirectional authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, based on the identity certificate and the authentication rule, the security authentication module of the downstream microservice is controlled to authenticate the service request;

[0033] If authentication is successful, control the downstream microservices to perform business processing.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0035] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0036] Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and the authentication rules are rotated regularly;

[0037] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0038] When the bidirectional authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, based on the identity certificate and the authentication rule, the security authentication module of the downstream microservice is controlled to authenticate the service request;

[0039] If authentication is successful, control the downstream microservices to perform business processing.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0042] Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and the authentication rules are rotated regularly;

[0043] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0044] When the bidirectional authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, based on the identity certificate and the authentication rule, the security authentication module of the downstream microservice is controlled to authenticate the service request;

[0045] If authentication is successful, control the downstream microservices to perform business processing.

[0046] The above-mentioned microservice authentication method, device, computer equipment, computer-readable storage medium and computer program product dynamically inject security authentication modules into all microservices in the microservice architecture through bytecode enhancement technology to realize the zero-trust security model. During the microservice upgrade process, a rolling upgrade method is adopted, and the microservice does not need to be stopped to ensure the continuity of the microservice. When the microservice is started, the security authentication module uses the startup key to obtain the identity certificate and authentication rules from the security center module, and supports regular rotation to enhance security. When communicating between microservices, the security authentication module of the upstream microservice initiates a two-way authentication request to the downstream microservice to ensure the legitimacy of the identities of both communicating parties. Once the two-way authentication is successful, the module will authenticate the request according to the identity certificate and rules, and only allow legitimate requests to pass. If the authentication check of the downstream microservice passes, the business processing will continue. This mechanism realizes secure communication between microservices, which complies with the zero-trust security principle, that is, no internal or external requests are trusted until they are verified. This solution reduces the intrusion of project code and the complexity of development and operation and maintenance, while providing flexible cross-platform deployment capabilities, which is suitable for a variety of microservice deployment scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] FIG1 is an application environment diagram of a microservice authentication method in one embodiment;

[0049] FIG2 is a schematic diagram of a process flow of a microservice authentication method in one embodiment;

[0050] FIG3 is a schematic diagram of a flow chart of a microservice authentication method in another embodiment;

[0051] FIG4 is a diagram of a microservice authentication architecture in traditional technology;

[0052] FIG5 is a structural block diagram of a microservice authentication device in one embodiment;

[0053] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The microservice authentication method provided in the embodiment of the present application can be applied in the application environment shown in FIG1. ​​The terminal 102 communicates with the server 104 (microservice controller) through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers.

[0056] Server 104 is used to perform rolling upgrades on all microservices in the link, and uses bytecode enhancement technology to configure security authentication modules for all microservices; based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and authentication rules are rotated regularly; when the upstream microservice sends a business request to the downstream microservice based on the business-customized security authentication rules, the security authentication module of the upstream microservice is controlled to send a two-way authentication request to the security authentication module of the downstream microservice; when the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified to be successful, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules; the terminal 102 is used to control the downstream microservice to perform business processing when the authentication is successful.

[0057] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0058] In an exemplary embodiment, as shown in FIG2 , a microservice authentication method is provided, which is described by taking the method applied to the server in FIG1 as an example, and includes the following steps S202 to S210. Among them:

[0059] Step S202: Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices.

[0060] Among them, rolling upgrade is a method of updating services that allows service instances to be updated one by one or gradually without stopping the entire service or system. This can minimize service interruptions and ensure high service availability.

[0061] Among them, bytecode enhancement technology is a technology that modifies Java bytecode at runtime. Through this technology, new functions can be dynamically added to the running Java program or existing behaviors can be modified without changing the source code. In the microservice architecture, this is often used to enhance the functionality of the service without restarting the service.

[0062] Specifically, configuring a security authentication module for all microservices means that each service in the microservice architecture will be integrated with a security authentication module. This module is responsible for processing the identity authentication and request authentication of the service, ensuring that only legitimate requests can be processed. By injecting the security module through bytecode enhancement technology, the security of the service can be enhanced without modifying the original service code. This method has little intrusion on the original system and is easy to implement and maintain.

