Microservice authentication methods, devices, computer equipment, and storage media

Abstract

This application relates to a microservice authentication method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: configuring a security authentication module for all microservices in the link; obtaining the corresponding microservice's identity certificate and authentication rules from a security center module based on a startup key, and periodically rotating the identity certificate and authentication rules; upon receiving a business request sent from an upstream microservice to a downstream microservice, controlling the upstream microservice's security authentication module to send a two-way authentication request to the downstream microservice's security authentication module; if the two-way authentication request is verified successfully, controlling the downstream microservice's security authentication module to authenticate the business request based on the identity certificate and authentication rules; and if authentication is successful, controlling the downstream microservice to perform business processing. This method improves the flexibility of authentication and authorization capabilities during communication between microservices.

Description

Technical Field

[0001] This application relates to the field of microservices technology, and in particular to a microservices authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the rapid development of cloud computing and microservice architecture, enterprises are increasingly inclined to deploy their businesses on cloud platforms. Microservice architecture, with its advantages of scalability, agility, independent expansion, business logic isolation, independent lifecycle management, and ease of distributed development, has become the preferred choice for building cloud platform services. However, this decentralized microservice architecture also brings security challenges. By default, all interactions between microservices are insecure because they communicate using plaintext HTTP, which is far from meeting security requirements. Therefore, internal calls must also be secure, which is why zero-trust security is so important. Zero-trust security requires explicit authentication everywhere and uses the principle of least privilege to restrict access to resources. This security strategy can effectively protect the microservice architecture and prevent attackers from exploiting vulnerabilities.

[0003] Current technology is based on Kubernetes combined with the service mesh Istio. A sidecar proxy uniquely identifies services and provides certificates for two-way authentication. After authentication, the sidecar encrypts communication between microservices. Upon receiving a request, the sidecar performs access authorization based on the identity and request attributes. However, this security authentication method has some limitations. Istio's security model is heavily reliant on and limited by the Kubernetes cluster. Istio certificate rotation must pass through the Kubernetes API server, which can make the API server a system bottleneck. Furthermore, Istio's certificate and authentication rule issuance heavily depends on the cluster's namespace, resulting in insufficient flexibility in authentication and authorization capabilities during communication between microservices, making it difficult to support cross-cluster and fine-grained security models.

[0004] Therefore, there is an urgent need for a microservice authentication method, device, computer equipment, computer-readable storage medium, and computer program product that can improve the flexibility of authentication and authorization capabilities during communication between microservices. Summary of the Invention

[0005] Therefore, it is necessary to provide a microservice authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the flexibility of authentication and authorization capabilities during communication between microservices, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a microservice authentication method, including:

[0007] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0008] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0009] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0010] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rules.

[0011] Once authentication is successful, control the downstream microservices to perform business processing.

[0012] In one embodiment, when the security authentication module is configured in attach mode, the authentication rules include real-time security rules; when the security authentication module is configured in agentmain mode, the authentication rules include the address and configuration items of the configuration center.

[0013] In one embodiment, the method further includes:

[0014] When the security authentication module is configured in attach mode, it controls the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send two-way authentication requests to the security authentication module of the downstream microservice.

[0015] When the security authentication module is configured in agentmain mode, it controls the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0016] In one embodiment, after obtaining the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key using the security authentication module, the method further includes:

[0017] When the security authentication module is configured in agentmain mode, the security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration items.

[0018] In one embodiment, the method further includes:

[0019] When the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

[0020] Secondly, this application also provides a microservice authentication device, including: a microservice controller, a security center module, a security authentication module, and a business module.

[0021] The microservice controller is used to perform rolling upgrades on all microservices in the chain. It uses bytecode enhancement technology to configure a security authentication module for all microservices.

[0022] The security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and to periodically rotate the identity certificate and authentication rules.

[0023] The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules.

[0024] The microservice controller is also used to control the security authentication module of the downstream microservice to authenticate the business request based on the identity certificate and the authentication rules, provided that the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified.

[0025] The business module is used to control downstream microservices to perform business processing when authentication is successful.

[0026] In one embodiment, the device further includes a service authentication module, which is granted authentication permissions by the security center module.

[0027] When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send custom security authentication requests to the business authentication module and perform proactive identity authentication.

[0028] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0029] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0030] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0031] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0032] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rules.

[0033] Once authentication is successful, control the downstream microservices to perform business processing.

