Micro-service distributed authority management system
By designing a distributed permission management system in the microservice system, and using the architecture of separation of permission management and permission control surfaces, a single point of failure risk and performance bottleneck problems of centralized permission management are solved, and efficient permission management and system reliability and performance improvement are achieved.
Patent Information
- Application Number
- CN202411909925.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-24
- Publication Date
- 2025-03-18
AI Technical Summary
In existing microservice systems, centralized permission management and authentication solutions have problems such as single point of failure risk, performance bottlenecks, scalability problems, network latency and complexity management, which affect the availability, performance and scalability of the system.
Design a distributed permission management system for microservices, centrally store and manage permission policies through the permission management plane, and deploy permission control planes in each microservice instance for local authentication to realize distributed permission verification.
Eliminate performance bottlenecks and single-point failure risks in centralized authentication, improve system reliability and performance, and support the autonomy and refined permission management of microservices.
Smart Images
Figure CN119646858A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of microservice authentication technology, and in particular to a microservice distributed rights management system. Background Art
[0002] With the widespread application of microservice architecture, permission management and authentication mechanisms have become important links in ensuring system security and service stability. Currently, most microservice systems use centralized permission management and authentication solutions, that is, a unified authentication service is used to handle permission verification for all microservices. Although this centralized design simplifies the logic and structure of permission management, it also brings many problems and shortcomings, which are mainly reflected in the following aspects: 1. Single point failure risk: In a centralized authentication architecture, all authentication logic and permission verification requests are concentrated on one service node, so the availability of this node is critical to the system. Once the centralized authentication service fails or goes down, the entire system will be unable to perform permission verification, causing all microservices that depend on it to fail to work properly. This single point failure risk seriously affects the availability and reliability of the system.
[0003] 2. Performance bottleneck: The centralized authentication service may become the performance bottleneck of the system. In high-concurrency and high-traffic scenarios, all authentication requests must be processed through this central node, which may lead to insufficient processing capacity. Especially when the number of user requests increases dramatically, the processing delay of the authentication service will increase significantly, thus affecting the user experience and may even cause system response timeouts.
[0004] 3. Scalability issues: The original intention of the microservice architecture design is to achieve high scalability of the system. However, centralized authentication services often cannot keep up with the expansion requirements of the system. As the number of microservices in the system continues to increase, the load of authentication requests will also grow rapidly, and a single authentication service cannot efficiently handle all requests, which limits the overall scalability of the system and leads to a decline in system performance and stability.
[0005] 4. Network delay: In a distributed system, network delay is inevitable. If all authentication requests need to go through a centralized authentication service node, it will bring additional network communication overhead, especially between microservices that are physically far away, this delay will be more obvious. Frequent network requests and long waiting times will increase the overall delay of the system, affecting the real-time nature of business operations and user experience.
[0006] 5. Complexity management: The centralized authentication service needs to support the permission management and authentication functions of all microservices, which increases the complexity of the system. In order to ensure the security of the system, the centralized authentication service must include multiple security measures and needs to be constantly updated to deal with new security threats. Maintaining such a complex service involves multiple aspects such as permission policy management, authentication logic update and optimization, system monitoring and troubleshooting, which increases the difficulty of system management and maintenance.
[0007] 6. Not conducive to service autonomy: A core advantage of the microservice architecture is the autonomy of services, that is, each service can be independently developed, deployed, and expanded. However, centralized authentication design may weaken this advantage. Since each microservice needs to rely on a centralized authentication service to handle permission verification, this dependency reduces the autonomy of microservices, limits the flexibility and independence of each service, and increases the coupling between services.
[0008] 7. Not conducive to fine-grained control: In actual applications, different microservices may need to formulate special or more fine-grained permission policies based on their own business needs. Centralized authentication services usually use a unified authentication mechanism, which makes it difficult to provide customized permission verification logic for each microservice. This inflexible design makes it difficult to meet the refined permission management requirements in complex business scenarios, limiting the system's adaptability.
[0009] Therefore, how to separate the permission management and permission verification functions to achieve centralized management and distributed authentication, effectively improve the performance, reliability and scalability of the system, and meet the needs of modern microservice architecture has become a technical problem that needs to be solved urgently. Summary of the invention
[0010] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a microservice distributed permission management system.