[0063] Step S204: Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and authentication rules are rotated regularly.

[0064] Specifically, each microservice uses a startup key when it starts. This key is a security credential used to establish a trust relationship between the service and the security center module to ensure the security of communication. The security authentication module uses the startup key to communicate with the security center module and request the identity certificate and authentication rules of the service. The identity certificate is used to prove the identity of the service, and the authentication rules define how the service should be authenticated and authorized.

[0065] The purpose of regular rotation is to improve the security of the system. Identity certificates and authentication rules will not be permanently valid, but will be updated regularly. This process is called rotation. Regular rotation can reduce the risk of certificate theft, because even if an attacker obtains the current certificate, its validity will expire quickly due to regular changes.

[0066] The security center module is a centralized service responsible for managing the identity certificates and authentication rules of all microservices. It is responsible for issuing certificates, issuing rules, and managing the life cycle of certificates, including certificate generation, distribution, update, and revocation.

[0067] Step S206, when the upstream microservice sends a service request to the downstream microservice based on the custom security authentication rule of the service, the security authentication module of the upstream microservice is controlled to send a two-way authentication request to the security authentication module of the downstream microservice.

[0068] Specifically, in a microservice architecture, different services may have different security requirements, so security authentication rules need to be defined based on specific business logic. These rules can define which services can communicate, what security checks need to be performed during communication, etc.

[0069] When the security center module receives the business-based customized security authentication rules, it will send these rules to the security authentication modules of each microservice module. These modules are responsible for executing these rules when microservices communicate with each other. In a microservice architecture, there is usually a calling relationship between services, and one service (upstream microservice) will call another service (downstream microservice) to complete certain business logic. When an upstream microservice needs to call a downstream microservice, the security authentication module of the upstream microservice will first send an authentication request to the security authentication module of the downstream microservice. This is a two-way process because:

[0070] The upstream microservice authenticates the downstream microservice: The security authentication module of the upstream microservice needs to verify the identity of the downstream microservice to ensure that it is a legitimate service instance.

[0071] The downstream microservice authenticates the upstream microservice: At the same time, the security authentication module of the downstream microservice also verifies the identity of the upstream microservice to ensure that the request comes from an authorized service.

[0072] This two-way authentication mechanism ensures the security of communication between microservices and prevents unauthorized services from accessing sensitive data or performing operations. It is also a reflection of the "never trust, always verify" principle in the zero trust model.

[0073] Through this mechanism, the microservice architecture can establish a secure trust chain between microservices, ensuring that only verified and authorized communications between microservices are allowed, thereby improving the security of the entire system.

[0074] Step S208: When the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified successfully, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rule.

[0075] Specifically, when microservices communicate, the security authentication module of the upstream microservice sends a two-way authentication request to the security authentication module of the downstream microservice. Only after both parties have passed the identity authentication of the other party, that is, confirmed the legitimacy of each other's identity, will the subsequent authentication process continue. Since the security authentication module is a module integrated in each microservice, it is responsible for handling the identity authentication of the service and request authentication. It uses the identity certificate and authentication rules obtained from the security center module to perform these tasks. The security authentication module uses two key components, identity certificate and authentication rules, for authentication, where:

[0076] Identity certificate: used to prove the identity of the service, similar to an ID card in the digital world. It contains the identity information of the service and is signed by the security center module to ensure its authenticity and non-repudiation.

[0077] Authentication rules: define the specific policies on how services should be authenticated and authorized, including which services can be accessed and which operations can be performed.

[0078] Once the two-way authentication succeeds, the security authentication module will authenticate the request according to the authentication rules. This process includes checking whether the request complies with the security policy, for example: confirming whether the requested service has the authority to perform a specific operation; or ensuring that the request complies with the principle of least privilege, that is, the service can only access the resources necessary to complete its function; or checking whether the request contains necessary security attributes, such as tokens, certificates or other security credentials.

[0079] In other embodiments, authentication includes method tracking and request attributes, which means that during the security authentication process, the system will not only check the legitimacy of the request, but also monitor and record access attempts to specific methods, and verify whether the attributes included in the request meet security requirements. This comprehensive authentication mechanism can provide more comprehensive security protection, helping to prevent unauthorized access and potential security threats.