[0034] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0035] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0036] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0037] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0038] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rules.

[0039] Once authentication is successful, control the downstream microservices to perform business processing.

[0040] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0041] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0042] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0043] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0044] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rules.

[0045] Once authentication is successful, control the downstream microservices to perform business processing.

[0046] The aforementioned microservice authentication methods, devices, computer equipment, computer-readable storage media, and computer program products dynamically inject security authentication modules into all microservices in the microservice architecture through bytecode enhancement technology, achieving a zero-trust security model. During microservice upgrades, a rolling upgrade approach is adopted, eliminating the need to stop microservices and ensuring microservice continuity. When a microservice starts, the security authentication module obtains identity certificates and authentication rules from the security center module using a startup key, and supports periodic rotation to enhance security. During inter-microservice communication, the security authentication module of the upstream microservice initiates a two-way authentication request to the downstream microservice to ensure the legitimacy of both parties' identities. Once two-way authentication is successful, the module authenticates the request based on the identity certificate and rules, allowing only legitimate requests to pass. If the downstream microservice's authentication verification passes, business processing continues. This mechanism achieves secure communication between microservices, conforming to the zero-trust security principle, i.e., not trusting any internal or external requests until they are verified. This solution reduces intrusion into project code, lowers development and operation complexity, and provides flexible cross-platform deployment capabilities, suitable for various microservice deployment scenarios. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a diagram illustrating the application environment of a microservice authentication method in one embodiment.

[0049] Figure 2 This is a flowchart illustrating a microservice authentication method in one embodiment;

[0050] Figure 3 This is a flowchart illustrating a microservice authentication method in another embodiment;

[0051] Figure 4 This is a diagram of a microservice authentication architecture in traditional technologies.

[0052] Figure 5 This is a structural block diagram of a microservice authentication device in one embodiment;

[0053] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] The microservice authentication method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 (microservice controller) via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on other network servers.

[0056] Server 104 is used to perform rolling upgrades on all microservices in the chain, employing bytecode enhancement technology to configure a security authentication module for all microservices. Based on the startup key, it uses the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and periodically rotates the identity certificate and authentication rules. When an upstream microservice sends a business request to a downstream microservice based on its custom security authentication rules, it controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice. If the two-way authentication request between the security authentication modules of the upstream and downstream microservices passes verification, it controls the security authentication module of the downstream microservice to authenticate the service request based on the identity certificate and authentication rules. Terminal 102 is used to control the downstream microservice to perform business processing when authentication is successful.

[0057] The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0058] In one exemplary embodiment, such as Figure 2 As shown, a microservice authentication method is provided, which is applied to... Figure 1 Taking the server in the example, the explanation includes the following steps S202 to S210. Wherein:

[0059] Step S202 involves performing a rolling upgrade on all microservices in the chain, using bytecode enhancement technology to configure a security authentication module for all microservices.

[0060] Rolling upgrades are a method for updating services that allows service instances to be updated individually or gradually without stopping the entire service or system. This minimizes service interruptions and ensures high availability.

[0061] Bytecode enhancement is a technique that modifies Java bytecode at runtime. This allows for the dynamic addition of new functionality or modification of existing behavior in a running Java program without altering the source code. In microservice architectures, this is typically used to enhance service functionality without restarting the service.

[0062] Specifically, configuring a security authentication module for all microservices means that each service in the microservice architecture will integrate a security authentication module. This module is responsible for handling service authentication and request authorization, ensuring that only legitimate requests can be processed. Injecting a security module through bytecode enhancement technology can enhance service security without modifying the original service code. This approach has minimal invasiveness to the existing system and is easy to implement and maintain.

[0063] Step S204: Based on the startup key, use the security authentication module to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotate the identity certificate and authentication rules periodically.

[0064] Specifically, each microservice uses a startup key upon startup. This key is a security credential used to establish a trust relationship between the service and the security center module, ensuring secure communication. The security authentication module uses the startup key to communicate with the security center module, requesting the service's identity certificate and authentication rules. The identity certificate proves the service's identity, and the authentication rules define how the service should perform authentication and authorization.

[0065] The purpose of periodic rotation is to improve system security. Identity certificates and authentication rules are not valid indefinitely but are updated periodically; this process is called rotation. Periodic rotation can reduce the risk of certificate theft because even if an attacker obtains the current certificate, its validity will quickly expire due to the periodic renewal of certificates.