[0011] The microservice distributed rights management system provided by the present invention includes: The permission management plane is used to centrally store and manage permission policies, and to create, modify, distribute, and update permission policies; Multiple permission control planes are integrated into multiple microservice instances to receive permission policies from the permission management plane and authenticate user permissions in business requests. The request distribution module is used to receive the business request from the business requester and distribute the business request to the corresponding microservice instance according to the target microservice of the business request; The permission synchronization module is used to synchronize the permission policies of the permission management plane to the permission control plane in each microservice instance.
[0012] Preferably, in the microservice distributed rights management system of the present invention, the rights management plane includes: The permission policy management module is used to create and modify permission policies; The policy distribution module is used to distribute the permission policy to the permission control plane in each microservice instance; The policy update module is used to update the permission policy in real time and synchronize the updated permission policy to the permission control plane.
[0013] Preferably, in the microservice distributed authority management system of the present invention, the authority policy includes user roles, operation permissions and resource access control policies.
[0014] Preferably, in the microservice distributed permission management system of the present invention, the permission management plane can monitor the permission control plane in each microservice instance and issue an alarm when a permission policy synchronization failure is detected.
[0015] Preferably, in the microservice distributed authority management system of the present invention, the authority control plane in each microservice instance includes: The local cache module is used to store the permission policies synchronized from the permission management plane; The authentication module is used to receive business requests and perform permission verification on the business requests according to the permission policy synchronized to the local cache module.
[0016] Preferably, in the microservice distributed permission management system of the present invention, when the permission management plane is unavailable, the permission control plane continues to perform authentication operations based on the permission policy of the local cache module.
[0017] Preferably, in the microservice distributed permission management system of the present invention, the permission control plane can dynamically load permission policies and update the permission verification logic in real time without restarting the microservice instance.
[0018] Preferably, in the microservice distributed permission management system of the present invention, the permission synchronization module synchronizes the permission policy of the permission management plane to the permission control plane in each microservice instance through the message middleware.
[0019] Preferably, in the microservice distributed permission management system of the present invention, permission control plane is deployed separately from business logic to avoid permission verification delay in the process of business request processing.
[0020] Preferably, the microservice distributed rights management system of the present invention is used for rights management in multi-user scenarios, and isolates the business request of each business requester between the rights management plane and the rights control plane.
[0021] The microservice distributed rights management system of the present invention is designed with a separate management plane and control plane. That is, rights management is performed through a centralized management plane, and the control plane for actual authentication is sunk to each specific microservice instance. Efficient rights management is achieved in the microservice architecture, and has the following advantages and beneficial effects: 1. Eliminate the performance bottleneck of centralized authentication and reduce network latency: By sinking the permission control plane to each microservice instance, distributed permission verification is achieved; each microservice instance can perform authentication operations independently without frequently accessing the central authentication service, thereby avoiding the performance bottleneck and network latency during centralized authentication and improving the overall performance of the system.
[0022] 2. Eliminate the risk of single point failure and improve system reliability: By deploying an independent permission control plane in each microservice instance, each service can independently complete permission verification. Even if the permission management plane is unavailable, the authentication operation of the business request will not be affected, thereby effectively eliminating the risk of single point failure and improving the reliability of the system.
[0023] 3. Support the autonomy of microservices and enhance the independence and flexibility of services: Through the distributed permission management architecture, each microservice instance is given independent permission verification capabilities, which enhances the autonomy of services, simplifies the independent deployment and operation and maintenance of services, and provides basic capabilities for the efficient management of microservices.
[0024] 4. Facilitate the implementation of refined permission strategies for specific services: By distributing the permission control plane in each microservice instance, each microservice can flexibly define and implement its own permission strategy, support more precise permission control, and thus meet the diverse permission requirements in complex business scenarios.
[0025] In summary, the microservice distributed permission management system of this embodiment effectively improves the performance, reliability and scalability of the system in the microservice architecture, and is particularly suitable for permission management of large-scale distributed systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0027] Figure 1 This is an example diagram of the architecture of a microservice distributed rights management system according to an embodiment of the present invention; Figure 2 The present invention is a technical schematic diagram of a microservice distributed rights management system according to an embodiment of the present invention. DETAILED DESCRIPTION
[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0029] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.