[0080] Step S210: If the authentication is successful, control the downstream microservice to perform business processing.

[0081] Specifically, after the upstream microservice sends a business request to the downstream microservice, the security authentication module of the downstream microservice will authenticate the request based on the identity certificate and authentication rules. This process includes verifying the legitimacy of the business request, checking whether the request complies with the security policy, and confirming whether the requester has the right to perform specific operations. The authentication check will only pass when the security authentication module confirms that the request complies with all security requirements and business rules. This means that the request is safe and legal, and the requester has the authority to perform the requested operation. Once the authentication check passes, the security authentication module of the downstream microservice will release the request and allow it to continue business processing. At this stage, the downstream microservice will perform the specific business operations required by the request, such as data processing, calculation, database interaction, etc.

[0082] Among them, business processing is the core part of the microservice architecture because it is directly related to the functionality and business value of microservices. Business logic is allowed to execute only after ensuring the security and compliance of the request, which can protect the service from unauthorized access and potential security threats. The core principle of the zero trust model is "never trust, always verify". In the zero trust model, each business request must undergo strict security checks, and its legitimacy and security must be verified regardless of whether the business request comes from inside or outside.

[0083] In the above microservice authentication method, the security authentication module is dynamically injected into all microservices in the microservice architecture through bytecode enhancement technology to realize the zero-trust security model. During the microservice upgrade process, a rolling upgrade method is adopted, and the microservice does not need to be stopped to ensure the continuity of the microservice. When the microservice is started, the security authentication module uses the startup key to obtain the identity certificate and authentication rules from the security center module, and supports regular rotation to enhance security. When communicating between microservices, the security authentication module of the upstream microservice initiates a two-way authentication request to the downstream microservice to ensure the legitimacy of the identities of both communicating parties. Once the two-way authentication is successful, the module will authenticate the request according to the identity certificate and rules, and only allow legitimate requests to pass. If the authentication check of the downstream microservice passes, the business processing will continue. This mechanism realizes secure communication between microservices, which complies with the zero-trust security principle, that is, no internal or external requests are trusted until they are verified. This solution reduces the intrusion of project code and the complexity of development and operation and maintenance, while providing flexible cross-platform deployment capabilities, which is suitable for a variety of microservice deployment scenarios.

[0084] In an exemplary embodiment, when the configuration mode of the security authentication module is the attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is the agentmain mode, the authentication rules include the configuration center address and configuration items.

[0085] The Attach method refers to dynamically attaching the security authentication module to the microservice after the service has been started. This method allows the security capabilities of the microservice to be enhanced without restarting the service.

[0086] Real-time security rules refer to the fact that in this configuration mode, the security authentication module may need to obtain security rules in real time or immediately to respond to rapidly changing security threats or business needs. Real-time security rules may be issued dynamically, and the security authentication module needs to be able to respond quickly to changes in these rules and immediately implement new security policies. This immediacy requires an efficient communication mechanism between the security authentication module and the security center module to ensure that the rules can be updated in real time.

[0087] Among them, the Agentmain method refers to the security authentication module being loaded when the microservice is started (agentmain). This method allows the security authentication module to intervene at the beginning of the service startup and perform initial security settings.

[0088] The configuration center address and configuration items refer to the configuration mode in which the security authentication module obtains the address of the configuration center and related configuration items when it starts. The configuration center is a place where security rules and service configurations are centrally managed. The security authentication module needs to know the location (address) of the configuration center so that it can obtain and update security rules and configurations from it. Configuration items include security rules, service-specific configuration parameters, etc. These configuration items will guide the security authentication module on how to perform security checks and authentication.

[0089] In this embodiment, these two configuration methods reflect different security authentication module loading timings and rule acquisition mechanisms. The Attach method focuses more on dynamic intervention and instant rule updates when the microservice is running, while the Agentmain method focuses on initial configuration when the microservice is started and obtaining persistent rules and configurations from the configuration center. Both methods are designed to ensure that the security authentication module can effectively perform its duties and protect microservices from security threats.

[0090] In an exemplary embodiment, as shown in FIG. 3 , the method further includes steps 302 to 303 .