[0066] The Security Center module is a centralized service responsible for managing the identity certificates and authentication rules of all microservices. It is responsible for issuing certificates, distributing rules, and managing the lifecycle of certificates, including certificate generation, distribution, renewal, and revocation.

[0067] Step S206: When the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules, control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0068] Specifically, in a microservice architecture, different services may have different security requirements, so security authentication rules need to be defined based on specific business logic. These rules can define which services can communicate and what security checks need to be performed during communication.

[0069] When the security center module receives business-defined security authentication rules, it distributes these rules to the security authentication modules of each microservice module. These modules are responsible for executing these rules during inter-microservice communication. In a microservice architecture, services typically have calling relationships; one service (upstream microservice) calls another service (downstream microservice) to complete certain business logic. When an upstream microservice needs to call a downstream microservice, the upstream microservice's security authentication module first sends an authentication request to the downstream microservice's security authentication module. This is a bidirectional process because:

[0070] Upstream microservice authentication of downstream microservices: The security authentication module of the upstream microservice needs to verify the identity of the downstream microservice to ensure that it is a legitimate service instance.

[0071] Downstream microservices authenticate upstream microservices: At the same time, the security authentication module of the downstream microservices also verifies the identity of the upstream microservices to ensure that the request comes from an authorized service.

[0072] This two-way authentication mechanism ensures the security of communication between microservices, preventing unauthorized services from accessing sensitive data or performing operations. It also embodies the "never trust, always verify" principle of the zero-trust model.

[0073] Through this mechanism, the microservice architecture can establish a secure chain of trust between microservices, ensuring that only verified and authorized communication between microservices is allowed, thereby improving the security of the entire system.

[0074] Step S208: If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and the authentication rules.

[0075] Specifically, during inter-microservice communication, the security authentication module of the upstream microservice sends a two-way authentication request to the security authentication module of the downstream microservice. Only after both parties have successfully authenticated each other, confirming their legitimacy, will the subsequent authentication process continue. Since the security authentication module is integrated into each microservice, it is responsible for handling service authentication and request authorization. It uses identity certificates and authentication rules obtained from the security center module to perform these tasks. The security authentication module uses two key components—identity certificates and authentication rules—for authentication, where:

[0076] Identity Certificate: Used to prove the identity of a service, similar to an ID card in the digital world. It contains the service's identity information and is signed by the security center module to ensure its authenticity and non-repudiation.

[0077] Authentication rules: Define the specific strategies for how services should be authenticated and authorized, including which services can be accessed and what operations can be performed.

[0078] Once mutual authentication is successful, the security authentication module will authenticate the request according to the authentication rules. This process includes checking whether the request complies with security policies, such as: confirming whether the requested service has the authority to perform a specific operation; or ensuring that the request complies with the principle of least privilege, i.e., the service can only access the resources necessary to perform its functions; or checking whether the request contains necessary security attributes, such as tokens, certificates, or other security credentials.

[0079] In other embodiments, authentication includes method tracking and request attributes. This means that during the security authentication process, the system not only checks the legitimacy of the request but also monitors and records access attempts to specific methods and verifies whether the attributes contained in the request meet security requirements. This comprehensive authentication mechanism can provide more comprehensive security protection, helping to prevent unauthorized access and potential security threats.

[0080] Step S210: If authentication is successful, control the downstream microservices to perform business processing.

[0081] Specifically, after an upstream microservice sends a business request to a downstream microservice, the downstream microservice's security authentication module authenticates the request based on identity certificates and authentication rules. This process includes verifying the legitimacy of the business request, checking whether the request complies with security policies, and confirming whether the requester has the authority to perform specific operations. Authentication will only pass if the security authentication module confirms that the request meets all security requirements and business rules. This means the request is secure and legitimate, and the requester has the permission to perform the requested operation. Once authentication passes, the downstream microservice's security authentication module allows the request to proceed with business processing. At this stage, the downstream microservice will execute the specific business operations required by the request, such as data processing, computation, and database interaction.

[0082] Business logic processing is a core component of a microservice architecture because it directly impacts the functionality and business value of microservices. Business logic is only allowed to execute after ensuring the security and compliance of requests, thus protecting services from unauthorized access and potential security threats. The core principle of the zero-trust model is "never trust, always verify." In the zero-trust model, every business request must undergo rigorous security checks, verifying its legitimacy and security regardless of whether it originates internally or externally.