[0030] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.
[0031] Figure 1 FIG. 1 is an example diagram of the architecture of a microservice distributed rights management system according to an embodiment of the present invention. Figure 1 As shown, the system may include a rights management server 101, a communication network 102 and / or one or more rights management clients 103. Figure 1 The example shown is a plurality of rights management clients 103 .
[0032] The rights management server 101 can be any suitable server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the rights management server 101 can perform appropriate functions. For example, in some embodiments, the rights management server 101 can be used for microservice distributed rights management.
[0033] As another example, in some embodiments, the rights management server 101 may send the microservice distributed rights management method to the rights management client 103 for the user to use based on the request of the rights management client 103 .
[0034] As an optional example, in some embodiments, the permission management client 103 is used to provide a visual permission management interface, which is used to receive a selection input operation of a user's microservice distributed permission management, and, in response to the selection input operation, obtain a permission management interface corresponding to the option selected by the selection input operation from the permission management server 101 and display the permission management interface, wherein the permission management interface at least displays information on the microservice distributed permission management and operation options for the information on the microservice distributed permission management.
[0035] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The rights management client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the rights management server 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the rights management client 103 and the rights management server 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.
[0036] The rights management client 103 may include any one or more clients that present an interface related to the microservice distributed rights management in an appropriate form for use and operation by a user. In some embodiments, the rights management client 103 may include any suitable type of device. For example, in some embodiments, the rights management client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.
[0037] Although the rights management server 101 is illustrated as one device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the rights management server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the rights management server 101. Alternatively, the functions of the rights management server 101 may be implemented using a cloud service.
[0038] Figure 2 A technical schematic diagram of a microservice distributed rights management system according to an embodiment of the present invention; Figure 2As shown, the microservice distributed rights management system of this embodiment includes: The permission management plane is used to centrally store and manage permission policies, and to create, modify, distribute and update permission policies. As an optional example, the permission management plane includes: a permission policy management module, which is used to create and modify permission policies, and permission policies include user roles, operation permissions and resource access control policies; a policy distribution module, which is used to distribute permission policies to the permission control planes in each microservice instance; a policy update module, which is used to update permission policies in real time and synchronize the updated permission policies to the permission control plane. In actual applications, the permission management plane of this embodiment can monitor the permission control planes in each microservice instance and issue an alarm when a permission policy synchronization failure is detected.
[0039] Multiple permission control planes are respectively integrated into multiple microservice instances, and are used to receive permission policies from the permission management plane and perform authentication operations on user permissions in business requests. As an optional example, in this embodiment, the permission control plane in each microservice instance includes: a local cache module, which is used to store permission policies synchronized from the permission management plane; an authentication module, which is used to receive business requests and perform permission verification on business requests according to the permission policies synchronized to the local cache module. It should be noted that when the permission management plane is unavailable, the permission control plane of this embodiment can continue to perform authentication operations based on the permission policies of the local cache module. At the same time, the permission control plane of this embodiment can dynamically load permission policies and update the permission verification logic in real time without restarting the microservice instance. This embodiment avoids permission verification delays during business request processing by deploying the permission control plane separately from the business logic.
[0040] The request distribution module is used to receive business requests from business requesters and distribute the business requests to corresponding microservice instances according to the target microservices of the business requests.
[0041] The permission synchronization module is used to synchronize the permission policy of the permission management plane to the permission control plane in each microservice instance. As an optional example, the permission synchronization module synchronizes the permission policy of the permission management plane to the permission control plane in each microservice instance through a message middleware.
[0042] It should be noted that the microservice distributed authority management system of this embodiment is used for authority management in a multi-user scenario, and isolates the business request of each business requester between the authority management plane and the authority control plane.
[0043] The following is a detailed introduction to the basic workflow of the microservice distributed rights management system of this embodiment under the microservice architecture through specific scenarios. For example, the operating principle of the microservice distributed rights management system of this embodiment is as follows: Step 1: Initialize the permissions management interface When the system starts, the permission management plane initializes the permission rules through the permission policy management module. Permission rules include user roles, operation permissions, and resource access control. Administrators can define, modify, and update permission rules through the permission policy management module. For example, the "Administrator" role has access to all resources. The "Ordinary User" role can only access the data resources it owns.