[0091] Step S302: When the configuration mode of the security authentication module is the attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice;

[0092] Step S304, when the configuration mode of the security authentication module is agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0093] Among them, in the Attach mode, the security authentication module of the upstream microservice will reuse the existing http port for security authentication. The purpose is to avoid modifying the network configuration of the service, because the security authentication module will use the port that the microservice has already listened to to process the authentication request. The security authentication module of the upstream microservice sends a two-way authentication request to the security authentication module of the downstream microservice through the reused http port. This two-way authentication ensures that the identities of both communicating parties are verified.

[0094] Different from the Attach mode, in the Agentmain mode, the security authentication module of the upstream microservice will open a new port to handle security authentication according to the configuration of the configuration center. This new port is dedicated to secure communication and may provide additional security measures or configurations. In the Agentmain mode, the security authentication module of the upstream microservice sends a two-way authentication request to the security authentication module of the downstream microservice through this newly opened port to ensure the security of communication between microservices.

[0095] In this embodiment, the two configuration methods reflect different security authentication module loading timings and communication port usage strategies. The Attach method provides authentication by reusing the existing HTTP port, while the Agentmain method opens a new port to handle authentication based on the configuration of the configuration center. Both methods ensure the security of communication between microservices.

[0096] In an exemplary embodiment, based on the startup key, after using the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, it also includes:

[0097] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration item.

[0098] Specifically, when the configuration mode is agentmain, the security authentication module is loaded when the service is started (through agentmain). This method allows the security authentication module to intervene at the beginning of the microservice startup and perform initial security settings. In agentmain mode, the security authentication module not only communicates with the security center module, but also needs to establish a connection with the configuration center. The configuration center is a place to centrally manage service configurations, including security configurations.

[0099] The security authentication module obtains the authentication information in the configuration items from the configuration center. This authentication information includes specific authentication policies, permission settings, security rules, etc., which guide the security authentication module on how to perform security checks and authentication. Authentication information is the key for the security authentication module to perform its functions. It ensures that the microservice can correctly apply security policies when processing requests, such as deciding which requests are legitimate and which requests should be rejected.

[0100] In this embodiment, by emphasizing that under the agentmain configuration mode, the security authentication module not only needs to obtain the identity certificate and authentication rules from the security center module, but also needs to establish a connection with the configuration center to obtain and apply authentication information, the security and compliance of the service are ensured, while also providing flexibility because security policies and rules can be centrally managed and dynamically updated.

[0101] In an exemplary embodiment, when the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

[0102] Specifically, the security authentication module is responsible for handling secure communications between microservices. When security checks related to specific business logic are required, the security authentication module will send customized security authentication requests to the business authentication module. These requests are for specific business scenarios and require personalized authentication based on business logic.

[0103] The business authentication module is the component responsible for executing specific business logic authentication. The security center module is responsible for granting the business authentication module the authority to perform authentication operations. This means that the security center module authenticates and authorizes the business authentication module, ensuring that only authorized business authentication modules can perform authentication operations.

[0104] The security authentication module performs active authentication while sending a request. This means that it provides the necessary credentials (such as certificates, tokens, etc.) to prove its identity and the legitimacy of the request. This active authentication is an important step in ensuring communication security and helps prevent unauthorized access.

[0105] The security center module plays a core role in this process. It is not only responsible for issuing identity certificates and issuing authentication rules, but also for authorizing business authentication modules. This authorization mechanism ensures the security of the entire system, because only components that have been authenticated and authorized by the security center module can participate in the security decision-making process.

[0106] In this embodiment, through the secure interaction between the security authentication module and the business authentication module under the agentmain configuration mode, and the key role of the security center module in the authorization and authentication process, it is ensured that the communication between microservices is not only secure at the technical level, but also compliant and secure at the business logic level.

[0107] As shown in Figure 4, this is a microservice authentication architecture diagram in traditional technology. This security authentication method has some limitations. Istio's security model is strongly dependent on the Kubernetes cluster and is limited by the Kubernetes cluster. Istio certificate rotation must pass through the Kubernetes API Server, which will cause the API Server to become a system bottleneck. In addition, Istio's certificate and authentication rules are strongly dependent on the cluster namespace, resulting in insufficient flexibility in authentication and authorization capabilities during communication between microservices, making it difficult to support cross-cluster and fine-grained security models.