[0083] The aforementioned microservice authentication method dynamically injects a security authentication module into all microservices in the microservice architecture through bytecode enhancement technology, achieving a zero-trust security model. During microservice upgrades, a rolling upgrade approach is adopted, eliminating the need to stop microservices and ensuring microservice continuity. When a microservice starts, the security authentication module uses a startup key to obtain identity certificates and authentication rules from the security center module, and supports periodic rotation to enhance security. During inter-microservice communication, the security authentication module of the upstream microservice initiates a two-way authentication request to the downstream microservice to ensure the legitimacy of both parties' identities. Once two-way authentication is successful, the module authenticates the request based on the identity certificate and rules, allowing only legitimate requests to pass. If the downstream microservice's authentication verification passes, business processing continues. This mechanism achieves secure communication between microservices, conforming to the zero-trust security principle, which means not trusting any internal or external requests until they are verified. This solution reduces the intrusion into project code, lowers development and operation complexity, and provides flexible cross-platform deployment capabilities, suitable for various microservice deployment scenarios.

[0084] In an exemplary embodiment, when the security authentication module is configured in attach mode, the authentication rules include immediate security rules; when the security authentication module is configured in agentmain mode, the authentication rules include the configuration center address and configuration items.

[0085] The Attach method refers to dynamically attaching the security authentication module to the microservice after the service has already started. This method allows for enhancing the security capabilities of the microservice without restarting the service.

[0086] Real-time security rules refer to a configuration where the security authentication module may need to obtain security rules in real-time or immediately to address rapidly changing security threats or business needs. Real-time security rules may be dynamically issued, and the security authentication module needs to be able to quickly respond to changes in these rules and immediately implement new security policies. This immediacy requires an efficient communication mechanism between the security authentication module and the security center module to ensure that rules can be updated in real time.

[0087] The Agentmain method refers to the security authentication module being loaded when the microservice starts (agentmain). This method allows the security authentication module to intervene at the beginning of the service startup and perform initial security settings.

[0088] The configuration center address and configuration items refer to the address and related configuration items that the security authentication module obtains upon startup in this configuration method. The configuration center is a centralized location for managing security rules and service configurations. The security authentication module needs to know the location (address) of the configuration center to retrieve and update security rules and configurations. Configuration items include security rules, service-specific configuration parameters, etc., which guide the security authentication module on how to perform security checks and authentication.

[0089] In this embodiment, the two configuration methods reflect different loading times and rule acquisition mechanisms for the security authentication module. The Attach method focuses more on dynamic intervention and immediate rule updates during microservice runtime, while the Agentmain method focuses on initial configuration at microservice startup and obtaining persistent rules and configurations from the configuration center. Both methods aim to ensure that the security authentication module can effectively perform its duties and protect microservices from security threats.

[0090] In one exemplary embodiment, such as Figure 3 As shown, the method also includes steps 302 to 303.

[0091] Step S302: When the security authentication module is configured in attach mode, control the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0092] Step S304: When the security authentication module is configured in agentmain mode, control the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication, and send a two-way authentication request to the security authentication module of the downstream microservice.

[0093] In the Attach method, the upstream microservice's security authentication module reuses the existing HTTP port for authentication. This avoids modifying the service's network configuration, as the security authentication module uses the port already being listened to by the microservice to handle authentication requests. The upstream microservice's security authentication module sends a two-way authentication request to the downstream microservice's security authentication module through the reused HTTP port. This two-way authentication ensures that the identities of both communicating parties are verified.

[0094] Unlike the Attach method, in the Agentmain method, the upstream microservice's security authentication module opens a new port for security authentication based on the configuration center's settings. This new port is dedicated to secure communication and may provide additional security measures or configurations. In the Agentmain method, the upstream microservice's security authentication module sends two-way authentication requests to the downstream microservice's security authentication module through this newly opened port to ensure the security of communication between microservices.

[0095] In this embodiment, the two configuration methods reflect different strategies for loading the security authentication module and using communication ports. The Attach method provides authentication by reusing the existing HTTP port, while the Agentmain method opens a new port to handle authentication based on the configuration center's settings. Both methods ensure the security of communication between microservices.

[0096] In an exemplary embodiment, after obtaining the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key using the security authentication module, the method further includes:

[0097] When the security authentication module is configured in agentmain mode, it controls the security authentication module to establish a connection with the configuration center and obtain the authentication information in the configuration items.