[0044] Step 2: Distribute permissions policy When the permission policy is defined, the permission management plane sends the permission rules to the permission control plane in each microservice instance through the policy distribution module. Policy distribution is implemented using message middleware, which supports asynchronous communication and ensures efficient distribution of permission policies.
[0045] Step 3: Business request processing When a business requester initiates a business request, it first passes through the request distribution module, which routes the request to the corresponding microservice instance based on the target resource and operation type of the request. For example, when requesting access to resources in microservice-A, the business request is routed to microservice-A. When requesting access to resources in microservice-B, the business request is routed to microservice-B.
[0046] Step 4: Permission verification In the target microservice instance, the permission control plane receives the business request and queries the corresponding permission rules from the local cache. The authentication module performs permission verification based on the user identity and the requested operation type to determine whether the user has the permission to perform the operation. If the permission verification passes, the business operation is performed and a successful response is returned. If the permission verification fails, an error message of insufficient permission is returned and the business operation is terminated.
[0047] Step 5: Update and synchronize permissions policy When the administrator updates the permission rules in the permission management plane, the policy update module synchronizes the new permission rules to the permission control planes of all microservice instances through the message middleware. The local cache module updates the local permission rules to ensure that the latest permission policy takes effect during verification.
[0048] In a multi-tenant scenario, different tenants may have their own permission policies. This embodiment supports the implementation of permission isolation management in a multi-tenant environment. The following is a detailed introduction to the multi-tenant permission management of the microservice distributed permission management system of this embodiment under the microservice architecture through specific scenarios. For example, the operating principle of the multi-tenant permission management of the microservice distributed permission management system of this embodiment is as follows: Step 1: Define tenant permission policy The permission management plane defines independent permission rules for each tenant based on the tenant ID. For example, the "Administrator" role of tenant A can access all resources. The "Administrator" role of tenant B can only access specific modules.
[0049] Step 2: Policy Isolation and Distribution The policy distribution module distributes the permission rules of each tenant to the microservice instance of the corresponding tenant according to the tenant ID. The permission rules of tenant A and tenant B are stored separately to avoid confusion of permissions between tenants.
[0050] Step 3: Permission verification for tenant isolation When processing a business request, the permission control plane loads the corresponding tenant permission rules according to the tenant ID in the request for verification. When a user of tenant A initiates a request, the system loads the permission rules of tenant A. When a user of tenant B initiates a request, the system loads the permission rules of tenant B.
[0051] In order to improve the high availability of the system, this embodiment provides a mechanism in which the permission control plane can still work normally when the permission management plane is unavailable. The following is a detailed description through a specific scenario: Step 1: Local Cache When the permission control plane is started, it pulls the latest permission rules from the permission management plane and stores them in the local cache. When processing business requests, it first queries the permission rules from the local cache to reduce the dependence on the permission management plane.
[0052] Step 2: Failover When the permission management plane fails or is under maintenance, the permission control plane can still continue to perform permission checks based on the permission rules cached locally to ensure the normal operation of the system. After the permission management plane is restored, the permission control plane automatically synchronizes the latest permission rules and updates the local cache.
[0053] This embodiment supports dynamic update of permission rules, and can implement real-time permission policy update without restarting the microservice instance. The following is a detailed description through a specific scenario: Step 1: Dynamically update notifications When the administrator modifies the permission rules, the policy update module publishes an update notification through the message middleware. After receiving the notification, the permission control plane of each microservice instance actively pulls the latest permission rules and updates the local cache.
[0054] Step 2: Take effect immediately The updated permission rules take effect immediately in the authentication module without restarting the microservice instance, ensuring the real-time nature of permission policy changes.
[0055] The microservice distributed permission management system of this embodiment adopts an architecture design that separates the management plane and the control plane, that is, permission management is performed through a centralized management plane, and the control plane for actual authentication is sunk to each specific microservice instance, thus realizing efficient permission management in the microservice architecture, and having the following advantages and beneficial effects: 1. Eliminate the performance bottleneck of centralized authentication and reduce network delay: Traditional centralized permission management can easily become a performance bottleneck of the system under high concurrency conditions, especially when the authentication service needs to be accessed across the network, the network delay problem is particularly obvious. This embodiment realizes distributed permission verification by sinking the permission control plane to each microservice instance; each microservice instance can perform authentication operations independently without frequent access to the central authentication service, thereby avoiding the performance bottleneck and network delay during centralized authentication and improving the overall performance of the system.