[0108] Therefore, based on the above problems, the most detailed embodiment of the present application is:

[0109] Embodiment 1 (as preferred):

[0110] 1.1 Perform rolling upgrades on existing microservices in the link, use JAVA Agent technology in the changes, and use the attach method to inject security authentication modules to enhance the microservices.

[0111] 1.2 The security authentication module obtains the corresponding identity certificate and instant authentication rules from the security center module based on the startup key.

[0112] 1.3 The upstream microservice sends a request to the downstream microservice.

[0113] 1.4 The security authentication module intervenes, reuses the http port to provide authentication, and sends a two-way authentication request to the security authentication module of the downstream microservice.

[0114] 1.5 The security authentication module of the downstream microservice performs certificate verification and verifies the validity of the identity.

[0115] 1.6 After identity authentication is passed, the upstream microservice sends a request, the downstream microservice receives the request, and the security authentication module authenticates the request based on the authentication rule configuration. The authentication can include method tracking points and request attributes.

[0116] 1.7 The downstream microservice performs business processing when the authentication verification passes.

[0117] Example 2 (as an extension):

[0118] 2.1 Perform rolling upgrades on existing microservices in the link, use JAVA Agent technology in the changes, and use agentmain to actively inject security authentication modules to enhance microservices.

[0119] 2.2 The security authentication module obtains the corresponding identity certificate, configuration center address and configuration items from the security center module based on the startup key.

[0120] 2.3 The security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration item.

[0121] 2.4 The upstream microservice sends a request to the downstream microservice.

[0122] 2.5 The security authentication module intervenes, opens the new port configured in the configuration center to provide authentication, and sends a two-way authentication request to the downstream microservice security authentication module.

[0123] 2.6 The downstream microservice security authentication module performs certificate verification and verifies the validity of the identity.

[0124] 2.7 After identity authentication is passed, the upstream microservice sends a request, the downstream microservice receives the request, and the security authentication module authenticates the request based on the authentication rule configuration, which can include method tracking points and request attributes.

[0125] 2.8 The downstream microservice performs business processing when the authentication verification passes.

[0126] 2.9 (Optional) The security authentication module carries the request information and performs custom authentication to the business authentication module defined by the security center, during which identity authentication is used.

[0127] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0128] Based on the same inventive concept, the embodiment of the present application also provides a microservice authentication device for implementing the microservice authentication method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more microservice authentication device embodiments provided below can refer to the limitations on the microservice authentication method above, and will not be repeated here.

[0129] In an exemplary embodiment, as shown in FIG5 , a microservice authentication device is provided, including a microservice controller, a security center module, a security authentication module, and a business module:

[0130] Microservice controller, used to perform rolling upgrades on all microservices in the link, using bytecode enhancement technology to configure security authentication modules for all microservices;

[0131] The security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and to rotate the identity certificate and authentication rules regularly;

[0132] The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the custom security authentication rules of the business;

[0133] The microservice controller is also used to control the security authentication module of the downstream microservice to authenticate the business request based on the identity certificate and authentication rules when the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified successfully;

[0134] The business module is used to control the downstream microservices to perform business processing when authentication is successful.

[0135] In an exemplary embodiment, the device further includes a service authentication module, and the service authentication module is granted authentication authority by the security center module;

[0136] When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send a custom security authentication request to the business authentication module and perform active identity authentication.

[0137] In an exemplary embodiment, when the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules, and when the configuration mode of the security authentication module is agentmain mode, the authentication rules include a configuration center address and configuration items.

[0138] In an exemplary embodiment, when the configuration mode of the security authentication module is the attach mode, the microservice controller is also used to control the security authentication module of the upstream microservice to reuse the http port to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice;

[0139] When the configuration mode of the security authentication module is agentmain, the microservice controller is also used to control the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0140] In an exemplary embodiment, when the configuration mode of the security authentication module is agentmain mode, the microservice controller is also used to control the security authentication module to establish a connection with the configuration center and obtain the authentication information in the configuration item.