[0098] Specifically, in the agentmain configuration mode, the security authentication module is loaded when the service starts (via agentmain). This mode allows the security authentication module to intervene at the very beginning of the microservice startup and perform initial security settings. In agentmain mode, the security authentication module not only communicates with the security center module but also needs to establish a connection with the configuration center. The configuration center is a centralized management system for service configurations, including security configurations.

[0099] The security authentication module retrieves authentication information from the configuration center. This information includes specific authentication policies, permission settings, and security rules, which guide the security authentication module in performing security checks and authentication. Authentication information is crucial for the security authentication module to perform its functions. It ensures that microservices correctly apply security policies when processing requests, such as determining which requests are legitimate and which should be rejected.

[0100] In this embodiment, by emphasizing that under the agentmain configuration method, the security authentication module not only needs to obtain identity certificates and authentication rules from the security center module, but also needs to establish a connection with the configuration center to obtain and apply authentication information, the security and compliance of the service are ensured, while also providing flexibility, because security policies and rules can be centrally managed and dynamically updated.

[0101] In an exemplary embodiment, when the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

[0102] Specifically, the security authentication module is responsible for handling secure communication between microservices. When security checks related to specific business logic are required, the security authentication module sends custom security authentication requests to the business authentication module. These requests are specific to particular business scenarios and require personalized authentication based on the business logic.

[0103] The business authentication module is responsible for executing specific business logic authentication. The security center module is responsible for granting the business authentication module the permission to perform authentication operations. This means that the security center module authenticates and authorizes the business authentication module, ensuring that only authorized business authentication modules can perform authentication operations.

[0104] The security authentication module performs proactive identity authentication simultaneously with sending a request. This means it provides the necessary credentials (such as certificates, tokens, etc.) to prove its identity and the legitimacy of the request. This proactive authentication is a crucial step in ensuring secure communication and helps prevent unauthorized access.

[0105] The Security Center module plays a central role in this process. It is responsible not only for issuing identity certificates and distributing authentication rules, but also for authorizing business authentication modules. This authorization mechanism ensures the security of the entire system, as only components authenticated and authorized by the Security Center module can participate in the security decision-making process.

[0106] In this embodiment, through the secure interaction between the security authentication module and the business authentication module under the agentmain configuration mode, and the key role of the security center module in the authorization and authentication process, it is ensured that the communication between microservices is not only secure at the technical level, but also compliant and secure at the business logic level.

[0107] like Figure 4 The diagram shows a traditional microservice authentication architecture, which has several limitations. Istio's security model is heavily reliant on and constrained by the Kubernetes cluster. Istio certificate rotation must pass through the Kubernetes API Server, making the API Server a system bottleneck. Furthermore, Istio's certificate and authentication rule issuance heavily depends on the cluster's namespace, resulting in inflexible authentication capabilities during inter-microservice communication and difficulty in supporting cross-cluster and fine-grained security models.

[0108] Therefore, based on the above problems, the most detailed embodiment of this application is as follows:

[0109] Example 1 (as preferred):

[0110] 1.1 Perform rolling upgrades on existing microservices in the pipeline. During the changes, use JAVA Agent technology and inject security authentication modules using the attach method to enhance the microservices.

[0111] 1.2 The security authentication module obtains the corresponding identity certificate and real-time authentication rules from the security center module based on the startup key.

[0112] 1.3 The upstream microservice sends a request to the downstream microservice.

[0113] 1.4 The security authentication module intervenes, reuses the HTTP port to provide authentication, and sends a two-way authentication request to the security authentication module of the downstream microservice.

[0114] 1.5 The security authentication module of the downstream microservice performs certificate verification to check the validity of the identity.

[0115] 1.6 After successful authentication, the upstream microservice sends a request, and the downstream microservice receives the request. The security authentication module authenticates the request based on the authentication rules configuration. Authentication can include method tracking and request attributes.

[0116] 1.7 Downstream microservices perform business processing after authentication and verification are passed.

[0117] Example 2 (as an extension):

[0118] 2.1 Perform rolling upgrades on existing microservices in the pipeline. During the upgrades, JAVA Agent technology is used, and the agentmain method is used to proactively inject security authentication modules to enhance the microservices.

[0119] 2.2 The security authentication module obtains the corresponding identity certificate, configuration center address, and configuration items from the security center module based on the startup key.