[0056] 2. Eliminate the risk of single point failure and improve the reliability of the system: In the traditional centralized authentication architecture, the authentication service exists as a single point. Once a failure occurs, the permission verification of all services in the system cannot be carried out normally, which seriously affects the availability of the business. This embodiment deploys an independent permission control plane in each microservice instance, so that each service can complete the permission verification independently. Even if the permission management plane is unavailable, the authentication operation of the business request will not be affected, thereby effectively eliminating the risk of single point failure and improving the reliability of the system.
[0057] 3. Support the autonomy of microservices and enhance the independence and flexibility of services: The core advantage of the microservice architecture lies in the autonomy of services, that is, each service can be independently developed, deployed and expanded. The centralized permission management solution requires each service to rely on the central authentication service for permission verification, which weakens the autonomy of microservices. The distributed permission management architecture of this embodiment gives each microservice instance independent permission verification capabilities, enhances the autonomy of services, simplifies the independent deployment and operation and maintenance of services, and provides basic capabilities for the efficient management of microservices.
[0058] 4. Facilitate the implementation of refined permission strategies for specific services: Different microservices may have different business requirements, and the requirements for the precision of permission verification are also different. Traditional centralized permission management usually adopts a unified permission verification rule, which is difficult to meet the refined permission requirements of specific services. This embodiment distributes the permission control plane in each microservice instance, so that each microservice can flexibly define and implement its own permission strategy, support higher-precision permission control, and thus meet the diverse permission requirements in complex business scenarios.
[0059] In summary, the microservice distributed permission management system of this embodiment effectively improves the performance, reliability and scalability of the system in the microservice architecture, and is particularly suitable for permission management of large-scale distributed systems.
[0060] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.
[0061] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.
[0062] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims
1. A microservice distributed rights management system, characterized in that: include: The permission management plane is used to centrally store and manage permission policies, and to create, modify, distribute, and update permission policies; Multiple permission control planes are integrated into multiple microservice instances to receive permission policies from the permission management plane and authenticate user permissions in business requests. The request distribution module is used to receive the business request from the business requester and distribute the business request to the corresponding microservice instance according to the target microservice of the business request; The permission synchronization module is used to synchronize the permission policies of the permission management plane to the permission control plane in each microservice instance.
2. The microservice distributed rights management system according to claim 1, characterized in that: The permission management aspect includes: The permission policy management module is used to create and modify permission policies; The policy distribution module is used to distribute the permission policy to the permission control plane in each microservice instance; The policy update module is used to update the permission policy in real time and synchronize the updated permission policy to the permission control plane.
3. The microservice distributed rights management system according to claim 2, characterized in that: Permission policies include user roles, operation permissions, and resource access control policies.
4. The microservice distributed rights management system according to claim 1, characterized in that: The permission management plane can monitor the permission control plane in each microservice instance and issue an alarm when permission policy synchronization failure is detected.
5. The microservice distributed rights management system according to claim 1, characterized in that: The permission control planes in each microservice instance include: The local cache module is used to store the permission policies synchronized from the permission management plane; The authentication module is used to receive business requests and perform permission verification on the business requests according to the permission policy synchronized to the local cache module.
6. The microservice distributed rights management system according to claim 5, characterized in that: When the permission management plane is unavailable, the permission control plane continues to perform authentication operations based on the permission policy of the local cache module.
7. The microservice distributed rights management system according to claim 1, characterized in that: The permission control plane can dynamically load permission policies and update the permission verification logic in real time without restarting the microservice instance.
8. The microservice distributed rights management system according to claim 1, characterized in that: The permission synchronization module synchronizes the permission policies of the permission management plane to the permission control plane in each microservice instance through the message middleware.
9. The microservice distributed rights management system according to claim 1, characterized in that: By separating the permission control plane from the business logic, permission verification delays during business request processing can be avoided.
10. The microservice distributed rights management system according to any one of claims 1 to 9, characterized in that: The system is used for permission management in multi-user scenarios, isolating the business requests of each business requester between the permission management plane and the permission control plane.