[0141] Each module in the above-mentioned microservice authentication device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0142] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store identity certificates and authentication rule data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a microservice authentication method is implemented.

[0143] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0144] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0145] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0146] Based on the startup key, use the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotate the identity certificate and authentication rules regularly;

[0147] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0148] When the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules;

[0149] If authentication is successful, control the downstream microservices to perform business processing.

[0150] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0151] When the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is agentmain mode, the authentication rules include the address and configuration items of the configuration center.

[0152] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0153] When the security authentication module is configured in attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice;

[0154] When the security authentication module is configured in agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0155] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0156] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration item.

[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0158] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

[0159] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0160] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0161] Based on the startup key, use the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotate the identity certificate and authentication rules regularly;

[0162] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0163] When the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules;

[0164] If authentication is successful, control the downstream microservices to perform business processing.

[0165] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0166] When the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is agentmain mode, the authentication rules include the address and configuration items of the configuration center.

[0167] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0168] When the security authentication module is configured in attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice;

[0169] When the security authentication module is configured in agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0170] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0171] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration item.

[0172] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0173] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

[0174] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0175] Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices;

[0176] Based on the startup key, use the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotate the identity certificate and authentication rules regularly;

[0177] When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice;

[0178] When the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules;

[0179] If authentication is successful, control the downstream microservices to perform business processing.

[0180] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0181] When the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is agentmain mode, the authentication rules include the address and configuration items of the configuration center.

[0182] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0183] When the security authentication module is configured in attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice;

[0184] When the security authentication module is configured in agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0185] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0186] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration item.

[0187] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0188] When the configuration mode of the security authentication module is agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

[0189] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0190] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0191] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0192] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A microservice authentication method, characterized in that: Applied to a microservice controller, the method includes: Perform rolling upgrades on all microservices in the link, use bytecode enhancement technology, and configure security authentication modules for all microservices; Based on the startup key, the security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and the identity certificate and the authentication rules are rotated regularly; When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice; When the bidirectional authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified, based on the identity certificate and the authentication rule, the security authentication module of the downstream microservice is controlled to authenticate the service request; If authentication is successful, control the downstream microservices to perform business processing.

2. The method according to claim 1, characterized in that: When the configuration mode of the security authentication module is attach mode, the authentication rules include immediate security rules; when the configuration mode of the security authentication module is agentmain mode, the authentication rules include the address and configuration items of the configuration center.

3. The method according to claim 2, characterized in that The method further comprises: When the security authentication module is configured in attach mode, the security authentication module of the upstream microservice is controlled to reuse the http port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice; When the security authentication module is configured in agentmain mode, the security authentication module of the upstream microservice is controlled to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

4. The method according to claim 2, characterized in that: After obtaining the identity certificate and authentication rules of the corresponding microservice from the security center module using the security authentication module based on the startup key, the method further includes: When the configuration mode of the security authentication module is agentmain mode, the security authentication module is controlled to establish a connection with the configuration center and obtain the authentication information in the configuration item.

5. The method according to claim 1, characterized in that The method further comprises: When the configuration mode of the security authentication module is agentmain mode, the security authentication module is controlled to send a custom security authentication request to the business authentication module and perform active identity authentication; wherein the business authentication module is granted authentication authority by the security center module.

6. A microservice authentication device, characterized in that: The device includes a microservice controller, a security center module, a security authentication module and a business module: Microservice controller, used to perform rolling upgrades on all microservices in the link, using bytecode enhancement technology to configure security authentication modules for all microservices; A security authentication module, used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and regularly rotate the identity certificate and the authentication rules; The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the custom security authentication rules of the business; The microservice controller is further used to control the security authentication module of the downstream microservice to authenticate the business request based on the identity certificate and the authentication rule when the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified successfully; The business module is used to control the downstream microservices to perform business processing when the authentication is passed.

7. The device according to claim 6, characterized in that The device also includes a service authentication module, which is granted authentication authority by the security center module; When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send a custom security authentication request to the business authentication module and perform active identity authentication.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images