[0120] 2.3 The security authentication module establishes a connection with the configuration center and obtains the authentication information from the configuration items.

[0121] 2.4 The upstream microservice sends a request to the downstream microservice.

[0122] 2.5 The security authentication module intervenes, opens the new port configured in the configuration center to provide authentication, and sends a two-way authentication request to the downstream microservice security authentication module.

[0123] 2.6 The downstream microservice security authentication module performs certificate verification to check the validity of the identity.

[0124] 2.7 After successful authentication, the upstream microservice sends a request, and the downstream microservice receives the request. The security authentication module authenticates the request based on the authentication rules configuration, which can include method tracking and request attributes.

[0125] 2.8 Downstream microservices perform business processing after authentication and verification are passed.

[0126] 2.9 (Optional) The security authentication module carries the request information and performs custom authentication with the business authentication module defined by the security center, during which identity authentication is used.

[0127] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0128] Based on the same inventive concept, this application also provides a microservice authentication device for implementing the microservice authentication method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more microservice authentication device embodiments provided below can be found in the limitations of the microservice authentication method described above, and will not be repeated here.

[0129] In one exemplary embodiment, such as Figure 5 As shown, a microservice authentication device is provided, including a microservice controller, a security center module, a security authentication module, and a business module:

[0130] The microservice controller is used to perform rolling upgrades on all microservices in the chain. It uses bytecode enhancement technology to configure a security authentication module for all microservices.

[0131] The security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and to periodically rotate the identity certificate and authentication rules.

[0132] The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules.

[0133] The microservice controller is also used to control the security authentication module of the downstream microservice to authenticate business requests based on identity certificates and authentication rules, provided that the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice has been verified.

[0134] The business module is used to control downstream microservices to perform business processing when authentication is successful.

[0135] In one exemplary embodiment, the apparatus further includes a service authentication module, which is granted authentication permissions by the security center module.

[0136] When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send custom security authentication requests to the business authentication module and perform proactive identity authentication.

[0137] In an exemplary embodiment, when the security authentication module is configured in attach mode, the authentication rules include real-time security rules; when the security authentication module is configured in agentmain mode, the authentication rules include the configuration center address and configuration items.

[0138] In an exemplary embodiment, when the security authentication module is configured in attach mode, the microservice controller is also used to control the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0139] When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication and send two-way authentication requests to the security authentication module of the downstream microservice.

[0140] In an exemplary embodiment, when the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to establish a connection with the configuration center and obtain authentication information from the configuration items.

[0141] Each module in the aforementioned microservice authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0142] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores identity certificates and authentication rules. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a microservice authentication method.

[0143] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0144] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0145] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0146] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0147] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0148] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules.

[0149] Once authentication is successful, control the downstream microservices to perform business processing.

[0150] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0151] When the security authentication module is configured using the attach method, the authentication rules include real-time security rules; when the security authentication module is configured using the agentmain method, the authentication rules include the address and configuration items of the configuration center.

[0152] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0153] When the security authentication module is configured in attach mode, it controls the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send two-way authentication requests to the security authentication module of the downstream microservice.

[0154] When the security authentication module is configured in agentmain mode, it controls the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0155] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0156] When the security authentication module is configured in agentmain mode, it controls the security authentication module to establish a connection with the configuration center and obtain the authentication information in the configuration items.

[0157] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0158] When the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

[0159] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0160] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0161] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0162] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0163] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules.

[0164] Once authentication is successful, control the downstream microservices to perform business processing.

[0165] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0166] When the security authentication module is configured using the attach method, the authentication rules include real-time security rules; when the security authentication module is configured using the agentmain method, the authentication rules include the address and configuration items of the configuration center.

[0167] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0168] When the security authentication module is configured in attach mode, it controls the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send two-way authentication requests to the security authentication module of the downstream microservice.

[0169] When the security authentication module is configured in agentmain mode, it controls the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0170] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0171] When the security authentication module is configured in agentmain mode, it controls the security authentication module to establish a connection with the configuration center and obtain the authentication information in the configuration items.

[0172] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0173] When the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

[0174] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0175] Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices;

[0176] Based on the startup key, the security authentication module obtains the identity certificate and authentication rules of the corresponding microservice from the security center module, and rotates the identity certificate and authentication rules periodically.

[0177] When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice.

[0178] If the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice passes the verification, the security authentication module of the downstream microservice is controlled to authenticate the service request based on the identity certificate and authentication rules.

[0179] Once authentication is successful, control the downstream microservices to perform business processing.

[0180] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0181] When the security authentication module is configured using the attach method, the authentication rules include real-time security rules; when the security authentication module is configured using the agentmain method, the authentication rules include the address and configuration items of the configuration center.

[0182] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0183] When the security authentication module is configured in attach mode, it controls the security authentication module of the upstream microservice to reuse the HTTP port to provide authentication and send two-way authentication requests to the security authentication module of the downstream microservice.

[0184] When the security authentication module is configured in agentmain mode, it controls the security authentication module of the upstream microservice to open the new port configured in the configuration center to provide authentication and send a two-way authentication request to the security authentication module of the downstream microservice.

[0185] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0186] When the security authentication module is configured in agentmain mode, it controls the security authentication module to establish a connection with the configuration center and obtain the authentication information in the configuration items.

[0187] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0188] When the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

[0189] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0190] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0191] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0192] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A microservice authentication method, characterized in that, Applied to a microservice controller, the method includes: Perform rolling upgrades on all microservices in the chain, adopt bytecode enhancement technology, and configure security authentication modules for all microservices; Based on the startup key, the security authentication module retrieves the corresponding microservice's identity certificate and authentication rules from the security center module, and periodically rotates the identity certificate and authentication rules. When the security authentication module is configured in attach mode, the authentication rules include real-time security rules; when the security authentication module is configured in agentmain mode, the authentication rules include the address and configuration items of the configuration center. The attach mode focuses more on dynamic intervention and real-time rule updates during microservice runtime, while the agentmain mode focuses on the initialization configuration at microservice startup and retrieving persistent rules and configurations from the configuration center. When an upstream microservice sends a business request to a downstream microservice based on a custom security authentication rule, the system controls the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice. Specifically, when the security authentication module is configured in attach mode, the upstream microservice's security authentication module reuses the HTTP port to provide authentication and sends a two-way authentication request to the downstream microservice's security authentication module. When the security authentication module is configured in agentmain mode, the upstream microservice's security authentication module opens a new port configured in the configuration center to provide authentication and sends a two-way authentication request to the downstream microservice's security authentication module. If the two-way authentication request between the upstream and downstream microservices' security authentication modules passes verification, the downstream microservice's security authentication module authenticates the business request based on the identity certificate and the authentication rules. Once authentication is successful, control the downstream microservices to perform business processing.

2. The method according to claim 1, characterized in that, After obtaining the corresponding microservice's identity certificate and authentication rules from the security center module based on the startup key, the process also includes: When the security authentication module is configured in agentmain mode, the security authentication module establishes a connection with the configuration center and obtains the authentication information in the configuration items.

3. The method according to claim 1, characterized in that, The method further includes: When the security authentication module is configured in agentmain mode, the control security authentication module sends a custom security authentication request to the business authentication module and performs proactive identity authentication; wherein, the business authentication module is granted authentication permissions by the security center module.

4. A microservice authentication device, characterized in that, The steps of the method applied to any one of claims 1 to 3 above; the apparatus includes a microservice controller, a security center module, a security authentication module, and a business module: The microservice controller is used to perform rolling upgrades on all microservices in the chain. It uses bytecode enhancement technology to configure a security authentication module for all microservices. The security authentication module is used to obtain the identity certificate and authentication rules of the corresponding microservice from the security center module based on the startup key, and to periodically rotate the identity certificate and authentication rules. The microservice controller is also used to control the security authentication module of the upstream microservice to send a two-way authentication request to the security authentication module of the downstream microservice when the upstream microservice sends a business request to the downstream microservice based on the business's custom security authentication rules. The microservice controller is also used to control the security authentication module of the downstream microservice to authenticate the business request based on the identity certificate and the authentication rules, provided that the two-way authentication request between the security authentication module of the upstream microservice and the security authentication module of the downstream microservice is verified. The business module is used to control downstream microservices to perform business processing when authentication is successful.

5. The apparatus according to claim 4, characterized in that, The device also includes a service authentication module, which is granted authentication permissions by the security center module. When the security authentication module is configured in agentmain mode, the microservice controller is also used to control the security authentication module to send custom security authentication requests to the business authentication module and perform proactive identity authentication.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images